Official ACLAS Privacy Policy explaining how we collect, use, protect, and retain personal data across our websites, student portals, and learning systems.
Effective May 14, 2025FERPA standards alignedGDPR & CCPA compliant
We collect information to provide, manage, and improve our Services, categorized as follows: Note: Personal information collected during the student registration application, including academic and work history, is used solely for our admissions review process to ensure eligibility. We are committed to maintaining its confidentiality and will not disclose it to third parties without your explicit consent, except as described in Section 3. You can manage cookie preferences via our website’s cookie consent tool, which allows you to accept or reject non-essential cookies (e.g., for analytics or marketing), or through your browser settings (see Section 5.1).
Account and Enrollment Data: When you apply or enroll, you understand and agree that ACLAS collects your full name, email address, phone number, mailing/billing address, date of birth, nationality, educational background (e.g., prior degrees, institutions), professional experience (e.g., job titles, work history) and other details ("Entered Data"). You are the source of such account data, and such data may be processed for the purposes of operating the Website, providing the Services, ensuring the security of the Website and Services, maintaining back-ups of our databases and communicating with you.
Payment Data: When you pay tuition or certificate fees, we collect credit/debit card details, bank account information, or third-party payment account details (e.g., PayPal, Western Union, PayMyTuition, Wintopay, Geoswift).
Application and Support Data: Responses to application forms, surveys, or quizzes; correspondence via email or support channels; uploaded documents (e.g., transcripts, resumes, identification documents like passports for verification).
Marketing Preferences: Your choices regarding newsletters or promotional communications.
Usage Data: When you visit our website, we collect your IP address, browser type/version, operating system, device type, access dates/times, pages viewed, navigation patterns, and referring website for analytics and security purposes.
Cookies and Tracking Technologies: We use cookies, web beacons, and pixel tags for functionality (e.g., login sessions), analytics (e.g., usage trends via Google Analytics), and personalization (e.g., course recommendations). Cookies include: Session Cookies: Temporary, deleted after your session.
Persistent Cookies: Stored for future visits (e.g., remembering preferences).
Third-Party Cookies: From analytics providers like Google Analytics.
Partners and Vendors: Data from payment processors (e.g., PayPal, PayMyTuition, Wintopay, Geoswift), educational partners, or service providers (e.g., Vultr for hosting, Cloudflare for global CDN services).
Affiliates: Enrollment data from affiliate program participants when you join via a referral link.
Public Sources: Information from publicly available platforms (e.g., LinkedIn), where permitted by law and your privacy settings.
2. How We Use Your Information
We use your information to deliver, manage, and enhance our Services, including:
Educational Services: Process enrollments, manage accounts, provide access to courses, issue digital/physical certificates and transcripts, and verify credentials via our website’s certificate verification function.
Payment Processing: Facilitate tuition and certificate payments, verify transactions, and manage installment plans.
Communication: Respond to inquiries, provide support, send administrative updates (e.g., course deadlines, payment confirmations), and, with your consent, deliver marketing emails or newsletters.
Analytics and Improvement: Analyze usage trends, monitor course performance, and improve website functionality and educational content.
Personalization: Tailor course recommendations and user experience based on your interactions.
Security: Detect and prevent fraud, abuse, or unauthorized access to our systems.
Compliance: Meet legal, regulatory, or accreditation requirements, including tax reporting and student record protection under FERPA (20 U.S.C. § 1232g).
Non-Compliance List: Maintain a desensitized public list of individuals whose enrollment or degree was revoked due to false information or violations of student conduct policies (see Section 3.5).
3. How We Share Your Information
We do not sell, rent, or trade your personal information. We may share it in the following limited circumstances: If credentials are revoked for fraud or policy violations, ACLASS will notify the affected student via email within 5 business days, providing reasons and an opportunity to appeal within 15 business days. Appeals must be submitted to info@aclas.college with supporting evidence.
Service Providers: With trusted vendors (e.g., Vultr for hosting, Cloudflare for global CDN services, PayPal, PayMyTuition, Wintopay, and Geoswift for payment processing, Google Analytics for usage trends) bound by contracts to protect your data. We do not share data with third parties in a manner that constitutes a “sale” under CCPA.
Certificate Verification: When you request academic credential verification, we may share your name, degree (e.g., MBA), certificate number, and degree award date with QualificationCheck, Hague Apostille certification bodies, government notaries, or other third-party verification services, subject to confidentiality agreements.
Affiliate Program: With affiliates to confirm enrollment and process commissions, limited to necessary data (e.g., enrollment confirmation).
Legal Obligations: When required by law, court order, or government authority, or to protect ACLAS's rights, property, or safety.
Business Transfers: In a merger, acquisition, or asset sale, with safeguards to maintain data confidentiality.
With Your Consent: For specific purposes (e.g., testimonials, partnerships) when you explicitly agree.
Non-Compliance List: If your enrollment or degree is revoked due to providing false information or violating student conduct policies, we may publicly disclose a desensitized version of your information (e.g., initials, degree type, revocation reason) on our non-compliance list. This data is processed to ensure it cannot be re-identified, in compliance with GDPR and CCPA anonymization standards.
4. Legal Basis for Processing (GDPR Compliance)
For users in the European Economic Area (EEA), we process personal data based on:
Contractual Necessity: To fulfill enrollment agreements (e.g., delivering courses, issuing certificates), per GDPR Article 6(1)(b).
Consent: For optional activities like marketing (withdrawable at any time), per GDPR Article 7.
Legitimate Interests: For improving services, ensuring security, and managing operations, balanced against your rights, per GDPR Article 6(1)(f).
Legal Obligation: To comply with laws, such as FERPA or tax regulations, per GDPR Article 6(1)(c).
5. Your Rights and Choices
You have rights over your personal information, subject to applicable laws: ACLAS voluntarily complies with the California Consumer Privacy Act (CCPA) to protect California residents’ privacy, even though we do not meet the statutory applicability thresholds (e.g., annual revenue or data processing volume). You may submit CCPA requests via info@aclas.college or the student portal’s privacy dashboard. ACLAS voluntarily complies with the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 C.F.R. Part 99) to protect the privacy of student educational records, including grades, transcripts, course progress, and official correspondence (but not informal notes or temporary data). ACLAS does not receive federal funding (e.g., Title IV funds), so FERPA is not legally binding, but we adhere to its standards to safeguard student records. If you are an enrolled student, you have the following FERPA rights: FERPA rights apply only to enrolled students and do not extend to prospective students or non-educational data. Refund-related requests are governed by our Refund Policy and are not addressed through privacy or FERPA rights. For more information on FERPA, visit www.ed.gov/ferpa . To exercise these rights, contact info@aclas.college or use the student portal’s privacy dashboard. We will respond within legal timeframes (e.g., 30 days for GDPR, 45 days for CCPA, 45 days for FERPA access requests).
Access: Request a copy of your data.
Correction: Update inaccurate or incomplete data.
Deletion: Request data deletion, subject to legal retention obligations (e.g., FERPA records).
Restriction: Limit data processing in certain cases.
Opt-Out: Unsubscribe from marketing emails via the “unsubscribe” link or by contacting info@aclas.college .
Cookies: Manage preferences via our website’s cookie consent tool, which allows you to accept or reject non-essential cookies (e.g., for analytics or marketing), or through your browser settings. Disabling cookies may affect functionality (e.g., login or course access). Essential cookies (e.g., for login) cannot be disabled.
Data Portability: Receive your data in a structured, machine-readable format, per GDPR Article 20.
Objection: Object to processing based on legitimate interests or marketing, per GDPR Article 21.
Withdraw Consent: Revoke consent without affecting prior processing, per GDPR Article 7.
Know: Learn about the categories and specific pieces of data we collect, use, or share, per CCPA § 1798.110.
Delete: Request deletion, subject to exceptions (e.g., legal obligations), per CCPA § 1798.105.
Non-Discrimination: No discrimination for exercising CCPA rights, per CCPA § 1798.125.
Access and Inspection: Request to inspect and review your educational records. Submit a written request to info@aclas.college , and we will provide access within 45 days, per FERPA.
Amendment: Request corrections to inaccurate or misleading educational records (e.g., incorrect grades). Submit a written request to info@aclas.college specifying the record and correction needed. If denied, you may request a hearing, and if the hearing upholds the denial, you may add a statement to the record.
Disclosure Control: Consent to disclosures of personally identifiable information in your educational records, except in cases permitted by FERPA without consent, such as: Disclosure to ACLASS officials with legitimate educational interests (e.g., instructors, administrators).
Disclosure to comply with a judicial order, subpoena, or other legal requirement.
Disclosure to QualificationCheck, Hague Apostille certification bodies, government notaries, or other verification services for credential verification, upon your request.
Directory Information Opt-Out: ACLASS may disclose directory information (e.g., name, email, enrollment status, degree awarded) unless you opt out. To restrict this, submit a written request to info@aclas.college within 30 days of enrollment or update your privacy settings in the student portal.
6. Certificate Verification Function
Our website offers a certificate verification function, allowing third parties (e.g., employers, institutions) to verify your credentials by entering a unique certificate number found on your degree certificate. This function discloses only basic information, including: This data is shared only when queried via the verification tool and is protected by secure access controls.
Degree awarded (e.g., MBA)
Name
Certificate number
Degree award date
7. Data Security
We use industry-standard measures to protect your data, including: Our servers are primarily located in the United States, hosted by Vultr, with global CDN services provided by Cloudflare. No system is fully secure. In case of a data breach affecting your rights, we will notify you via email and relevant authorities (e.g., within 72 hours under GDPR for EEA residents, or within 30 days for CCPA-covered California residents), providing guidance on protective steps (e.g., changing passwords, monitoring accounts).
Encryption: Sensitive data (e.g., payment details, identification documents) is encrypted in transit and at rest.
Access Controls: Data is accessible only to authorized personnel with a legitimate educational or operational need.
Regular Security Audits: We conduct periodic system updates and audits to ensure security.
8. Data Retention
We retain data only as long as necessary or required by law: Data no longer needed is securely deleted or anonymized.
Educational Records: Kept while your account is active and for 5 years post-closure, per FERPA standards and accreditation requirements.
Payment Records: Retained for 7 years, per tax and financial regulations.
Usage Data: Kept in anonymized form for analytics indefinitely.
Non-Compliance List: Desensitized data (e.g., initials, revocation reason) may be retained indefinitely for public disclosure, processed to ensure it cannot be re-identified, per GDPR and CCPA anonymization standards.
9. International Data Transfers
Your data may be processed or stored in the United States, where our servers are primarily hosted by Vultr, or in other countries where our providers operate (e.g., payment processors like PayPal, PayMyTuition, Wintopay, or Geoswift). These countries may have different data protection laws.
EEA Residents: We use Standard Contractual Clauses (SCCs), per GDPR Article 46, to ensure GDPR-compliant transfers. Global Users: We comply with local laws where feasible, but U.S. law primarily governs our operations. Customers are responsible for any applicable customs duties or taxes for physical certificate shipments.
Contact info@aclas.college for details on transfer safeguards.
10. Children’s Privacy
Our Services are not intended for individuals under 18. We comply with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501-6506) and do not knowingly collect data from individuals under 13, or from those aged 13-17 without appropriate safeguards. We verify age during enrollment by collecting date of birth and may request identification (e.g., passport). If we discover data from minors, we will delete it promptly. Contact info@aclas.college if you believe we have collected minor data.
11. Third-Party Links and Services
Our Services may link to third-party sites (e.g., PayPal, PayMyTuition, LinkedIn). We are not responsible for their privacy practices. Review their policies before sharing data.
12. Changes to This Privacy Policy
We may update this policy to reflect changes in practices or laws. Updates will be posted with a revised “Effective Date.” Significant changes (e.g., new data uses or sharing practices) will be notified via email or a website banner. You can subscribe to policy update notifications via the student portal or by contacting info@aclas.college . Check this page regularly.
13. Contact Us
Atlanta College of Liberal Arts and Sciences Email: info@aclas.college
For GDPR inquiries, contact our Data Protection Officer at dpo@aclas.college or our GDPR EU representative, Emily Sarah Knight, at e.knight@aclas.college . EEA residents may lodge complaints with their local data protection authority.
14. Additional Notices
We do not sell personal information under CCPA. ACLASS voluntarily complies with CCPA to protect California residents’ privacy, even though we do not meet the statutory applicability thresholds. See Section 5.3 for your rights.
For alternative formats of this policy, contact info@aclas.college .
Campus services Program and admissions information is available here. To apply, manage your account, make a payment, access private student records or download documents, use the ACLAS campus at aclas.college.
