Privacy Policy
CONTENTS
Introduction
Access 4 Learning (A4L) Community (“A4L,” “we,” “our,” or “us”) respects your privacy and is committed to protecting personal information collected through our websites, registries, standards resources, certification tools, events, and related services. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit or use A4L-operated websites and services, attend A4L events, participate in community forums or collaboration spaces, download specifications or other materials, or otherwise interact with A4L.
This Privacy Policy applies to A4L-operated websites and services and other websites, registries, repositories, or online services that link to or reference this Privacy Policy.
This Privacy Policy does not apply to third-party websites, services, or platforms that may be linked to A4L websites or used in connection with A4L programs unless those third parties expressly incorporate this Privacy Policy. Those third parties maintain their own terms and privacy practices, and A4L is not responsible for them.
If you access A4L resources through an employer, school district, university, or other organization that has membership, participation, or other contractual relationship with A4L, the terms of that organization’s agreement A4L may also apply to your use of certain A4L services and resources.
Member and Non-Member Access
A4L resources may be accessed by both members and non-members.
Members are individuals or organizations that have entered into a membership Agreement with A4L. Members have access to additional resources, including the Agreement Registry, project teams, collaboration areas, certification tools, registries, implementation resources, draft materials, or other member services. Because A4L is a collaborative standards community, participation by members may involve attribution of contributions, publication of names and organizational affiliations in standards-related activities, and visibility of professional profile information within member spaces.
Non-members, sometimes referred to as guests, may access certain public resources, including published specifications, public documentation, selected registry information, event registration pages, and other public-facing materials. Non-members may also provide personal information when registering for events, requesting information, downloading materials, signing up for newsletters or updates, or participating in publicly accessible forums.
A4L resources are made available to both members and non-members, but access levels, participation rights, and available services will differ depending on membership status.
Information We Collect
A4L may collect personal information directly from you, automatically when you use our websites or services, and in some cases from your organization or from service providers acting on our behalf.
The categories of personal information we may collect include identifiers and contact details such as your name, username, email address, telephone number, mailing address, and organization name. We may collect professional information such as job title, employer, school district, university, or institutional affiliation. We may collect account information such as login credentials, profile information, registration history, transaction records, event attendance information, communication preferences, and records of support requests or inquiries.
If you make a purchase, register for a paid event, or otherwise complete a transaction, we may collect transaction and billing information. Payment card information, if collected, is typically processed by third-party payment processors and not stored by A4L except as needed for payment confirmation, accounting, audit, or dispute resolution.
We may collect content you choose to provide, including information posted in forums, collaboration platforms, surveys, webinars, event sessions, public comments, implementation discussions, or other communications with A4L. If you upload a photo or include biographical material in your profile, we may collect and display that information in accordance with the settings and functions of the relevant service.
We may also collect device and usage information automatically, including IP address, browser type, browser language, operating system, device identifiers, referring URLs, pages visited, links clicked, dates and times of access, session duration, and information about how you interact with our sites, registries, standards resources, or online tools.
A4L does not intentionally collect sensitive personal information unless it is reasonably necessary for a specific purpose and permitted by law. A4L also does not knowingly seek student education records through this website privacy workflow.
How We Collect Personal Information
A4L collects information that you provide directly when you create or update an account, complete a form, register for an event, subscribe to communications, request support, respond to a survey, participate in community activities, join a mailing list, download specifications or materials, or otherwise communicate with us.
We also collect certain information automatically as you navigate and interact with A4L websites and services. This may include cookies, web beacons, log files, and similar technologies used to support functionality, analytics, and system integrity.
In some cases, we may receive personal information from your employer, institution, or another member organization when that organization designates you as a participant, administrator, delegate, or attendee for A4L-related activities. We may also receive information from service providers such as event platforms, customer support tools, analytics providers, payment processors, and email distribution services, but only as needed to operate A4L services.
Cookies, Analytics, and Similar Technologies
A4L may use cookies, local storage, log files, analytics tools, and similar technologies to operate our websites and services, remember preferences, authenticate users, maintain sessions, understand usage patterns, improve content and performance, troubleshoot issues, and protect against fraud, abuse, or unauthorized activity.
Some cookies are necessary for the operation of A4L services. Others may be used for analytics, such as measuring traffic, identifying popular content, understanding event registration flows, or improving user experience. A4L and its affiliated websites may use Google Analytics to help us understand how users interact with our websites. Google may collect and process information in accordance with its own privacy policies.
Most browsers allow you to block or delete cookies, but some A4L site functions may not work correctly if cookies are disabled. Where required by law, A4L will provide appropriate notice and choice regarding non-essential cookies or similar technologies.
A4L does not use website tracking for the purpose of selling personal information. If A4L uses automated technologies in a manner that triggers legal rights under applicable law, A4L will honor those requirements to the extent applicable, including opt-out rights where legally required.
Purposes of Collection and Use
A4L uses personal information to operate, administer, maintain, and improve our websites, standards programs, registries, events, communications, certification tools, and member services. We use information to register attendees, manage accounts, respond to inquiries, provide requested materials, administer memberships, facilitate collaboration, publish standards work where appropriate, and communicate about A4L activities, updates, project teams, specifications, events, and related opportunities.
We may also use information to protect the security and integrity of our systems, investigate misuse, enforce our policies, prevent fraud or abuse, comply with law, meet accounting, and audit obligations, and defend legal claims.
Where permitted by law, A4L may also use information in deidentified, aggregated, or statistical form to understand trends, improve services, measure engagement, and inform planning. Deidentified or aggregated data is not used to identify a specific individual.
Authorized Use of A4L Materials, Registries, and Intellectual Property
A4L publishes standards, technical specifications, implementation guidance, registries, documentation, schemas, artifacts, and related materials in support of interoperability, privacy, and security in education.
These materials are made available for authorized use consistent with the mission of A4L. Permitted uses include participation in the A4L community, implementation of interoperability standards, educational research, evaluation of technical compatibility, and other activities consistent with A4L’s mission and applicable participation terms.
A4L prohibits unauthorized use of its websites, registries, standards resources, and related materials. Prohibited conduct includes automated scraping, crawling, or extraction of registry or repository content without authorization; bulk harvesting of data; creation of derivative commercial databases or competing services using A4L registry content; use of A4L materials for unrelated commercial exploitation or market intelligence inconsistent with A4L purposes; circumvention of technical or access controls; and use that infringes the rights of A4L or others.
A4L reserves all rights in and to its intellectual property and proprietary materials, including copyrights, trademarks, service marks, trade names, logos, database rights, compilation rights, and other proprietary or contractual rights associated with A4L content, registries, standards, services, and related resources. Except as expressly permitted by law or by an applicable A4L license, policy, membership term, or written authorization, no license is granted by this Privacy Policy.
A4L may monitor public-facing services and registry access for security, performance, and misuse prevention purposes. We reserve the right to restrict, suspend, terminate, or investigate access where we reasonably believe an individual or entity is using A4L resources in violation of applicable policies, licenses, technical restrictions, or authorized-use expectations.
Sharing and Disclosure of Information
A4L does not sell or transfer user data to third parties and will use the data for only authorized purposes. Those purposes are, in part set forth below.
A4L may share personal information with service providers that perform services on our behalf, such as website hosting, analytics, payment processing, registration management, customer support, event administration, communication distribution, cloud storage, authentication, or security monitoring. These providers may access personal information only as needed to perform services for A4L and are expected to protect it appropriately.
If you register for an event, webinar, summit, or similar program, A4L may share your name, title, organization, and professional contact details with sponsors, co-organizers, or attendees where that sharing is part of the event registration terms or where you have consented.
If you participate in collaborative standards development, implementation groups, public forums, or other community activities, information you choose to share may be visible to other participants or, in public areas, to the general public. If a specification, implementation guide, or related publication identifies contributors or working-group participants, A4L may publish names and organizational affiliations consistent with community practice.
A4L may disclose personal information if required by law, subpoena, court order, governmental request, or regulatory process, or when we believe disclosure is reasonably necessary to protect the rights, property, safety, or security of A4L, its users, members, or the public; investigate misuse; enforce agreements; or respond to emergencies.
A4L may also transfer information in connection with a merger, reorganization, transition of services, or similar transaction, subject to appropriate confidentiality and legal safeguards.
Community Forums and Collaboration
A4L websites and services may include community forums, discussion boards, blogs, shared workspaces, implementation communities, or similar features. Information posted in public or shared areas may be read, copied, collected, or used by others. Information posted in public or shared areas may be visible to other users or the public.
By participating in A4L forums or community spaces, you agree not to post unlawful, defamatory, abusive, harassing, obscene, infringing, or otherwise inappropriate content. You also agree not to post copyrighted or proprietary material without authorization. A4L may moderate community spaces, but because many interactions occur in real time, A4L cannot guarantee complete review of all submissions. Content posted by users reflects the views of those users, not necessarily those of A4L.
If A4L receives a complaint, legal demand, or credible allegation concerning forum content, A4L may review available account and activity information and may disclose relevant information as permitted or required by law.
Resource Registry
The Access for Learning Community provides its users access to the SDPC Registry, allowing Members the ability to manage, search and share DPAs. Users can include both Members and those districts and other LEAs who have been allowed by the Member to access the Registry. We may collect member names, URLs and application Meta Data. Member and User data may be shared with other Registry Users to facilitate functions within the Registry and use by other Users.
Data contained within a DPA may also be accessed by other users. This can include the names, telephone numbers and email addresses of persons who are listed as contacts and may not be users of the Registry. The data within a DPA may be accessible by users, even if the DPA has not otherwise been made public.
A4L maintains a repository of DPAs. It did not negotiate the DPAs and does not warrant or otherwise guarantee the accuracy of individual DPAs or the contents therein. Individual members must conduct their own due diligence.
Education Records and School Privacy Context
A4L is an interoperability and standards organization, not a school or school district. A4L primarily provides interoperability standards, community collaboration resources, and technical registries for educational organizations. A4L generally does not collect, maintain, or control student education records through its public websites and general community resources.
Educational institutions, agencies, universities, and vendors that implement or use A4L standards remain responsible for their own compliance with FERPA and other applicable student privacy laws.
If A4L receives education-related data through a specific program, contract, pilot, or service, the terms of that arrangement will govern the handling of such information along with applicable law.
Data Security
A4L maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures may include access controls, role-based permissions, logging, encryption where appropriate, vendor diligence, secure configuration practices, incident response procedures, and workforce confidentiality expectations.
Even with these safeguards, no website, platform, or online service can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials and should not share passwords or reuse passwords across services. If you believe your credentials have been compromised, you should notify A4L promptly.
Data Retention
A4L retains personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including providing services, maintaining accounts, supporting memberships, administering events, preserving standards-development records, meeting legal, accounting, audit, and tax obligations, resolving disputes, enforcing agreements, and protecting security and integrity.
Retention periods vary depending on the type of information and the context in which it was collected. At the end of the applicable retention period, personal information will be deleted, deidentified, anonymized, or securely destroyed where practicable, subject to backup, archival, legal hold, and system limitations. Users may also request that A4L delete their information, which will be within a reasonable time after the request. A4L may be required to maintain some data in order to comply with the legal requirements set forth in the preceding paragraph.
International Users and Cross-Border Transfers
A4L is based in the United States and processes information in the United States and other locations where our service providers operate. If you access A4L services from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your jurisdiction.
Individuals located outside the United States acknowledge that their personal information may be transferred to and processed in the United States. Where applicable, A4L will process personal information in accordance with applicable data protection laws.
Where A4L relies on consent, contractual necessity, legal obligation, legitimate interests, or another lawful basis for processing under applicable law, A4L will seek to identify and apply the appropriate basis in context.
Your Rights and Choices
Depending on where you live and the laws that apply, you may have rights regarding your personal information. These may include the right to request access to personal information, request correction of inaccurate information, request deletion, object to certain processing, withdraw consent where processing is based on consent, request portability where applicable, or request information about categories of personal information collected, used, or disclosed.
You may also have choices regarding cookies, analytics, email communications, and similar technologies. You may unsubscribe from non-essential promotional emails by using the unsubscribe link in the message or by contacting A4L. You may also control some tracking technologies through browser settings or other user controls.
Some browsers and extensions transmit a Global Privacy Control or similar preference signal. Where required by applicable law, A4L will make reasonable efforts to recognize and honor such signals.
A4L will respond to privacy requests in accordance with applicable law. We may need to verify identity before acting on a request, and some requests may be limited by legal exceptions, technical feasibility, recordkeeping obligations, or the rights of others.
California Privacy Rights
Residents of California may have certain rights regarding their personal information under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights may include the ability to request access to personal information collected about them, request deletion of personal information, and request correction of inaccurate personal information.
A4L does not sell personal information. Personal information may be shared with service providers solely for purposes related to operating A4L services.
California residents may submit privacy-related requests using the contact information provided in this Privacy Policy.
GDPR Privacy Rights
A4L provides LEAs and vendors who are participating members of the Student Data Privacy Consortium (SDPC) with the National Data Privacy Agreement (NDPA), which when filled out and executed, processes the following information from the vendor’s designated representative: name, title/position, work address, phone number, email address, and signature. The vendor also provides contact information for an individual to receive security notices, which includes their contact information (name, role, postal address, e-mail address). The vendor also may provide contact information for their legal counsel.
The NDPA also includes a General Offer of Privacy Terms (Exhibit E), allowing other participating LEAs to subscribe to the same privacy terms as the originating agreement. This is available if the vendor signs it, which will include the name, signature, and title/position of the vendor’s designated representative.
When an LEA contracts with a vendor based in the European Economic Area (EEA), any data processing related to that vendor’s contact information is subject to the GDPR.
A4L is a joint controller along with the school district for some data processing in cases when a district uses either the NDPA or Exhibit E to contract with an EEA-based provider. Data processing for which A4L is a joint controller involves maintaining the SDPC registry, which allows districts to search for the NDPA as signed by other districts and Exhibit Es available for them to subscribe to. A4L determines the content of the NDPA and structure of the resource registry. All processing of personal data related to data subjects based in the EEA is based on Article 6(1)(b) of the GDPR, in that it is necessary for the performance of the contract between the LEA and the provider and for other districts to find the provider’s general offer of terms (Exhibit E).
In all other cases, the district is the controller and A4L is a processor of the district’s information. The content of individual agreements is between the district and provider. A4L is not a party to them other than hosting them in the resource registry and is not authorized to handle data subject requests related to them. The district may make the content of individually signed NDPAs, including the personal data of the provider’s EEA-based representatives, publicly available as may be required under US state law or district policy, as allowed by Article 6(1)(c) of the GDPR.
Data subject requests regarding individually signed NDPAs or Exhibit E should be directed to the district as the controller (generally found in the countersignature of the NDPA or Exhibit E). Data subject requests related to processing within the resource registry, which A4L maintains, should be sent to A4L via support@A4L.freshdesk.com
Children’s Privacy
A4L services are not directed toward children under the age of thirteen. A4L does not knowingly collect personal information from children under thirteen without appropriate consent. If A4L becomes aware that personal information from a child under thirteen has been collected without appropriate authorization, A4L will take steps to delete the information.
Changes to This Privacy Privacy
A4L may update this Privacy Policy from time to time to reflect changes in operational practices, legal requirements, or community activities. Updates will be indicated by revising the “Last Updated” date at the beginning of this document.
Continued use of A4L services after changes become effective constitutes acceptance of the revised Privacy Policy.
Contact Information
Questions, concerns, or requests related to this Privacy Policy may be directed to:
Access 4 Learning Community
PO Box 249, Malden MA 02148
A4L will make reasonable efforts to respond to privacy-related inquiries in a timely manner.