Legal
Privacy Policy
Organizational Commitment to Privacy
Borel Educational Consulting Services ("Borel," "we," "us," or "our") is committed to protecting the privacy and security of personally identifiable information (PII) of all learners, participants, and users in accordance with the ANSI/IACET 1-2018 Standard for Continuing Education and Training. This Privacy Policy establishes our comprehensive framework for the collection, use, storage, protection, and disposal of personal information in connection with our continuing education and training services.
1. Scope and Responsibility
This policy applies to all personally identifiable information collected, processed, stored, or transmitted by Borel Educational Consulting Services in connection with: continuing education and training programs; IACET CEU-eligible learning events; learner registration and record management; assessment and certification processes; and all digital platforms and services operated by Borel.
The Chief Data Protection Officer (cdb@borelonline.com) maintains ultimate responsibility for privacy policy implementation, compliance monitoring, and incident response. All staff members are required to complete annual privacy training and adhere to established data handling protocols.
2. Learner Records and Educational Privacy
Educational records include any record directly related to a learner and maintained by Borel Educational Consulting Services, including but not limited to: registration and enrollment information; assessment results and grades; attendance records; CEU transcripts and certificates; learning outcomes documentation; and progress tracking data.
In accordance with ANSI/IACET 1-2018 Standard Category 8 (Awarding the IACET CEU and Maintaining Learner Records), learners have the right to: access their educational records; request corrections to inaccurate information; understand how their information is collected and used; receive notification of any data security incidents; and request restriction of information sharing (subject to legal limitations).
Learner records shall be maintained for a minimum of seven (7) years following completion of the learning event, or longer as required by applicable law or accreditation standards. Records may be maintained in electronic or physical format, subject to appropriate security controls.
3. Information Collection and Classification
Learner Registration Information collected includes: name, address, email, telephone number; professional credentials and affiliations; educational background; and employment information. Learning Activity Data includes: course enrollment and completion status; assessment scores and learning outcomes; attendance and participation records; and CEU awards and certificates. Technical Information includes: IP addresses and device identifiers; browser type and operating system; website usage patterns and preferences; and learning management system interactions.
All personally identifiable information is classified according to sensitivity levels. High Sensitivity: assessment results, grades, disciplinary records, financial information. Medium Sensitivity: contact information, employment data, learning preferences. Low Sensitivity: general demographic information, program participation.
Information is collected from: direct learner input during registration and participation; automated collection through learning management systems; third-party educational partners (with appropriate agreements); and public records where relevant to educational purposes.
4. Data Security and Protection Measures
BECS applies the Four "E's" of Data Security. ENCRYPT: All sensitive personally identifiable information is encrypted both in transit and at rest using industry-standard encryption protocols (minimum AES-256). ELIMINATE: Data that is no longer necessary for educational, legal, or accreditation purposes is securely deleted according to established retention schedules. EDUCATE: All personnel receive annual training on privacy policies, data handling procedures, and security incident response protocols. ENFORCE: Access controls, monitoring systems, and compliance auditing ensure adherence to privacy policies and prompt detection of violations.
Technical safeguards include: multi-factor authentication for system access; role-based access controls with principle of least privilege; regular security assessments and vulnerability testing; encrypted data transmission (SSL/TLS); and secure backup and disaster recovery procedures.
Administrative safeguards include written information security policies and procedures, regular staff training and awareness programs, incident response and breach notification procedures, vendor management and third-party agreements, and regular policy review and updates. Physical safeguards include secure facilities with controlled access, locked storage for physical records, secure disposal of hardware and documents, and environmental controls for data centers.
5. Information Use and Disclosure
Personal information is used to: deliver continuing education and training programs; assess learning outcomes and award CEUs; maintain accurate educational records; communicate with learners regarding programs; and improve educational services and curriculum.
Information may be shared without consent in the following circumstances: to educational officials with legitimate educational interests; to accrediting bodies for compliance purposes; to government agencies as required by law; in response to valid legal process (subpoenas, court orders); and to protect health and safety in emergency situations.
When engaging third-party vendors for educational technology, data processing, or other services, Borel ensures: written agreements governing data protection; vendor compliance with applicable privacy laws; regular monitoring of vendor security practices; and notification requirements for data incidents. Learners may opt out of promotional communications while continuing to receive essential educational notices. Marketing communications are governed by applicable laws (CAN-SPAM, GDPR where applicable).
6. Learner Rights and Procedures
Learners may request access to their educational records by contacting the Chief Data Protection Officer. Requests will be processed within 45 days, and records will be provided in an accessible format.
Learners who believe their records contain inaccurate information may request corrections by providing: a written request specifying the alleged inaccuracy; supporting documentation; and the preferred correction.
The following information may be designated as directory information (subject to opt-out rights): name and contact information; program participation; dates of attendance; and CEUs earned. Privacy concerns or complaints may be submitted to the Chief Data Protection Officer at cdb@borelonline.com, to IACET for accreditation-related matters, or to applicable regulatory agencies.
7. International Privacy Considerations
Our services are hosted in the United States. International learners acknowledge that their information will be transferred to and processed in the United States, where privacy laws may differ from their home country.
For European Union residents, we provide additional protections including: legal basis for processing; enhanced consent mechanisms; right to data portability; and right to be forgotten (subject to educational record requirements).
8. Incident Response and Breach Notification
In the event of a suspected privacy or security incident: immediate containment and assessment procedures are activated; affected individuals are notified within 72 hours when feasible; regulatory notifications are made as required by law; and post-incident review and corrective action are implemented.
Breach notifications include: a description of the incident; types of information involved; steps taken to address the breach; recommendations for affected individuals; and contact information for inquiries.
9. Children's Privacy
We do not knowingly collect personal information from children under 13 years of age. If we discover that we have inadvertently collected such information, it will be promptly deleted. Parents or guardians who believe we have collected information about a child under 13 should contact us immediately.
11. Policy Updates and Communication
This Privacy Policy is reviewed annually and updated as necessary to reflect: changes in applicable laws and regulations; updates to IACET standards and requirements; technological developments; and organizational changes.
Material changes to this Privacy Policy will be communicated through: email notification to registered learners; prominent website posting; and update notices in learning platforms.
12. Contact Information
For privacy inquiries, record access requests, or complaints, contact the Chief Data Protection Officer:
For IACET accreditation inquiries: International Association for Continuing Education and Training, 45591 Dulles Eastern Plaza, Suite 132, Box 805, Sterling, VA 20166. Phone: (703) 763-0705. Email: info@iacet.org.
13. Compliance Statement
This Privacy Policy has been developed in accordance with: ANSI/IACET 1-2018 Standard for Continuing Education and Training; Family Educational Rights and Privacy Act (FERPA); applicable state and federal privacy laws; and international privacy frameworks where applicable.
By utilizing Borel Educational Consulting Services, learners acknowledge understanding of and agreement to the terms of this Privacy Policy.