Privacy Notice - Phillips Exeter Academy

Last Updated: March 10, 2020

Introduction

Welcome! You have arrived at a website provided by Phillips Exeter Academy (the “Academy,” “Company,” “we,” “our” or “us”). We understand that privacy is important to you and want you to know that we are committed to safeguarding your Personal Information (defined below). As a result, we want to provide you with a clear picture of how the Personal Information that you provide to us is processed, managed, and protected by us, and what your choices are with respect to that information.

This Privacy Notice governs the Academy’s website, exeter.edu and its subdomains, and all portals, applications, products, services, events, and any interactive features, applications, or other services that post a link to this Privacy Policy (each, a “Site”), as well as any Personal Information provided to the Academy by any means. It applies to our collection, use, and retention (“processing”) of Personal Information, including any information transferred from outside the United States that we receive and record in the United States, which identifies, or can be used by us or on our behalf to identify an individual, household or device (“Personal Information”).

We strongly encourage you to read this Privacy Notice in its entirety to understand the Academy’s privacy practices in advance of using the Site or submitting any Personal Information to us. If you choose to provide us with your Personal Information, you are telling us that you understand and accept the privacy practices detailed in this Privacy Notice and authorize us to take actions consistent with this Privacy Notice. This Privacy Notice is also part of our Terms of Use, which govern your use of the Site.

This Privacy Notice will inform you about:

Types of Information the Academy Collects
How We Collect Your Information
How the Academy Uses Your Information
Sharing Your Personal Information with Others
Changes to Your Personal Information
How Long We Keep Your Personal Information
Children’s Privacy
International Transfers of Your Personal Information
How You Can Opt Out of Receiving Information from Us
Additional Rights Applicable to European Union and EEA Residents
Links
Security of Personal Information
Do Not Track
Updates to this Privacy Notice
Our Contact Information

Types of Information the Academy Collects

We may collect the following types of Personal Information about you:

For Applicants and Students

Your name and biographical information;
Your physical address, email address, telephone number, or other contact information;
Your gender, date of birth, passport number or national identity card details, country of domicile, and nationality;
Information relating to your education, the school(s) you have attended, information regarding academic and extracurricular interests, and other student record-related information;
Records related to your use of our facilities and services;
Photographs, audio and/or video recordings you have sent us for identification badges or use in Academy files;
Photographs, audio and/or video recordings of you while on campus or at Academy events;
Information about your involvement, activities, and awards;
Financial information including tuition, fees, financial aid, etc.;
Information about your family or personal circumstances;
Written and/or oral comments about you from your references;
Sensitive Personal Information, including:
- Information about your racial or national origin, or religious or similar beliefs;
- Information about your health and medical conditions (e.g. disability and dietary needs); and
- Biometric data.

For Alumni and Donors

Your name and contact information, such as your address, email address, and telephone number, as well as your date of birth, passport number or national identity card details, country of domicile, and nationality;
Your record of attendance at the Academy and at alumni events, as well as activities and awards for your service;
Photographs, audio and/or video recordings you have submitted to us for use in Academy publications or online;
Photographs, audio and/or video recordings of you while on campus or at Academy events;
Financial information, including past donations and pledges;
Information relating to your education and employment history; and
Information about your family or personal circumstances.

For General Visitors to the Site

In addition to information that you choose to submit to us, we and/or our service providers may automatically collect and/or store certain information when you visit or interact with the Site (“Usage Information”). This Usage Information may be stored and/or accessed from your personal computer, laptop, tablet, mobile phone or other device (a “Device”) whenever you visit or interact with our Site. Usage Information may include:

Your IP address, IDFA, Android/Google Advertising ID, IMEI, or another unique identifier;
Your Device functionality (including browser, browser language, operating system, hardware, mobile network information);
Referring and exit web pages and URLs;
The areas within our Site that you visit and your activities there, including remembering you and your preferences;
Your Device location or other geolocation information, including the zip code, state or country from which you accessed the Services;
Your Device characteristics; and
Certain other Device data, including the time of day you visit our Site.

How We Collect Your Information

The Academy may collect Personal Information from or about you in a number of ways, for example:

From Applicants and Students

From information you provide when you first express an interest in enrolling at the Academy;
From information you provide when you seek admission to the Academy and complete other admissions-related processes and procedures, as well as when you enroll in courses;
When you communicate with us by telephone, email, or via our website in order to ask questions or raise concerns;
When you interact with us in person at events or during campus visits;
When you interact with us during your time as a student at the Academy;
From third party entities who you have requested or authorized to provide information, such as your previous or current school, potential colleges or universities to which you may apply, who may provide reference information about you, as well as other third-party individuals or entities that may provide information about you;
Through the Academy’s school disciplinary procedures, the Lamont Health and Wellness Center, and/or the administration of student housing or financial services; and
Through surveys, comment cards, and/or other feedback mechanisms.

From Alumni and Donors

From the information you voluntarily provide to us: when you are graduating, sign up for an alumni event, make inquiries, raise concerns, or share what is going on in your life, make a donation to the Academy, or otherwise communicate with us by telephone, email, or via our website or in person at an alumni or other Academy event;
From the information you voluntarily provide to the Academy or third parties with whom we partner when you sign up for an alumni event;
From the information you voluntarily provide to other third-party entities to whom you have granted permission to share your information who may provide reference information about you; and
From publicly available sources of information.
The Academy also may combine personal information you provide to us with information available from external sources to gain updated contact information and/or a better understanding of our alumni and donors to improve our fundraising methods, products, and services.

Use of Cookies and Tracking Technologies

We may use various methods and technologies to store or collect Usage Information (“Tracking Technologies”). Tracking Technologies may set, change, alter or modify settings or configurations on your Device. A few of the Tracking Technologies used on the Site(s), include, but are not limited to, the following (as well as future-developed tracking technology or methods that are not listed here):

Cookies. A cookie is a file placed on a Device to uniquely identify your browser or to store information on your Device. Our Site may use HTTP cookies, HTML5 cookies, Flash cookies and other types of cookie technology to store information on local storage.
Web Beacons. A Web Beacon is a small tag (which may be invisible to you) that may be placed on our Site’s pages and messages.
Embedded Scripts. An embedded script is programming code that is designed to collect information about your interactions with the Site, such as the links you click on.
ETag, or entity tag. An Etag or entity tag is a feature of the cache in browsers. It is an opaque identifier assigned by a web server to a specific version of a resource found at a URL.
Browser Fingerprinting. Collection and analysis of information from your Device, such as, without limitation, your operating system, plug-ins, system fonts and other data, for purposes of identification.
Recognition Technologies. Technologies, including application of statistical probability to data sets, which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user).

We may use Tracking Technologies for a variety of purposes, including:

To allow you to use and access the Site, including for the prevention of fraudulent activity and improved security functionality or to allow you to make use of cart or payment functionality;
To assess the performance of the Site, including as part of our analytic practices or otherwise to improve the content, products or services offered through the Site;
To offer you enhanced functionality when accessing the Site, including identifying you when you sign into our Site or keeping track of your specified preferences or to track your online activities over time and across third-party sites; and
To deliver content relevant to your interests on our Site and third-party sites based on how you interact with our advertisements and/or content.

You can get more information about Cookies and Tracking Technologies, and instructions on how to opt out of cookies and certain tracking technologies, in our Cookie Policy.

How the Academy Uses Your Information

For Applicants and Students

We may use Personal Information (including Sensitive Personal Information) we collect from and about you during your application to and enrollment at the Academy for the following purposes:

Recruiting and/or admitting you as a student at the Academy;
Facilitating academic matters, including for:
- The provision of our teaching, learning, and research services (e.g. registration, assessment, attendance, managing progress, discipline investigations, certification, and graduation);
- Maintaining student records; and
- Assessing your eligibility for financial aid;
Providing you with educational services which may not be set out in our E Book, but which are nevertheless a part of our academic and educational mission;
Providing library, IT, media, and other information services;
Providing support of our core services in non-academic matters, including:
- Safeguarding and promotion of students’ welfare;
- Ensuring students’ safety and security;
- Managing student employment and internships;
- Managing student housing;
- Managing the use of social media; and
- Managing facilities on campus.
Administering finances, such as tuition, fees, and financial aid;
Providing other administrative functions, such as:
- Carrying out research and statistical analysis;
- Carrying out audits to ensure compliance with our regulatory and legal obligations;
- Providing operational information;
- Promoting our services;
- Preventing and detecting crime;
- Dealing with disciplinary actions;
- Dealing with complaints and inquiries; and
Facilitating any other purpose for which you provide us with your Personal Information.

We process your Personal Information because it is necessary for the execution of a contract with you (specifically, our annual Enrollment Contract) or in order to take steps at your request prior to entering into a contract, to comply with our obligations under applicable law, because you have provided consent for us to do so, and/or to protect your interests and/or the interests of others.

For Alumni and Donors:

We may process your personal information because it is necessary for the performance of our duties in carrying out our mission, vision, and values; our strategic plan; and our policies, as well as to fundraise, and for other legitimate business purposes.

For All Visitors to The Site and All Categories of Data Subjects:

In addition to the areas listed above, we also may process your Personal Information because it is necessary for our legitimate business purposes. In this respect, we also may use your Personal Information for any of the following:

To monitor and evaluate the performance and effectiveness of the Academy, including by training our employees or monitoring their performance;
To maintain and improve the academic, administrative, financial, and human resource management of the school;
To promote diversity, equity, and inclusion throughout the Academy;
To seek advice on our legal rights and obligations and to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other students or faculty, visitors to the Academy, or anyone else who could be harmed by such activities.

We also may process your Personal Information for compliance with our legal obligations. In this respect, we may use your Personal Information for the following:

To meet our audit, compliance, and regulatory obligations;
For the prevention and detection of crime; and
In order to assist with investigations (including criminal investigations) carried out by the police and other responsible authorities.

We also may process your Personal Information where:

It is necessary for emergency medical purposes;
It is necessary to protect your or another person’s vital interests; or
We have your specific or, where necessary, explicit consent to do so.

Sharing Your Personal Information with Others

We may participate in advertising networks administered by third parties. These networks track your online activities over time and across third party websites and online services by collecting information through automated means, including through the use of the Tracking Technologies described above, and they use this information to show you advertisements that are tailored to your individual interests. The information they collect includes information about your visits to our Site, such as the pages you have viewed. This collection and ad targeting takes place both on our Site(s) and on third-party websites that participate in the ad network. This process also helps us track the effectiveness of our communications and marketing efforts.

For the purposes referred to in this Privacy Notice and relying on the bases for processing as set out above, we may share your Personal Information with certain third parties. Depending on the jurisdiction in which you are located, you may be able to request that we not share your Personal Information with third parties. Please refer to the other relevant sections of this Privacy Notice for more information.

Sometimes a law, court order, or other judicial or administrative process requires us to provide your personal information to a government authority or party to a private lawsuit.

For Students and Applicants

We also may share your information with certain third parties described below. In some cases, you will be asked to opt in to these data sharing arrangements. In those cases, you should carefully consider the possible impact that not opting in will have on provision of our core teaching, learning, and residential school services to you. Third party recipients may include:

Our affiliates and contractors where there is a legitimate reason for their receiving the information, including:
- Third parties who work with us to provide student support services (i.e. counseling, health services, etc.);
- Third parties who are contracted to provide services such as dining, IT, and staffing;
- Organizations operating software on our behalf; and
- Internal and external auditors.
Any study abroad programs in which you may participate;
Governmental departments and agencies where we have a legal obligation to provide information;
Crime prevention or detection agencies;
Parents, guardians, and next-of-kin (where there is a legitimate reason for disclosure);
Third parties conducting surveys;
Third party communication providers; and
Third party data services providers.

For Alumni and Donors:

We may share your information with our current or prospective students, administrators, staff, and other alumni. In some instances, we may use third parties to assist with fundraising efforts and collecting information about our alumni, their achievements and their updated contact information. We may also share information about your donations to the appropriate governmental agencies, should reporting be required.

Changes to Your Personal Information

We prefer to keep your Personal Information accurate and up to date. Please tell us promptly about any changes to the Personal Information you have voluntarily provided to us. This is particularly important with respect to your contact details.

Prospective Students: Please contact the Admissions Department by mail addressed to “Admissions” at the address provided at the end of this document or by email at admit@exeter.edu with “Update Personal Information” in the subject line.

Students: Please contact the Dean of Students by phone at (603) 777-3411 or send a request by mail addressed to “Dean of Students” at the address provided at the end of this document, or you may email dean_students@exeter.edu with “Update Personal Information” in the subject line.

Alumni, Donors and all other interested parties: Please address your request to update your information to the “Director of Business Institutional Advancement” at the address provided at the end of this Notice, or you may email records@exeter.edu with “Update Personal Information” in the subject line.

We will make good faith efforts to make requested changes in our then-active databases as soon as reasonably practicable (but we may retain prior information as business records). Please note that it is not always possible to completely remove or delete all of your information from our databases and that residual data may remain on backup media or for other reasons, such as a legitimate business reason.

How Long We Keep Your Personal Information

We will retain your Personal Information for as long as needed to meet the uses described in the “How the Academy Uses Information” in compliance with legal document retention obligations. Even where you have exercised one of the rights listed below with respect to your Personal Information, we will have the right to retain your Personal Information for compliance with a legal obligation, for the performance of a task carried out in the public interest, for archiving purposes in the public interest, for scientific or historical research purposes, for statistical purposes, or for the establishment, exercise, or defense of legal claims.

Children’s Privacy

Protecting children’s privacy is important to us. For that reason, no part of our Site is targeted to attract anyone under the age of 13. We do not request, or knowingly collect, any personally identifiable information from children under the age of 13. Minors from ages 13 to 15 may use the Site(s) only under the supervision of a parent or guardian who agrees to be bound by the Site’s Terms of Use. While we may collect information of children under the age of 13 when they are prospective students, we do not solicit this information from the child directly – we will seek parental consent for any personal information provided for children under the age of 16. We also will not disclose or share the information of a user under the age of 16 with any third parties. The Academy also complies with the Children’s Online Privacy Protection Act (COPPA). If you are the parent or guardian of a child under 13 who has provided his or her information to us that you have not authorized, you may contact us at privacy@exeter.edu or at the street address at the end of this Notice to request that we delete it. Parents may find additional information about protecting your child’s privacy here.

For GDPR purposes, the Privacy Notice is not directed to “children,” as defined per Member State implementation legislation. Where a prospective or current student is classified as a child, we will make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child, where Personal Information of the child is to be processed.

International Transfers of Your Personal Information

The Academy is located in the United States. Some of the Personal Information we process about you will be transferred to, and stored at, a destination outside the European Union (“EU”), the European Economic Area (“EEA”), and Switzerland. For example, all Academy employees are located outside the EU, the EEA, or Switzerland and may process Personal Information; similarly, Personal Information may be processed by one of our suppliers who is based outside the EU, the EEA, Switzerland, or who uses storage facilities outside the EU, the EEA, or Switzerland. When we transfer personal data outside of these areas, we take steps to make sure that appropriate safeguards are in place to protect your Personal Information. Our transfers of your personal data outside of the E.U. are safeguarded by data processing agreements (“DPAs”) incorporating Standard Contractual Clauses.

In these circumstances, your Personal Information will only be transferred on one of the following bases:

Where you have provided explicit consent for the transfer;
Where the transfer is occasional and necessary in relation to a contract or a legal claim;
Where the transfer is made on the basis of an adequacy decision;
Where the transfer is subject to one or more appropriate safeguards for international transfers prescribed by applicable law; or
Where the transfer is necessary for the execution of a contract with you or in order to take steps at your request prior to entering into a contract.

How You Can Opt Out of Receiving Information from Us:

We give you many choices regarding our use and disclosure of your Personal Information for marketing purposes. (Please note that EU residents may have different options described below). You may opt-out from:

Receiving electronic communications from us: If you no longer want to receive marketing-related emails or mobile text messages from us on a going-forward basis, you may opt-out of receiving these marketing-related emails or mobile text messages by sending a request for list removal to privacy@exeter.edu or following the instructions for unsubscribing in the email or original text message. If you have provided your information to the Academy, and opt-out, the Academy will put in place processes to honor your request. This may entail keeping some information for the purpose of remembering that you have opted-out.
Our sharing of your Personal Information with unaffiliated third parties for their (or their customers’) direct marketing purposes: If you would prefer that we do not share your Personal Information on a going-forward basis with unaffiliated third parties for their direct marketing purposes, you may opt-out of this sharing by emailing privacy@exeter.edu from the email that you have signed up or used in receiving services from the Academy. Please include “opt-out” or similar language in the subject line.
Our providing of student contact details to contractors to carry out surveys. These contractors will use students’ details only for a specific purpose pursuant to our instructions and will then delete them. (If you do not wish to participate in any of these surveys, please inform the Dean of Students by phone (603-777-3411) or by using the contact details provided at the end of this Notice.)

We will try to comply with your request(s) as soon as reasonably practicable.

Administrative Correspondence. Please also note that if you do opt-out of receiving marketing-related emails from us, we may still send you messages for administrative or other purposes directly relating to your use of the Services, and you cannot opt-out from receiving those messages.

Additional Rights Applicable to European Union and EEA Residents

If you are a resident of the EU or EEA, you have additional rights under the General Data Protection Regulation (“GDPR”), including the right to access, rectify, download or erase your information, as well as the right to restrict and object to certain processing of your information. While some of these rights apply generally, certain rights apply only in certain limited circumstances. We describe these rights below.

Under GDPR, you have the following rights:

To obtain access to the Personal Information that we hold about you;
To object on grounds relating to your particular situation to our processing activities where you feel they have a disproportionate impact on your interests, rights, and freedoms;
If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge;
To restrict the processing activities related to your Personal Information (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before Direct withdrawal);
To request that we erase your Personal Information;
To have Personal Information, which you have voluntarily provided to us, produced in a structured, commonly used, and machine-readable format, including for the purpose of transmitting it to another party; and
To require us not to send you marketing communications.

If you are a resident of the EU or EEA, you may initiate a request to access, reject, correct, restrict, or erase your Personal Information, or where you may initiate a request for transfer of your Personal Information or initiate a request that we refrain from sending you marketing information by sending us a request at privacy@exeter.edu and write “GDPR Request” in the subject line. You may also write to us at the address at the end of this Privacy Notice. Please note that the above individual rights are not absolute, and we may be entitled to refuse requests where certain exceptions apply. Please note that where our processing of your Personal Information relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services. Should you wish to raise a concern about our use of information (without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority.

Links

For your convenience, the Site and this Privacy Notice may contain links to other websites. Please be aware that the Academy is not responsible for the privacy practices, advertising, products, services, or the content of such other sites. You are encouraged to use common sense when sharing your Personal Information, and we encourage our users to be aware when they leave our site and to read the privacy notices of each and every website that collects personally identifiable information. None of the links on the Site should be deemed to imply that the Academy endorses or has any affiliation with the third-party link. This Privacy Notice applies solely to information collected by the Academy and not by any other sites or third parties.

Security of Your Personal Information

The Academy takes reasonable and appropriate measures to protect and secure Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Information. However, no data transmission over the Internet, mobile networks, wireless transmission, or electronic storage of information can be guaranteed to be completely secure. Accordingly, we cannot guarantee or warrant the security of any Information you transmit to or from our Site, and you provide us with your information at your own risk. Please see our Terms of Use for additional information.

Do Not Track

Do Not Track (“DNT”) is a web browser setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your browser, your browser sends a special signal to websites, analytics companies, ad networks, plug in providers, and other web services you encounter while browsing to stop tracking your activity. Various third parties are developing or have developed these signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services, but there is currently no industry or legal standard for what a company should do when a DNT signal is detected. Because of this, we currently do not respond to DNT signals. You can learn more about Do Not Track here.

Updates to this Privacy Notice

The Academy reserves the right, at our sole discretion, to change, modify, add, remove, or otherwise revise portions of our policies and this Privacy Notice at any time, consistent with the requirements of applicable law. When we do, we will post the revision(s) on our website at www.exeter.edu/privacy. If we change the Privacy Notice in a material way, we will provide appropriate notice to you. The “Effective Date” at the top of this Privacy Notice reflects the date of the most recent revisions. If you are concerned about how your personal information is used, please visit our Site often for this and other important announcements and updates.

Our Contact Information

If you have questions about this Privacy Notice, our privacy practices, or any other aspect of your privacy and the security of your Personal Information, please send an email to privacy@exeter.edu or contact us by mailing an inquiry with “Privacy Inquiry” in the subject line to the address below:

Phillips Exeter Academy

Attn: Privacy Inquiry

20 Main Street

Exeter, NH 03833

United States of America