P-TECH Data Privacy Policy

Date: March 24, 2020

P-TECH an IBM initiative (IBM) (sometimes, “we,” “us” or “our”) is committed to protecting
your privacy. This Data Privacy Policy is important, and we encourage you to carefully read it.

This Data Privacy Policy discloses how we collect, use, and disclose information that we gather
related to your engagement with our online learning channels (the “Services”). The Services do
not include websites, mobile applications, or other services that link to another Data Privacy
Policy. This Data Privacy Policy also describes the choices you have regarding our use of and
your ability to access, correct, or delete your personal information. Subject to applicable law, by
using the Services, you accept the terms of this Data Privacy Policy and consent to the data
collection, use, and sharing described herein. We may seek your consent by other means such as
by asking you to click on a button or to change a setting. Where we do so, we will also offer you
a way to revoke your consent.

1. How and Why We Collect and Use Personal and Other Information

In order to operate the Services and to maximize your experience, we may collect and use
information, some of which may be considered your personal information. In general, we use
your personal information to serve you best, including to create your account, to maintain,
operate, and improve the Services, to personalize your experience, and to administer the
Services. Please note that you may choose not to provide us with certain information; by doing
so, however, you may not be able to receive the full range of Services from us. We collect
information in the following ways:

A. Information Provided By You (Student). You may provide us with information, some
of which may be personal information, when you interact with the Services in the
following ways:

• Account Registration—For example, students must provide us with the following

information to register for the Services: name, profile picture (students may select
to either have their initials appear or upload a profile photo), email address,
country of residence, and the name of the student’s school. We also require users
to create a member name and password. We may request additional information
from users, but this information is optional. We specify whether information is
required or optional when we request it. If your school or P-TECH Administrator
registers your account on your behalf, then the school or P-TECH Administrator
may view or edit the account registration information; view the content of your
Submissions; and view data related to the use of the Services such as badges,
courses completed, and credentials.
• Account Transfer—You will be notified if a school you attend wants to include
your existing individual account under the school’s account. After your account is
transferred to a school, it allows your school, P-TECH Administrator or teachers
to view and edit your registration information, view the content of your
Submissions (as defined below), and view data related to the use of the Services
 such as badges, courses completed, and credentials. If you do not want to have
your individual account registered your school, you may refuse. Likewise, if you
have a school-registered account and your school is no longer affiliated with the
Services, then you will have the option of transferring your account to an
individual registration (and the school will no longer have the ability to view or
edit your registration information, view the content of your Submissions (as
defined below), or view data related to the use of the Services such as badges,
courses completed, and credentials). If you do not want to have your school
account registered as an individual account, you may refuse.
• Commenting & Submissions—The Services may from time to time offer areas
where you and other users can post or otherwise submit comments (e.g.
discussion boards), information, creative suggestions, ideas, notes, concepts,
information, ratings or other materials on or to the Services (collectively,
“Submissions”). Your profile photo will be associated with any Submission you
make and will be publicly available to other users of the Services, including your
school, P-TECH Administrator or teacher (if you have a school registered
account). You agree that your Submissions will comply with our Terms of Use.
We do not monitor or review this content before it is posted, and we cannot
control and are not responsible for how others may use the information contained
in your Submissions. We encourage parents and student administrators to educate
their children about safe internet use and to monitor their children's Submissions.
• Responding to Your Request for Information or Support—When you contact us
(online or offline) in connection with a request for information, to provide you
with support, or to participate in a forum, we collect information necessary to
fulfill your request, to grant you access, to provide you with support, and to be
able to contact you. For instance, we collect your name and contact information,
details about your request and your agreement with us. We retain such
information for administrative purposes, defending our rights, and in connection
with our relationship with you. If you have a school registered account and wish
to make any corrections or updates to the registration, you must contact your
school or P-TECH Administrator to have them make the corrections.
• Surveys—We may occasionally invite you to fill out a survey in order to help us
measure the effectiveness of our program and improve upon it. The surveys are
not required for participation in the Open P-TECH program. In these surveys we
may ask you to provide personal information such as name or email address, as
well as your personal opinions. The data you provide will be reported as
aggregates, with your personal identity removed. The companies who will have
access to your personal identity are IBM administrators and a third party survey
platform which serves as our data processor.

B. Information Provided By Your School or P-TECH Administrator. Your school or P-

TECH Administrator may provide us with personal information about you (e.g., your
name, name of your school, parental consent to use the Service) to help us register
your account and to provide the Services. We will combine this with the information
we collect from you. Your school or P-TECH Administrator can only register an
account for you with your consent and, if required by law, your parent’s consent.
 Your school or P-TECH Administrator must collect your registration information in
an appropriate manner and be responsible for properly entering the information into
your account. If your school or P-TECH Administrator registered your account and
you wish to update your account registration information to correct any inaccuracies,
then you must contact your school or P-TECH Administrator to modify your account
registration. If you do not approve of how your account is registered or modified by
your school or P-TECH Administrator, you can close your account.

C. Information Used By Your School. Whether you or your school registers your
account, your school cannot disclose to third parties (except your parents or legal
guardians) any data relating to your use of the Services. Where you are registered
through your school, your school (i) must not use or view your account other than to
register or edit the account information; view the content of your Submissions; and
view data related to the use of the Services for the sole of monitoring of student
performance; (ii) may enable up to two (2) P-TECH Administrators or teachers to
register, monitor or track groups or classes of students; (iii) is responsible for
ensuring that P-TECH Administrators and teachers access the Services in compliance
with law and our Terms of Use; and (iv) must inform us of any change in P-TECH
Administrators or teachers so that we can discontinue their access, as appropriate, and
re-assign you to new P-TECH Administrator or teacher. If you do not wish to be re-
assigned, you can close your account.

D. Information Used By Your P-TECH Administrator or Teacher. Whether you or your

school registers your account, your P-TECH Administrator or teacher cannot disclose
to third parties (except your parents or legal guardians) any data relating to your use
of the Services. Where you are registered through your school, your P-TECH
Administrator or teacher must (i) not use or view your account other than to register
or edit the account information; view the content of your Submissions; and view data
related to the use of the Services for the sole of monitoring of student performance
(ii) accurately register students and update registrations to keep them current or as
otherwise requested by students for accuracy; (iii) access the Services only in
compliance with law and our Terms of Use; and (iv) inform us of any change in their
status in supporting the Services, so that we can discontinue their access, as
appropriate, and re-assign you to new P-TECH Administrator or teacher. If you do
not wish to be re-assigned, you can close your account.

E. Automatic Collection. When entering one of our websites, or using an online service,
we will record information necessary to provide you with access, for the operation of
the website and for us to comply with security and legal requirements in relation to
operating our site, such as passwords, IP address and browser settings. We also
collect information about your activities during your visit in order to personalize your
website experience, such as recording your preferences and settings, and to collect
statistics to help us improve and further develop our websites, products and services.

F. Information from Social Media Networks and Other Third Parties. Where legally
permissible, we may obtain information about you or your use of the Services from
our vendors and other third parties such as analytics providers. We may combine the
 information you provide us and information we automatically collect with
information from public or third-party sources. When you access the Services through
social media networks and other third-party platforms, you are authorizing us to
collect, store, and use such information and content in accordance with this Data
Privacy Policy. If we combine or associate information from other sources with
personal information that we collect through the Services, we will treat the combined
information as personal information in accordance with this Data Privacy Policy.

2. Data Collection Technologies

We may contract with certain third parties that use data collection technologies to track, analyze,
and report data about the use of the Services and to analyze and optimize the performance of the
Services (“Analytics Partners”).

Information that we collect via the data collection technologies described in this section may be
linked to other information about you and may be considered personal information. We use the
technologies described in this section, alone or in combination, to understand user behavior, help
diagnose problems, recognize repeat visitors, and facilitate your access to and use of the
Services.

A. Use of Cookies, Web Beacons, and Information Saved by Other Technologies

Third parties may use cookies and other technologies through use of our Services to
support or deliver online services. The data collection technologies we and third parties
use on web include but are not limited to:

1. Cookies: Cookies are text files containing small amounts of information

that are downloaded to your computer or mobile device when you visit a website
and stored within your browser. Cookies are then sent back to the originating
website on each subsequent visit to that website or to another website that
recognizes those cookies. Some cookies on our Services collect IP and MAC
addresses, which may be considered personal information in some jurisdictions.
Cookies are useful because they allow a website to recognize a user’s device. You
can find more information about cookies at www.allaboutcookies.org. The
cookies used on this website can be categorized in the following ways:

Category 1: Strictly Necessary Cookies

These cookies are essential in order to enable you to use the Services and its
features.

Category 2: Performance Cookies

These cookies collect information about how you use the Services (such as which
pages you go to most often and if you receive error messages). In general, these
cookies do not collect information that directly identifies you. However, some
such cookies may collect GeoIP or other identifiers that may be considered
personal information in some jurisdictions.
 Category 3: Functionality Cookies
These cookies allow Services to remember choices you make such as language or
the region you are in. These cookies can also be used to remember changes you
have made to customize the Services.

2. Web beacons: Certain pages on the Services may contain web beacons.
Web beacons allow third parties to obtain information, such as the IP address of
the computer that accessed the page on which the web beacon appears, the URL
of the page on which the web beacon appears, the time the page containing the
web beacon was viewed, the type of browser used to view the page, and the
information in cookies sent by the third party.

3. Web Storage: We may use local storage, such as HTML5 localStorage

and indexedDB, to enhance user experience by, for example, storing your user
preferences and settings (e.g., volume/mute) in connection with animated content
on the Services. Local storage is similar to browser cookies but can store data
more complex than simple text. By itself, local storage cannot do anything to or
with the data stored on your device.

B. Web-Related Opt Outs

Your browser, such as Internet Explorer, Chrome, Firefox, or Safari, may allow you to
manage your cookies and local storage. Because each browser is a little different, we
encourage you to check your browsers’ “Help” feature to learn how to block cookies,
how to receive notification of new cookies, and how to disable existing cookies. Please
note, however, that without some cookies you may not be able to take full advantage of
all the Services and some parts of the Services may not function properly. For more
information about managing cookies, please visit www.allaboutcookies.org/manage-
cookies/.

3. How We Share or Disclose Your Information with Others

As a global organization offering a wide range of products and services, with business processes,
management structures and technical systems that cross borders, IBM has implemented global
policies, along with standards and procedures, for consistent protection of personal information.
As a global company, we may share information about you with our subsidiaries world-wide and
transfer it to countries in the world where we do business in accordance with this Data Privacy
Policy.

Between IBM controlled subsidiaries we only grant access to personal information on a need-to-
know basis, necessary for the purposes for which such access is granted. In some cases, IBM
uses suppliers located in various countries to collect, use, analyze, and otherwise process
personal information on its behalf.

Where appropriate and reasonable, IBM may also share your personal information with selected
partners to help us provide you, or the school you attend, products or services, or to fulfill your
 requests, or with your consent. When selecting our suppliers and partners, we take reasonable
steps to ensure proper data handling processes.

If IBM decides to sell, buy, merge or otherwise reorganize businesses in some countries, such a
transaction may involve the disclosure of personal information to prospective or actual
purchasers, or the receipt of such information from sellers. It is IBM's practice to require
appropriate protection for personal information in these types of transactions.

Please be aware that in certain circumstances, personal information may be subject to disclosure
to government agencies pursuant to judicial proceeding, court order, or legal process. We may
also share your personal information to protect the rights or property of IBM, our business
partners, suppliers or clients, and others when we have reasonable grounds to believe that such
rights or property have been or could be affected.

We may share certain information with your school or P-TECH Administrator, including but not
limited to the content of your Submissions and data related to the use of the Services such as
badges, courses completed, and credentials.

4. Information Security and Accuracy

We intend to protect your personal information and to maintain its accuracy. IBM implements
reasonable physical, administrative and technical safeguards to help us protect your personal
information from unauthorized access, use and disclosure. For example, we encrypt certain
personal information when we transmit such information over the Internet. We also require that
our suppliers protect such information from unauthorized access, use and disclosure.

5. Retention Period

We will not retain personal information longer than necessary to fulfill the purposes for which it
is processed, including the security of our processing complying with legal and regulatory
obligations (e.g. audit, accounting and statutory retention terms), handling disputes, and for the
establishment, exercise or defense of legal claims in the countries where we do business.

6. Your Information and Data Rights

You may access and change some of your personal information by editing your profile at any
time. At any time, you can review, change, or delete your personal information by sending us an
email at ptechinf@us.ibm.com. To protect your privacy and security, we may require you to take
certain steps or provide additional information to verify your identity before we provide any
information or make corrections.

You may have additional rights pursuant to your local law applicable to the processing. For
example, if the processing of your personal information is subject to the EU General Data
Protection Regulation ("GDPR"), and your personal information is processed based on legitimate
interests, you have the right to object to the processing on grounds relating to your specific
situation. Under GDPR you may also have the right to request to have your personal information
deleted or restricted and ask for portability of your personal information.
 In the event that you consider our processing of data related your use of the Services not to be
compliant with the applicable data protection laws, you can contact us or lodge a complaint:

• Directly with IBM by contacting ptechinf@us.ibm.com.

• With the competent data protection authority. The name and contact details of the Data
Protection Authorities in the European Union can be found here.

7. Student Privacy

We are committed to protecting the safety and privacy of young people using the Internet. We do
not knowingly collect personal information from children under the age required in the relevant
jurisdiction (for example, in the United States, age 13) unless and until we have received consent
and authorization from the proper authority to use the Services and for us to collect such
information. If you become aware that we have collected personal information from a child
without proper parental consent, please notify us promptly at ptechinf@us.ibm.com. If we
become aware that a child under the applicable age has provided us with personal information
without proper consent, we will take steps to remove such personal information.

8. International Transfer

The international footprint of IBM involves a large number of transfers of personal information
between different subsidiaries, as well as to third parties located in the countries where we do
business. Some countries have implemented transfer restrictions for personal information, in
connection with which IBM takes various measures, including:

• Where required, IBM implements Standard Contractual Clauses approved by the EU

Commission, or similar contractual clauses in other jurisdictions. This includes transfers
to suppliers or other third parties. You can request a copy of the EU Standard Contractual
Clauses here.
• IBM certified to the APEC Cross Border Privacy Rules.
• IBM certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. More
information can be found here.

9. Our Commitment to Security

We have put in place physical, electronic, and managerial procedures intended to protect your
data. Of course, we cannot guarantee that your communications with the Services will never be
unlawfully intercepted or that your data will never be unlawfully accessed by third parties. Any
transmission of information is at your own risk.

10. Changes to the Data Privacy Policy

From time to time we may update this Data Privacy Policy. When making changes to this Data
Privacy Policy, we will add a new date at the top of this Data Privacy Policy. If we make
material changes to the way we collect, use and disclose personal information, we will notify
affected users through the Services.
11. How to Contact Us

If you have a question related to this Data Privacy Policy, please contact us
at ptechinf@us.ibm.com or at:

IBM
Attn: Privacy Office (P-TECH)
1 New Orchard Road
Armonk, NY 10540
U.S.A.

12. California Residents

If you are a California resident, California law may provide you with additional rights regarding
our use of your personal information. We will provide more information about your California
privacy rights, which will be posted here in April 2020.