PrivacyPolicy

Effective Date: July 25, 2025

Last Updated: July 25, 2025

1. ORGANIZATIONAL COMMITMENT TO PRIVACY

Borel Educational Consulting Services ("Borel," "we," "us," or "our") is committed to protecting the privacy and security of personally identifiable information (PII) of all learners, participants, and users in accordance with the ANSI/IACET 1-2018 Standard for Continuing Education and Training. This Privacy Policy establishes our comprehensive framework for the collection, use, storage, protection, and disposal of personal information in connection with our continuing education and training services.

1.1 Scope and Authority

This policy applies to all personally identifiable information collected, processed, stored, or transmitted by Borel Educational Consulting Services in connection with:

Continuing education and training programs
IACET CEU-eligible learning events
Learner registration and record management
Assessment and certification processes
All digital platforms and services operated by Borel

1.2 Responsibility and Control

The Chief Data Protection Officer (cdb@borelonline.com) maintains ultimate responsibility for privacy policy implementation, compliance monitoring, and incident response. All staff members are required to complete annual privacy training and adhere to established data handling protocols.

2. LEARNER RECORDS AND EDUCATIONAL PRIVACY

2.1 Educational Records Definition

Educational records include any record directly related to a learner and maintained by Borel Educational Consulting Services, including but not limited to:

Registration and enrollment information
Assessment results and grades
Attendance records
CEU transcripts and certificates
Learning outcomes documentation
Progress tracking data

2.2 Privacy Rights of Learners

In accordance with ANSI/IACET 1-2018 Standard Category 8 (Awarding the IACET CEU and Maintaining Learner Records), learners have the right to:

Access their educational records
Request corrections to inaccurate information
Understand how their information is collected and used
Receive notification of any data security incidents
Request restriction of information sharing (subject to legal limitations)

2.3 Record Retention Requirements

Learner records shall be maintained for a minimum of seven (7) years following completion of the learning event, or longer as required by applicable law or accreditation standards. Records may be maintained in electronic or physical format, subject to appropriate security controls.

3. INFORMATION COLLECTION AND CLASSIFICATION

3.1 Categories of Personal Information Collected

Learner Registration Information:

Name, address, email, telephone number
Professional credentials and affiliations
Educational background
Employment information

Learning Activity Data:

Course enrollment and completion status
Assessment scores and learning outcomes
Attendance and participation records
CEU awards and certificates

Technical Information:

IP addresses and device identifiers
Browser type and operating system
Website usage patterns and preferences
Learning management system interactions

3.2 Information Sensitivity Classification

All personally identifiable information is classified according to sensitivity levels:

High Sensitivity: Assessment results, grades, disciplinary records, financial information

Medium Sensitivity: Contact information, employment data, learning preferences

Low Sensitivity: General demographic information, program participation

3.3 Sources of Information

Information is collected from:

Direct learner input during registration and participation
Automated collection through learning management systems
Third-party educational partners (with appropriate agreements)
Public records where relevant to educational purposes

4. DATA SECURITY AND PROTECTION MEASURES

4.1 The Four "E's" of Data Security

ENCRYPT: All sensitive personally identifiable information is encrypted both in transit and at rest using industry-standard encryption protocols (minimum AES-256).

ELIMINATE: Data that is no longer necessary for educational, legal, or accreditation purposes is securely deleted according to established retention schedules.

EDUCATE: All personnel receive annual training on privacy policies, data handling procedures, and security incident response protocols.

ENFORCE: Access controls, monitoring systems, and compliance auditing ensure adherence to privacy policies and prompt detection of violations.

4.2 Technical Safeguards

Multi-factor authentication for system access
Role-based access controls with principle of least privilege
Regular security assessments and vulnerability testing
Encrypted data transmission (SSL/TLS)
Secure backup and disaster recovery procedures

4.3 Administrative Safeguards

Written information security policies and procedures
Regular staff training and awareness programs
Incident response and breach notification procedures
Vendor management and third-party agreements
Regular policy review and updates

4.4 Physical Safeguards

Secure facilities with controlled access
Locked storage for physical records
Secure disposal of hardware and documents
Environmental controls for data centers

5. INFORMATION USE AND DISCLOSURE

5.1 Educational Purposes

Personal information is used to:

Deliver continuing education and training programs
Assess learning outcomes and award CEUs
Maintain accurate educational records
Communicate with learners regarding programs
Improve educational services and curriculum

5.2 Authorized Disclosures
Information may be shared without consent in the following circumstances:

To educational officials with legitimate educational interests
To accrediting bodies for compliance purposes
To government agencies as required by law
In response to valid legal process (subpoenas, court orders)
To protect health and safety in emergency situations

5.3 Third-Party Service Providers
When engaging third-party vendors for educational technology, data processing, or other services, Borel ensures:

Written agreements governing data protection
Vendor compliance with applicable privacy laws
Regular monitoring of vendor security practices
Notification requirements for data incidents

5.4 Marketing and Communications
Learners may opt out of promotional communications while continuing to receive essential educational notices. Marketing communications are governed by applicable laws (CAN-SPAM, GDPR where applicable).

6. LEARNER RIGHTS AND PROCEDURES

6.1 Access Rights

Learners may request access to their educational records by contacting the Chief Data Protection Officer. Requests will be processed within 45 days, and records will be provided in an accessible format.

6.2 Correction Procedures
Learners who believe their records contain inaccurate information may request corrections by providing:

Written request specifying the alleged inaccuracy
Supporting documentation
Preferred correction

6.3 Directory Information

The following information may be designated as directory information (subject to opt-out rights):

Name and contact information
Program participation
Dates of attendance
CEUs earned

6.4 Complaint Procedures

Privacy concerns or complaints may be submitted to:

Chief Data Protection Officer: cdb@borelonline.com
IACET (for accreditation-related matters)
Applicable regulatory agencies

7. INTERNATIONAL PRIVACY CONSIDERATIONS

7.1 Cross-Border Data Transfers

Our services are hosted in the United States. International learners acknowledge that their information will be transferred to and processed in the United States, where privacy laws may differ from their home country.

7.2 GDPR Compliance

For European Union residents, we provide additional protections including:

Legal basis for processing
Enhanced consent mechanisms
Right to data portability
Right to be forgotten (subject to educational record requirements)

8. INCIDENT RESPONSE AND BREACH NOTIFICATION

8.1 Security Incident Response

In the event of a suspected privacy or security incident:

Immediate containment and assessment procedures are activated
Affected individuals are notified within 72 hours when feasible
Regulatory notifications are made as required by law
Post-incident review and corrective action implementation

8.2 Notification Procedures

Breach notifications include:

Description of the incident
Types of information involved
Steps taken to address the breach
Recommendations for affected individuals
Contact information for inquiries

9. CHILDREN'S PRIVACY

We do not knowingly collect personal information from children under 13 years of age. If we discover that we have inadvertently collected such information, it will be promptly deleted. Parents or guardians who believe we have collected information about a child under 13 should contact us immediately.

10. TECHNOLOGY AND COOKIES

10.1 Website Technologies

Our websites and learning platforms use cookies and similar technologies to:

Maintain user sessions and preferences
Analyze website usage and performance
Provide personalized learning experiences
Enable essential website functionality

10.2 Analytics and Tracking

We use analytics services to understand how our educational services are used and to improve the learning experience. Learners may opt out of analytics tracking through browser settings or platform preferences.

11. POLICY UPDATES AND COMMUNICATION

11.1 Policy Review

This Privacy Policy is reviewed annually and updated as necessary to reflect: