1. Introduction and Overview

This Privacy Policy describes the practices of Bach Education, Inc. (“Bach”, “we” or “us”) with respect to the collection and handling of Personal Information on our www.bacheducation.com (“Site”) and our Bach mobile applications (“Apps”), specifically, our college matching tool and communication platform for students (“Students”) to explore college options and to communicate directly with college admissions teams (“Colleges”) (collectively, the “Services”). By affiliating with a high school, Students grant their high schools (“High Schools”) limited access to their account, for the purpose of verifying student data. Students may also grant additional access at their discretion.

By clicking an Accept, Register, or similar button or icon, or by accessing, browsing, or using the Services in any manner, you agree to be bound to our Terms of Use and our Privacy Policy, whether or not you registered with the Services. All references to “you” or “your,” as applicable, mean the person who accesses, or uses the Services in any manner, and each of your heirs and assigns (if you are a Student), and each of your employers (if you are a High School or College representative).

2. Definitions

Data Subject or you refers to an individual whose Personal Information or Personal Data is being collected and processed. Students who set up accounts, download our App, or visit our Site are Data Subjects. In California and the EU, EEA, and UK, the employees of Colleges and High Schools who set up accounts, download our App, or visit our Site are also Data Subjects.

Data Protection Laws means (i) the General Data Protection Regulation (Regulation 2016/679); (ii) the EU e-Privacy Directive (Directive 2002/58/EC); (iii) any national data protection laws in the Member States of the EEA made under or pursuant to (i) or (ii), or (iii), and (iv) the analogous laws enacted in Switzerland; (v) the analogous laws of the UK; and (vi) the consumer privacy laws of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

European Jurisdictions means the EEA, EU, Switzerland, and the UK.

Personal Data, Personal Information, or PI means data identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer. It does not include information that is publicly available.

Process or Processing means any use of PI including collecting, recording, organizing, structuring, storing, adapting or altering, amending, retrieving, consulting, sharing, disclosing, making available, aligning or combining, restricting, transferring outside the European Jurisdictions or erasing or destroying it.

Subcontractor means an independent contractor engaged by Bach in order to carry out part of the Services.

User means an individual who visits the Site, or downloads the App, or creates an account and Profile, or represents a High School or College.

3. Transfer of Personal Data to U.S.

Bach is located in the United States. If you are located in a jurisdiction with comprehensive laws regulating PI, please be aware that when you provide PI to us, you are transferring it to a jurisdiction whose laws may not provide the same level of protection for such data as those of your own jurisdiction.

4. PI Collected about Student Data Subjects – Category, Purpose, and Sharing

A. To Deliver the Services

The purpose of our Services is to match Students with Colleges. All accounts require name, email and mobile phone number. Name, email, and mobile number are PI. To set up your Student Profile, you input relevant college matching information such as your GPA, activities, and high school. Your Student Profile may be accessible by your High School representative, if any. Your Student Profile will also be visible to all Colleges who access the Services. We will not share your name with Colleges unless you are matched with them and then swipe right on that College. You may also share additional information directly with Colleges. We do not share your email and mobile phone number with Colleges. Students communicate with Colleges through the Services; therefore, sharing email and phone number is not necessary.

B. General Uses

We may also use PI to analyze and improve our Services, to better understand our Student account holders and their preferences, to investigate or settle any disputes, and to meet our legal obligations such as providing PI requested under subpoena or other mandatory legal process or by a government authority.

C. Sharing

We will not share your PI with third parties without your permission, other than (i) as necessary or appropriate to carry out the Services, (ii) comply with applicable law, court order or other judicial process, (iii) enforce our Terms of Service, (iv) protect the rights, property, or safety of us, other Users or third parties, (v) as noted in the two paragraphs immediately following below, or (vi) as otherwise required or permitted under applicable law.

Though this is not likely, if Bach is ever sold (in whole or in part) or reorganized in terms of corporate structure, we may disclose and/or transfer PI to the potential purchaser of our business. In such case, we will take reasonable efforts to be sure the PI remains subject to the undertakings set forth in this Privacy Policy. We will not sell PI other than in connection with the sale or reorganization of the company.

We may also hire Subcontractors to provide some Services to Students. In such cases, we transfer to such Subcontractors the PI about the Students as necessary to enable the Subcontractors to carry out their contracted Services. All such Subcontractors are required under agreements to maintain all PI in confidence and to use the PI only in order to provide the Services.

D. Summary

The table below summarizes this Section 4 by category of PI:

Category of PI Collected	Source	Purpose for Collection / Use	Categories of Recipients
Contact information: Name, email address, mobile number, age	Provided by Students. Collected from and confirmed by you in connection with your receipt of the Services	To provide the Services to Students. To communicate with you about your college needs and preferences. Mobile number and email may be used for multi-factor authentication, to protect the security of your account	Any Subcontractors who assist us in providing the Services to you. Colleges that our Services match you with. Providers of our multi-factor text messaging service.
Protected Classifications / Special Categories: such as race, religion, marital status, physical disability, gender, pregnancy, sexual orientation	We collect it directly from you only if you volunteer it when you complete your Profile. We may also receive this information from your High School, such as class rank.	To provide context to Colleges to curate in-App communications	Any Subcontractors who assist us in providing the Services to you. Colleges who visit your Student Profile.

5. PI Collected about College and High School Employee Data Subjects – Category, Purpose, and Sharing

Bach collects and stores limited PI about College and High School Employees when they create a College or High School account or Profile. Data collected may include the employer, name, address and phone number (none of which is PI), as well as PI such as the name, email address, mailing address, and phone number of the individual representatives of High Schools and Colleges. This data is collected and processed to deliver the matching Services to the High Schools and Colleges, and in some cases to receive and make payments on fee-based Services, and to communicate with such persons about our Services. This PI is generally not covered by the U.S. consumer privacy laws except for California, but it is Personal Data under applicable European Jurisdiction law.

The table below summarizes this Section 5 by category of PI:

Category of PI Collected	Source	Purpose for Collection / Use	Categories of Recipients
Contact information: Name, address, email addresses, mobile and other telephone numbers	Collected from and confirmed by you in connection with your account and Profile creation.	To provide the Services. To communicate with High School representatives about Students who have created Profiles who attend your High School. To verify information provided by Students who have created Profiles who attend your High School. To communicate with College representatives about their target applicant profile.	Any Subcontractors who assist us in providing the Services to you.
Commercial information: records of Services Colleges may have purchased from us	Records are created when you make a purchase on behalf of your employer	To manage your purchases and delivery of Services	Any Subcontractors who assist in managing our commercial records

6. PI Collected from Website Visitors– Category, Purpose, and Sharing

We collect certain information automatically from visitors to our Site, and individuals who download our App, such as IP address. Most of this information is necessary to respond to your request to see specific pages of our Site or App.

Neither our Site nor our App drops online behavioral advertising (“OBA”) cookies on your device. OBA is the targeting of advertising to you based on your online behavior across websites over time. It does not include “retargeting,” which is when we cause you to see ads for our Service after you have seen one of our ads or visited our Site or used our App.

We also may collect information from you that you directly provide if you contact us seeking information. We need your contact information to respond to your request.

Category of PI Collected	Source	Purpose for Collection / Use	Categories of Recipients
Contact information: Name, address, email addresses, mobile and other telephone numbers	Provided by you through a Contact Us Form or a similar means	To respond to your request for information about our Services	Any Subcontractors who assist us in managing information requests and marketing
Browsing information: We log your IP address and with it your landing pages, browsing activity, content viewed and clicked, dates and times of access, pages viewed, forms you complete or partially complete, the URL that referred you to our Website; and other web usage activity and data logged by our web servers, whether you open an email and your interaction with email content, access times, error logs, and other similar information	This information is collected automatically through your device, when you visit our Site or use our App. Website analytics providers. Advertising providers that we hire to advertise our Services online. Cookies and tracking technologies.	We need your IP address so that our servers can respond to your page requests. Marketing and advertising our products, specifically, understanding which of our marketing campaigns resulted in your visit to our Site. We use IP address to understand the general geographic location of our Users.	Our service providers who help us with fraud protection, website analytics, and advertising

7. Opting Out of Email Promotional Communications

When you send an email to us seeking additional information about the Services, we consider this consent to send you email promoting our Services. You may choose to discontinue receiving any promotional emails by following the opt-out instructions contained in the email or otherwise by contacting us as described below under “Contact Us.” Please allow at least ten (10) days for us to process any such request.

8. Children Under 16

Our Services are not directed to or intended for children under the age of 16. If you are a child under the age of 16, please do not use our Site or App.

9. Data Retention

We store your PI only as long as necessary to perform the Services and to comply with applicable laws regarding corporate records.

10. Security

Bach has implemented reasonable organizational, technical and administrative security measures in place to protect the loss, misuse and alteration of the PI under our control. We also require our Subcontractors to take similar measures. Within our organization, only our employees who need to access the information to perform a specific task have access to your PI. However, in the course of providing the Services, some PI is being transmitted via email over the Internet and no electronic data transmission can be guaranteed as 100% secure. As a result, while we strive to protect your PI during transmission, we cannot ensure or warrant the security of any PI you transmit to us or receive from us.

11. Suggestions

Suggestions, materials or other intellectual property sent to us are the property of Bach, and you hereby relinquish any claim to such items, or for remuneration for the same. All such items are deemed non-confidential and we shall have no obligation of any kind with respect to such items and shall be free to use and distribute them to others, including making products or services using or incorporating them.

12. Contacting Us

You may contact us to access, correct or delete your PI, or restrict the processing of your PI, at support@bacheducation.com.

13. PROVISIONS APPLICABLE ONLY TO INDIVIDUALS SUBJECT TO US STATE LAWS

Under the law of several states (California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) residents have some or all of the following rights list below.

A. Right to know. You have the right to know (i) what categories of PI we are collecting about you and for what purposes, (ii) the sources from whom we obtain PI; (iii) what categories of PI we are sharing and selling and for what purposes, and (iv) the categories of third parties to whom we are sharing or selling. This information is summarized in the tables at Section 4, 5 (California residents only), and 6. We do not sell your PI to anyone or share it for the purposes of OBA.
B. Right to access. You have the right to request that we disclose to you, in addition to the categories listed immediately above, the specific pieces of PI we collected about you in the past twelve months. Most, if not all of it, is information provided directly by you. If you believe that the PI we hold about you requires correction (for example, because the information is inaccurate, out-of-date, incomplete, irrelevant or misleading), you may request that the information be corrected using our contact details set out below. If you would like for us to completely remove your PI, you can contact us, however we are not required to delete your PI if we have a regulatory, operational or administrative requirement to keep it.
C. Right to delete. You have the right to request that we delete any of the PI that we collected from you and retained, subject to certain exceptions. You can also delete your account and Profile. Once we receive and confirm your verifiable consumer request to delete as described in Section 13-F below, we will delete (and direct our Subcontractors to delete) your PI from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
D. Right to data portability. You have the right to receive a copy of your electronic PI in a readily-usable format.
E. Right to opt out of certain sharing with third parties. You have the right to direct us to stop disclosing your PI to third parties for monetary or other consideration. We do not make such disclosures.
F. Exercising access, data portability, and deletion rights. To exercise the access, data portability, and deletion rights described above, please send your request to support@bacheducation.com. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your PI. You may only make a consumer request for access or data portability twice within a 12-month period. You can also delete your account yourself. We cannot respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use PI provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
G. Non-Discrimination. We will not discriminate against you for exercising any of your state law rights.

14. PROVISIONS APPLICABLE TO INDIVIDUALS LOCATED IN THE EU/EEA/UK AND SWITZERLAND

The provisions of the below portion of the Privacy Policy are applicable to Data Subjects located in the EU/EEA/UK and Switzerland. For purposes of this section, we refer to PI as Personal Data, the European term.

A. Additional Definitions

Consent or Agree means your freely given, specific, informed and unambiguous expression of your wishes through a statement or other clear affirmative action such as checking a box or signing a consent form which indicates your agreement to our Processing of Personal Data relating to you.

Third Party includes our Subcontractors who we authorize to process your Personal Data or other information to help us with the activities described in this Privacy Policy. It may include government bodies and public agencies and authorities.

B. Transferring Your Data; Consent

Bach is headquartered in the US, and has operations, entities and service providers in the US and throughout the world. As such, when you provide information to us, you are transferring to a jurisdiction (the United States) that may not provide equivalent levels of data protection as your home jurisdiction.

By submitting Personal Data to Bach, to the fullest extent permitted under applicable Data Protection Laws, you consent to this transfer and the other processing by us described in this Privacy Policy.

C. Data Protection Principles & Best Practice Standards

Bach Processes Personal Data in accordance with the following data protection principles and industry best practice standards:

Bach Processes Personal Data lawfully, fairly and in a transparent manner consistent with Data Protection Law, and its obligations to Users.
Bach collects Personal Data only for specified, explicit and legitimate purposes consistent with Data Protection Law, and its obligations to Users.
Bach Processes Personal Data only where it is adequate, relevant and limited to what is necessary for the purposes of Processing consistent with Data Protection Law, and its obligations to Users.
Bach keeps accurate Personal Data and takes reasonable steps to ensure that inaccurate Personal Data is rectified or deleted without delay consistent with Data Protection Law and its obligations to Users.
Bach keeps Personal Data only for the period necessary for Processing consistent with Data Protection Law and its obligations to Users.
Bach adopts appropriate measures to make sure that Personal Data is secure, and protected against unauthorized or unlawful processing, and accidental loss, destruction or damage.
Bach informs Data Subjects located in the European Jurisdictions the reasons for Processing their Personal Data, how it uses their Personal Data and the legal basis for Processing by providing this Privacy Policy and related notices, disclosures, and consent forms at the time of intake.

Data Subjects can decline to include certain Personal Data in their Profiles. By submitting Personal Data in your Student Profile, you as Data Subject agree to allow Bach to disclose Personal Data and other information you provide to Colleges. You also agree to allow High Schools to verify that information.

All Data Subjects in the European Jurisdictions are asked to inform us immediately about any changes in their Personal Data.

Bach will not Process Personal Data that qualifies as Special Categories of Personal Data for purposes other than to carry out the Services unless the Processing is:

permitted by applicable European Jurisdiction laws;
necessary for administering justice or for exercising statutory, governmental, or other public functions;
necessary for the establishment of legal claims or defenses;
in the vital interests of an individual in in the European Jurisdictions or another person;
required to provide medical care or diagnosis; or
necessary to carry out Bach’s legal obligations under applicable law.

D. Personal Data Transfers to Independent Third Parties

Bach will disclose Personal Data to Third Parties other than those identified above only if:

required by law or legal process (e.g., lawful requests by public authorities, including disclosures to law enforcement authorities in connection with their duties or to meet national security requirements);
to investigate, prevent or take actions against illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, or as otherwise required by law.
to protect and defend the legal rights, property/or and legitimate interests of Bach and/or its employees, Subcontractors and/or Third Parties; or
where necessary for Bach to perform a contractual obligation owed to a User or for other lawful purposes.

E. Complaints

Individuals in the UK may also make data privacy and/or data use complaint about Bach to the UK Information Commissioner’s Office (ICO) here https://ico.org.uk/concerns/. Individuals in the EU/EEA can also make a complaint to the Data Protection Authority in the EU/EEA Member State where they live or work listed here: http://ec.europa.eu/justice/dataprotection/article-29/structure/data-protection-authorities/index_en.htm.

Bach Education, Inc. Privacy Policy