Privacy policy
USAC is committed to performing business with integrity and with the highest ethical standards and appropriate internal controls. Our privacy policy applies to all users of the USAC website.
About This Notice
This Privacy Notice explains how University Studies Abroad Consortium (USAC) collects, uses, shares, and protects personal data in connection with USAC’s public website, request-for-information forms, marketing and recruitment communications, the USAC Gateway enrollment portal, and related study abroad application, enrollment, advising, course registration, and program participation activities.
This notice applies to public website visitors, prospective students who request information from USAC, applicants, enrolled students, alumni, donors and authorized university or institutional staff who interact with USAC systems or services. Different parts of this notice may apply depending on how you interact with USAC. For example, public website visitors and prospective students may provide inquiry or lead information before applying, while applicants and enrolled students may provide additional sensitive student records through USAC Gateway.
USAC Gateway involves the collection and processing of personal data beyond what occurs during general public website browsing, including sensitive student application, enrollment, advising, course registration, and program participation records. Statements specific to USAC Gateway apply only to authenticated USAC Gateway use.
This notice does not apply to:
- Third-party payment processing, which is governed by the applicable payment processor’s own privacy policies
- Third-party websites, platforms, or services that are not operated by USAC and are not processing personal data on USAC’s behalf
- In-country activities, services, or records handled independently by host universities, housing providers, travel providers, medical providers, government agencies, or other third parties when those parties determine their own purposes, processes, or privacy practices and are not acting on USAC’s behalf
Who We Are
USAC is a 501(c)(3) nonprofit educational consortium that has provided study abroad programs for university students since 1982. USAC is governed by a board of directors composed primarily of representatives from member universities and has no parent or subsidiary organizations.
1. What Personal Data We Collect and Why
USAC collects personal data from public website visitors, prospective students, applicants, enrolled students, and authorized university or institutional staff for purposes related to study abroad program information, recruitment, application processing, enrollment, program administration, student support, security, and legal compliance. We collect personal data appropriate to the context in which it is provided.
1.1 Data We Collect from Public Website Visitors and Prospective Students
| Category | Specific Data Elements | Why We Collect It |
|---|---|---|
| Website and Technical Data | IP address, browser type, device information, pages visited, referring source, cookie or similar technology identifiers where used | Website operation, security, analytics, performance improvement, and understanding visitor engagement |
| Inquiry and Lead Information | Name, email address, phone number, school or institution, academic level, intended term, program interests, destination interests, and information submitted through request-for-information or similar forms | Responding to inquiries, providing requested information, supporting admissions and recruitment outreach, and helping prospective students identify relevant USAC programs |
| Communication Preferences | Email preferences, SMS/text-message opt-in status, mobile phone number for SMS where provided, opt-out or unsubscribe status, communication history, and stated areas of interest | Managing communications, honoring email and SMS preferences, sending relevant program information, and maintaining opt-in and opt-out records |
| Campaign and Source Information | Form source, campaign source, referral source, event source, and similar attribution information where available | Understanding how prospective students learn about USAC and improving outreach effectiveness |
1.2 Data We Collect from Applicants and Enrolled Students
| Category | Specific Data Elements | Why We Collect It |
|---|---|---|
| Student Identifiers | Full name, student ID or institutional identifier, username, account credentials, and related account profile information | Account creation, authentication, identity verification, and access management |
| Contact Information | Personal email address, institutional email address, phone number, mobile phone number for SMS/text messages where the student opts in, mailing address, home address, preferred contact details, and contact information used to issue refunds through Zelle where applicable | Program communications, enrollment administration, student support, emergency or time-sensitive outreach, and refund processing through Zelle where applicable |
| Demographic Information | Date of birth, gender, nationality, citizenship, race, ethnicity, language background, and other demographic information submitted during the application or enrollment process | Program eligibility, placement, reporting, legal and host-country compliance, and program administration. Protected demographic information is not used in admissions decisions except as required to verify eligibility or meet applicable legal or host-country requirements |
| Academic Records | Home institution, enrollment status, major or field of study, GPA or academic standing where required, course registrations, academic transcripts, advising notes, admissions data, and academic approvals | Application evaluation, academic advising, course placement or registration, transfer-credit coordination, and program administration |
| Travel Documents | Passport number, passport copy or image where required, expiration date, issuing country, visa status, pre-departure and post-departure flight and travel plans, onsite travel plans, travel itinerary, and related travel documentation | Travel coordination, visa support, in-country enrollment, regulatory compliance, safety planning, emergency preparedness, and student support during program-related travel |
| Health & Accommodation Data | Dietary preferences or restrictions, disability or accommodation requests, medical accommodation requests, housing preferences or needs, health history forms, medication, information, vaccination records where required by program or destination, and other information needed to support student health, safety, accessibility, or housing placement | Student health, safety, accessibility, accommodation coordination, in-country support, program administration, and helping place students in the safest and most appropriate housing available based on the information provided |
| Emergency Contacts | Name, relationship, phone number, email address, and other contact details for emergency contacts | Safety and emergency response, urgent student support, and collection-related outreach when necessary |
| Financial Records | Program fee payment history, balance status, billing records, refund information, scholarship or financial aid information where applicable, and transaction status information received from payment processors | Program billing, payment administration, refund processing, financial reconciliation, and coordination with third-party payment processors |
| Conduct and Criminal Activity Information | Information about conduct issues, disciplinary matters, policy violations, criminal activity, arrests, charges, convictions, or related disclosures before or during the program, where collected or reported to USAC | Application evaluation, eligibility review, student support, risk management, health and safety response, program administration, and compliance with applicable legal, institutional, or program requirements |
| Authentication & Technical Data | Session ID cookie, IP address logs, login timestamps, device or browser information, audit logs, and security event data | USAC Gateway authentication, security monitoring, access management, troubleshooting, fraud prevention, and investigation of unauthorized access |
1.3 Legal Basis for Processing
The legal basis for processing personal data depends on the context in which the data is collected and used. For applicants and enrolled students, the primary legal basis is contractual necessity because the data is required to evaluate applications, support enrollment, and fulfill USAC’s obligations under the study abroad enrollment relationship with the student, their host institution and, where applicable, their home institution.
Additionally:
- Student-record privacy practices apply to academic, enrollment, advising, and program participation data handled through USAC Gateway
- Consent or user request may apply when a prospective student submits a request-for-information form, asks to receive program information, opts in to receive SMS/text messages, or provides optional information to USAC
- Explicit consent is obtained for optional sensitive data categories, such as dietary preferences or medical accommodations, through structured intake forms
- Legitimate organizational interests may apply to website security, analytics, inquiry response, recruitment communications, CRM administration, and improving USAC programs and services
- Legal compliance governs certain processing activities, including financial record retention, privacy obligations, and breach notification requirements
2. How We Use Your Data
USAC uses personal data only for purposes that are related to the context in which it was collected, including study abroad information, recruitment, application processing, enrollment, program administration, student support, security, and legal compliance. How USAC uses your data depends on your relationship with USAC.
2.1 Public Website Visitors and Prospective Students
For public website visitors and prospective students, USAC may use personal data to:
- Operate, secure, analyze engagement with, and improve the public websites
- Respond to request-for-information forms, questions, and other inquiries
- Provide information about USAC programs, destinations, terms, scholarships, deadlines, events, and application steps
- Support admissions, recruitment, advising, and follow-up communications
- Maintain communication preferences, including unsubscribe and opt-out requests
- Send SMS/text messages to students who affirmatively opt in, including program information, reminders, deadlines, events, and other relevant USAC communications
SMS/text-message communications are optional. Students may choose whether to provide a mobile phone number for SMS communications and may opt out of SMS messages as described in the message instructions or other communication-preference mechanisms provided by USAC.
2.2 Applicants and Enrolled Students
For applicants and enrolled students, USAC may use personal data to:
- Evaluate and process study abroad applications
- Manage enrollment, course registration, and program scheduling
- Facilitate in-country program operations, including housing, visas, emergency contacts, and student support
- Use pre-departure, post-departure, and onsite travel information to support travel coordination, safety planning, emergency preparedness, location awareness during program-related travel, and student support in the event of disruptions, emergencies, or other health and safety concerns
- Communicate with students about program logistics, requirements, deadlines, updates, and, where the student has opted in, SMS/text-message reminders or alerts
- Enable student self-service access to their own records
- Process program fee payments through third-party payment processors
- Respond to student inquiries and support requests
- Comply with applicable legal and regulatory requirements, including privacy and breach notification obligations
- Maintain security of USAC Gateway and investigate unauthorized access
2.3 No Sale of Personal Data
USAC does not sell personal data. USAC may use contact information, stated program interests, inquiry history, and communication preferences to respond to inquiries and provide relevant information about USAC programs and services, including SMS/text messages where a student has opted in. USAC does not use sensitive student records submitted through USAC Gateway for unrelated advertising, third-party marketing, or sale to data brokers, and does not share sensitive student records with advertising networks. Any service provider access to personal data is limited to the services they provide to USAC.
3. Who We Share Your Data With
USAC shares personal data only as necessary to support USAC operations, program delivery, website and CRM services, communications, security, legal compliance, and other purposes described in this notice.
3.1 In-Country Program Staff
When a student enrolls in an overseas program, limited operational data is shared with USAC's in-country program coordinators at the relevant program site. This may include application details, contact information, emergency contacts, dietary/medical, accommodations, and passport data. Access is role-restricted to the specific program site to which the student is enrolled.
A list of USAC's current program locations is available at usac.edu/study-abroad-programs.
3.2 Host Universities and Housing Providers
Limited enrollment and contact data may be shared with host universities and housing providers prior to the program start and at the program site, as required to complete in-country enrollment and arrange student accommodation.
3.3 Visa Processing Centers and Consulates
If a student chooses to have USAC assist with a visa or related travel authorization application, USAC may share limited personal data and supporting documentation with third-party visa processing centers, consulates, embassies, or other government-authorized offices as necessary to support the application process. This sharing occurs only as needed for the student’s requested visa assistance and may include information such as identity, contact, passport, enrollment, program, travel, or other application-related documentation required by the relevant authority or processing center.
3.4 Insurance Carriers and Assistance Providers
USAC includes international health insurance and related assistance services for students as part of the program support described on USAC’s health and safety resources. To administer this coverage, support claims, coordinate referrals or assistance, and respond to health, safety, or emergency needs, USAC may share limited personal data with the applicable insurance carrier, claims administrator, assistance company, or related service provider. This may include identity, contact, enrollment, program, travel, emergency contact, claims-related, or health and accommodation information as necessary for coverage administration, assistance, claims processing, or student support.
3.5 Home Universities, Host Universities, and Schools of Record
USAC may share application, enrollment, academic, billing, health and safety, conduct, program participation, and related student information with the student’s home university, host university, sponsoring institution, or school of record as necessary to support application review, enrollment approval, academic credit coordination, course registration, financial aid or billing coordination, student support, risk management, reporting, and other study abroad administration purposes. The receiving institution may maintain its own education records and privacy practices for information it receives or independently holds.
3.6 Payment Processors
Program fee payment processing and certain refund processing may be handled by third-party payment processors, banks, or payment service providers. Students may be directed to an external payment portal to complete payment transactions, and USAC may use contact information, refund information, or related financial records to issue refunds through services such as Zelle where applicable. USAC does not store, process, or transmit credit card data. The applicable payment processor, bank, or payment service provider’s privacy practices are governed by that provider’s own privacy policies.
3.7 Website, CRM, Communications, and Technology Service Providers
USAC may use service providers that support website hosting, analytics, CRM administration, communications, inquiry management, enrollment operations, security, and related business functions. These providers may process personal data only to provide services to USAC and are not permitted to use personal data for their own independent purposes.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile phone numbers and SMS opt-in information may be processed by service providers only as needed to deliver messages on USAC’s behalf, maintain consent and opt-out records, or support related communications services.
3.8 Law Enforcement
USAC does not share student data with law enforcement without a valid warrant, subpoena, or court order, except as required by law.
4. International Data Transfers
USAC is based in the United States and operates core systems and services from the United States. If you interact with USAC from outside the United States, your personal data may be processed in the United States.
If you are enrolled in a program at an international site, limited operational data will be transmitted to in-country program staff at that location. This transmission is made for program enrollment, administration, safety, student support, and in-country compliance purposes and is governed by USAC’s internal data handling policies and staff confidentiality obligations.
USAC may also use service providers that support websites, CRM, communications, security, or program operations. Where service providers process personal data, USAC expects them to handle that data only for the services they provide to USAC and in accordance with applicable contractual and legal requirements.
5. Cookies and Technical Data
5.1 Public Website Cookies and Similar Technologies
USAC’s public websites may use cookies and similar technologies to operate the site, understand visitor engagement, remember preferences, support inquiry or communication workflows, improve site performance, and maintain security. Depending on the tools in use, these technologies may collect technical information such as IP addresses, browser type, device information, pages visited, referring source, and interaction data.
USAC may use website analytics or similar service providers to help understand how visitors use the public websites and improve the usability and effectiveness of USAC’s online services. USAC does not sell cookie data to data brokers.
5.2 USAC Gateway Session Cookies
USAC Gateway uses a functional session cookie after login. This cookie maintains your authenticated session across pages during an active session and is automatically invalidated upon logout or session timeout. USAC Gateway session cookies are used for authentication, security, and access management.
5.3 What USAC Gateway Does Not Use
- Advertising or retargeting cookies
- Cross-site tracking mechanisms for advertising purposes
- Third-party tracking pixels used for behavioral advertising
5.4 Links to Third-Party Websites
USAC’s public websites may include links to websites or online services that are operated by third parties. These third-party websites may independently collect personal data from you and are governed by their own content, terms, and privacy practices. USAC is not responsible for the content or privacy practices of third-party websites, and we encourage you to review the privacy policy of any website you visit.
5.5 IP Addresses
USAC may log IP addresses and related technical data when you access the public websites or USAC Gateway. This data may be used for website operation, security, troubleshooting, fraud prevention, investigating unauthorized or suspicious access attempts, enforcing access controls, and improving system performance. USAC Gateway IP address logs are accessible only to personnel with an administrative or security need and are not used to create advertising profiles from sensitive student records.
6. Privacy Rights and Student Records
6.1 USAC’s Role for USAC Gateway and Student Records
USAC is the independent data controller for personal data submitted directly to USAC through USAC Gateway and related USAC systems. When you apply for or enroll in a USAC study abroad program, USAC determines the purposes and means of processing the data it collects for application, enrollment, advising, course registration, program participation, student support, and related administrative purposes.
USAC treats student application, enrollment, advising, course registration, and program participation records as sensitive student records. We protect these records using privacy practices designed for student data, including limiting access to personnel with a legitimate program need, using records only for study abroad administration, and sharing information only as described in this notice or as otherwise authorized by the student or required by law.
6.2 Your Privacy Rights Regarding USAC-Held Records
Your privacy rights may vary depending on your jurisdiction, your relationship with USAC, and the type of personal data involved. For personal data that USAC independently holds, USAC is your direct point of contact for exercising applicable rights. You are not required to route requests through your home institution to exercise rights regarding data that USAC independently holds.
| Right | What it Means | How to Exercise |
|---|---|---|
| Access | Request a copy of the personal data USAC holds about you | Submit written request to privacy@usac.edu |
| Review | View your enrollment profile, application materials, and submitted data |
Self-service access may be available directly through USAC Gateway |
| Correction | Request correction of inaccurate, incomplete, or outdated data | Submit written request to privacy@usac.edu; routine enrollment corrections may also be directed to enrollment@usac.edu |
| Deletion | Request deletion of your data where USAC has no overriding legal or operational basis for retention | Submit written request to privacy@usac.edu; reviewed case-by-case |
| Restriction | Request that USAC restrict active processing of your data in specific circumstances | Submit written request to privacy@usac.edu |
| Portability | Request your data in a structured, machine-readable format (CSV) | Submit written request to privacy@usac.edu |
USAC will respond to all data subject rights requests within 30 days of receipt. Complex requests may require up to 60 days, in which case you will receive written notice of the extension. All requests require identity verification before any data is disclosed or modified.
6.3 USAC-Held Records vs. Institution-Held Records
USAC holds records relating to your study abroad enrollment, application, and program participation. Your home institution, host institution, and school of record may separately maintain their own education records — such as official transcripts, degree progress, course enrollment, grades, and broader institutional academic history. These are distinct record sets:
| Record Type | Held by | Contact for Rights Requests |
|---|---|---|
| Study abroad application and enrollment data | USAC | privacy@usac.edu; routine enrollment questions may also be directed to enrollment@usac.edu |
| Program participation, advising notes, course registrations | USAC | privacy@usac.edu; routine enrollment questions may also be directed to enrollment@usac.edu |
| Official transcripts, unofficial transcripts, grade reports and other academic records | USAC | privacy@usac.edu; routine academic record questions may also be directed to enrollment@usac.edu |
| Official transcripts and academic records | Home institution, host institution, or school of record, as applicable | The applicable institution’s Registrar or records office |
| Broader institutional academic history | Home institution, host institution, or school of record, as applicable | The applicable institution’s Registrar or records office |
Where USAC makes your enrollment data available to your home institution, host institution, school of record, or another authorized institutional recipient, and you wish to restrict or challenge that sharing, please contact USAC directly at privacy@usac.edu. USAC will review your request and, where appropriate, restrict the sharing of specific data elements with the applicable institution.
6.4 How to Submit a Request
All data subject rights requests should be directed to: privacy@usac.edu
Requests may also be submitted to: USAC Enrollment Services at enrollment@usac.edu (for enrollment-related questions or if you are unable to use the privacy mailbox)
7. Data Retention
USAC retains personal data for the period necessary to fulfill the purposes described in this notice and as required by applicable law:
| Data Category | Retention Period |
|---|---|
| Inquiry and lead information | Retained for the period needed to respond to inquiries, support recruitment and admissions communications, honor communication preferences, and maintain appropriate business records, unless a shorter or longer period is required by law or USAC policy |
| Active application, enrollment, and program participation records | Duration of enrollment plus post-program period consistent with USAC's student-record retention practices |
| Financial records | Minimum 7 years per IRS requirements |
| Unsuccessful application data | Limited retention period in accordance with USAC's student-record retention practices |
| Authentication and IP address logs | Retained for security and incident response purposes per USAC's incident response plan |
| Health/accommodation data | Duration of program plus a post-program period; purged when no longer needed for safety purposes |
When data is no longer required, USAC disposes of it using documented media sanitization procedures.
8. How We Protect Your Data
USAC protects personal data through a layered security program:
Technical Controls:
- Role-Based Access Control (RBAC) — access limited to staff with a legitimate need
- Multi-Factor Authentication (MFA) — enforced for all administrative accounts
- Encryption in transit (TLS/SSL)
- 24×7 managed detection and response (Adlumin MDR) with automated account lockdown for suspicious activity
Physical Controls:
- Server infrastructure co-located on a university campus with keycard and physical barrier access controls
- Redundant power, fire suppression, and cooling systems
Organizational Controls:
- Background checks for all new employees
- Security awareness training
- Formal access provisioning and deprovisioning procedures
9. Data Breach Notification
In the event of a data breach affecting personal data, USAC will notify affected individuals and, where appropriate, relevant institutions, partners, regulatory agencies, government authorities, or other required recipients in accordance with applicable breach notification laws and reporting obligations, including Nevada Revised Statutes (NRS 603A). Notification and any required reporting will be coordinated through USAC’s incident response team and cyber insurance carrier. Credit monitoring services will be offered where appropriate.
10. SMS/Text Message Terms
By providing a mobile phone number and affirmatively opting in, you agree to receive SMS/text messages from University Studies Abroad Consortium (USAC). Messages may include study abroad program information, application reminders, enrollment deadlines, event information, advising reminders, logistical updates, and other communications related to USAC programs and services.
Message frequency may vary depending on your relationship with USAC, your inquiry or enrollment status, applicable deadlines, and the communications you request or consent to receive. Message and data rates may apply.
Consent to receive SMS/text messages is not a condition of applying to, enrolling in, or participating in a USAC program. You may opt out of SMS/text messages at any time by replying STOP to a USAC text message. After you opt out, USAC may send a confirmation message and will update its records to honor your opt-out request.
For help with SMS/text messages, reply HELP or contact USAC using the contact information in this notice. SMS/text-message availability may depend on your mobile carrier and device settings, and carriers are not liable for delayed or undelivered messages.
USAC maintains records of SMS opt-in, opt-out, message preference, and related communication activity as needed to document consent, honor communication preferences, comply with applicable requirements, and support USAC communications. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
11. Privacy Complaints
If you have a concern about how USAC handles your personal data, or if you are dissatisfied with USAC’s response to a privacy rights request, please contact USAC at privacy@usac.edu.
USAC will investigate and respond to privacy complaints within a reasonable timeframe. Unresolved complaints may be escalated to USAC’s executive leadership by contacting USAC’s President/CEO at the address listed in Section 15. Students with concerns about institution-held education records should contact their home institution directly; where applicable, students may also contact the U.S. Department of Education’s Student Privacy Policy Office regarding FERPA-protected institution records.
12. Changes to This Notice
USAC may update this Privacy Notice from time to time. When material changes are made, we will update the “Last Reviewed” date above and provide notice through appropriate channels, which may include the public websites, USAC Gateway, email, SMS/text message, or other communications depending on the nature of the change. We encourage you to review this notice periodically.
Contact Us
For questions about this Privacy Notice or your personal data:
University Studies Abroad Consortium
University of Nevada, Reno
1664 N. Virginia St., MS 0323
Reno, NV 89557
Email: privacy@usac.edu or enrollment@usac.edu
Toll-free phone: (866) 404-USAC (8722)