California Privacy Notice

California Privacy Rights (CCPA/CPRA)

Effective date: [EFFECTIVE DATE — set before publishing]

This notice supplements our Privacy Policy and applies only to California residents ("consumers"), as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). It describes the personal information we collect and how California residents can exercise their rights. It does not apply to personal information exempt from the CCPA, including certain information governed by FERPA.

Categories of Personal Information We Collect

In the preceding 12 months, we may have collected the following categories of personal information (as defined by the CCPA):

• Identifiers — such as name, postal address, email address, phone number, IP address, and online identifiers;
• Customer records — contact and demographic details you provide;
• Protected classifications — such as age or gender, where you choose to provide them;
• Commercial information — records of transactions such as gifts or event registrations;
• Internet or network activity — browsing and interaction with our sites;
• Geolocation data — general location derived from IP address;
• Professional or education information — where relevant to admissions or employment;
• Inferences — drawn from the above to reflect preferences and interests; and
• Sensitive personal information — [confirm whether any is collected; e.g., account log-in credentials — otherwise state none].

Sources of Personal Information

We collect personal information directly from you, automatically through your use of our sites, and from third parties such as analytics and marketing providers, as described in our Privacy Policy.

Purposes for Collecting Personal Information

We use personal information for the business and commercial purposes described in the "How We Use Your Information" section of our Privacy Policy, including responding to inquiries, processing applications, operating and improving our sites, communications, analytics, security, and legal compliance.

Categories of Personal Information Disclosed

In the preceding 12 months, we may have disclosed the categories of personal information listed above to service providers and contractors for business purposes, and to third parties as described in our Privacy Policy.

Sale or Sharing of Personal Information

We do not sell personal information for money. We may "share" certain identifiers and internet activity information with advertising partners for cross-context behavioral advertising, which may be considered "sharing" (and in some cases a "sale") under the CCPA. [Confirm current advertising/analytics practices and update this statement accordingly before publishing.] We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your California Privacy Rights

Subject to certain exceptions, California residents have the right to:

• Know the categories and specific pieces of personal information we have collected about you;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of your personal information;
• Limit the use and disclosure of sensitive personal information; and
• Not be discriminated against for exercising your rights.

How to Submit a Request

You or your authorized agent may submit a request to know, delete, or correct by contacting us:

• Email: privacy@bvu.edu
• Phone: (800) 383-9600
• [Add a toll-free number and/or online request form if required.]

To protect your information, we will take steps to verify your identity before fulfilling a request, and may ask for information to match against what we hold. Authorized agents must provide proof of authorization. We will respond within the timeframes required by the CCPA.

Do Not Sell or Share & Global Privacy Control

To opt out of the sale or sharing of your personal information, contact us using the details above [or use the "Do Not Sell or Share My Personal Information" link once implemented]. We also recognize the Global Privacy Control (GPC) browser signal as a valid opt-out request for the browser and device on which it is enabled.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights, including by denying services, charging different prices, or providing a different level of quality, except as permitted by law.

Changes to This Notice

We may update this California Privacy Notice from time to time. When we do, we will revise the effective date above.