Effective Date: July 11, 2023
Welcome to Xello!
“Student Personal Information” means information that may, alone or in combination with other available information, be reasonably used to identify a current or former Student and shall be referred to as “Student Personal Information.” Student Personal Information may include, but is not limited to, FERPA Records.
Users include, each as described and/or defined below, Educators, Students, parents or guardians of a Student (“Parents”), Authorized Administrators, Schools, Ambassadors, Post-Secondary Staff, Work-Based Learning administrators and employers who offer work-based learning.
How We Collect Information
We will collect, use, maintain and share your information as allowed by applicable law.
Information Provided by Schools and Districts and Educators
Schools and Districts that use the Services provide certain information about their students (“Students”), Parents, and teachers, counselors and administrators (“Educators”) to create accounts.
Schools and Districts may provide the following Student Personal Information:
- Student ID, First Name, Last Name, Gender, Date of Birth, Current Grade, Current School, and Next Year School;
- Student email address, as an optional part of the account creation process
- For Schools and Districts that implement Course Planner information about courses Students have taken, including Course Codes, Course Names, Date Courses Completed or Grade Level Completed, Final
- Grades, Credits Achieved, and the Term Achieved
- For Schools and Districts that implement e-Transcript services, Student transcript data for submission to colleges and universities.
Schools and Districts may provide information about a Student’s parent or guardian, including name and email address, in order to enable Xello to invite such parent or guardian to create an account and review their Students’ information in Xello. Schools and Districts may provide Educator name and email address or Educators, when creating their own accounts, will be required to provide an email address as well as first and last name. Educators may submit support requests or User Content.
We may collect the following information from a School or Authorized Administrator to set up and administer a School account:
- Authorized Administrator contact information as well as information about his/her School relevant to purchasing and setting up accounts such as School’s name, address, billing address, and number of students.
- Support requests and any other information submitted by a School or Authorized Administrators.
Information Provided by Higher Education Institutions
Colleges and universities and other higher education institutions (“Post-Secondary Schools”) that use the Services as part of Xello for Higher Education Platform (“Higher Ed Platform”), provide certain information about their Authorized Administrators, counselors, staff or faculty who are authorized to participate in Higher Ed Platform (“Post-Secondary Staff” or “Staff”) and students who are authorized serve as ambassadors to the Post-Secondary School in the Higher Ed Platform. (“Ambassadors”). Ambassadors and Staff are also “Users”.
We may collect the following information from a Post-Secondary School or Authorized Administrator to set up and administer a Post-Secondary School account:
- Authorized Administrator contact information as well as information about his/her Post-Secondary School relevant to purchasing and setting up accounts such as Post-Secondary School’s name, address, billing address, and number of students.
- Support requests and any other information submitted by a School or Authorized Administrators.
Post-Secondary Schools and their Authorized Administrators may provide the following information about Ambassadors or other Post-Secondary Staff:
- First and last name,
- email address,
- As applicable, current year of study (for Ambassadors), title (for Staff)
Information Provided by Students, Ambassadors and Post-Secondary Staff
With the Services, Students discover the unique pathway that’s right for them using an investigative, discovery-based learning process. As they gain self-knowledge through assessments and reflection, Students can save careers, schools, programs, and experiences to form a vibrant, visual roadmap that’s easy to update and share.
Given the purpose of the Services, Students may provide a variety of information including certain Student Personal Information in the Services. Students may provide information such as email address, phone number, mailing address, personal avatar, education goal, favorite clusters, interests, skills, test scores, work experiences, volunteer experiences, high school course plan, future readiness plans, and any other information or User Content that Students choose to provide.Students who are in Schools that have turned on access to the Higher Ed Platform, can post User Content, including comments and questions on Post-Secondary School pages and participate in one-to-one chats with Ambassadors and Staff. Ambassadors and Staff can post User Content on Post-Secondary School pages, including answers to questions and information about their Post-Secondary School. They can also participate in one-to-one chats with Students.
Information Provided by Work-Based Learning Administrators & Employers
Schools and Districts may offer student users the ability to find and participate in work-based learning (“Work-Based Learning”) opportunities. We may collect the following information from Work-Based Learning administrators and employers offering Work-Based Learning opportunities:
- Work-Based Learning Administrator and employee administrator and authorized personnel contact information.
- Support requests and any other information submitted by such individuals.
Information Provided by Visitors
We may collect the following information directly from Users and other visitors:
- Requests for Information: If you submit a request for information or otherwise contact us, we collect your request and your identifying contact information (including name, email address, phone number and address).
- Support Requests: If you submit a support request or question, we receive your request/question and your associated identifying contact information.
Automatically Collected Information
How We Use Information
We use the information we collect, including Student Personal Information and User Content, to help Students create a successful future.
Specifically, we use such information to:
- provide, improve and analyze the Services;
- respond to questions, comments, and requests for information or provide customer support;
- comply with applicable law or legal process.
- detect, investigate and prevent activities that may be a violation of our Terms of Service or law
- administer, troubleshoot and secure the Services;
- as directed or authorized by a School, District or Post Secondary School that has licensed and/or uses the Services —including as described in more detail for the Higher Ed Platform below.
We use and share de-identified and aggregate information for a variety of purposes including improving the design, features, and functionality of the Services, for marketing purposes, for general business purposes, and for administrative purposes.
In addition to the above, we use School or School Authorized Administrator information to send information about features on the Services or changes to our policies and communicate with Schools about the Services, including your account, transactions with us and security alerts.
How We Disclose Information
We may disclose personal information in certain special cases, including the following:
- We are required to do so by law or as ordered by a court.
- To detect, investigate and prevent activities that may be a violation of our Terms of Service, our other agreements with you, or any laws; to respond to claims of violations of the rights of third parties; or to protect the rights, property, or personal safety of Xello or others.
- To resolve a technical problem or secure the Services.
- As directed by a School or District that has licensed Xello.
We may permit certain trusted service providers and partners to analyze usage of the Services, as well as analyze information such as the source address that a page request is coming from, your IP address or domain name, the date and time of the page request, the referring website (if any), and other parameters in the URL. This is collected in order to better understand usage of our website and the Services and enhance the performance of and maintain and operate the Services. We may also use trusted service providers to host portions of the Services infrastructure, operate various features of the Services, store content, send emails, and store data on our behalf. As described above, we also permit certain third-party advertising partners to collect information regarding visits to our business information websites to deliver relevant advertising about our Services.
We may also disclose personal information or User Content in connection with a merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company (or in connection with related due diligence). In these circumstances, we will only disclose such information with a company that has agreed to data privacy standards no less stringent than our own and after providing advanced notice to you with an opportunity to opt out of our sharing of such information.
When a School turns on access to the Higher Ed Platform, Students may post questions and messages on a Post-Secondary School’s page within Xello, and Ambassadors and Staff may respond and post other information. Such User Content will be visible to anyone who has access to the Post-Secondary School page within Xello. When a School turns on access to the Higher Ed Platform, Students may also engage in one-to-one chat with Ambassadors or Post-Secondary Staff. Participants in the one-to-one chat can view such messages. Xello cannot control how others who view such posts or messages, or other User Content use and/or share those messages or User Content.
For Schools that have turned on access to the Higher Ed Platform, Students may also choose to opt-in to “Profile Sharing” for one or more Post-Secondary Schools and the Post-Secondary School can view the Students’ profile information. Please note, Students must opt in to Profile Sharing for each Post-Secondary School that they want to be able to view their information. Students can disable Profile Sharing at any time and Profile Sharing is turned off by default. Students in Schools who have not enabled the Community feature of the Higher Ed Platform cannot post on Post-Secondary Schools’ pages, engage in chats or opt in to Profile sharing.
When a School turns on access to Work-Based Learning, Students may apply for Work-Based Learning opportunities within Xello. Work-Based Learning administrators can have access to Student name, grade, and school to facilitate Work-Based Learning opportunities. Potential employers offering work-based learning will have access to Students’ applications and contact information in order to contact Students about their applications.
Certain third-party products or services (such as single sign on for test preparation services) may be available for Schools to choose to integrate within or use within the Services. A School is not required to use such additional products in the Services. Before electing to use such third-party services, Schools should review the terms, policies and practices of the third-party products and services to understand their terms and policies with respect to any personal information, including Student Personal Information, they may collect. We strive to make available third-party services that will be useful to Schools, but we are not responsible for their practices, including with respect to personal information.
How We Protect Information
We are committed to protecting personal information, including Student Personal Information, and User Content submitted to the Services. We have numerous systems in place to help safeguard against security breaches, denial of service attacks, and destruction of data. These measures include physical security and backups, employee restriction to data, and a comprehensive security breach policy.
All traffic transmitted to and from the Services is encrypted using Secure Socket Layers (SSL). We use industry-standard hashing mechanisms for sensitive data, such as passwords, and all backups are securely encrypted. Network infrastructure is monitored 24/7 by an intrusion detection system, while all servers use virus protection with full antivirus pattern updates. We maintain a detailed, and frequently tested, disaster recovery plan that includes multiple layers of redundancy in addition to a robust backup strategy.
Our employees who require access to personal information, including Student Personal Information, to perform their function must complete a criminal background check and sign a non-disclosure agreement prior to employment.
Information Provided by Schools and Districts
Information provided by Schools and Districts is controlled by such educational institutions. If you have any questions about reviewing, modifying, or deleting the personal information they have provided us, please contact your educational institution directly.
Schools may update account information and modify the Services by signing in to the administrator account or by contacting us.
Information Provided by Students
The Services offer a robust set of tools and features which allow Students to access, edit or delete Student Personal Information and Users (including Students) to access, edit or delete User Content that they have added to the Services. If Students have enabled Profile Sharing in the Higher Ed Platform, they can disable it at any time.
Students may also request changes or deletions to Student Personal Information and User Content provided by emailing us at email@example.com. We will respond to your request, when permitted by law, within 30 days. Please note, this request may be referred to the School for instruction.
Users can update their individual notification preferences for the Services to control certain service-related messaging. Other service-related messaging (such as password reset communication) cannot be disabled.
Automatically Collected Information
If you do not want Google Analytics to collect and use information about your use of our websites, then you can install an opt-out in your web browser at: tools.google.com/dlpage/gaoptout.
Information Provided by Other Visitors
Depending on a visitor’s jurisdiction, certain rights with respect to information may be available as further described below. Specifically, you may be able to request that we:
- provide access to and/or a copy of certain information we collect;
- confirm that we are processing your information;
- prevent the processing of information for direct-marketing purposes (including any direct marketing processing based on profiling);
- update information which is out of date or incorrect;
- restrict the way that we process and disclose certain information;
- transfer information to a third-party provider of services;
- revoke previously provided consent for the processing of information; and
- delete certain information which we are holding (request that you be forgotten).
Please note, however, that certain information may be exempt from such requests in some circumstances, which may include if we need to keep processing your information for our legitimate interests or to comply with a legal obligation.
To make such a request, you may email us at firstname.lastname@example.org. We may ask you to provide us with information necessary to reasonably verify your identity before responding to your request. We will consider all requests and provide our response within the time period required by applicable law. If we deny your request in whole or in part, you may have the right to appeal the decision. In such circumstances, we will provide you with information regarding the appeals process.
Following termination or deactivation of a School’s account, we will retain User personal information and User Content for a period of 90 days. Should the School decide to renew their contract within this 90-day period, your account and all related information will be restored. At the end of 90 days, or earlier at the request of the School, we will delete or transfer (and direct any subcontractors to delete or transfer) to School with rights in the information: Student Personal Information (including FERPA Records), personal information of Educators, and User Content in our or our subcontractor’s possession. Notwithstanding the foregoing, we may retain any such information as required by or to demonstrate compliance with applicable law.
At any time upon termination of an agreement or otherwise at their discretion, Schools can request we delete all Student Personal Information and User Content. We will follow these instructions within 30 days of receipt.
For other visitors’ information, we maintain information as long as necessary to provide the requested Services or as necessary under law.
Legal Basis for Use (e.g., processing) of information
- Where use of information is necessary to perform our obligations under a contract (for example, to comply with the terms of service of our Services; and/or our contract to provide our Services);
- Where use of information is necessary for our legitimate interests or the legitimate interests of others (for example, to provide security for our Services; operate our Services; make and receive payments; comply with legal requirements and defend our legal rights; prevent fraud);
- For legal compliance;
- With consent; or
- Other grounds, as required or permitted by law in the specific respective context.
Location of Data Storage and Processing
Please note that data collected in the US, Canada and the UK will remain stored in the country of origin. Data collected from users in other countries will be stored in the country where the application originates. For example, if a user is accessing the US version of Xello, their data will be stored in the US.
In addition, in providing the Services, we may process your data in other jurisdictions where Xello (and its service providers) operates which includes the US, Canada and the UK. Please be aware that the privacy protections and legal requirements, including the rights of authorities to access your information, in these countries may not be equivalent to those in your country.
Students are not allowed to create their own accounts in the Services. Student accounts are created under the direction of School or Educators. Only Educators provided access by the School in the Services have access to that Student’s personal information and content.
In the United States, we are required under the Children’s Online Privacy Protection Act (“COPPA”) to obtain verifiable parental consent in order to collect, use, or disclose personal information from Children under the age of 13. As provided for by COPPA, we rely upon the School to obtain parental consent for the online collection of personal information from Children who are Students of such School.
Additional Information for California Residents
|Category of Personal Information||Purposes of Use||Categories of Third Parties to Which Xello Discloses Personal Information||Categories of Third Parties to Which Xello “Sells” or “Shares” Personal Information|
|Contact and account information||Provide the Services; Communicate with you; Marketing and advertising; Personalize the Services; Improve the Services; Business Operations; With your consent||Affiliated entities; Service providers; Online advertising partners; Connected third-party services; Entities for legal purposes; Entities for business transactions||Online advertising partners; Online analytics providers for potential customers or current customers only|
|Gender, date of birth, education, and employment history||Provide the Services; Communicate with you; Marketing and advertising; Personalize the Services; Improve the Services; Business Operations; With your consent||Affiliated entities; Service providers; Entities for legal purposes; Entities for business transactions||We do not “sell” or “share”|
|Customer service interaction information||Communicate with you; Improve the Services; Business Operations; With your consent||Affiliated entities; Service providers; Entities for legal purposes; Entities for business transactions||We do not “sell” or “share”|
|Information collected through automated technologies||Provide the Services; Marketing and advertising; Personalize the Services; Improve the Services; Business Operations; Recognize a user across multiple touchpoints across Services; With your consent||Affiliated entities; Service providers; Online advertising partners; Connected third-party services; Entities for legal purposes; Entities for business transactions||Online advertising partners; Online analytics providers for our business websites only|
For more information about each category, purpose of use, and the third parties to which we disclose, “sell,” or “share” information, please see the sections “How We Collect Information,” “How We Use Information,” and “How We Share Information” above.
Your Choices Regarding “Sales” and “Sharing.”
Other CCPA Rights. The CCPA also allows you to limit the use or disclosure of your “sensitive personal information” (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information as defined by the CCPA.
Retention of Your Personal Information. Please see the “Data Retention” section above for information about how long we retain your information.
Notice Concerning Do Not Track. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser-initiated Do Not Track signals. Learn more about Do Not Track
California “Shine the Light” Disclosure. The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. We do not currently disclose your personal information to third parties for their own direct marketing purposes.
Xello is committed to the highest standards of openness and accountability. As a community we have a professional responsibility to speak up and report unethical behavior. If a Xellion (current or former), contractor, volunteer, or user/customer believes Xello, or a member of staff, has taken action that is of concern towards malpractice or impropriety, all reasonable steps should be taken to communicate concerns through appropriate channels. These concerns could include:
- Financial malpractice or impropriety or fraud
- Failure to comply with a legal obligation or Statutes
- Dangers to Health & Safety or the environment
- Criminal activity
- Improper conduct or unethical behavior
- Attempts to conceal any of these
All individuals who disclose such concerns will be protected provided the disclosure is made:
- in good faith
- in the reasonable belief of the individual making the disclosure that it tends to show malpractice or impropriety and if they make the disclosure to an appropriate person (see below). It is important to note that no protection from internal disciplinary procedures is offered to those who choose not to report through the identified channels.
Xello will treat all such disclosures in a confidential and sensitive manner. We will work to keep the identity of the individual making the allegation confidential so long as it does not hinder or frustrate any investigation. However, the investigation process may reveal the source of the information and the individual making the disclosure may need to provide a statement as part of the evidence required. An individual can disclose through the following designated channel: Confidential email submission – email@example.com
How to Contact Us