Privacy Policy

This Privacy Policy is effective as of, and was last updated on, August 1, 2023.

Bisk Education, Inc. (“Bisk”) is the online administrative service provider for Columbia Law School (“Columbia”). This Privacy Policy discloses how Bisk collects, uses and safeguards the personal information you provide to Columbia and Bisk. As used herein, “we” and “our” shall mean Bisk.

We are committed to protecting your privacy. You have chosen to visit and/or do business with us, and we recognize our obligation to keep the information you provide secure and to inform you of our policies concerning its use. You can be sure that our commitment to protect your information will continue under the principles and online guidelines described below. We take steps to ensure the data we hold about you is:

The term “site” or “website” as used in this Privacy Policy includes / and all other versions of internet pages accessed via an electronic device.

If we decide to change our Privacy Policy, we will post those changes on this page so that you are always aware of what information we collect, how we use it, and under what circumstances we disclose it. We encourage you to periodically check this site and review the most recent version of the Privacy Policy. By continuing to provide us with information or use our site after any changes are made, you accept such changes to the Privacy Policy.

If you have any questions about this privacy statement, the practices of this site, or your dealings with this website, please email privacy@bisk.com.

What information do we collect and when do we collect it?

We collect two kinds of information on this site:  1) Information that is voluntarily supplied by you by visiting the site, requesting information, and enrolling in programs and 2) Information that is automatically collected as you navigate the site.

In certain areas of our website — such as when you place and fill out an application, request more information, enroll in a program, apply to a degree or fill out a survey — you are required to enter personal contact information (name, mailing address, email address, phone number) that allows us to contact you to fulfill the current or future request or to inform you of future promotions.  You may also be asked to provide financial information (credit card information) that allows us to process your enrollment. Should you abandon a form on our website, your information may still be collected and utilized for notices or communications pertaining to the site, products or services. If you choose not to provide personal information, you can still browse most of our website (the areas that do not require registration) anonymously. If you place a call to us, whether by landline or mobile device, we may also capture your phone number and any other information you provide during the call. This information may also be used to communicate with you about the site, products or services via phone, mail, email, social media or third-party applications.

When you visit our site, we may directly and through third-party service providers automatically log certain information about your visit including: the pages you visit while on our site; the IP address of a referring website, if any; the type of browser, device or hardware you are using; your IP address and general geographic information; and the date and time you accessed our site. Through the use of third-party tools, such as Google Analytics (Remarketing, Display Network Impression Reporting, Demographics and Interest Reporting, and other integrated services), we may also collect certain demographic information and information about interests from a portion of the visitors to our site. This information may link to personal data that you voluntarily provide to us which will allow us to serve interest-based ads and content.

How do we use this information?

We may use this information in order to facilitate enrollment and/or admission, provide educational services, improve our website and services, and otherwise as permitted by applicable law. The legal basis for processing your personal data is typically (1) as necessary for Bisk’s, Columbia’s or contracted third parties legitimate interests, (2) as necessary for performance of a contract with you, (3) as necessary for compliance with a legal obligation, or (4) if you have provided consent.  

We collect information to process and fulfill your enrollment/application, to notify you of your enrollment/application status, to alert you to special offers, provide you updated information, and new services, and to help us understand our customers in order to create content and a web environment that is most relevant to you. We also use information, including information that is automatically collected, to understand more about our site visitors, to determine how users navigate our site, to improve site performance, to protect the security and integrity of our site and business, to identify and protect our systems from fraudulent activity and access, to provide advertising that may be of interest to our visitors, and to monitor legal compliance.

What about cookies?

To provide better service and a more effective website, we sometimes use first-party and third-party “cookies” as part of our interaction with your browser. A cookie is a small text file placed on your computer’s hard drive by our web page server. Cookies are commonly used on websites and do not harm your system. By configuring your preferences or options in your browser, you determine if and how a cookie will be accepted. We use cookies to determine if you have previously visited our websites and the pages you have visited, and for a number of administrative, marketing or remarketing purposes. We use both first-party and third-party cookies for different purposes:

First-party cookies and third-party cookies

Cookies can be first-party or third-party. A first-party cookie is one that you receive directly from Bisk when visiting our Site. A third-party cookie is one that you have received from another party, such as Google or Facebook. We do not control what third parties do on other sites. However, we may work with certain third-party providers such as Google or Facebook to permit their cookies to function through our Site so we can learn more about your web experience on our Site and better personalize our services for you.

Persistent and session cookies

A persistent cookie is a cookie that is stored by the web browser on your device until it expires or you delete it. The expiration of a persistent cookie is determined by the creator of the cookie and can be upon a certain date or after a length of session time has passed. This means that, for the cookie’s entire lifespan, its information will be transmitted to the creator’s server every time the user visits the website that it belongs to or another website configured to check for that cookie (such as an advertisement placed on that website). For this reason, persistent cookies are also called “tracking cookies.”

A session cookie is created temporarily on your device for use by a website during your visit. This type of cookie may store information you enter and track your activity within the website. A session cookie is deleted after you leave the website or when the web browser is closed. A good example of a session cookie is the shopping cart on an e-commerce site. The session cookie stores the items that you add to your cart so they are not forgotten while you view products on other pages of the website. Using a session cookie, the items will all be in the cart when you go to the checkout page.

Please note the following links to understand how you can change your cookie settings for your preferred browser in addition to understanding more about how cookies work:

Explorer: https://support.microsoft.com/en-us/help/260971/description-of-cookies
Firefox: http://support.mozilla.org/en-US/kb/Cookies
Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=en&answer=95647
Opera: http://www.opera.com/browser/tutorials/security/privacy/
Safari: http://support.apple.com/kb/ph5042
Safari iOS: http://support.apple.com/kb/ht1677
Android: http://support.google.com/android/bin/answer.py?hl=en&answer=1722193

All About Cookies: http://www.allaboutcookies.org/
Cookie Central: http://www.cookiecentral.com/faq/
Network Advertising: http://networkadvertising.org/.

Third-Party Advertising Partners

We use third-party service providers to serve interest-based advertisements on our behalf on our site(s), social media networks and across the Internet. These advertising service providers may collect non-identifiable information about your visits to our website, and your interactions with our products and services. Such non-identifiable information does not include your name, address, email address or other personal information. The information is collected through the use of cookies and pixel tags (also known as action tags), which is industry-standard technology used by most major websites. Interest-based ads are then displayed based on the information that is collected.

In addition to the information about your visits to our website, our service providers may also use the information about your visits to other websites to target advertisements for programs and services available from us.

If you would like more information about this practice and to know your choices for not having this information used by third-party service providers, please visit https://optout.networkadvertising.org/.

If you choose to “opt-out” of this third party use, it does not mean you will no longer receive online advertising. It does mean that the company or companies from which you opted out will no longer remarket to you or deliver ads tailored to your web preferences and usage patterns. You will be able to “opt-out” of marketing materials by clicking the “unsubscribe” button within the marketing pieces themselves or by emailing your request to privacy@bisk.com.

How do we protect customer information?

To help protect the privacy of data and personally identifiable information you transmit through use of this website, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data to those employees who we reasonably determine need to know that information to provide benefits and services to you.  In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information.  We commit to taking appropriate disciplinary measures to enforce our employees’ privacy responsibilities.

We use industry-standard technologies when transferring and receiving consumer data to help ensure its security. Our sites have security measures in place to protect the loss, misuse, and alteration of the information under our control. Our servers are backed up regularly and protected by security systems. 

Financial transactions are facilitated through a third-party payment processor. Bisk does not directly process banking or credit card information.

While we use industry-standard technologies and measures to protect any data you provide to us, nothing can completely guarantee the security of transmission of data or information over the Internet. Therefore, we cannot guarantee against the loss, misuse or alteration of data or personal information that you provide to us, and we are not responsible and disclaim any liability for any damages or injuries which arise from such loss, misuse or alteration.

Will we disclose the information collected to outside parties?

Bisk does not consider Columbia to be an outside party. We are providing Columbia with online administrative services, and we process data on their behalf in accordance with their requirements. Any personal information we collect on this site which is transmitted to Columbia for review and processing, will be governed by Columbia’s privacy policy.

The personal information Bisk collects from you is stored in one or more databases hosted by third parties in the United States.  These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. On occasion, Bisk engages third parties to mail information to you, including items like books or materials you may have purchased. Bisk does not otherwise reveal your personal data to third-parties for their independent use unless: (1) you request or authorize it; (2) it’s in connection with the administrative services provided by Bisk to Columbia; (3) the information is provided to comply with the law (for example, to comply with a search warrant, subpoena or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf.

Our website interfaces with social media sites such as Facebook, LinkedIn, Twitter and others. We may share information regarding your activities on our website with social media networks, who may associate that information with personally identifiable information they already have about you (such as your profile on the social network). This information may be used to improve the network or services, to present advertising that may be of interest to you or others within the network, or for other purposes in accordance with the network’s terms of use or policies. Social media networks may, in accordance with their privacy policies and as authorized by you, share your information with us and other third parties, who may use it for marketing and other purposes. If you choose to “like” or share information from the website through these services, you should review the privacy policy of that service:

LINKEDIN – https://www.linkedin.com/legal/privacy-policy

FACEBOOK – https://www.facebook.com/privacy/explanation

INSTAGRAM – https://help.instagram.com/519522125107875

If you are a member of a social media site, the interfaces may allow the social media site to connect your site visit to your personal data.

The contact information we collect, including through our websites, email communications with you or when you place a call to us, is used to improve the content of our website and to contact customers for marketing purposes. For example, based on the information you provide or that we collect, we may decide to inform you of our existing programs and services, including any of the programs that we feel may be of interest to you. We may also use the collected information to help develop new programs and services that we think customers may find helpful in the future. We share information only for legitimate business purposes. For example, we may share your personal information with companies who provide services such as information payment processing, extending credit, fulfilling customer orders, delivering products to you, managing and enhancing customer data, providing customer service, assessing your interest in our products and services, and conducting customer research or satisfaction surveys. In each case, we carefully review the company and the products and services offered to make sure that they provide value. If you do not wish to receive any or all such offers, please let us know by emailing us at any time at privacy@bisk.com. If you don’t want to receive printed materials, please also provide us with your exact/legal name and address and we will be sure your name is removed from the data we share with our business partners.

Our website may display or work with social media features or features from third parties which are approved vendors of social media networks (collectively known as “features”). These features are either hosted by a third party or hosted directly on our site. Many of these features are a part of our advertising and communications efforts. If you choose to use these features, they may collect information about your interactions with our site, which may then be used by social media networks for various purposes. Your interactions with those features and with social media networks are governed by the privacy policies of the companies that provide them.

In order to comply with the Federal anti-spam laws effective January 1, 2004, we provide a suppression list of the e-mail addresses of those who ask to be removed from our distribution database to third-party advertisers who provide e-mail marketing services to our company. We require all third party marketers to sign an agreement prohibiting them from using this data for any purpose other than sending out our marketing materials. It may be necessary − by law, legal process, litigation, and/or requests from public and governmental authorities within or outside your country of residence − for us to disclose your personal information. We may also disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, a disclosure is necessary or appropriate. We may also disclose information about you if we determine that disclosure is reasonably necessary to enforce our terms and conditions or protect our operations, employees or users.

Data storage and retention

Your personal data is stored by Bisk on its servers, and on the servers of the cloud-based database management services Bisk engages.  Bisk retains data for the duration of the student’s relationship with Bisk and for a period of time thereafter to facilitate the administrative services provided to Columbia For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at privacy@bisk.com. For information about how your data is stored and protected by Columbia, please reference the Columbia privacy policy.

Links

We may create links to other websites. We will make a reasonable effort to link only to sites that meet similar standards for maintaining each individual’s right to privacy. However, many other sites that are not associated or authorized by us may have links leading to our site. We cannot control these links and are not responsible for any content appearing on these sites. It is your responsibility to thoroughly read the terms of use, privacy policies and any other policies that apply to any website that you visit on the Internet.

Notice to parents

We do not knowingly solicit information from children (individuals under age 16). Likewise, we do not knowingly market to children. We recognize that protecting children’s identities and privacy online is important and that the responsibility to do so rests with both the online industry and with parents. We encourage you to talk to your children about the safe and responsible use of their personal information while using the Internet.

EU GDPR

Notice to EU Residents

As of May 2019, the General Data Protection Regulation (GDPR) provides a series of privacy to rights to EU data that affect how your data can be used and stored by third parties. The GDPR is an EU regulation that establishes a legal framework to protect the personal data of EU residents.  It applies to all organizations doing business with individuals in the EU.  Organizations that are established in the EU, as well as organizations that process the personal data of EU residents (even if not based in the EU), are required to comply with the GDPR. This Privacy Policy has been written with the GDPR and the CCPA (see below) in mind and attempts to meet the requirements established in both laws.

GDPR aims to bring privacy/data protection laws across Europe in accordance with the rapid pace of technological changes.  GDPR introduce new obligations and liabilities on organizations that handle personal data by establishing a number of rights for Data Subjects. 

If you are a resident of the European Union, under the General Data Protection Regulation (GDPR), you now have the following rights:

Legal Basis for Processing Your Information

We rely on the following legal grounds to process your personal information:

Transferring personal data from the EU to the US

Columbia, as data controller, uses Bisk as a data processor. Bisk has its headquarters in the United States.  Information we collect from you will be processed in the United States. As of August 1, 2023 the United States has received a finding of “adequacy” from the European Union under Article 45 of the GDPR.  Additionally, Bisk relies on derogations for specific situations as set forth in Article 49 of the GDPR. In particular, Bisk collects and transfers to the U.S. personal data only: with your consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Bisk in a manner that does not outweigh your rights and freedoms. Bisk endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Bisk and the practices described in this Privacy Policy. Bisk also enters into data processing agreements with its vendors whenever feasible and appropriate.

If you wish to exercise any of these rights or have questions as to other components of the GDPR, please make send such request to privacy@bisk.com. This action will trigger our formal Data Subject Action Request (DSAR) process in accordance with the GDPR. Once we verify your identity, we will work to respond to your request within 20 days.

Additionally, we have retained the service of a Data Protection Officer (DPO) in accordance with the GDPR to assure the rights of Data Subjects are being met and that our processing remains consistent with the GDPR requirements. Our DPO can be contacted directly at dpo@bisk.com.

Opt-Out

We honor all requests to be removed from our marketing lists. If you do not want to receive e-mail, telephone messages or direct mail from us, contact us at privacy@bisk.com and we will remove your name from our in-house list and add you to our marketing suppression list. You will also have an opportunity to add your phone number to our internal “Do Not Call” list during each phone call you receive from us. You will further have the ability to opt-out or manage certain advertising preferences through links provided in marketing and promotional e-mails you may receive. We honor all requests to be removed from our e-mailing lists within ten days, and update our suppression list every ten days. If you prefer to learn about new offers from us through a specific medium — for example, through the mail — simply let us know your preference by sending us an email at privacy@bisk.com.

We are fully committed to complying with your wishes regarding receiving commercial e-mail messages from us and with the laws regarding unsolicited e-mail. If for any reason you receive a commercial message directly from us or on our behalf more than ten days after making a request to be taken off our mailing list, we would request that you forward a copy of the e-mail to privacy@bisk.com with a brief explanation of your efforts to unsubscribe and the approximate timeframe you made the request. We will immediately investigate the matter, confirm that you have been removed, and provide a written response to you detailing our efforts. Please note that requests to be removed from our direct mail list will be processed as soon as possible, but given the nature of direct mail, it may be impossible to prevent a mailing that is being processed or underway from reaching you. If you receive multiple mailings from us after your request, please contact us at privacy@bisk.com.

Keeping Customer Information Up-to-date

Keeping your account information accurate and up-to-date is very important. If you ever find that our records are incomplete, inaccurate or not current, please email at privacy@bisk.com and we will correct the information as soon as possible.

Notice to California Residents

This Section is for California Residents and supplements the information contained in this Privacy Policy. As used in this Section, consumers or you applies solely to those people who reside in the State of California. We add this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws.  Any terms defined in the CCPA have the same meaning when used in this Section.

Sale of Data

We do NOT “sell” personal information as defined by the CCPA. We will continue to monitor and review our processing activities and will notify you if this change and take the appropriate steps to stay in compliance with the CCPA.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	YES
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	YES
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

Personal information does not include:

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We disclose your personal information for a business purposes to the following categories of third parties:

In the preceding twelve (12) months, we have not sold any personal information.

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

Deletion Request Rights

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by emailing us at privacy@bisk.com.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us.  We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.  If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Questions and Concerns

Please do not hesitate to contact us at the email address provided above if you have any questions or concerns regarding the processing of your data.  For individuals located in the European Union, you may also lodge a complaint with the applicable supervisory authority, although we would appreciate the opportunity to receive and address your concerns first.