PRIVACY POLICY Kaplan Higher Education Privacy Policy Last Revised: April 2020 Kaplan Higher Education (KHE), a subsidiary of Kaplan, Inc. (“Kaplan”, “we” or “us”), a subsidiary of Graham Holdings Company, recognizes the importance of protecting the privacy of your personal information, and we have prepared this Privacy Policy to provide you with important information about our privacy practices. This Privacy Policy applies when you are contacted by KHE by phone or email or use any website, mobile, or tablet application or other online service that links and refers to this Privacy Policy (collectively, the “Services”). This Privacy Policy explains what personal data we collect as part of the Services and the purpose for that collection. We also explain how we use your personal data and your choices about that use. By participating in the Services or submitting your personal data, you consent to the practices described in this Privacy Policy. We at KHE manage or support an extensive range of education-related services worldwide for students, professionals, and partner institutions (“Educational Offerings”). This Privacy Policy does not apply to information collected by our partner institutions, other websites, or online services. If you request information from us about Educational Offerings, we will forward your personal information to the entity that has educational offerings that match your interests, and that entity will be responsible for the further processing of your personal information in accordance with its privacy policy. If you have asked for such information, we encourage you to familiarize yourself with the applicable entity’s privacy policy posted on its website. Express Consent to Receive Text Messages If you have provided prior express written consent in the process of requesting information from KHE about Educational Offerings, or if you have provided prior express consent after becoming a student with one of our partner institutions to receive texts, we may use text messages to communicate with you. Information We Collect We may collect personal information about our users in various ways. For example, we may collect information that you provide to us, information that we collect through your use of the Services, and information that we collect from third parties or publicly available sources. Information You Provide to Us. In order to take advantage of the Services or features offered or provided by the Services, you may be asked to provide personal information. For example, if you request information from us through the Services, we may collect your name, e-mail address, mailing address, and phone number. Information About Use of the Services. In addition to the information you provide to us, we may collect information about your use of the Services. For example, we may collect: Device Information—We may collect information concerning your computer and other devices used to access the Services. For example, we may collect your hardware model, IP address, other unique device identifiers, operating system version, and browser type and settings of the device you use to access the Services. Usage Information—We also may collect information about the Services you use, your interactions with content offered through the Services, and other online activity. For example, we may collect information about how many visitors visit a specific page on the Services, how long they stay on that page, and which hyperlinks, if any, they click on. We collect this information, in part, through the use of technologies such as cookies and web beacons, which are discussed in greater detail below. Information From Third-Party Sources. We may receive information about you from publicly and commercially available sources, as permitted by law, which we may combine with other information we receive from or about you. For example, we may receive information about you from a social media site if you connect to the Services through that site. Information From Other Sources. We may also periodically obtain both personal and non-personal information about you from other KHE businesses, business partners, contractors, and other third parties. Examples of information that we may receive include: updated contact, delivery and address information, and additional demographic information. How We Use Information To Provide You Access to the Services and Manage Your Requests on the Services. We use your information to send it to the Educational Offerings that you select. We may share information with other Kaplan entities or our partner educational institutions if you apply for a job opening or have a customer inquiry about one of their Educational Offerings or services. Other uses include, for example, responding to transactional requests and delivering, analyzing, and improving our website(s) and other services. To Better Understand Our Users. We may use information we gather to determine which areas of the Services are most frequently visited to understand how to enhance the Services. To Protect the Rights of the Services and Others. We may use your personal information as we believe is necessary or appropriate to protect, enforce, or defend the legal rights, privacy, safety, or property of the Services, our employees or agents, or other users and to comply with applicable law. Consent. We may otherwise use your information with your consent or at your direction. Security We have adopted physical, technical, and administrative safeguards to help protect against theft, loss, misuse, and unauthorized access to or disclosure of the information we collect and receive. However, please note that no data transmission or storage can be guaranteed to be 100% secure. As a result, while we are concerned with the security of your personal data and strive to protect your information and privacy, we cannot and do not guarantee the security of any information you disclose or transmit to our Services and cannot be responsible for the theft, destruction, or inadvertent disclosure of your information, or any other disclosures out of our control. Sharing with Third Parties and Selected Providers Affiliates. We may share information within our corporate group for the purposes set out in this Privacy Policy. Partner Educational Institutions and Educational Affiliates. If you request information about Educational Offerings, we may share information with those partner educational institutions and educational affiliates you select for the purpose of providing you the information you seek. If you apply for a job or have an inquiry related to them, we also share information with them for that purpose. These entities are expected to protect the confidentiality, integrity, and security of any information we share with them. However, we are not responsible for all of their privacy practices, and they may use your information for their own purposes, including providing you with special offers, promotional materials, and other information that may be of use to you. We encourage you to review their privacy policies. Service Providers. We may use service providers to perform a variety of services for KHE and the Services, such as providing data analysis and form submissions. As a result, we may share your personal information with those businesses for the limited purpose of performing those services. Other Parties When Required by Law or as Necessary to Protect Our Services. There may also be occasion for KHE to disclose your personal data to third parties if it believes, in its sole discretion, that such disclosure is required by law, is necessary to enforce its user agreement or privacy policy, or in connection with a sale or transfer of some or all of the assets in KHE. Otherwise With Your Consent or at Your Discretion. In addition to the sharing described in this Privacy Policy, we may share information about you with third parties whenever you consent to or direct such sharing. We also may share other information with third parties in a manner that does not identify particular visitors, including, for example, aggregate information about how the Services are used. Selected Providers. From time to time we may share your contact information with selected providers of goods and services that may be of interest to you. If you prefer not to receive information from these providers, you can notify us at any time by emailing to privacy@kaplan.edu. Online Tracking We may use cookies, web beacons, and similar tracking technologies to facilitate administration and navigation on the Services, to better understand and improve the Services, and to provide you with a customized online experience. Cookies. A cookie is a string of information that is sent by a Web site and stored on your hard drive or temporarily in your computer’s memory. We may employ cookie technology to help you move faster through our Services. We may employ cookie technology to estimate our total audience size and traffic and to help us improve the Services’ experience by measuring which areas are of greatest interest to users. You can turn off the ability to receive any of these cookies by adjusting the browser in your computer, but you should note that if you do so, this may materially affect the functionality of the Services and the information you can access through them. Information about prohibiting the collection of cookies is set out below. If you wish to find out more about cookies, please visit the Interactive Advertising Bureau’s web site at www.allaboutcookies.org Prohibiting the Collection of Cookies. If you would like to prevent KHE from collecting cookies when you visit our site, please update the privacy setting in your chosen web browser. You can directly control cookie acceptance from there: Google Chrome: https://www.google.com/chrome/browser/privacy/ Mozilla Firefox: www.mozilla.org/en-US/privacy Internet Explorer: windows.microsoft.com/en-gb/windows/change-internet-explorer-privacy-settings#1TC=windows-7 Google Analytics: https://tools.google.com/dlpage/gaoptout Web Beacons and Other Tracking Technologies. We also may use other tracking technologies. For example, we may use technologies called beacons (or “pixels”) that communicate information from your device to a server. Beacons can be embedded in online content, videos, and emails, and can allow a server to read certain types of information from your device, know when you have viewed particular content or a particular email message, determine the time and date on which you viewed the web beacon, and the IP address of your device. We use web beacons for a variety of purposes, including to analyze the use of our Services and in conjunction with cookies. Do Not Track Signals. Some web browsers may transmit “do not track” signals to the websites and other online services with which a user communicates. There is no industry standard that governs what, if anything, websites should do when they receive these signals. We currently do not take action in response to these signals. If and when a standard is established and accepted, we may revisit our policy on responding to these signals. Third Parties that Provide Content or Functionality. Some of the content and functionality on our Services may be provided by third party service providers. When you use our Services, such third parties may collect or receive certain information about you and/or your use of the Services, including through the use of cookies, beacons, and similar technologies. This information may be combined with information collected across different websites, online services, and other linked or associated devices. These third parties may use your information to improve their own services. However, we do not permit such parties that receive or collect your information in connection with their services to share or use your information for other purposes. Links to Other Web Sites We may make content or services from other websites including our co-branded websites, or other KHE-affiliated websites or partner educational institutions, available to you from links located on this site. These other web sites are not subject to this Privacy Policy. We recommend that you review the Privacy Policy at each such website to determine how that site protects your privacy. Transfer of Data Outside of Your Home Country Your information may be stored, processed and accessed in the United States or any other countries where KHE and our affiliates have facilities. By using the Services, you consent to the collection, transfer, storage, and processing of information outside your country. If you are located in the EU and applicable law specifies relevant legal grounds for processing personal data, the legal grounds for our processing activities are to perform our contract(s) with you; to meet our legal obligations; and for our legitimate business purposes, including to improve our operation and Services and to detect and prevent fraud. We rely on your consent to send your personal information to our affiliated or managed educational institutions so that they may send you direct marketing messages about educational offerings and related services. Please see the “Your Ability to Choose” section below for more information on how to withdraw your consent at any time. You may lodge a complaint with a supervisory authority if you consider that our processing of your personal information infringes applicable law. Your Ability to Choose Disclosure of Information for Marketing Purposes. If you wish to change your preferences about being contacted or withdraw your consent to be contacted, we encourage you to follow the instructions in any email or other message you receive, and contact the applicable educational institution sending you the information directly, since they are subject to separate privacy policies. If you do not receive a response or are not unsubscribed promptly, you may also let us know by sending us a written request by email to privacy@Kaplan.edu. When composing your email, please include the phrase “Unsubscribe Request” in the subject line and body of the request and state to which educational institution the unsubscribe request applies. Access, Update, or Correct Information and Other Data Subject Rights. You may have certain rights as a data subject under local law. For example, you may have the right to access, update, or correct inaccuracies in your personal information in our custody and control, subject to certain exceptions prescribed by law, or the right to data portability. If you would like to access, review, or update your information or otherwise exercise your rights, please contact us as set out in the “How to Contact Us” section below. Other Important Information Children’s Privacy. We do not knowingly collect any personal information from children under the age of 13 without parental consent, unless permitted by law. If we learn that a child under the age of 13 has provided us with personal information, we will delete it in accordance with applicable law. Special Notice for California Residents. Persons with disabilities may obtain this notice in alternative format upon request by contacting us at privacyrequests@kaplan.edu or calling 1-866-523-3473. Your California Privacy Rights. California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their direct marketing purposes in the preceding calendar year. We do not share personal information with third parties for their own direct marketing purposes. California Consumer Privacy Act The California Consumer Privacy Act (“CCPA”) provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of “Personal Information,” as well as rights to know/access, delete, and limit sharing of Personal Information. The CCPA defines “Personal Information” to mean “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Certain information we collect may be exempt from the CCPA because it is considered public information (i.e., it is made available by a government entity) or covered by a specific federal privacy law, such as the Family Education Rights and Privacy Act, Gramm–Leach–Bliley Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act. To the extent that we collect Personal Information that is subject to the CCPA, that information, our practices, and your rights are described below. Right to Notice at Collection Regarding the Categories of Personal Information Collected. You have the right to receive notice of the categories of Personal Information we collect, and the purposes for which those categories of Personal Information will be used. This notice should be provided at or before the time of collection. The categories we use to describe the information are those enumerated in the CCPA. Personal Identifiers:We collect your name, phone number, contact address and e-mail address when you engage with certain Services. We use this information to manage and provide the Services that you request, respond to your requests, and to communicate with you about the Services. We collect your social media handle and basic account information when you interact with our Services through social media. We use this information to improve the user experience and our Service. We automatically collect unique numerical identifiers assigned to you by a cookie, your IP address, and your device ID when you use our Services. We use this information to improve the user experience, measure activity, determine the effectiveness of our Services, and improve them. Internet or Other Electronic Network Activity Information: We automatically collect information about your browsing history and your interaction with the content of our Services to measure activity, determine the effectiveness of our Services, and improve them. Geolocation Data: As described above, we automatically collect your IP address when you use our Services. We may be able to determine your general location based on the IP address. We use this information to measure activity and determine the effectiveness of our Services and improve them. Inferences drawn to create a profile about a consumer reflecting the consumer’s preferences or characteristics: As described above, we may combine information that we receive from or about you with information that we receive from publicly available or commercial sources. We analyze and use this information to manage and tailor Services that you request, measure the appeal and effectiveness of our Services, and improve our Services. We do not collect any of the following information about you: commercial information; biometric information; audio, electronic, visual, thermal, olfactory, or similar information; or professional or employment-related information. We may use any of the categories of information listed above for other business or operational purposes compatible with the context in which the Personal Information was collected. We may share any of the above-listed information with Service Providers, as described above. Service Providers are restricted from using Personal Information for any purpose that is not related to our engagement. The types of Service Providers with whom we share information and the services they provide are described in the above section titled “Sharing of Information.” Right to Know About Personal Information Collected, Disclosed, or Sold. You have the right to request that we disclose to you the Personal Information we collect, use, disclose, or sell. Our collection, use, disclosure, and sale of Personal Information is described in our Privacy Policy above. Right to Know/Access Information. You have the right to request access to Personal Information collected about you and information regarding the source of that information, the purposes for which we collect it, and the third parties and service providers with whom we share it. You may submit such a request as described below. To protect our users’ Personal Information, we are required to verify your identity before we can act on your request. Right to Request Deletion of Information. You have the right to request in certain circumstances that we delete any Personal Information that we have collected directly from you. You may submit such a request as described below. To protect our users’ Personal Information, we are required to verify your identity before we can act on your request. We may have a reason under the law why we do not have to comply with your request, or why we may comply with is in a more limited way than you anticipated. If we do, we will explain that to you in our response. How to Submit a Request. You may submit a request to exercise your rights to know/access or delete your Personal Information through any of the following means: 1. By filling out a Consumer Data Request Form available here. 2. By sending us an email at privacyrequests@kaplan.edu. 3. By calling us at 1-866-523-3473. Verification Procedures. In order to process your request to know/access or delete Personal Information we collect or disclose, we must verify your request. We do this by asking you to (A) provide personal identifiers we can match against information we may have collected from you previously; and (B) confirm your request using the email or telephone account stated in the request [and (C) submit a signed declaration under penalty of perjury that the you are the consumer whose personal information is the subject of the request]. Authorized Agent. You may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf. Before complying with the request, we require that you independently verify your identity directly with us. Right to Opt Out of Sale of Personal Information to Third Parties. You have the right to opt out of any sale of your Personal Information by Kaplan Higher Education. We do not sell information to third parties. Right to Information Regarding Participation in Data Sharing for Financial Incentives. You have the right to be free from discrimination based on your exercise of your CCPA rights. We do not discriminate against anyone who chooses to exercise their CCPA rights. Changes to Our Privacy Policy We may update this Privacy Policy from time to time without prior notice to reflect changes in our information practices. Any changes to the Privacy Policy will become effective when posted. We recommend that you revisit this Privacy Policy periodically to ensure that you are aware of our current privacy practices. Your continued use of the Services following the posting of changes will mean that you accept the updated Privacy Policy. How to Contact Us If you have any questions about this Privacy Policy or our information-handling practices, please contact us by email as follows: privacy@Kaplan.edu. We are not responsible for the privacy practices of third parties, which are subject to their respective privacy policies. © 2021 Kaplan Higher Education | Privacy Policy