New Meridian Corporation
PLATFORM & ASSESSMENT PRIVACY POLICY

Introduction

New Meridian Corporation (“New Meridian,” “we,” “us,” or “our”) respects your privacy and makes the security and integrity of the data we collect a top priority. As part of our commitment to data privacy, we developed this Platform & Assessment Privacy Policy (“Policy”) to explain how New Meridian collects, uses, shares, and protects the information you provide to us in the course of our assessment services and your rights with respect to such information.

This Policy applies to information we collect or receive through our assessment products and proprietary assessment platform.

Summary

• We only use the data collected through our platforms and products to deliver and improve our assessment services.
• We do not sell any student/examinee data or use such data for targeted advertising.
• We comply with applicable federal, state, and international laws governing data privacy, including the Family Educational Rights and Privacy Act (FERPA), and the Children’s Online Privacy Protection Act (COPPA).
• We protect your data using industry-standard security tools and processes.

Definitions

“COPPA” means the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501-6505, and the regulations promulgated thereunder, each as amended.

“Customer” means an institution or professional who licenses Services, such as states, school districts, schools and educational agencies.

“Customer Personnel” means employees, staff, contractors, agents, and other authorized representatives of our Customers, such as administrators, authorized account holders, staff and teachers.

“FERPA” means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and the regulations promulgated thereunder, each as amended.

“Personal Information” means information that, either alone or in combination with other information, identifies or relates to an individual.

“Platform” means New Meridian’s proprietary Waypoint® web-based platform for assessment, scoring, and reporting.

“Products” means New Meridian’s educational assessments.

“Services” means the Platforms and Products.

“Students/Examinees” means individuals who either directly use New Meridian’s Services or whose information New Meridian collects in the course of providing Services.

Additional defined terms are identified throughout the rest of this Policy.

Types of Personal Information We Collect and Use

In providing the Services, we may request Personal Information from you or other individuals affiliated with the Customer sponsoring your use of the Services, including Students/Examinees. The exact Personal Information we need to collect depends on which Service you are using and the optional data fields you or the Customer sponsoring your use of our Services chooses to provide. Our Services may collect three broad categories of Personal Information:

• Student/Examinee information, including assessment responses, first name, middle name, last name, email, date of birth, gender, grade, race, ethnicity, language, school/building code, local ID, student identification number, IEP/IFSP status, 504 program status, Title I status, free or reduced lunch status, gifted and talented status, English language learner status, migrant status, country, enrollment date, disability, additional identification numbers, braille user, home reporting, program code, and active user status.
• Customer and Customer Personnel information, including organization name, customer address (city, state, zip code, and country), and, with respect to customer personnel (e.g. school officials, test administrators, teachers, proctors) first name, middle name, last name, title, email address, phone number, fax, employee identification number, username/ID, grade, district/area, class name/code, role/permissions, and active user status.
• Usage information, including IP addresses, and device, browser, and operating system identifiers.

How We Collect Personal Information

We may collect the foregoing types of Personal Information through your use of the Services in the following manner:

• Submitting or importing files for the purposes of completing assessment enrollments.
• Receiving roster data and related information from third-party service providers for the purposes of completing assessment enrollments.
• Hand keying data for the purposes of completing assessment enrollments.
• Hand keying item responses and test raw scores for the purposes of creating derived test statistics.
• Collection of answer strings – for tests administered online, we collect submitted assessment data electronically throughout the course of an assessment.
• Audio and video recordings of assessment sessions for Services that support such features.
• Collection of usage data – on some of our webpages, we collect usage information relating to computer, browser, and internet specifications through technology such as temporary cookies, persistent identifiers, and Google Analytics. The collection of usage information takes place while assessments are in progress and on some webpages when Customer Personnel engage with our Platforms’ assessment management activities (e.g., test administration and reporting). Most browsers provide you with the ability to block, delete, or disable cookies, and your mobile device may allow you to disable transmission of unique identifiers and location data. Please note, however, that disabling cookies in certain cases may prevent you from accessing the Services because, as detailed below, temporary cookies allow us to validate testing sessions. Cookies in place during an assessment session are deleted once you close your browser. For information regarding how Google Analytics collects, uses, and shares your personal information, please visit: https:///www.google.com/policies/privacy/partners/. To prevent data from being used by Google Analytics, you can download the opt-out browser add-on at: https://tools.google.com/dlpage/gaoptout?hl=en.
• Some of our third-party service providers may use cookies or other methods to gather usage information regarding your use of the Services. The use of such tracking information by a third party depends on the privacy policy of that third party. We review these third-party privacy policies and strive to only engage with third parties whose data privacy practices are consistent with our own. When possible, we encourage you to also review their privacy policies.
• Central scanning – scanning of enrollment data and submitted assessment data gridded onto answer sheets or consumable test booklets.
• Local scanning – localized scanning by Customer Personnel of enrollment data and of submitted assessment data gridded onto answer sheets or consumable test booklets.

How We Use Personal Information

The primary use of any Personal Information we collect from you is to communicate assessment measurements and reports.

In addition, we may use Personal Information for the following purposes:

• To communicate with Customer Personnel about the assessments and assessment management features available through our Platforms, including improvements to these features.
• To communicate with Customer Personnel about transactions with us.
• To communicate with Customer Personnel about Service availability and downtime.
• To provide data and feedback on the functionality and features of our Services and where applicable:
  • To personalize our Platform content and experiences for users according to their roles on the Platform.
  • To provide maintenance and support upon request.
  • To detect, investigate, and prevent activities that may violate laws or this Policy.
  • To administer and make improvements to the Services, enhance security, and conduct statistical analysis.

Under no circumstances will New Meridian sell any Personal Information of a Student/Examinee or Customer Personnel or use such Student/Examinee or Customer Personnel Personal Information for targeted marketing. Any sale of Personal Information would only occur in the context of a transaction described below in Organizations Involved in Mergers and Acquisitions Transactions.

Disclosure of Personal Information

We will not disclose Personal Information except as set forth in this Policy or with your consent. This section describes to whom we disclose Personal Information and for what purposes:

Our Service Providers

We employ reputable service providers to assist us in providing aspects of our Services. A service provider is a third party engaged by New Meridian who has or may have access to Personal Information for the purpose of helping us provide our Services to you. For example, we may engage third parties to provide hosting services, security, customer communications, user and data subject rostering, user onboarding, and customer service (including online chat). These service providers may have access to some of your Personal Information only if they are performing specific tasks on our behalf. We take commercially reasonable steps to interact or contractually engage with service providers that have adopted a privacy policy governing their processing of Personal Information that is consistent with this Policy.

If you would like to review a list of our current service providers, please see our List of Subprocessors.

Organizations Involved in Mergers and Acquisitions Transactions.

If we sell or otherwise transfer some or all of our business or assets to another organization (e.g., in the course of a merger, acquisition, sale of assets, bankruptcy, dissolution, liquidation), any information collected through our Services, including Personal Information, may be among the items sold or transferred. If the rights and obligations with respect to your Personal Information are assigned to a third-party successor entity, then, with respect to your Personal Information, the successor entity will be subject to the terms of the then-applicable privacy policy or will adopt a privacy policy that is substantially similar in all material respects with this Policy.

Law Enforcement, Government Agencies, and Courts.

We may disclose Personal Information at the request of law enforcement or government agencies or in response to subpoenas, court orders, or other legal processes in order to establish, protect, or exercise our rights; to defend against a legal claim; to protect the rights, property, or safety of another person; or as otherwise required by law. We may also disclose Personal Information to investigate or prevent a violation by you of any contractual or other relationship with us or any alleged illegal or harmful activity by you.

How We Protect Personal Information

We use commercially reasonable safeguards that comply with accepted industry practice in protecting the confidentiality and security of Personal Information, including adherence to standards issued by the National Institute of Standards and Technology (“NIST”). Examples of how we protect your Personal Information include:

• Keeping and maintaining all Personal Information in strict confidence and using such degree of care as is appropriate to avoid unauthorized access, use, modification, or disclosure;
• Deploying industry-standard encryption technology;
• Collecting, using, and disclosing Personal Information solely and exclusively for the purposes for which you provided the Personal Information; and
• Except as otherwise specified in this Policy, or with your consent, not disclosing Personal Information to any person other than our employees, agents, and service providers who have a need to know.

Despite these efforts to store Personal Information in a secure operating environment, we cannot guarantee the security of Personal Information during its transmission or storage in our systems. Further, while we attempt to ensure the integrity and security of Personal Information, we cannot guarantee that our security measures will prevent third parties, such as hackers, from illegally obtaining access to Personal Information. We do not represent or warrant that Personal Information about you will be protected against loss, misuse, or alteration by third parties.

Accessing, Updating, or Deleting Personal Information

Properly authorized Customer Personnel may log into the Platforms to access, update, and delete Personal Information collected by the Services. If you would like to otherwise access, update, or delete Personal Information about the data associated with your account, or to have us complete any of the tasks described in this section on your behalf, you may submit a request to [email protected] We will promptly review all such requests in accordance with applicable law.

Compliance With COPPA and FERPA

Many of our Services are designed for Customer Personnel working with K-12 students. We recognize the sensitive nature of Personal Information contained in educational records concerning children under age 13 and K-12 students generally. This Personal Information is protected under either or both of the following federal statutes: COPPA and FERPA. Our privacy practices comply with both COPPA and FERPA.

COPPA

COPPA permits a school, acting in the role of “parent,” to provide required consent regarding Personal Information of students who are under the age of 13. Where a school is the user of or subscriber to our Services, we rely on this form of COPPA consent. We provide the school with this Policy, to ensure that the school, in providing its COPPA consent, has relevant information and assurance that our practices comply with COPPA.

FERPA

FERPA permits a school to provide educational records (including those that contain students’ Personal Information) to certain service providers without requiring the school to obtain specific parental/guardian consent. FERPA permits this disclosure where the service provider acts as a type of “school official” by performing services, for example, that would otherwise be performed by the school’s own employees. We fulfill FERPA requirements for qualifying as a school official by, among other steps, giving our school district Customers control with respect to the use and maintenance of the education records at issue (including associated Personal Information) and refraining from re-disclosing or using this Personal Information except provided under this Policy.

Children’s Privacy

Except as necessary to provide our Services, we do not knowingly collect or solicit Personal Information directly from anyone under the age of 18 without a parent’s or guardian’s prior consent. The information collected from children under 18 through assessments are intended only with the consent and under the supervision of a parent or guardian, or, in the case of use through an institutional user, with the consent and supervision of such institutional user acting with authority and consent from the parent or guardian. This information is not used for, sold to, or shared with third parties for marketing or commercial purposes.

Other Websites and Services

Our Services may direct you to or integrate with third-party services or websites. As noted above in the subsection Our Service Providers, we exercise commercially reasonable efforts to partner with service providers whose privacy policies governing their processing of Personal Information align with this Policy. We understand that you may want to examine and inquire about our service providers’ privacy practices, and we encourage you to do so.

De-Identified Information

The specific definition of “de-identified information” applicable to you depends on the laws applicable to your data. In general, however, de-identified information is information from which all personal identifiers have been removed or obscured such that it does not identify an individual and there is no reasonable basis to believe that the information can identify an individual.

New Meridian collects and uses aggregated, de-identified information to assess the quality of and improve our Services and for purposes of assessment development, research, and publications relevant to our services and industry. As part of our assessment development efforts, we may share aggregated, de-identified information with reputable third-party development partners, who are considered experts in the field of assessments and subject to strict obligations of security and confidentiality with respect to information they receive from us. These development partners only use the de-identified information we share with them for analysis on our behalf and for purposes permitted under this Policy.

Finally, while assessments are in progress, we use de-identified information in order to authenticate a user’s identity, maintain links between Students/Examinees and their respective proctors during assessment sessions, and update certain features of our Services.

Changes to Our Privacy Policy

We reserve the right to update this Policy at any time. We will post the revised Policy on our Platform, and such changes will be effective immediately unless otherwise stated. If these changes are material, we will provide notice to you through email notifications and/or prominent statements on our website and, where required by applicable law, we will obtain your consent.

Personal Information Transferred from the U.S.

If you are located outside of the United States, please be aware that information we collect, including Personal Information, may be transferred to, and processed, stored, and used in the United States. The data protection laws in the United States may differ from those of the country in which you are located.

How to Contact Us

If you have any questions about this Policy, please email us at [email protected].