Privacy Policy & Notice

Who is the Clearinghouse?

Each year, the nonprofit Clearinghouse provides hundreds of millions of dollars’ worth of free services to the education community by serving as a trusted agent to primarily Title IV-eligible, degree-granting U.S. Higher Education institutions (“Participating Institutions”) and performing research to help them meet their analytical needs. For more information on the Clearinghouse, please go to our About Us web page, and for information on the Clearinghouse’s commitment to the privacy and security of the education records it holds on behalf of Participating Institutions, please go to our Privacy web page.

As used in this Privacy Policy, the term “Websites” includes the studentclearinghouse.org website, all websites and pages that are associated with that website, and all online applications or services that the Clearinghouse offers.

How the Clearinghouse Receives Your Personally Identifiable Information

From Participating Institutions, Education Agencies, Credential Providers, and Other Education Authorities

The Clearinghouse collects education records, which include both Directory and Non‐Directory Information, from Participating Institutions, education agencies, and other education authorities, under either the school official or directory information exceptions to the Family Educational Rights and Privacy Act (“FERPA”). With this delegated authority, the Clearinghouse uses this data for enrollment reporting of Title IV schools to the National Student Loan Data System (“NSLDS”), enrollment reporting to private lenders, verification of student enrollment and credentials earned, transcript services, course exchange, and research.

From Your Use of Our Services/Websites

We collect information about you directly from you, with your consent, when you provide us with an order for your transcript or use our other services (e.g., Verification Services or Myhub℠) and Websites. We may collect your name, date of birth, address, phone number(s), email address, and/or school information, as well as other account or user information, that may be needed to provide our services, such as for information security reasons. We do not store any credit card data provided by you to use our services. We may collect your attendance, enrollment, degree, credential, or transcript information from the educational institution holding such information when you request services from the Clearinghouse. When you register for an account on our Myhub website, we may collect account information you knowingly provide to us from a third‐party site or platform, such as social networking websites. See Myhub Conditions and Terms of Use when creating a Myhub account.

Unless required or authorized by law, the Clearinghouse will not collect or use personally identifiable information (“PII”) from your use of our services and Websites for any purpose other than those identified in this Privacy Policy without obtaining further consent. For details on the type of information we collect via our Websites and on how we use and share this information, please refer to the Personally Identifiable Information (PII) Generated from Your Use of Our Websites section of this Privacy Policy.

From Loan Lenders, Holders, and Servicers

We receive nonpublic personal information from various lenders, holders, and servicers of student loans for the purpose of reporting on the enrollment status of borrowers on behalf of Participating Institutions. In compliance with the Gramm‐Leach Bliley Act, we do not redisclose any nonpublic personal information we receive solely from any lenders, holders, or servicers of student loans.

Personally Identifiable Information (PII) Generated from Your Use of Our Websites

The Clearinghouse generally collects and uses PII from or about visitors and users of our Websites. Your sole option, if you do not wish to provide all requested information, is to not use or interact with the Clearinghouse Websites. In addition to the information we collect, as referenced in the From Your Use of Our Services/Websites section of this Privacy Policy, the Clearinghouse collects and uses the information collected as follows:

Information You Provide

In many cases, we collect PII directly from you when you visit or use our Websites. For instance, we may collect the following types of information:

• Inquiries. We may collect your name, contact information, email address, and any information you provide us when you make an inquiry or contact us through our Websites. We will use this information only to provide you with the information requested or to contact you to respond to your questions and/or requests.
• Requests for a Product and/or Service. The Clearinghouse collects and stores only the information that you knowingly provide to us by subscribing to blog and other webpage updates and/or using our Websites’ registration or request forms, including but not limited to, your name, address, phone, email, job title, and job function. We may request additional information if you subscribe to our blog, listserv, and/or other webpages, order a product or service, request information, or participate in a survey or contest via one of our Websites. We will use this information only to process and answer your request or to manage our business needs in connection with such participation or request, and in accordance with this Privacy Policy. If you enter your email address to receive alerts on new content to our site(s), the address will be used only for that purpose, unless authorized by law.

Use of Cookies, Web Beacons, and Other Analytics

As you navigate through and interact with our Websites, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Websites, including traffic data, location data, logs, and other communication data, and the resources that you access and use on the Websites.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

The information we collect automatically is statistical data and does not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. This information also is collected for information security purposes, particularly to detect, prevent and respond to fraud, abusive practices, and security risks that could harm the Clearinghouse, our data, and our users. It further helps us to improve our Websites and to deliver a better and more personalized array of services, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Websites according to your individual interests.
• Recognize you when you return to our Websites.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Websites. Unless you have adjusted your browser settings to refuse cookies, our system will issue cookies when you direct your browser to our Websites.
• Flash Cookies. Certain features of our Websites may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Websites. Flash cookies are not managed by the same browser settings used for browser cookies.
• Web Beacons. Pages of our Websites and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single‐pixel gifs) that permit the Clearinghouse, for example, to count users who have visited those pages or opened an email or email attachments, and for other related statistics (e.g., recording the popularity of certain website content and verifying system and server integrity).
• Analytics on Websites. For certain of the Clearinghouse’s Websites, such as those through which users download files, the Clearinghouse may track certain information, such as the number of downloads of specific files. For certain Websites, the Clearinghouse may also track other details related to use, such as the type of device on which users are accessing the Websites, as well as the sections through which users scroll, in the aggregate. The Clearinghouse does not collect or use personally identifiable information in our use of these analytical tools.

Privacy Policies of Third Parties

This Privacy Policy addresses only the use and disclosure of information by the Clearinghouse. Other external websites that may be accessible through our link from the Clearinghouse Websites may have their own privacy policies and data collection, use, and disclosure practices. You acknowledge and agree that the Clearinghouse is not responsible for the availability of such external websites or resources, does not endorse, and is not responsible for, any content, advertising, products, services, or other materials on or available through such websites or resources (collectively, “External Materials”). The Clearinghouse is not responsible or liable, directly or indirectly, for External Materials or any third parties with whom you connect via the service(s), including any representations, warranties, or loss or damage of any kind.

We encourage you to familiarize yourself with the privacy statements provided by all third parties before providing them with information or taking advantage of an offer or promotion.

How the Clearinghouse Uses Your Personally Identifiable Information

Family Educational Rights and Privacy Act (FERPA)

FERPA is a federal law that protects the privacy of student education records. The law applies to all Participating Institutions that receive funds under an applicable program of the U.S. Department of Education. Although FERPA does not directly apply to private organizations, unless they receive funds under an applicable program of the U.S. Department of Education, FERPA regulates what data Participating Institutions can share with the Clearinghouse, and what redisclosures of that data the Clearinghouse can make. The Clearinghouse commits to following FERPA regulations as a School Official (as that term is defined by FERPA), as appointed by Participating Institutions. This section introduces some terms used in FERPA to discuss education records, as well as how the Clearinghouse complies with FERPA in our use of education records.

FERPA Permissible Uses 

The Clearinghouse only discloses education records under the following limited FERPA permissible uses:

• Consent: An education record may be disclosed to a third party if a valid consent from the student has been obtained in writing (may be electronic), signed and dated, specifying the records that may be disclosed, stating the purpose of disclosure, and identifying the party or class of parties to whom the disclosure may be made.
• School Official: Participating Institutions may disclose education records to School Officials, provided there is a legitimate educational interest served by the disclosure.
• State and Local Educational Authorities: An education record may be disclosed without consent to an authorized representative of state and local education authorities for audit and evaluation purposes.
• Financial Aid: An education record may be disclosed in connection with a student’s application for, or receipt of, financial aid.
• Research: An education record may be disclosed to an organization conducting a study for or on behalf of an educational institution, in order to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction.
• Directory Information: Directory information may be disclosed without consent, as it consists of information that is generally considered not to be harmful or an invasion of privacy if disclosed.

Student Rights Under FERPA

Although FERPA allows for disclosure of education records without student consent in certain circumstances, eligible students (students who are over the age of 18 or attend postsecondary school) and parents of non‐eligible students still have the following rights:

• inspect and review the student’s education records maintained by the school
• request that a school amend the student’s education records
• control who has access to the student’s records

The first two rights concern how the education records are collected and maintained by a student’s institution. If you believe there is an error in your records or they are incomplete, you must contact your institution directly to correct that error. The Clearinghouse may only amend a record at the request and direction of a Participating Institution. You may also inspect and review the education records kept by your institution. You can find more information on your rights as a student under FERPA, including how to control who has access to your education record through administering directory information blocks, on the U.S. Department of Education’s website: https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

Website Access Intended for United States Use Only

The Clearinghouse’s Websites and services are intended for use exclusively within the United States (U.S.) and its territories. Locations outside of the U.S. and its territories may have regulatory requirements that differ from the U.S. and, therefore, this information may be inappropriate for use outside the U.S. Therefore, the Clearinghouse makes no representation that the information on our Websites is appropriate or available for use in non-U.S. locations.

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) imposes various obligations on defined “businesses” regarding consumer data privacy. While the National Student Clearinghouse is not considered a “business” under the CCPA and is therefore not subject to these CCPA requirements, we are subject to FERPA. Under that law, you have certain rights regarding your education records, which are explained in the FERPA sections of this Privacy Policy (under the heading “How the Clearinghouse Uses Your Personally Identifiable Information”).

If you are a current or former student of a postsecondary institution that is subject to the CCPA and wish to exercise your rights under the CCPA with respect to the data held by that institution, you should contact that institution directly to do so.  We enable institutions that have indicated to us that they are subject to the CCPA to instruct us regarding how we process student PII in a manner that is consistent with the CCPA.

European Union General Data Protection Regulation (EU GDPR)

The European Union GDPR is a regulation that protects the privacy and security of personal data collected from individuals within the territory of the European Union (“EU data subjects”). It applies to organizations established outside of the EU if they:

1. process the personal data of EU data subjects when offering them goods or services; or
2. monitor the behavior of EU data subjects.

The Clearinghouse neither offers goods or services to EU data subjects nor monitors their behavior. Therefore, the GDPR does not directly apply to the Clearinghouse. However, the Clearinghouse works with organizations, including certain Participating Institutions, that collect or process personal data of EU data subjects, making them subject to the GDPR.

At the request of organizations who provide personal data collected from EU data subjects to the Clearinghouse for processing (such organizations hereinafter referred to as “Controller organizations”), the Clearinghouse enters into a Data Processing Addendum with Controller organizations whereby the Clearinghouse as a processor agrees to assist these organizations with the fulfillment of their obligations as set out in the GDPR. The Clearinghouse also agrees to implement appropriate technical and organizational security measures to provide a level of security appropriate to the risks that are presented by the processing and the nature of the personal data to be protected. In case of a personal data breach, the Clearinghouse will notify the Controller organization(s) without undue delay upon becoming aware of the personal data breach. In all such instances, the Clearinghouse is processing the personal data of EU data subjects solely on behalf of and at the direction of the Controller organizations that provide personal data to the Clearinghouse for processing.

Providing Clearinghouse Services

Financial Aid Services:

As an agent of Participating Institutions, the Clearinghouse partners with Participating Institutions for the purpose of reporting enrollment statuses of students to various lenders, servicers, guaranty agencies, and the U.S. Department of Education (collectively “Lenders”). The Clearinghouse periodically receives enrollment files containing all enrolled students from Participating Institutions, which we incorporate into our nationwide central repository of enrollment information. Lenders submit listings of their financial aid recipients to the Clearinghouse and the Clearinghouse advises the Lenders on which financial aid recipients are currently enrolled in Participating Institutions. The regularity and content of this process conform to applicable federal and guaranty agency regulations. This service benefits both the Participating Institutions and their students. Under Title IV of the Higher Education Act, students receiving federal student loans are entitled to a deferment of their repayment obligation while they are enrolled in an institution of higher education, and thus institutions are required to report student enrollment information to these entities. By utilizing the Clearinghouse’s enrollment reporting service, institutional reporting burdens are alleviated, and students are able to receive the loan deferment benefit afforded to them by law.

Research:

In providing enrollment reporting and verification services to Participating Institutions, the Clearinghouse collects enrollment and degree data on students enrolled in Participating Institutions. The Clearinghouse’s coverage of this data, which includes the public, private nonprofit, and private for‐profit sectors, gives the Clearinghouse the unique capability to work with Participating Institutions, states, districts, high schools, and educational organizations to better inform practitioners about student educational pathways. The Clearinghouse harnesses this capability through our StudentTracker^® services, as well as our research arm, the National Student Clearinghouse Research Center.

• StudentTracker^®: Participating Institutions have appointed the Clearinghouse as their agent to respond to the requests of authorized educational institutions, organizations, and agencies (“Authorized Requesting Entities”) for information on the postsecondary enrollment of, and credentials earned by, their current and former students, under the directory information, audit and evaluation, and/or studies exceptions to FERPA, as applicable. These Authorized Requesting Entities use this information for educational and related purposes, including the following:
  • Postsecondary institutions can determine whether, and at what institutions, former students pursued further postsecondary education, providing insight into student pathways and success for use in institutional improvement.
  • Postsecondary institutions can identify the institution(s) eventually attended by those applicants who declined their offer of admission, providing assistance with student recruitment efforts.
  • Secondary schools, school districts, and state K‐12 educational authorities can determine the postsecondary enrollment and credential attainment of their students, providing insights that they can use to improve their college preparation efforts.
  • Secondary schools, school districts, and state K‐12 education authorities can use this information in connection with an audit or evaluation of federal or state-supported education programs or for conducting studies to improve instruction.
  • Programs, such as TRIO and GEAR UP, which provide support to disadvantaged students to enable their educational success, can better measure their effectiveness by obtaining enrollment and credential attainment data on program participants.
  • Authorized researchers may obtain postsecondary enrollment and degree attainment data to conduct research aimed at improving the provision of education to students or administering student aid programs.
• Additional Information Regarding StudentTracker^® for High Schools: Through the Clearinghouse’s StudentTracker^® for High Schools (“STHS”) service, participating high schools, school districts, state and local educational agencies and authorities (“STHS Participants”) provide the Clearinghouse with data on their graduates, including PII, and the Clearinghouse returns reports to the STHS Participants on the postsecondary enrollment and degrees of those graduates. Specifically, STHS Participants provide the Clearinghouse with the following types of education records as part of the service, for the following purposes:
  • PII (name, date of birth) and information on the graduates’ high school and graduation date, required for the purpose of matching the graduates of the STHS Participant with the postsecondary records held by the Clearinghouse.
  • PII (name, date of birth) and information on the graduates’ high school and graduation date, which STHS Participants are required to report as part of the service, and which is used for the purpose of providing reports back to the STHS Participant on the postsecondary enrollment and degrees of its graduates. Graduates’ program codes are provided for this purpose at the option of the STHS Participant.
  • Student ID number may be provided at the option of the STHS Participant, for the administrative convenience of the STHS Participant, and is included in the reports sent back by the Clearinghouse to the STHS Participant.
  • While Social Security Number (“SSN”) is not required in the STHS service, some STHS Participants submit it as an identifier. If available, SSN is returned with the students’ postsecondary enrollment and degree information. SSN is not used in the matching process within STHS.
  • Assessment results, demographic data, and curriculum information, which may be provided at the option of the STHS Participant, for the purpose of providing richer aggregate reporting back to the STHS Participant.
  • For the purpose of producing aggregate research: high school graduation date (required for the service) and ethnicity (at the STHS Participant’s option).
  • STHS Participants also are required to provide, and may sort their submission by, the type of diploma earned by the student. This data element serves to confirm students as graduates and may be used in the future for research purposes.

The Clearinghouse does not disclose student PII provided through this service to third parties, except through the DiplomaVerify service described below, as necessary for the maintenance of the STHS service, or as required by law. The Clearinghouse contractually restricts third parties involved in the maintenance of the STHS service from using the data in any unauthorized way, trains them on Clearinghouse privacy and security requirements, and monitors their access to PII.

The Clearinghouse uses education records provided in connection with the STHS service to report data in a de‐identified, aggregated form for authorized research purposes. The Clearinghouse works with STHS Participants to support mutual compliance with FERPA. A parent, legal guardian, or eligible student may exercise his/her right to review and inspect education records held by the Clearinghouse as an agent for STHS Participants by contacting the STHS Participant. The STHS Participant may then contact its designated account representative at the Clearinghouse for support.  If we make material changes in the manner in which we process PII in our STHS service that reduce the privacy protections applicable to such PII, we will notify the STHS Participant on whose behalf we are performing the STHS service at least thirty (30) days prior to the date the change becomes effective.  We will provide notification through our Website of other changes in the way we process PII in our STHS service.

• Postsecondary Data Partnership: The Postsecondary Data Partnership (“PDP”) is a nationwide data collaborative to help colleges and universities (“PDP Institutions”) gain a fuller picture of student progress and outcomes, meet various reporting requirements, and identify where to focus their resources for increasing student success.  PDP Institutions report personally identifiable course and credit data (including grades), credential data, demographic data, individual identifiers, institutional information, high school completion data, and college readiness data. The Clearinghouse uses this data, along with the Clearinghouse’s nationwide depository of postsecondary enrollment and degree data (in compliance with FERPA and other applicable legal requirements), to:
  • Calculate aggregate metrics for the PDP Institutions.
  • Help the PDP Institutions conduct their own analyses of this data.
  • Report de-identified and aggregate data to the authorized partners of PDP Institutions (such as grant-making foundations, state agencies, and institutional support initiatives).

PDP Institutions that wish to engage the Clearinghouse to help them audit or evaluate financial aid programs may also submit certain financial aid data as part of the PDP for that purpose.

• Industry Credentials: Through the Clearinghouse’s Industry Credentials service, issuers of industry-recognized credentials (“Certification Bodies”) send us PII on their credential holders and receive individual-level reports back on the postsecondary enrollment and completion of their credential holders in a manner similar to the Clearinghouse’s StudentTracker service. These Certification Bodies also receive aggregate reports which provide insights into the labor market outcomes and postsecondary educational attainment of their credential holders, in a partnership with the U.S. Census Bureau.
  
• Research Center: Through aggregated longitudinal data outcomes reporting, the Research Center facilitates better educational policy decisions leading to improved student outcomes. The Clearinghouse periodically produces several aggregate reports on student enrollment, movement, and other important student outcomes. Learn more at: https://nscresearchcenter.org/.

Verifications:

• Postsecondary Student Data: The Clearinghouse uses the enrollment information it receives from Participating Institutions for the financial aid‐related services outlined above, as well as additional degree information it receives from Participating Institutions, to provide verification services to eligible requestors (“Postsecondary Requestors”). When you apply for a product, service, or employment that depends on your enrollment or graduation status, the provider of that product, service, or employment may contact the Clearinghouse to verify the enrollment, degree, or other credential information you have provided in your application. On behalf of Participating Institutions, we will compare the information provided by the Postsecondary Requestor with the education record information we received from your Participating Institution to verify the information that you provided in your application, which can assist the Postsecondary Requestor in determining your eligibility for the product, service, or employment.

• DiplomaVerify: The Clearinghouse provides a DiplomaVerify service for participating high schools, school districts, and state agencies (“DiplomaVerify Participants”).  This service verifies an individual’s status as a high school graduate, their year of graduation, and the name of their high school, to employers, background screeners, and others seeking confirmation of these data elements for an employment or educational purpose, provided that the individual is 17 years of age or older. This verification is performed with the consent of the individual or, if the individual is 17 years old, with the consent of the individual’s parent or guardian. In performing these verifications, the Clearinghouse uses the student data reported to us as an authorized School Official by either (i) an STHS Participant (described above); or (ii) a school, district, or agency that reports student data to us solely for purposes of DiplomaVerify.

We never release any information about you for the purpose of targeted advertising.

Transcripts:

The Clearinghouse delivers student transcripts to third parties only with a student’s consent or, if another valid FERPA exception applies, at the direction of the Participating Institution. Your institution electronically sends the Clearinghouse your transcript, which we securely transmit to the recipient(s) identified in the order (we employ electronic and print‐to‐mail transmission systems from which you may select), such as another educational institution or a prospective employer. As part of the electronic transcript delivery methods offered by the Clearinghouse, a transcript may be temporarily maintained by us until delivered and accessed by the recipient of the transcript order.

If we make material changes in the manner in which we process transcripts that reduce the privacy protections applicable to such transcripts, we will notify the educational institution or agency on whose behalf we are delivering such transcripts at least thirty (30) days prior to the date the change becomes effective.  We will provide notification through our Website of other changes in the way we process high school transcripts.

Course Exchange:

The Clearinghouse facilitates the awarding of degrees and certificates between Participating Institutions by transmitting course data through Reverse Transfer and other course exchange programs. Reverse Transfer allows students who transfer from a two‐year institution to a four‐year institution without first obtaining an Associate’s Degree to still receive that degree from the two‐year institution when they have completed the requisite courses to qualify. This Reverse Transfer is done with student consent, collected by the student’s four‐year institution.

Request for Correction or Deletion by Participating Institutions and STHS Participants

Participating Institutions and STHS Participants that send the Clearinghouse student data to receive Clearinghouse services may request the correction or deletion of such data by contacting their Clearinghouse contact, by sending an email toprivacy@studentclearinghouse.org, or calling the Clearinghouse at (703) 742-4200.

Use of Data Pertaining to Your Access of Our Websites

The Clearinghouse generally uses the PII it collects from an individual’s use of our Websites for the following purposes:

• To fulfill orders and send your transcript or degree, certificate, or enrollment verification information as you direct, when you provide us with a request for such service.
• To contact you, when necessary, regarding your correspondence with us or your requests.
• To authenticate the identity of individuals requesting our services or individuals contacting the Clearinghouse by telephone, electronic means, or otherwise.
• To inform Participating Institutions, DiplomaVerify Participants, or individuals concerning inquiries about their education records.
• To help diagnose problems with our servers and ensure the efficiency, reliability, and security of our systems and networks.
• To present our Websites and their contents to you and to improve your experience interacting with our Websites.
• In aggregate and de‐identified form, for research.
• To assess our services and operations to determine areas for improvement and to understand and assess the interests, wants, and changing needs of users of our Websites with a view to improving our products and services and developing new ones.
• To meet legal and regulatory requirements and allow the Clearinghouse to meet contractual requirements relating to the products and services that we provide.
• To ensure our records are accurate.

Sharing of Your Personally Identifiable Information with Service Providers

Your information may be made available by the Clearinghouse to third parties assisting the Clearinghouse to fulfill the purpose for which the information was collected or as set forth in this Privacy Policy. The Clearinghouse will not sell, rent, or trade your PII to any third party. However, we may share your PII with third‐party service providers hired to support our business and who are bound by contractual obligations to keep PII confidential and use it only for the purposes for which we disclose it to them. The Clearinghouse provides them only the information that they need to know to perform the requested services on our behalf. They are bound by confidentiality obligations prohibiting them from using your PII for purposes other than to facilitate and carry out the services for which they have been retained. The Clearinghouse protects PII disclosed to third parties by contractual agreements, requiring those third parties to adhere to confidentiality and security procedures and protections that are, at a minimum, equivalent to those employed by the Clearinghouse itself.

Only those personnel of the Clearinghouse or third-party contractors, with whom the Clearinghouse has contracted and who have a business need to know to perform the services being requested by the Clearinghouse, will be granted access to PII.

For information on how you can limit the type of information that we collect, use, or share about you when you visit and/or use our Websites, please refer to the Personally Identifiable Information (PII) Generated from the “Your Use of Our Websites” section of this Privacy Policy.

Security of Your Personally Identifiable Information

The security of the PII we maintain is a priority of the Clearinghouse. Our services are designed to comply with the requirements of FERPA, our agreements with Participating Institutions, STHS Participants, and DiplomaVerify Participants, all applicable federal and state privacy laws, and accepted industry best practices. Below are some of the highlights of our data security.

• The Clearinghouse maintains a comprehensive information security program based on the ISO 27001/27002 standards, staffed by experienced professionals, and backed by comprehensive security policies that detail Operational, Management, and Technical control requirements that are mapped to widely accepted, industry best practice security standards. This program is regularly reviewed and updated on an annual basis to ensure its continuing suitability, adequacy, and effectiveness.
• All information you provide to us or that we receive from Participating Institutions is stored on secure servers in the contiguous United States.
• The Clearinghouse security policy ensures the confidentiality, integrity, availability, and privacy of your data through:
  • Management and business processes that include and enable security processes;
  • Ongoing personnel training to maintain awareness of security issues;
  • Physical security requirements for information systems;
  • Governance processes for information technology;
  • Reporting information security events and weaknesses;
  • Creating and maintaining business continuity plans; and
  • Monitoring for compliance.
• Our network perimeter and other controls ensuring security from external threats are regularly tested by a third party.
• Our employees undergo a background check, as well as mandatory annual security and privacy training.
• We maintain secure authentication protocols and access limitations for external and internal users.

In the unlikely event of an incident of unauthorized access to PII, the Clearinghouse will comply with all applicable legal requirements, including by making any required notifications.

Changes to Our Privacy Policy

As the Clearinghouse develops new services, deploys new technologies, or develops new uses of information, we review and update our Privacy Policy to reflect these changes. We also commit to monitoring the applicable privacy laws and updating both our Privacy Policy and security practices to ensure ongoing compliance. In addition, from time to time we make organizational, stylistic, and grammatical changes to the Privacy Policy to present our services in a way that makes our Privacy Policy easy to read. If we make material changes in the way we process your PII, we will provide you notice via our Website or by other means, such as email. Any revised Privacy Policy supersedes all previous versions. Please review any changes carefully. All changes are effective immediately upon posting, unless otherwise specified. By continuing to use our services, you consent to the terms of our Privacy Policy, as revised. However, we will always handle the PII we collect from you in accordance with the Privacy Policy that was in effect at the time of your order.

Prohibition on the Assignment of Your Data

If the Clearinghouse or our assets are acquired by another company that is not a majority‐owned subsidiary of the Clearinghouse, or in the event of a merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation to a non‐majority‐owned subsidiary of the Clearinghouse, we will not, under any circumstances, sell, transfer, or assign to a third party education records directly concerning you. The education records we receive from Participating Institutions, STHS Participants, and DiplomaVerify Participants shall be returned to the entity from which they were originally received.

Contact Information

If you have questions or concerns regarding any information in this Privacy Policy, please email us at privacy@studentclearinghouse.org.  You may also contact us at 2300 Dulles Station Blvd., Suite 220, Herndon, VA 20171, at (703) 742-4200, or through our website at: https://nscsso.my.site.com/student/s/. We will respond to data access requests, including any denial of access to such requests, within 45 days.

For Nevada Residents Only:  If you are a Nevada resident and wish to exercise your rights under Nevada Revised Statutes Sections 603A.300 through 603A.360, please provide the following information to nevada@studentclearinghouse.org:

• first name, last name, and middle initial
• date of birth (day/month/year)
• the names of all educational institutions you have attended
• the last four digits of your SSN

By providing us with the information above, you are certifying that you are a Nevada resident as defined by state law. While the Clearinghouse does not exchange, for monetary consideration, the data individuals provide to us, we are nevertheless required to provide you with this opt-out right.

Glossary of Terms

• Education Records – Records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution or by a party acting for the agency or institution.​
• Directory Information – Under FERPA, information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed, as determined and designated by institutions.
• Non‐Directory Information – Any PII that an institution does not designate as Directory Information is deemed Non‐Directory Information. This information is associated with a higher degree of sensitivity and thus there are stricter restrictions around how and when it may be used.
• Personally identifiable information (PII) – Includes, but is not limited to — (a) student’s name; (b) name of the student’s parent or other family members; (c) address of the student or student’s family; (d) a personal identifier, such as the student’s SSN, student number, or biometric record; (e) other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; (f) other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or (g) information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
• School Official – A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official provided that the outside party — (1) performs an institutional service or function for which the agency or institution would otherwise use employees; (2) is under the direct control of the agency or institution with respect to the use and maintenance of education records; and (3) is subject to the requirements of FERPA governing the use and re-disclosure of PII from education records.