Privacy Policy

1. What Personal Information We Collect

When you visit our website, register for an account, request a demo, place an order, or otherwise interact with us, we may collect personally identifiable information ("PII") including your name, company or agency, mailing address, email address, phone number, job title, and (where you provide them) billing contacts and procurement details. Credit card information, if any, is processed through our payment gateway providers and is not stored on our servers.

For users of the AchieveDXP platform itself, we additionally process authentication data (usernames, hashed passwords, federated identity assertions), rostering metadata supplied by the contracting agency, and learner activity (content viewed, assessments completed, credentials earned, hours logged) as required to operate the service on behalf of that agency.

2. When We Collect Information

We collect information from you when you register on our site, request a demo, place an order, complete a contact form, subscribe to communications, or otherwise enter information on our site. We also collect technical information automatically through standard web server logs and analytics tools (IP address, browser type, operating system, referring URLs, pages visited, and similar interaction telemetry).

3. How We Use Your Information

We may use the information we collect in the following ways when you register, request a demo, sign up for communications, respond to a survey or marketing communication, browse the website, or use certain other site features:

• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested;
• To quickly process your transactions and orders;
• To send periodic communications regarding your account, your orders, security notices, platform updates, and (where you have opted in) marketing about our products and services;
• To operate, maintain, secure, and improve the AchieveDXP platform and related services;
• To detect, investigate, and prevent fraud, abuse, or violations of our terms;
• To comply with legal obligations and respond to lawful requests.

4. How We Protect Visitor Information

• We do not use vulnerability scanning and/or scanning to PCI standards on this public website. (AchieveDXP production environments are subject to separate, more stringent security controls described in our Security & Trust page, including FedRAMP-aligned hosting, FIPS 140-2/-3 validated cryptography, and regular third-party penetration testing.)
• We use regular malware scanning.
• Your PII is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential. All sensitive information you supply is encrypted in transit using TLS (Transport Layer Security) and at rest using AES-256.
• We implement a variety of administrative, technical, and physical security measures to maintain the safety of your PII, including role-based access controls and multi-factor authentication for administrative access.
• All payment transactions are processed through a gateway provider and are not stored or processed on our servers.

5. Cookies

Yes, we use cookies. Cookies are small files that a site or its service provider transfers to your computer's hard drive through your web browser (if you allow) that enable the site's systems to recognize your browser and capture and remember certain information. We use cookies to:

• Remember your cookie consent preferences so we do not ask you again on every visit;
• Understand and save your preferences for future visits;
• Maintain authenticated sessions where applicable;
• Keep track of advertisements (where you have consented);
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Each browser is a little different, so look at your browser's Help menu to learn the correct way to modify your cookies. You can also manage your preferences at any time using the Cookie preferences link in our website footer. See our Cookie Policy for full details.

If you disable cookies, some features will be disabled, and your site experience may be less efficient.

6. Protection of Your Phone Number

We value your privacy and are committed to protecting your personal information. SMS consent or phone numbers are not shared for the purpose of SMS with third parties or affiliates.

7. Third-Party Disclosure & Links

We do not sell, trade, or otherwise transfer to outside parties your PII unless we provide you with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or servicing you (such as Microsoft Azure for hosting, payment processors, and customer-support tooling), so long as those parties agree to keep this information confidential. We may also release your information when we believe such release is appropriate to comply with the law, enforce our site policies, or protect our or others' rights, property, or safety. Non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Our public website may contain links to third-party sites. We are not responsible for the content, privacy policies, or practices of any third party.

When you launch a third-party learning application from within AchieveDXP, limited identity and rostering information may be shared with that partner under our integration agreements and your agency's contract.

8. Google, AdRoll & Advertising

Google's advertising requirements can be found at support.google.com/adwordspolicy.

We use AdRoll advertising on our website. AdRoll, as a third-party vendor, uses cookies to serve ads on our site. AdRoll's use of the pixel enables it to serve ads to our users based on their visit to our site and other sites on the Internet. We have implemented Remarketing with AdRoll and Demographics and Interests Reporting.

We, along with third-party vendors such as Google, may use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie or other third-party identifiers) together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.

Opting out: You can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising Initiative opt-out page or permanently using the Google Analytics Opt Out Browser add-on. Our partners (such as NextRoll) may use non-cookie technologies that may not be impacted by browser settings that block cookies. You can also use the following third-party tools to decline the collection and use of information for the purpose of serving you interest-based advertising:

• The NAI's opt-out platform: networkadvertising.org/choices
• The EDAA's opt-out platform: youronlinechoices.com
• The DAA's opt-out platform: optout.aboutads.info

9. Do Not Track Signals

We honor "Do Not Track" signals and do not track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place. We also honor the Global Privacy Control (GPC) signal where required by law.

10. COPPA & Children's Privacy

When it comes to the collection of PII from children under 13, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation's consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children's privacy and safety online.

Our public marketing website is not directed to children under 13, and we do not knowingly collect PII from children under 13 through this website.

11. Student Data (FERPA & State Laws)

When iT1 Nucleos acts as a "school official" or "service provider" under the Family Educational Rights and Privacy Act (FERPA), state student data privacy laws, or under our contracts with K-12 districts, higher education institutions, correctional agencies, or other educational organizations, we process student personal information solely on behalf of the contracting institution. We do not use student personal information for advertising, do not sell it, and do not retain it beyond the contracted term except where required by law. Inquiries about specific student records should be directed to the contracting institution, which acts as the data controller for those records.

12. CAN-SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to send you information about our products and services, respond to inquiries, and (where applicable) confirm orders or process transactions. To be in accordance with CAN-SPAM, we agree that if at any time you would like to unsubscribe from receiving future emails, you can email us at info@iT1.com and we will promptly remove you from ALL correspondence.

13. California Consumer Privacy Act (CCPA / CPRA)

This section is intended to comply with the California Consumer Privacy Act of 2018 (CCPA) and the regulations promulgated thereto, each as amended, including pursuant to the California Privacy Rights Act of 2020 (CPRA). Any terms defined in the CCPA have the same meaning when we use them in this section.

This section does not apply to or describe information that is not PII or is otherwise exempt from the CCPA, including publicly available information from government records, information that a business has a reasonable basis to believe is lawfully made available to the general public, de-identified or aggregated consumer information, and information excluded from the CCPA's scope (such as HIPAA-covered health information, GLBA-covered financial information, or FCRA-covered consumer report information).

Categories of PII we have collected

While our processing of PII varies based upon our relationship and interactions with customers, the categories of PII (as defined by the CCPA) that we may have collected about California users include:

• A. Identifiers — name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or other similar identifiers.
• B. Personal information categories listed in the California Customer Records statute — name, signature, address, telephone number, education, employment, employment history, bank account number, credit card number, debit card number, or other financial information.
• C. Protected classification characteristics — age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression), sexual orientation, veteran or military status (only as voluntarily provided or as relevant to a specific learning program).
• D. Commercial information — records of products or services purchased, obtained, or considered, or other purchasing or consuming histories.
• F. Internet or other similar network activity — browsing history, interaction with our website, application, or advertisement.
• G. Geolocation data — general physical location inferred from IP address.
• I. Professional or employment-related information — current or past job history, job title, employer.
• J. Education information — non-public education information (per FERPA) is processed only as a service provider to the contracting institution and is not used for our own commercial purposes.
• K. Inferences drawn from other personal information — profile reflecting a user's preferences and learning history (in AchieveDXP, on behalf of the contracting agency).
• L. Sensitive Personal Information — account log-in credentials in combination with required security or access codes; we do not knowingly collect other categories of sensitive personal information from California users through our public website.

We do not "sell" or "share" (as defined by the CCPA) PII about California residents, including those we know to be under sixteen (16) years of age.

Your CCPA rights

The CCPA provides California users with specific rights regarding their PII, as further described below. We will respond to your requests as required by and subject to certain exceptions and limitations set forth in the CCPA.

• Right to Know / Access. You may request, up to twice per year, that we disclose certain information to you about our collection and use of your PII, including categories collected, sources, purposes, third parties with whom we share it, and the specific pieces of PII we have collected about you.
• Right to Delete. You may request that we delete any PII we collected from you and retained, subject to certain exceptions.
• Right to Correct. You may request that we correct inaccurate PII we maintain about you.
• Right to Opt Out of Sale or Sharing. As noted above, we do not currently "sell" or "share" PII about California residents.
• Right to Limit Use and Disclosure of Sensitive PII. California users have the right to direct us to limit certain uses and disclosures of sensitive PII; however, we do not use or disclose sensitive PII beyond authorized purposes.
• Right to Non-Discrimination. California users have the right to exercise their CCPA rights without being subject to discriminatory treatment or retaliation.

To exercise these rights, please submit a verifiable consumer request by calling 1-877-777-5995 or emailing info@iT1.com. We will endeavor to respond to a verifiable consumer request within 45 days of receiving it. If we require more time (up to a total of 90 days), we will inform you of the reason and extension period in writing. Authorized agents may submit requests on behalf of another consumer with proof of authorization.

14. EEA, UK & Switzerland (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss laws, including the rights of access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint with your supervisory authority. To exercise these rights, contact us at info@iT1.com. Our production infrastructure is hosted in the United States; where required, we rely on Standard Contractual Clauses or equivalent safeguards for international transfers.

15. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. We will provide notice of any material changes we make to this Privacy Policy, such as through a notice on our website homepage or via email. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

16. Contact Us

If there are any questions regarding this Privacy Policy you may contact us using the following information:

iT1 / iT1 Nucleos
1860 W. University Drive, Suite 100
Tempe, AZ 85281
Office: (877) 777-5995
Email: info@iT1.com