Privacy Policy

01

Introduction

HECUA stands for Higher Education Consortium for Urban Affairs. HECUA is a nonprofit consortium of over twenty colleges and universities. Founded in 1971, HECUA has a history of providing experiential off-campus programs in collaboration with local communities in the United States and abroad. HECUA is based in St. Paul, Minnesota.

A privacy policy explains how an organization handles personal information in connection with the websites or services covered by that policy. This policy should describe the information HECUA collects or receives, why it is used, when it may be shared, how long it is retained, and the choices that may be available to relevant individuals.

This policy should apply only to the HECUA website, pages, forms, and services that HECUA confirms are within its scope. It should not be interpreted as applying automatically to every HECUA activity, partner institution, third-party website, application, or service.

Questions about this policy or HECUA’s handling of personal information may be sent to support@hecua.org.

02

Information We Collect

This section must identify only the categories of personal information HECUA actually collects or receives through the website and covered services.

Information provided directly by visitors

HECUA must confirm whether visitors can provide personal information through contact forms, email communications, program inquiries, applications, registrations, or other website forms. The policy should identify the data fields and purposes associated with each confirmed submission method.

Information collected automatically

HECUA must determine whether its website or service providers automatically receive technical or usage information, such as an IP address, browser or device details, operating-system information, referring pages, access timestamps, usage activity, or diagnostic logs. Only confirmed categories should appear in the final policy.

Cookies and similar technologies

Any collection through essential, analytics, preference, advertising, or other tracking technologies must be documented only after the website’s configuration has been reviewed.

Information received from other sources

HECUA must confirm whether it receives personal information from academic institutions, external organizations, service providers, or any other source, and document the relevant categories and purposes if it does.

03

How We Use Information

The final policy must describe, in plain language, each purpose for which HECUA actually processes personal information. Potential purposes requiring verification include responding to inquiries, communicating with visitors, providing program information, processing submissions, maintaining the website, troubleshooting technical issues, protecting website security, understanding website performance, or meeting applicable legal obligations.

No purpose—including marketing, research, profiling, behavioral advertising, or automated decision-making—should be included unless HECUA confirms that it applies. Any applicable legal basis for processing also requires review and must not be inferred.

04

Cookies and Similar Technologies

Cookies are small data files that a website may place on or read from a visitor’s device. Related technologies may perform comparable functions. Their use varies by website and must be confirmed for HECUA before this section is finalized.

If applicable, the final policy should identify the technologies used, their purposes, the categories of information involved, relevant third-party providers, available browser controls, and any consent or preference-management process. It should not list cookie names, expiration periods, providers, or effects of disabling technologies unless those details have been verified.

05

How Information May Be Shared

HECUA must confirm whether personal information is disclosed to any recipients and the circumstances in which disclosure occurs. Possible categories for review include hosting or infrastructure providers, communication providers, analytics providers, educational or administrative service providers, recipients authorized by documented organizational practices, and disclosures required by applicable law.

For every confirmed disclosure, the final policy should identify the category of recipient, the purpose of sharing, and any supported safeguards. It should not name companies or describe contractual protections without evidence. It also should not state that HECUA sells, rents, or never sells personal information until that statement has been verified.

06

Data Retention

The final policy should explain how HECUA determines how long each relevant category of personal information is retained. The description may address the purpose for collection and applicable legal or administrative requirements, but only when confirmed.

No fixed retention period or automatic deletion, anonymization, or destruction process is stated in this draft because those practices have not been supplied.

07

Data Security

This section should accurately describe the administrative, technical, and organizational practices HECUA uses to protect personal information. Relevant details may include access controls, staff procedures, internal policies, or incident-response practices, but each detail must be verified.

No method can guarantee complete security. The final language should describe risks and safeguards in measured terms without claiming specific technologies, certifications, encryption, multi-factor authentication, or continuous monitoring unless confirmed.

08

Privacy Rights and Choices

Privacy rights vary according to applicable law, jurisdiction, the individual’s relationship with HECUA, and the circumstances of processing. This draft does not assume that every visitor has every possible right.

HECUA must determine whether relevant individuals may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and whether marketing opt-out choices apply. The final policy should also explain the confirmed request method, identity-verification process, exceptions, deadlines, and any appeal mechanism.

Questions may currently be directed to support@hecua.org; HECUA must confirm whether this email address is also the approved method for formal privacy requests.

09

Children’s Privacy

HECUA must confirm whether the website or covered services are directed toward children, whether information relating to minors may be collected, and whether age-related safeguards or parental or guardian consent requirements apply.

The final policy should explain how concerns about a minor’s information can be reported. This draft does not establish a minimum age or claim compliance with a particular children’s privacy law.

10

Third-Party Websites and Services

External websites and services may maintain their own privacy terms and practices. HECUA must verify whether the website links to or integrates with partner institutions, payment providers, analytics systems, embedded content, external applications, or other third-party services.

The final policy should distinguish HECUA-controlled services from external services and accurately explain the extent to which this policy applies. No specific third-party platform or external URL is identified in this draft.

11

International Data Transfers

HECUA’s history of educational programming in the United States and abroad does not, by itself, establish that personal information is transferred across national borders.

If international transfers occur, the final policy should identify the relevant information categories, countries or jurisdictions where appropriate, applicable legal requirements, and the safeguards actually used. No transfer mechanism or contractual arrangement is asserted in this draft.

12

Changes to This Privacy Policy

This page should be reviewed and updated when HECUA’s verified privacy practices or applicable requirements change. The current version is dated October 10, 2026.

This draft does not state that HECUA will provide updates through email, website alerts, or another notification method because no such process has been confirmed.