Privacy & information practices

1. Purpose, scope, and relationship to other notices

This privacy notice applies to the public pages operated for South Salt Lake Community College, including pages that describe programs, admissions, costs, events, student resources, and contact options. It also describes general expectations for information received during an inquiry or other early college conversation. A separate notice, agreement, portal message, employment notice, financial document, health form, or student-record policy may provide more specific terms for a particular service.

When a service-specific notice conflicts with this general website notice, the more specific notice controls for that service. Laws and contractual duties may also require the College to collect, retain, disclose, restrict, or protect information in a particular way. Nothing on this page expands a legal right beyond the law that applies to the person, record, institution, and activity involved.

The public website is intended for general information and early planning. It is not a student portal, payment system, immigration-advice service, emergency reporting service, or secure document repository. Visitors should use the contact information on this page to ask for an approved secure method before sending identity, education, financial, disability, medical, or immigration documents.

2. Information that may be collected

The information connected with a college website depends on how a person uses it. Someone who only reads a page may create limited technical records. Someone who calls, emails, attends an event, requests information, begins an application, asks for an accommodation, or later becomes a student may choose to provide additional information. The College seeks to collect information that is reasonably related to the stated purpose and not simply because it may be available.

Information provided directly may include a name, email address, telephone number, mailing address, preferred language, program interest, education history, questions, scheduling preferences, communication choices, or other details included in a message. Later processes may require official transcripts, identity records, residency information, financial documents, accommodation information, employment records, or other materials, but those records should be requested through a process designed for that purpose.

Standard website and hosting records may include an internet protocol address, browser and device type, operating system, requested page, referring page, date and time, approximate region derived from network information, error details, and security events. These records help deliver pages, investigate failures, protect the service, and understand general website use. They should not be treated as a complete or perfectly accurate description of a person.

• Contact and communication information voluntarily provided by a visitor.
• Academic interests, applicant type, education background, or questions shared for planning purposes.
• Technical request, device, browser, security, and error information created when pages are delivered.
• Records received from a previous school, evaluator, service provider, employer, or government source when the individual authorizes the process or law permits it.
• Accessibility, language, or support preferences needed to communicate effectively or provide a requested service.

3. How information may be used

Information is used to respond to the purpose for which it was provided and to operate, protect, and improve college services. A prospective-student question may be used to identify the right program page, explain a requirement, arrange a visit, or direct the question to a person who can answer it. Technical records may be used to keep the website available, prevent abuse, identify broken pages, understand accessibility problems, or investigate a security event.

If a person later begins an official application or enrolls, information may be used to evaluate requirements, communicate a decision, support advising and registration, maintain academic and financial records, provide approved services, satisfy reporting duties, protect health and safety, and carry out other legitimate educational or administrative functions. Only information relevant to the function should be made available to the people or service providers responsible for it.

The College may also use contact information to send a response, an operational notice, a requested reminder, or information closely connected with an expressed interest. Marketing or outreach messages should identify the sender and provide a reasonable way to stop optional messages. Stopping optional outreach does not stop communications required for an application, appointment, account, safety matter, legal duty, or active student relationship.

4. Website inquiries, admissions conversations, and applications

The current public inquiry form is a conversation starter. It asks for a name, email address, and a short description of what the visitor is exploring. The form does not ask for passwords, payment details, Social Security numbers, passport or visa images, medical records, or complete transcripts. Visitors should not place those items in a general message. A person who needs a response may also contact the College by phone or email using the details published below.

An inquiry is different from an application. An inquiry does not establish eligibility, reserve a place, create immigration documentation, approve transfer credit, award financial support, or complete enrollment. If an official process becomes available, the College should explain the system used, required information, submission method, applicable notices, fee or payment terms, and how the applicant can confirm that a file is complete.

Email is convenient but may not be appropriate for sensitive records. Before sending identity, residency, immigration, disability, financial, disciplinary, or health information, ask which records are actually required and request the approved secure delivery method. Keep original documents, submission receipts, and copies of important communications.

5. Student education records and FERPA

The Family Educational Rights and Privacy Act, commonly called FERPA, applies to educational agencies and institutions that receive funds under programs administered by the U.S. Department of Education. When FERPA applies at a postsecondary institution, rights generally belong to the eligible student and include rights to inspect and review education records, request amendment of records believed to be inaccurate or misleading, consent to certain disclosures, and file a complaint concerning alleged failures to comply.

This website notice does not claim that every record described here is an education record or that FERPA applies to every SSLCC activity. Applicant records for a person who does not attend, law-enforcement-unit records, treatment records, employment records unrelated to student status, alumni records created after attendance, and records held only in a person's sole possession may be treated differently under applicable law. A specific student-record notice should identify the records, responsible office, access and amendment procedures, disclosure rules, directory-information categories, and complaint process that apply.

Where FERPA applies, disclosure of personally identifiable information from education records generally requires the eligible student's consent unless an exception permits disclosure. Exceptions may include disclosure to school officials with legitimate educational interests, certain audits or evaluations, financial-aid purposes, organizations conducting qualifying studies, accrediting functions, lawful subpoenas, health or safety emergencies, and other circumstances described in law. An exception permits a disclosure; it does not require unrestricted access or remove the need for reasonable safeguards.

Students should receive an annual FERPA notice when required. A student who wants to inspect, correct, authorize release of, or restrict directory information in an education record should follow the procedure in that notice. Questions may be directed to the Privacy and Records Contact below. Official federal guidance is included in the resources section of this page.

• Use a written, signed, and dated authorization when consent is the basis for releasing a student record.
• Verify the identity and authority of a person requesting access before disclosing a protected record.
• Limit internal access to a legitimate role and the information needed for that role.
• Record disclosures when required and use agreements or safeguards when information is shared with an authorized service provider.
• Do not assume that a parent, spouse, sponsor, employer, or government contact may receive a postsecondary student's records without consent or another lawful basis.

6. Cookies, local storage, analytics, and third-party content

Cookies and similar technologies can remember a preference, maintain a secure session, measure website use, or support embedded content. The current public website does not intentionally use third-party behavioral advertising pixels or sell browsing activity. Essential hosting and security systems may still use short-lived technical identifiers or request records needed to deliver and protect the site.

If analytics are added, the College should configure them to collect no more information than needed, document the provider and purpose, limit retention, restrict secondary use, and provide a choice where applicable. Aggregate counts can help identify popular pages, failed searches, device compatibility, and accessibility barriers, but they should not be used to make an admission, academic, employment, or disciplinary decision about a person without an appropriate and disclosed process.

A page may link to maps, videos, forms, social platforms, government directories, or other external services. Visiting an external service can expose information to that provider under its own privacy terms. A link does not mean SSLCC controls the provider's data practices. Review the destination and its notice before submitting information, accepting optional cookies, signing into another account, or uploading a document.

7. When information may be disclosed

The College may disclose information to employees, contractors, and service providers that need it to perform an authorized function, such as hosting, communications, records management, security, accessibility, document review, payment processing, or other college operations. Those arrangements should define the service, limit use, require appropriate safeguards, and require return or deletion when the information is no longer needed, subject to law and record-retention duties.

Information may also be disclosed when a person directs or authorizes the disclosure; when needed to complete a requested transaction; to comply with a law, court order, subpoena, audit, accreditation review, or government reporting duty; to investigate fraud or security threats; to protect the rights and safety of a person or the community; or in connection with an institutional reorganization where lawful protections continue. The College may disclose information that has been aggregated or de-identified so that it is not reasonably linked to a person.

SSLCC does not sell personal information. It does not permit a service provider to use college information for the provider's unrelated behavioral advertising. A provider may process information only for the authorized service or another purpose allowed by law and the applicable agreement. If a new practice materially changes how personal information is used or shared, the College should update this notice and provide any additional notice or choice required by law.

• A service provider supporting an authorized college function.
• A school, evaluator, employer, sponsor, or other person when the individual requests or authorizes the disclosure.
• A regulator, court, law-enforcement agency, public-health authority, or other recipient when law permits or requires it.
• Appropriate persons when information is needed to respond to an articulable health, safety, fraud, or security concern.
• A successor or responsible custodian if records must be transferred as part of a lawful institutional change or closure.

8. Security, retention, and disposal

No website, email message, database, or paper file can be guaranteed completely secure. SSLCC uses administrative, technical, and physical safeguards appropriate to the sensitivity and use of the information. Examples may include role-based access, account controls, secure transmission, backups, logging, staff training, vendor review, locked storage, incident response, and secure disposal. Safeguards should be reviewed as services and risks change.

Information is retained for the period reasonably needed to answer a request, maintain an official record, deliver a service, resolve a dispute, preserve institutional history, protect safety and security, or satisfy a legal, audit, insurance, accreditation, financial, or contractual requirement. Retention periods differ by record category. A temporary website log should not automatically be kept for the same period as a transcript, enrollment agreement, tax record, complaint file, or employment record.

When a record reaches the end of its retention period and no legal hold or continuing need applies, it should be deleted, destroyed, anonymized, or transferred to an authorized archives or records custodian using a method appropriate to the record. If SSLCC learns of a security incident, it should contain and investigate the issue, preserve evidence, reduce continuing risk, and provide notice when required by applicable law.

9. Access, correction, communication choices, and privacy requests

A person may ask what information was provided through a college interaction, request correction of inaccurate contact information, update communication preferences, or ask a question about a particular use or disclosure. The College may need to verify identity and authority before acting, especially when the request concerns an applicant, student, employee, dependent, or another person. It may also need enough detail to locate the relevant record and understand the request.

Some requests are governed by a specific law or procedure. FERPA, employment law, public-records law, litigation rules, financial regulations, contractual obligations, or another privacy law may define access, correction, deletion, restriction, appeal, or response rights. These rights are not identical, and exceptions may permit or require continued retention. The College should explain the process and, when a request cannot be fulfilled, provide the reason to the extent permitted.

Residents of a state with an applicable consumer privacy law may have additional rights, but coverage and exemptions depend on the law, the institution, the information, and the activity. The Utah Consumer Privacy Act, for example, contains definitions, thresholds, duties, rights, and exemptions that must be evaluated before a right is assumed. A request can still be sent to the Privacy and Records Contact even when the requester is unsure which rule applies.

• Describe the service, date range, record, communication, or interaction involved.
• Use the same contact channel associated with the record when practical, but do not email sensitive verification documents until a secure method is provided.
• State whether the request concerns access, correction, consent, communication preferences, restriction, deletion, or another privacy question.
• Allow the College to verify identity and authority without requesting more information than reasonably needed.
• Keep the confirmation and any written response with the related application, account, or record.

10. Children, parents, and family communications

The public website is directed to a general audience interested in postsecondary and community learning; it is not designed as an online service for children under 13. A child under 13 should not submit personal information through the public inquiry form. A parent or guardian who believes a child has provided personal information should contact SSLCC so the College can review the situation and take appropriate action.

The Children's Online Privacy Protection Act and its rule apply in specified circumstances to websites and online services directed to children under 13, and to certain general-audience services with actual knowledge that they are collecting personal information from a child under 13. Where the rule applies, it can require notice, verifiable parental consent, access, deletion, security, and limited retention. SSLCC should evaluate any future youth-directed online program separately before collecting information.

At the postsecondary level, a parent or family member does not automatically control a student's education record. Where FERPA applies, rights generally transfer to the student when the student turns 18 or attends a postsecondary institution at any age, although legal exceptions may permit certain disclosures. Students may authorize appropriate family communication through the process provided for the record.

11. International visitors and cross-border access

A visitor may access the website from outside the United States or communicate with the College while living in another country. Website hosting, email, service providers, and college operations may process information in the United States. Privacy laws in another country may provide different rights or requirements, and this notice does not promise that every foreign privacy regime applies to SSLCC.

International applicants should limit an initial inquiry to the information needed for a response. Do not send passport pages, visas, immigration filings, bank statements, sponsor records, or full education records through a general website message. Ask for the official requirement, purpose, retention period, and secure submission process first. An admissions communication is not legal immigration advice and does not guarantee a visa, status, Form I-20, admission, or transfer result.

12. Policy changes, questions, and complaints

SSLCC may update this notice as the website, services, providers, laws, or institutional practices change. The effective and last-reviewed dates appear near the beginning of the page. A material change should be explained in clear language and, when appropriate, communicated through the service affected by the change. A previous version may continue to govern information collected under an earlier agreement when law or the agreement requires that result.

Questions about website information, a suspected mistaken disclosure, communication preferences, record access, or another privacy concern may be sent to the Privacy and Records Contact. Include enough information to identify the service and issue, but do not include sensitive identity or account documents in the first email. The College may direct the request to another responsible office and should explain how to use a secure verification method when verification is necessary.

A concern about an education record may also be covered by a student-record or FERPA complaint process when the law applies. External agency deadlines and jurisdiction rules are determined by the agency. Official federal and Utah resources are listed below so visitors can review the underlying source rather than relying only on a summary on this website.