Effective as of October 4, 2021
Candy.com is owned and operated by Candy Digital, Inc., a Delaware corporation, and/or its affiliates(“Company,” "we," "us," “our,” or “Candy Digital”).
We know you care about what information may be collected from and about you, how such information is used and shared, and the choices you have.
a. Directly From You. We may collect personal information during your access or use of the Properties and through other online and offline interactions, such as when you sign up for marketing, make purchases, create an account, contact us for customer service or other assistance, and participate in promotions.
b. From Your Friends. If you consent, your friends and contacts may provide personal information about you in connection with a “friend” referral program and for other purposes. You should only provide us with information about another person if you have the right to provide that person’s information.
c. Cookies and Tracking Technologies. When you access or use the Properties, we may collect data about your device, internet usage, location, website activity, and other details about your use of theProperties through cookies and other tracking technologies. For further information on these practices, see Section 5 – “Cookies and Other Tracking Technologies.”
d. Service Providers. We may collect personal information from service providers who are assisting us in the supply of our products or services and carrying out our business, such as to provide a platform to sell third party products and services, and provide customer assistance.
e. Other Third Parties and Publicly Available Information. We may collect personal information from other third parties that provide information to us, such as Business Partners, advertising networks, data brokers, government and other public sources, and social media platforms and networks. “BusinessPartners” are third parties with whom we share personal information for their (or their service providers’)own purposes, such as for marketing purposes, and from whom we may receive personal information.For more information about Business Partners, see Section 4.f, below.
Types of Personal Information Collected
We may collect the following types of information about you:
a. Identifiers, characteristics, and other information you provide, such as your contact information(including your name, email address, postal address, and telephone number), gender and other demographic information, payment method and payment information, authentication information you create (such as account password), birthdays, professional and educational information, and device identifiers (such as advertising IDs, pixel and cookie IDs, IP address, ICCID).
b. Internet and other electronic activity that is gathered automatically when you visit our Properties or interact with our App or advertisements, such as browsing and search history, browser information, device type, app, and OS version.
c. Geolocation information, such as IP-based or precise geolocation information. This may be collected automatically (such as through our App) or based on information you provide.
d. Commercial information and preferences, such as purchase information, favorite teams and players, non-fungible tokens and virtual collectibles (“NFTs”), and other preferences.
e. Audio, visual, and similar information, such as when you call us or provide pictures or other content.
f. Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences and characteristics.
a. To provide you with products and services, such as to respond to your inquiries, process transactions and payments, fulfill your order, communicate with you, authenticate users, verify your eligibility for certain programs or benefits, and otherwise facilitate your relationship with us.
b. For marketing, such as to market Candy Digital goods and services or goods and services of those of our affiliates, Business Partners, and other third parties. You can always unsubscribe to Candy Digital email marketing via a link in the email. We may make additional methods available to you from time to time for you to unsubscribe from marketing. In addition, if you have provided us with a mobile phone number and we have separately obtained your consent to participate in our SMS marketing campaigns on behalf of ourselves or our affiliated entities, we may use such information in accordance with that separately obtained consent.
c. For insights, such as to identify trends and make inferences about you and your interactions with us or our affiliates and Business Partners, such as to analyze your behavior and preferences, and to evaluate and improve the products and services of our affiliates and Business Partners.
d. To comply with legal obligations, including keeping records required by law or to evidence our compliance with laws or to provide information to law enforcement.e. For internal business and operational purposes, such as:i. For our internal business administration, such as to manage customer accounts, including keeping general records of customers, sales, customer care, and other interactions;ii. Auditing related to our interactions with you;iii. For security purposes, such as to protect genuine customers and our business from fraud, to minimize the risk of false details being used, and to avoid abuse by fraudsters;iv. To manage competitions or other promotions that you have chosen to participate in;v. To comply with contractual obligations;vi. To improve or develop our products and services (including our marketing activity more generally), including operating our Properties and improving or personalizing your experience(such as building profiles about you or how you interact with us); andvii. For internal research and quality assurance.We may use de-identified, anonymized, or aggregated versions of your personal information for any purpose.
a. Affiliates: We may share your personal information with our affiliates, parents, and subsidiaries.
b. Service Providers: We may permit our vendors and subcontractors to access your personal information in connection with performing services for us. For example, in order to process your transactions, we may share your personal information with certain third parties, such as your credit card issuer, a third party credit verification company, the product handler, the delivery service, and vendors who may ship product to you directly from their warehouse (called drop-ship vendors). Other service provider examples include IT providers, internet service providers, and data analytics providers. We also use service providers to help us anticipate, prevent, and detect fraud. Before personal information is disclosed to such a party, we endeavor to require the party to agree to protect the privacy and confidentiality of your personal information.
c. With Third Parties to Provide You with Services or Communications: We may disclose your information to third parties to provide you with services or benefits. For example, if you participate in our auction programs, we may share your personal information with Business Partners and other third parties to operate the program.
d. With others for Legal, Security, or Safety Purposes: We may share your personal information: (i) as required by law or legal process; (ii) to prevent or investigate suspected or possible fraud, harassment, or other violations of any law, rule, or regulation; and (iii) to prevent or investigate suspected or possible violations of any terms or policies applicable to the Properties or the services provided by us or our third party providers or affiliates.
e. In Connection with a Corporate Transaction: We also may transfer your personal information in connection with a sale, merger, change of control, bankruptcy, or similar transaction.
f. With Business Partners for their Own Purposes: We may share your personal information withBusiness Partners. In many cases, such sharing is related to our operation of the Properties, such as sharing your personal information with a Business Partner (or their service providers), when you purchase that Business Partner's products or services (e.g., a brand, sports league, team or university/college/athletic department). Other examples of Business Partners that might receive your information include social networks, partners who work with us on promotional or sponsorship opportunities available on our properties, data analytics companies and other companies that may use the data to help us drive advertising-related revenue (including those who may have registered in California as a“data broker”), and partners who advertise on our sites to measure advertising effectiveness. We do not control how Business Partners use and share your information once they receive it. You will need to contact such Business Partners directly for information about their privacy practices or to exercise rights you may have (including if you would like to opt-out of receiving future emails from a BusinessPartner).
g. With other third parties with your consent.
Like many other websites and applications, we may automatically collect certain information regarding ourProperties' users. Such information may include, without limitation, the Internet Protocol ("IP") address (which may be used to determine your geographic location) of your computer/internet service provider, your device ID, your zip code, the date and time you access the Properties, the Internet address of a referring website, the operating system you are using, the sections or pages of the Properties that you visit, and the images and content viewed. Some of the ways in which we or the Properties may collect and use such information are further described below.
Additionally, we may employ, either directly or through trusted third parties, tracking pixels. Tracking pixels are tiny, transparent graphics with a unique identifier, similar in function to cookies, and are used to provide analytical information concerning the user experience as well as to support custom marketing activities for users of the Properties. In contrast to cookies, which are stored on a user's computer hard drive, tracking pixels are embedded invisibly on web pages. The Properties may use tracking pixels to help us better manage content, such as by improving the user interface or improving our marketing programs or the marketing of our affiliates, Business Partners, and other third parties (including for Interest-Based Advertising as described below). The Properties may use information to create aggregate tracking information reports regarding user demographics, traffic patterns and purchases. We may also link tracking information with personal information.
Cross Device Matching. We may now or in the future have the ability to match your devices using the data collected, making educated predictions, and, in some cases, using deterministic data (e.g., unique identifiers)or other content across devices. We may then, subject to the limitations otherwise set forth in this PrivacyPolicy and applicable law, display targeted advertisements to you across your devices unless it is an OptedOut Device (as defined below) as further described in the Interest-Based Advertising Section below.
Blockchain DataIf you use Candy Digital NFT products, some information is publicly available information and may be seen by other users of the Candy Digital blockchain. Publicly available information includes your blockchain address(es), the time and date your transactions are finalized on the Candy Digital blockchain, the amounts and currency denominations of the transactions, and the other blockchain address(es) that are parties to any transactions you have made on the blockchain.
Interest-Based AdvertisingWe may use information we collect (alone or in combination with information provided by third parties and service providers) to deliver targeted advertising (about Candy Digital or other third party products and services) to you when you visit our Properties or other websites. Information about you (such as email address) as well as cookies and other tracking technologies (described above) may be used in this process.For example, if you are searching for information on a particular product, we may use that information to cause an advertisement to appear on other websites you view with information on that product. We may, now or in the future, have the ability to engage in “cross-device matching” to display targeted advertisements to you across browsers and devices (as described in Section 5 above).To further clarify, we partner with third parties that collect information across various channels, including offline and online, for purposes of delivering more relevant advertising to you or your business. Our partners may place or recognize a cookie on your computer, device, or directly in our emails/communications, and we may share personal information with them if you have submitted such information to us, such as your name, postal address, email address, or device ID. Our partners use this information to recognize you across different channels and platforms, including but not limited to, computers, mobile devices, and Smart TVs, over time for advertising, analytics, attribution, and reporting purposes.If you would like to opt-out of these interest-based advertisements or “cross-device matching,” please see theOpt-Out Process/Options and Additional Terms below in Section 11.
Data RetentionWe will retain your personal information for as long as your account is active (as determined by us) and for a reasonable time thereafter, or such other time period as prescribed by law. We also may retain your personal information for a longer period of time as needed to provide you services or as necessary to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Even if we delete some or all of your personal information, we may continue to retain and use aggregate, anonymous data previously collected and/or anonymize and aggregate your personal information.
We are committed to the preservation of online privacy for all of our visitors, including children. We sell services and products intended for purchase by adults (i.e., those age 18 or older). If you make a purchase on our Properties, you are representing that you are an adult. We will not knowingly collect any personal information from children under the age of 18 without the consent of that child's parent or guardian. If you are a child under the age of 18, you are not authorized to use the Properties without consent from your parent or legal guardian. If we become aware that personal information from a child under 18 has been collected without such child's parent or guardian's consent, we will use all reasonable efforts to delete such information from our database. If any parent, guardian or other responsible adult becomes aware that we have collected personal information from a child under the age of 18, please contact us at [email protected].
Under California Civil Code Section 1798.83 (“Shine the Light”), California residents have the right to request in writing from businesses with whom they have an established business relationship: (a) a list of the categories of personal information, as defined under Shine the Light, such as name, email address and mailing address and the type of services provided to the customer that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. If you are a California resident: (i) to request the above information, or (ii) if you do not want your personal information shared with any third party who may use such information for direct marketing purposes and wish to opt out of such disclosures, please contact us by email at [email protected] note that under Shine the Light, we are not responsible for removing your personal information from the lists of any third party who has previously been provided with your information, and any elections or privacy choices you may make with respect to receipt of certain types of e-mails or marketing communications from us will not apply to any such third parties. You should directly contact any third parties that send you communications regarding choices that they may make available to you concerning such communications.
If you are a Nevada resident, you have the right to request that we do not sell your covered information (as those terms are defined in N.R.S. 603A) that we have collected, or may collect, from you. We do not sell your covered information, however, if you would like to make such a request you may do so by contacting us [email protected].
We collect information that identifies, relates to, describes, references, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.The California Consumer Privacy Act of 2018 (“CCPA”) refers to such information as “personal information.” If you are a California consumer, as defined by the CCPA, the CCPA provides you with specific rights regarding your personal information. This section describes the rights that California consumers have and explains how to exercise those rights. For the purposes of this section, personal information does not include: (i) information that is lawfully made available from federal, state or local government records; (ii) de-identified or aggregated data; or (iii) information excluded from the scope of the CCPA. To be clear, these rights are granted only to the extent that you are a California consumer under CCPA. The rights in this section are not intended to grant you additional rights, but only your rights under the CCPA.
Information We Collect; How We Collect It; How We Use It
Information about our data collection during the prior 12 months is described below.
● To fulfill or meet the reason you provided the information.
● To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
● As described to you when collecting your personal information or as otherwise set forth in the CCPA.
● To help maintain the safety, security, and integrity of our Website, Services, databases and other technology assets, and business.
● For internal research for technological development and demonstration and to improve, upgrade, or enhance our Website and Services.
● For detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
● In emergency situations to protect the personal safety of us, our users, or the public.
● To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Candy Digital’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Candy Digital about ourWebsite and Service users is among the assets transferred.Sharing of Personal InformationCandy Digital may disclose your personal information to a third party for a business purpose or sell your personal information, subject to your right to opt out of those sales (see Personal Information Sales Opt-Out and Opt-In Rights, below). The chart found above under Information We Collect; How We Collect It; How WeUse It lists the categories of third parties with which we may share your personal information.Rights to Your InformationRight to Know About Personal Information Collected, Disclosed or SoldAs a California consumer, you have the right to request that we disclose certain information to you about our collection, use, disclosure or sale of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Access and Deletion Rights, below), and subject to certain limitations that we describe below, we will disclose such information. You have the right to request any or all of the following:
● The categories of personal information we collected about you.
● The categories of sources from which the personal information is collected.
● Our business or commercial purpose for collecting or selling that personal information.
● The categories of third parties with whom we share that personal information.
● The specific pieces of personal information we collected about you (also called a data portability request).
Deletion Request Rights
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (seeExercising Access, Data Portability, and Deletion Rights, below), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. However, we maybe retain personal information that has been de-identified or aggregated. Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) in order to perform certain actions set forth under CCPA, such as detecting security incidents and protecting against fraudulent or illegal activity.
Exercising Access and Deletion Rights
Only you, or a person or business entity registered with the California Secretary of State that you authorize to act on your behalf (an “authorized agent”), may make the requests set forth above.
The request should include your contact information and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. In addition, you should provide sufficient information that allows us to reasonably verify that you are the person about whom we collected the personal information or an authorized representative of that person.For more information about verification, see Response Timing and Format immediately below.
Response Timing and Format
We will respond to consumer requests in a reasonably timely manner. If we require extra time to respond, we will inform you of the reason and extension period in writing. In order to protect the security of your personal information, we will not honor a request if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. The method used to verify your identity will depend on the type, sensitivity and value of the information, including the risk of harm to you posed by any authorized accessor deletion. Generally speaking, verification will be performed by matching the identifying information provided by you to the personal information that we already have.Any disclosures we provide will only cover the 12-month period preceding our receipt of your request (and will not be made more than twice in a 12-month period). If we cannot comply with a request, in whole or in part, the response we provide will also explain the reasons we cannot comply.Personal Information Sales Opt-Out and Opt-In RightsYou have the right to direct us to not sell your personal information at any time (the "right to opt-out"). We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is at least 16 and less than16 years of age, or the parent or guardian of a consumer less than 16 years of age. To our knowledge, we do not sell the personal information of minors under 16 years of age.To exercise the right to opt out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page:"Do Not Sell My Personal Information"Alternatively, you may submit an opt-out request by visiting: candy.com/FAQ.
You may change your mind and opt back in to personal information sales at any time by visiting the followingInternet Web page: OPT-IN INSTRUCTIONSNon-DiscriminationWe will not discriminate against you for exercising any of your CCPA rights, including but not limited to, by:
● Denying you goods or services.
● Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.● Providing you a different level or quality of goods or services.
● Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.18. Additional European DisclosuresIF YOU ARE SITUATED IN THE EUROPEAN ECONOMIC AREA, SWITZERLAND, OR THE UNITED KINGDOM, THIS SECTION APPLIES TO OUR COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL DATA AND ADDITIONAL RIGHTS YOU HAVE UNDER APPLICABLE LAW.Legal BasisWe will only use your personal data, as that term is defined under the General Data Protection Regulation(“GDPR”), when the law allows us to. Most commonly, we will use your personal data in the following circumstances:● Where we need to perform the contract we are about to enter into or have entered into with you.
● Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
● Where you have consented to a certain use of your personal data.
● Where we need to comply with a legal or regulatory obligation.To the extent permitted under applicable laws, we will also process, transfer, disclose, and preserve personal data when we have a good faith belief that doing so is necessary.Data controllerCandy Digital is the data controller of all personal data collected through our Services. To contact us, please see the section titled Contact.If you are situated in the EEA, Switzerland, or the UK and have any complaints regarding our privacy practices, you have the right to make a complaint at any time to your local supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach your supervisory authority so please contact us in the first instance. If you have a complaint, please contact our privacy manager can be contacted here: [email protected] of personal data and failure to provide personal dataWhere we need to collect personal data by law or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may not be able to provide certain services to you.Collection of personal data from third party sources
We may obtain personal data and other information about you, some of which may include personal data collected from public sources, through our third-party partners who help us provide our products and services to you. We will obtain cookie data about you from Google Analytics.Withdrawing your consentIf we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time by contacting us at [email protected].
We may transfer personal data from the EEA, Switzerland, or the UK to the USA and other countries, some of which have not been determined by the European Commission or UK data protection authorities to have an adequate level of data protection. Where we use certain service providers, we may use specific contracts approved by the European Commission or UK data protection authorities which give personal data the same protection it has in the EEA, Switzerland, or the UK. For more information about how we transfer your data, please contact us at [email protected] of your personal data for marketing purposesWe strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising:
● Promotional offers from us: We may use your personal data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers maybe relevant for you (we call this marketing). You will receive marketing communications from us if you have requested information from us or used our services and, in each case, you have consented to our use of your personal data for marketing purposes.Data Subject RightsIf you are a situated in the EEA, Switzerland, or the UK, as a data subject, you have the right to:
● Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
● Request correction of the personal data that we hold about you. This enables you to have any in complete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
● Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
● Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
● Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
● Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
● Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
To exercise your rights under the GDPR, please contact us at [email protected]. Please note that in order for you to assert these rights, we may need to verify your identity to confirm your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. In order to verify your identity, we may need to gather more personal data from you than we currently have.
180 Madison Avenue, 21st Floor
New York, NY 10016
or by email at: [email protected]
To the extent you believe we have not addressed your concerns or otherwise choose to do so, you have the right to lodge a complaint with a supervisory authority. You may contact the US Federal Trade Commission regarding your concerns.
|Category||Examples||Purposes for Which SuchInformationWasCollected in the Preceding 12Months orWill be Used||Categories of Sources From Which Personal Information Has Been Collected in the Preceding 12 Months or will be Collected||Categories of Third Parties With Whom the Website Shares Personal Information||Disclosed by CandyDigital in the Preceding Twelve (12)Months for a Business Purpose||“Sold” (as defined byCCPA) by Candy Digital in the Preceding Twelve (12)Months|
|A. Personal identifiers.||A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.||See Sections3.a-e; 4.a-f; and 7.||See Sections1.a-e.||See Sections4.a-g.||YES||YES|
|B. Personal information covered by the California Customer Records statute (Cal.Civ. Code §1798.80(e)).||Some personal information included in this category may overlap with other categories.A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.||See Sections3.a-e; 4.a-f.||See Sections1.a-e.||See Sections4.a-g.||YES||YES|
|C. Protected classification characteristics under California or federal law.||Age (40 years or older),race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex(including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions),sexual orientation, veteran or military status, genetic information(including familial genetic information).||See Section3.d, e(ii)-(iii).||See Sections1.d-e.||See Sections4.a-b, d-e, g.||YES||NO|
|D.Commercial information.||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||See Sections3.a-e; and4.a-e, g.||See Sections1.a, c-e.||See Sections4.a-g.||YES||YES|
|F. Internet or other similar network activity.||Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.||See Sections3.a-e; 4.a-g; and 7.||See Sections1.c-e.||See Sections4.a-g.||YES||YES|
|G. Location data.||Physical location or movements.||See Sections3.a-e; 4.a-g; and 7.||See Sections1.a, c-e.||See Sections4.a-g.||YES||YES|
|H. Sensory data.||Audio, electronic, visual, thermal, olfactory, or similar information.||See Sections3.a, c-e; and4. a-b, d-e, g.||See Sections1.a, d-e.||See Sections4.a-b, d-e, g.||YES||NO|
|I. Professional or employment related information.||Current or past job history or performance evaluations.||See Sections3.a, c-e; and4. a-b, d-e, g.||See Sections1.d-e.||See Sections4. a-b, d-e, g.||YES||NO|
|J. Non-public education information(per theFamilyEducationalRights andPrivacy Act(20 U.S.C.Section1232g, 34C.F.R. Part99)).||Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.||See Sections3.a-e; and 4.a-b, d-e, g.||See Sections1.d-e.||See Sections4. a-b, d-e, g.||YES||NO|
|K. Inferences drawn from other personal information for profiling purposes.||Used to create a profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.||See Sections3.a-e; 4.a-g; and 7.||See Sections1.c-e.||See Sections4.a-g.||YES||YES|