SLM Education Services Privacy Policy

Last Updated: November 19, 2024

1. INTRODUCTION

This Privacy Policy (“Privacy Policy”) contains details about how SLM Education Services, LLC (“SLM Education Services,” “we,” “us,” or “our”) collects, uses, stores, discloses, and otherwise processes certain information, including your personal information.

This Privacy Policy covers our collection of your personal information from: (i) the SLM Education Services website www.sallie.com, and any other website, platform, or mobile application that we operate and that links to this Privacy Policy (collectively, the “Sites”); (ii) advertising services; (iii) emails or newsletters we sponsor or send; (iv) contests, sweepstakes, promotions, events, research and surveys that we sponsor or conduct; (v) accounts on third-party social networking sites; and (vi) other content, products, and services that we make available to users (collectively, the “Services”). Our Services also include any interactive features, widgets, plug-ins, applications, chatbots, content, downloads and other online or offline services that we own and control, and in each case wherever this Privacy Policy is posted or referenced. Finally, this Privacy Policy describes SLM Education Services’ collection and processing of non-public personal information about consumers, customers, and former customers that may be subject to the Gramm-Leach-Bliley Act (“GLBA”). For further information about those practices and rights that may be available to you under the GLBA, please review the Consumer Privacy Notice.

Importantly, this Privacy Policy does not apply to Sallie Mae Bank’s collection and processing of your personal information, including Sallie Mae Bank’s collection and processing of non-public personal information pursuant to the GLBA. Sallie Mae Bank’s GLBA Privacy Notice covers non-public personal information it collects about individuals who apply for or obtain financial products and services for personal, family, or household purposes, including when applying for or obtaining private student loans through Sallie Mae Bank’s websites or mobile applications, or inquiring about such products, and Sallie Mae Bank’s Privacy Policy covers other information Sallie Mae Bank collects.

This Privacy Policy also does not apply to any third-party websites, services, products, or mobile applications maintained by other companies or entities, which may be linked from our Sites or Services.

2. SOURCES OF PERSONAL INFORMATION

In this Privacy Policy, the term “personal information” refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, as well as to information defined as “personal information,” “personal data,” “nonpublic personal information,” “personally identifiable information,” and other similar terms under applicable privacy laws.

The personal information that we collect varies depending upon your use of our Services and our interactions with you. In certain circumstances (e.g., to enter a sweepstakes or submit an inquiry), you must provide us with certain personal information, and if you don’t, we may not be able to provide you with the requested product, service, or information. We may share information between our affiliates (financial and nonfinancial) under common ownership or control. We may also combine information collected from one source with information collected in other contexts and use such combined information in accordance with this Privacy Policy and any other privacy policies that may apply.

We, and others on our behalf, collect personal information from the following sources:

3. WHAT PERSONAL INFORMATION DO WE COLLECT?

The categories of personal information we may collect are outlined below:

Categories of Personal Information

1. Identifiers and contact information, including name, username, phone number, address, billing address, email address, IP address, MAC address, cookie ID, GUID, device ID, third-party platform identifiers and other online or unique identifiers.

2. Personal Records, including account and profile information, user records that contain personal information, such as name, signature, address, telephone number, education, and financial information.

3. Personal Characteristics or Traits, including age or date of birth, marital status, sex, or veteran or military status.

4. Transaction / Commercial Information, including products or services used, purchased, or considered; products or services considered from third parties, including third-party partners and technology companies that offer digital advertising services; and other purchasing or consuming histories or tendencies.

5. Internet or other Electronic Network Activity / Usage Data, including browsing history, clickstream data, search history, access logs, information regarding your interactions with the Services and our marketing emails, newsletters, and online ads, and other usage data related to your use of the Services, such as language and preferences, statistics, click paths, preferences and friends, as well as your comments, posts, and interactions in any forums and communities.

6. Geolocation Data, including when we may infer your rough location (such as zip code, phone number, IP Address or MAC Address) as part of the Services, and device location information for mobile users.

7. Audiovisual and Similar Information, including photographs, videos, and images (e.g., that you provide us or post to your profile), and call recordings (e.g., of customer support calls).

8. Professional or Employment Information, including your title, affiliated organization, professional expertise and experience, or education-related information.

9. Non-public Education Records, including education transcripts you may upload yourself into your scholarship search account.

10. Inferences from Personal Information, including information we collect about you that we combine and use to derive other information and inferences about you. This includes inferences drawn from other personal information that we collect or are provided to create a profile based on your account and activities, that reflect your preferences, characteristics, behavior, attitude, and abilities.

11. Sensitive Information, including government-issued identification numbers (e.g., Social Security numbers and driver’s license information), account information and passwords, sexual orientation, religious or philosophical beliefs, union membership, and information regarding race, ethnicity, health, and precise geolocation.

4. HOW DO WE USE YOUR PERSONAL INFORMATION?

We may use your personal information for any of the following purposes:

• Processing transactions and providing our products and services – to process transactions, service accounts and provide you with information or services or to perform activities that you have requested or information you agreed to receive or to provide you with special offers or materials on behalf of us, our affiliates, or certain third parties that may be of interest to you.
• Support, maintenance and fulfillment – to provide, maintain, and improve the Services (including building correlations for use in our advertising services in order to better serve our advertisers and third-party partners or business customers), to process and fulfill your requests or applications, and to develop new products, services, features and functionalities.
• Customizing your experience, offers, and content – to enhance your experience using our Services and the products we offer, you may be delivered curated content and recommendations on our Services, including marketing for our own products or offerings, our affiliates’ products or offerings, or those of our third-party partners or business customers such as scholarship providers, financial services providers, and other companies.
• Registering and administering accounts – to process your registration with the Sites, verify your information is active and valid, and to manage your account.
• Customer service and communications – to respond to questions, comments, or requests that you have for us or for other customer service purposes, to contact you with regard to your use of the Services and, in our discretion, changes to the Services and/or Services’ policies, and to verify eligibility for certain services offered by us, our affiliates, our third-party partners, or our business customers. We use your information to communicate with you, including sending you service information such as confirmations, invoices, notices, updates, security alerts, user surveys, and support and administrative messages. This includes communication with you via telephone calls, text messages, and email.
• Research, development, and analytics – for beta testing our products and services or to better understand how users access and use our Services, both on an aggregated and individualized basis, in order to improve our products and services, respond to user desires and preferences, and for other research and analytical purposes. We also use your information to measure performance and analyze key metrics relevant to our business and Services, and to administer surveys and questionnaires, including for market research.
• Advertising services, measurement and administration – to show you ads (including targeted or personalized ads on behalf of us, our affiliates, and other third parties) through the Services and on third-party websites, mobile apps, platforms, and devices. We use your information to measure and understand the reach, viewership, and effectiveness of advertising, to help us determine where to place ads, and to provide advertising analytics and reporting. We also use information to help us, our affiliates, third-party partners, business customers, and advertising partners create segments, reach the desired audience and understand, measure, and improve their ad campaigns. We use your information to reach you with more relevant ads and to evaluate, measure, and improve the effectiveness of our ad campaigns, send you newsletters, offers, or other information we think may interest you, to contact you about our Services or information we think may interest you, and to administer promotions and contests.
• Marketing and Promotions – for marketing purposes, including to send you alerts, notifications, emails, and text messages, about products, events, promotions, and offers from us or our third-party partners or business customers, and to measure and understand the effectiveness of our marketing. Additionally, we may communicate with you now or in the future by sending emails that include content from our blog, information about promotions, and details about products and services that may interest you. This may also include third-party promotions and third-party products and services.
• Safety, security, and compliance with legal obligations – for identity verification, the prevention, detection, investigation, and mitigation of illegal or unauthorized activities, fraud, injury to us, our users or others, or violation of our Terms of Use or this Privacy Policy (including click fraud), as well as to fulfill contractual, legal, and regulatory requirements.
• Disclosed and additional compatible purposes – for purposes disclosed at the time you provide your personal information and other purposes that are compatible with the purpose of collecting your personal information and that are not prohibited by law, including for our legitimate business interests, such as in protecting, maintaining, and improving the Services, and developing new features and services.
• Business transactions – for purposes related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, bankruptcy, or restructuring of all or part of our business.
• Fulfilling any other purpose for which you give your consent.

We may also de-identify or aggregate information and use and disclose such information for any purpose permitted by law, including sharing it with third parties for their own uses. Where we process de-identified information, we maintain and use it in de-identified form and do not attempt to reidentify the information, except in accordance with applicable privacy laws.

5. TO WHOM DO WE DISCLOSE YOUR PERSONAL INFORMATION?

We may disclose the personal information listed above to the following types of third parties:

• Our affiliates, for the purposes described above, including for marketing purposes.
• Our vendors and service providers, for various purposes, including helping us provide our products, services and customer support to you, such as support for the internal operations of our Services (e.g., operations and technical support processing), communicating with you, and collecting information through Tracking Technologies, as well as related offline product support services, data storage, and other services. In providing their services, vendors and service providers may access, receive, collect, maintain, or otherwise process personal information on our behalf.
• Joint marketing partners, including financial institutions with whom we have joint marketing agreements and service providers that perform marketing services on our behalf, and on behalf of us and other financial institutions.
• Third-party partners and business customers, including those with which we partner or provide services to provide contests, scholarships, or co-branded services, or that want to market to you or otherwise provide you with special offers or materials regarding products or services that may be of interest to you. We may also enter into agreements with third parties to sell or license information to them for their own purposes.
• Third-party platforms, sites, and services, including third-party ad networks, advertisers, analytics providers, social networks, Internet service providers, channel partners, measurement services, data aggregators or suppliers, and others, to help us personalize, display, and measure advertising within our Services and on third-party sites, mobile apps, and online services, as described further in “Tracking Technologies and Targeted Advertising” below. We and these third-party companies may use Tracking Technologies to collect information within our Services and on third-party sites and services, as well as IP address, location information, device ID, cookie and advertising IDs, and other identifiers. Personal Information received by these companies may also be subject to their privacy policies. These parties may act as our service providers, or in certain contexts, may independently decide how to process your information.
• Universities, colleges, professional schools, certificate and licensing programs, and other education providers, for the purposes described above, including for marketing purposes.
• Government agencies, to the extent reasonably necessary to fulfill legal and regulatory requirements or comply with federal, state, or local laws, or to comply with civil, criminal, or regulatory investigations.
• Other third parties, if we reasonably believe that such disclosure is reasonably necessary to (a) comply with legal requirements, including reasonable requests of law enforcement, (b) to enforce our Terms of Use, defend claims, or to protect the security or integrity of our Services, services, databases, and other technology assets, and business, or (c) to exercise or protect the rights, property, or personal safety of us, our customers, visitors, or others.
• The public, for example, when we post the names of scholarship or sweepstakes winners on our Sites.
• Third parties in relation to a proposed or completed transfer, sale or merger of all or part of us or our affiliates, whether through a sale, acquisition, merger, consolidation, reorganization, bankruptcy, or other corporate change involving us or our affiliates.

6. TRACKING TECHNOLOGIES AND TARGETED ADVERTISING

Tracking Technologies

We collect certain usage information through a variety of tracking technologies, including cookies, web beacons/pixel tags, server logs, file information, SDKs and mobile advertising IDs, session replay technology, our interactive chat functionality, and other similar tools and technologies (collectively, “Tracking Technologies”), and we may use third parties, including social media platforms, analytics companies, data brokers, third-party advertisers, and other technology companies that offer digital advertising services, to collect information using Tracking Technologies. By using the Services, you consent to the collection of this information via these technologies.

Information collected using Tracking Technologies includes information described in the “What Personal Information Do We Collect” section above. We may disclose, or we may permit third parties to collect, personal information about your use of our Services over time, to provide and enhance the performance of the Services, facilitate user experience, monitor and analyze trends, conduct internal research and development, and for debugging, fraud prevention, and session management. We and these third parties may also use information collected through Tracking Technologies for personalization, analytics, and targeted advertising on or through the Services and third-party websites, apps, and platforms. For example, we or third parties may use information collected through Tracking Technologies to display ads and content that may be relevant to your interests on our Sites as well as on other websites or apps, or on other devices you may use. We or third parties may also collect and use such information to analyze and evaluate the success of such ads. Similarly, we or third parties may use e-mail tracking technologies to monitor the success of e-mail campaigns.

Depending on your browser or mobile device, you may be able to control the way in which your browser or device permits the use of Tracking Technologies. For example, if you choose, you may block or delete cookies from your browser or take steps to limit cross-site tracking. In addition, if you wish to prevent your information from being used by Google Analytics, Google has developed the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout/. Please keep in mind, however, that if you delete or block cookies, the Site or Services may not function properly.

If you would like to learn more about the use of information for targeted advertising, and to opt out of targeted advertising from companies that participate in industry opt-out programs, please use the links set out directly below. Even if you opt out, you still may receive advertising from us that is not customized or advertising from other third parties if they are not a participating company.

• Network Advertising Initiative: http://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance: https://optout.aboutads.info/?c=2&lang=EN
• AppChoices: https://www.youradchoices.com/appchoices

Depending on where you live, you may have other choices relating to Tracking Technologies and targeted advertising, described further in the “Privacy Rights” section below.

Session Replay Technology

We use third-party session recording and replay technology to observe your mouse movements, scrolling, and clicks on our websites. This involves the use of third-party cookies and other tracking technologies. We use these tracking tools for support and analytics purposes, and to better understand how people engage with our websites (e.g., pageviews, clicks, inputs, tap and mouse clicks, scrolls and swipes, long loading spinners, session time, rage clicks, frequent refreshes, site errors, JS errors, etc.). This also enables us to build and maintain the Services with user feedback. This information is often collected and processed by our vendors whom we have engaged to analyze this information on our behalf.

7. LINKS TO THIRD-PARTY WEBSITES AND SERVICES

Our Services may permit you to access third-party websites directly that we do not own or control. It is important to remember that if you link to a third-party website from our Services, that third-party’s privacy policy and its terms and conditions of use apply to you. We encourage you to learn about each third-party’s privacy policy before sharing your personal information with them. We are not responsible for the privacy practices or the content of the sites to which we link, including their collection and use of your information by these third-party sites.

In addition, our Services and/or Sites may include or incorporate social media and other third-party features (e.g., widgets, buttons, and plugins), which are operated by third parties, such as educational institutions, Facebook, Steam, Twitch, Twitter, Instagram, YouTube, and others. These features are hosted by the respective third-party operator even though they appear on our Services or Sites, and the third-party may collect your IP address, URL, date and time stamp, browser details, and the like, subject to their own privacy policies.

If you provide your personal information on a co-branded page, your personal information may be shared with the third-party partner. Please review the third-party partner’s privacy policy and terms of use prior to providing any personal information. If you have any questions regarding the privacy policies of our third-party partners or business customers, please contact the third party directly using the channels provided by the third party.

8. CHILDREN’S PRIVACY AND MINORS

Children under the age of 13 are not permitted to use the Services, and we do not seek or knowingly collect any personal information about children under 13 years of age. If we become aware that we have unknowingly collected information about a child under 13 years of age, we will make commercially reasonable efforts to delete such information. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

9. PROTECTION OF INFORMATION

We take a variety of physical, technical, administrative, and organizational security measures to protect against possible security incidents and, taking into account the sensitivity of the information we collect, to protect your personal information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure, or access. Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services, Sites, or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

10. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Your personal information may be stored and processed in the United States or any other country in which we or service providers maintain facilities. While our Sites are only intended for users in the United States and we do not intentionally market to individuals outside of the United States, if you are located outside the United States (e.g., in the European Union), those countries have laws and regulations governing data protection, security, collection and use that may differ from data protection laws in the United States. Please note that we or third parties on our behalf may transfer personal information to a country that does not have the same data protection laws as your jurisdiction.

11. RETENTION OF PERSONAL INFORMATION

We may retain information as required or permitted by applicable laws and regulations, including to honor your choices, for our billing or records purposes and to fulfill the purposes described in this Privacy Policy. We may retain information for our legitimate interests and essential business purposes, such as operating, maintaining, and improving our Services; complying with our legal obligations; and exercising our legal rights and remedies, including enforcing our Terms of Use. Our retention of information is based on many factors, such as your relationship with us, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims.

12. UPDATES

This Privacy Policy is current as of the Effective Date set forth above. We may modify this Privacy Policy from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Policy. If we make material changes to the way in which we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Sites or Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

13. CONTACT US

If you have any questions or comments about this Privacy Policy or our privacy practices generally, you are welcome to contact us at:

Customer Privacy
SLM Education Services, LLC
P.O. Box 3319
Wilmington, DE 19804-4319
(855) 364-3119

You may also contact us via email at: privacy@sallie.com or go to www.sallie.com/legal/privacy.

SLM Education Services Consumer Privacy Notice

Rev. 11/2024

14. CALIFORNIA AND OREGON RESIDENTS

This section supplements the other sections of this Privacy Policy and applies to you only if you are a California or Oregon resident. However, please note that this section does not apply to, nor does it describe, personal information that is exempt from the California Consumer Privacy Act (“CCPA”) or Oregon Consumer Privacy Act (“OCPA”) such as information subject to the Fair Credit Reporting Act or the GLBA. For purposes of this section, references to “personal information” shall include “sensitive personal information,” as defined under the CCPA and OCPA.

Processing of Personal Information

In the preceding 12 months, we have collected personal information, and where indicated in the table below, we may have disclosed such personal information for a business purpose.

SLM Education Services “sells” and “shares” personal information as those terms are defined by the CCPA, and over the preceding 12 months has sold or shared the categories of personal information, including sensitive personal information set out in the table below for:

• Advertising and marketing purposes, including to serve targeted advertising or cross-context behavioral advertising;
• Our business customers and other third parties, including educational institutions, to pursue enrollment leads; and
• The business purposes of advertisers, business customers, and other third-party partners.

We do not have actual knowledge that we “sell” or “share” personal information of residents under 16 years of age.

The specific business or commercial purposes for which we collect and disclose your personal information and the categories of sources from which we collect your personal information are described in the sections above, “Sources of Personal Information, “How Do We Use Your Personal Information,” and “To Whom Do We Disclose Your Personal Information.” The criteria we use to determine how long to retain your personal information is described in the section above, “Retention of Personal Information.”

Notice of Financial Incentive

We offer certain programs, benefits, and other offerings that may be deemed a “financial incentive” under applicable U.S. Privacy Laws. Examples of the programs that we offer include sweepstakes, contests, promotions, and email/text message alert programs. These offerings may involve the collection of the following categories of personal information from individuals who participate: identifiers, personal records, personal characteristics or traits, education information, transaction/commercial information, and Internet usage information. Participation in these programs is voluntary, and no purchase is required.

While we cannot calculate the precise value of your information, our programs generally reflect the value of the relationships that we have with the individuals who participate in them. Participation in these programs is governed by this Privacy Policy, the Official Rules, and our Terms of Use. You may cancel or terminate your participation in these programs by following the instructions in the email, text message notification, or applicable rules, or contacting us using the information above in the Contact Us section.

Privacy Rights

As a California or Oregon resident, you may have the following rights in relation to your personal information. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. For example, these rights are not available in relation to personal information that is exempt from the CCPA or OCPA, such as information subject to the Fair Credit Reporting Act or the GLBA.

• Right to Know / Access. You may have a right to request certain information about our collection, use, and disclosure of your personal information, including:
• Categories of personal information we have collected, disclosed for a business purpose, sold, or shared;
• Categories of sources from which we collected personal information;
• The business or commercial purposes for collecting, selling, and/or sharing personal information;
• Categories of third parties to whom the personal information was disclosed for a business purpose, sold, or shared;
• A list of the specific third parties with whom we disclose any personal information; and

• Specific pieces of personal information we have collected.

  You may also have the right to request a copy of the personal information we collected about you.
  
  
• Right to Delete. You may have a right to request that we delete personal information we maintain about you.
• Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
• Right to Limit. You may have a right to direct us to limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the Services or as otherwise permitted by applicable law, including the CCPA.

We may need to collect information from you to verify your identity, such as your email address, full name, government issued ID or date of birth, before providing a substantive response to the request. Depending on the nature of the request and whether we have the email address you have provided in our systems, we may request further information from you in order to verify that you are the individual making the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

To request to exercise these rights, please submit your request to us by visiting our Privacy Rights Request Form or by calling us at 833-618-0661.

You may also have additional rights to opt out of our “sale” or “sharing” of your personal information to certain third parties, or to opt out of our processing of personal information for targeted advertising purposes.

• Opt Out of Selling/Sharing/Targeted Advertising. To opt out of the sale or sharing of your personal information, or the processing of your personal information for targeted advertising, visit our opt out page: Your Privacy Choices
• Opt Out Preference Signals. Your browser settings may allow you to transmit a “do not track” signal, “opt out preference” signal, or other mechanism for exercising your choice regarding the collection of your information when you visit various websites. Consistent with applicable law, when we recognize a Global Privacy Control (“GPC”) signal from a browser, our Sites are designed to treat the browser as opted-out and, depending on your state of residency, to stop selling your personal information, sharing your personal information and/or processing your personal information for targeted advertising. GPC is limited to the browser that you use, meaning that you may need to opt out on each browser and device you use. When you log into your account, the opt-out through GPC will extend to your account as well. If you do not have an account or are not logged into your account, your request to opt out through the GPC will not apply to any account information. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org.
•  Ad Industry Tools. You can also opt out of targeted advertising from companies that participate in industry opt-out programs, as described above in the “Tracking Technologies and Targeted Advertising” section above.

We will not discriminate against you for exercising any of these rights. If we deny your request to exercise one of the rights listed above, depending on your state of residency you may appeal our decision by contacting us via the information provided in the “Contact Us” section.

Additional Disclosures for California Residents

California law permits residents to request certain details about how their “personal information” (as defined in California Civil Code Section 1798.83) is shared with third parties for their direct marketing purposes. We may from time to time elect to share certain personal information about you with third parties for those third parties’ direct marketing purposes. Individuals may, under certain circumstances, obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year. To make such a request, please contact us using the information listed above. Please note that we are only required to respond to one request per individual each year.

Any California residents under the age of eighteen (18) who have registered to use the Services and who have posted content or information on the Services can request that such information be removed from the Services by contacting us at the e-mail or address set forth in the section above, Contact Us. Such request must state that they personally posted such content or information and detail where the content or information is posted. We will make reasonably good faith efforts to remove the post from prospective public view or anonymize it so the individual cannot be individually identified. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished the post, and archived copies of it may be stored by search engines and other parties that we do not control.