Updated: 12/18/2019

Starfish by Hobsons is a web-based student success platform owned and operated by Hobsons, Inc. Starfish helps educational institutions scale their student success initiatives, enabling students to engage effectively with the campus community to achieve their academic goals, and enabling institutions to better gauge risks and implement interventions that remove barriers to student success.

This Privacy Policy is intended to inform visitors to Starfish (“Starfish”), owned and operated by Hobsons, Inc., about how Hobsons, Inc. may collect, use, and disclose your personal information. By accessing or using Starfish, you acknowledge that you have read and understood this Privacy Policy.

Definitions

“Administrative Users” means Users who are associated with a Customer account and have responsibility for managing information about the Customer institution within Starfish.

“Customers” means higher education institutions who have a contractual agreement in place with, and subscribe to, Starfish by Hobsons. “Personal Information” means any information relating to an identified or identifiable natural person.

“Special Categories of Personal Data” means personal data which reveals race/ethnic origin; political opinions; religious or similar beliefs; trade union membership; physical or mental health; sex life or sexual orientation; and criminal convictions data.

“Users” and “your/you” means Administrative Users, students and prospective students who access and use Starfish.

[top]

Personal Information Collection and Processing Overview

When we provide services to you as a Customer or User accessing Starfish through a Customer account, under the European Union General Data Protection Regulation (GDPR), we function in the capacity of a “data processor.” In those circumstances, our processing of your personal information is governed by this Privacy Policy as well as the contractual agreement with the Customer.

We function as a “data controller” when we process certain Personal Information if we send marketing materials or communications to existing Users.

As a User, you may provide Personal Information to us when you visit and engage with Starfish. In some cases, we will ask for your consent so that we may process your Personal Information. In other circumstances, we may rely on a different lawful basis, as explained in the section, “How We Use and Disclose Personal Information.” (See Terms of Use.)

[top]

Information We Collect

We may collect and process all or some of the following Personal Information about you, which you may provide directly, or which may be provided by Customers.

Information Customers Provide

When Customers contract with us to use Starfish, an Administrative User submits information necessary to create their institution and employee User accounts, including first and last names, email addresses and passwords.

Customers also provide the following minimally required information about their students to allow Customers to create student accounts and create relationships within Starfish between their students and Users:

  • Unique identifier, first name, last name, password, and email address

Starfish works in tandem with existing Customer course management and/or student information systems. Therefore, Customers may choose, at their sole discretion, to import additional information about students from these systems into Starfish. This information may include city and state, age, gender, race, ethnicity, additional demographic information, attendance data, course plans, academic interests, academic performance data, personal attributes, behavioral data, and information about student well-being.

Starfish may also be used by students and prospective students to register in and out of appointments with Customer. These individuals will be asked to provide an identification card, first and last name.

Prospective students will also be asked to agree to this Privacy Policy and provide an email address and one or more of the following: date of birth, home phone or postal code.

Users may also choose to provide information about the purpose for their appointment. This information is used to create a limited record of prospective students in

Starfish for the Customer’s records. Starfish Usage Information and Cookies:

When a Customer or User accesses Starfish, our servers automatically collect the Internet Protocol (“IP”) address associated with the user’s computer. We may also collect additional information such as login timestamp, browser type and version, the operating system of the computer and language, as well as areas that users visit most frequently, and services accessed most often. This information is logged to help us to diagnose technical problems and to administer Starfish. We also analyze the information for aggregate trends about how our customers use Starfish.

To collect information about an individual user’s use of Starfish, we use cookies. Cookies are small data files sent by a website and stored on the computer or device at the request of that site. Cookies store information related to a user’s browser to enable us to recognize the browser on return visits to Starfish and to remember the user’s preferences.

We use cookies for these purposes:

  • To remember your preferences, such as any customization of your home page in Starfish
  • To keep track of your progress within Starfish, so that on a return visit we display the information as you last left it
  • To understand how our Users interact with Starfish to help us improve user workflows and the ways Starfish works and to enhance our service to our users

Third Party Cookies:

We use third-party service providers to assist us in collecting and understanding the usage information. Most browsers can be set to detect browser cookies and to let a user reject them but refusing cookies may make it difficult to use Starfish. To learn more about browser cookies, including how to manage or delete them, refer to the Tools, Help or similar section of your web browser.

By using Starfish, you agree to the use of these aforementioned tracking technologies.

[top]

How We Use and Disclose Personal Information:

WE DO NOT SELL OR RENT DATA. We do not disclose, distribute, access or reference Customer or User personal information except as noted at the time that we request the information, when Users choose to connect with other Users, make their profiles visible and share their information, when Users post in public forums, or in the following circumstances:

  • To generate and manage log-in credentials: to create the Customer account, provide log in credentials, authenticate Users, maintain, and administer Starfish and the Customer and User accounts.

Legal basis: legitimate interests (to enable us to perform our obligations and provide access to Starfish and our services to you);

  • To provide Starfish features to you as a Customer and your Users including to fulfill orders or requests you have made, provide reporting and analytics for you on your Starfish usage, including services and features utilized, to allow our Customers to tailor and optimize the use of Starfish to the needs of their Users, to permit Customers and Users to offer students feedback and support from their institution, permit students to access information shared by their counselors, advisors, teachers and other campus community members and to help students track their progress, schedule appointments, connect with other campus community members, including sharing content with them, and to otherwise provide support services and communications, or where we need to provide your Personal Data to our service providers related to the provision of the Services as detailed below. Where this includes Special Categories of Personal Information, we rely the Customer having obtained your explicit consent.

Legal basis: legitimate interests (to enable us to perform our obligations and provide access to Starfish and our services to you); performance of a contract; and in limited circumstances, your explicit consent.

  • To provide and ensure the quality and security of Starfish: to maintain and administer Starfish and the Customer and User accounts, to ensure service quality, and to ensure the security of Starfish and our associated services, including provision of support, services and security by our third party providers, and to permit Starfish consultants, when retained by a Customer, to provide Customer support and guidance on how the Customer can analyze its student data, including its students’ use of Starfish.

Legal basis: legitimate interests (to enable us to perform our obligations and provide access to Starfish and our services to you); performance of a contract.

  • To communicate effectively with Customers and Users: including to respond to queries, resolve a problem or support issue, notify about changes to the services, and to otherwise communicate and solicit feedback on your product experience.

Legal basis: legitimate interests (to enable us to perform our obligations and provide access to Starfish and our services to you).

  • In relation to a known or suspected violation of our terms of use, fraud prevention or other unlawful use: including to share Personal Information with entities assisting us in investigation and as may be required by applicable law.

Legal bases: legal obligations, legitimate interests (to allow us to ensure the legality of Starfish and our services).

  • With your consent, to provide you with marketing materials: to provide you with updates and offers about our products and services, where you have chosen to receive these. At anytime you may unsubscribe or opt-out of further communication on any electronic marketing communication by using the link labeled “unsubscribe” available in each email communication or by contacting us at privacypolicy@hobsons.com.

Legal basis: consent.

  • In the event of a reorganization, merger, sale, assignment, bankruptcy, or similar business change: we may need to transfer your Personal Information to that re-organized entity or new owner after the sale or reorganization for them to use in accordance with this policy.

Legal basis: legitimate interests (in order to allow us to change our business);

  • In connection with legal or regulatory obligations: We may use and disclose your Personal Information as necessary to protect our rights or the rights and safety of our Customers and Users, or as necessary in the event of a court order, regulatory inquiry or other lawful request. Provided, however, that unless legally prohibited, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime.

Legal bases: legal obligations, legitimate interests (to cooperate with law enforcement and regulatory authorities).

We may create de-identified data from Customer and User information by removing data components that make the information personally identifiable to you and your institution, and through deletion, obfuscation, or other means. We may use this data for a variety of purposes subject to applicable law, including, but not limited to:

  • When requested by a Customer, to apply descriptive, inferential, and predictive data analytics techniques to their data to better inform student success interventions
  • To improve our educational products for adaptive learning purposes and for customizing the student experience
  • To demonstrate the effectiveness of Starfish, including in our marketing materials
  • To develop and improve our products
  • For other lawful purposes

[top]

Third Party Services:

Starfish provides Customers with access to a variety of features which Customers may choose to make available to their End Users and students. These features allow students to explore their strengths and career interests and allow End Users to engage in SMS text messaging with students sent through Starfish.

If Customers choose to make these features available, a limited amount of information, including personal information, may need to be sent to the third party in order to deliver the service to the Users. We do not disclose more information to third parties than is necessary for them to provide features on behalf of Starfish.

We may also share information, including personal information, with select third party service providers to facilitate our delivery of the service or to provide a feature on our behalf. Such services and features may include maintenance services, database management, enabling course registration synchronization with a Client SIS, analytics, customer support and improvement of Starfish, or assistance for us to better understand how Starfish is used. In addition, certain features are provided by third parties and are governed by the privacy policies and terms and conditions of those third parties.

All third parties have agreed to handle the information in compliance with legal requirements, this Privacy Policy, and the Starfish security policy. They may use the information for the sole purpose of providing the service to Customers and their students.

In some cases, links may be provided to permit students with the opportunity to explore a third party’s offerings beyond those that are part of Starfish. Those links are provided for convenience, and Users may need to agree to those third-party privacy policies and terms and conditions in order to access and use those features.

[top]

How Customers Can Modify Their Information:

Users may correct or change the information collected during registration by logging into their account and choosing the “Profile” option or similar functionality offered in Starfish. For data not available directly, please contact the system administrator at your institution or contact Starfish at the address listed below.

Users should contact their educational institution or other organization licensing the software for questions about accessing or modifying the personal information provided to Starfish by the Customer. We will also provide access to and assist in modifying personal information as required by applicable privacy laws.

[top]

Security:

We are committed to protecting the security, integrity, and confidentiality of the data using physical and technical safeguards. We host Customer data in secure cloud-based environments that use a firewall, encryption, and other industry-standard technology to prevent interference or access from outside intruders.

We also require unique account identifiers and passwords that must be entered each time Customers or students sign on to Starfish. The Internet, however, is not perfectly secure and we are not responsible for security breaches not reasonably within our control.

We require that Customers maintain the confidentiality of their user names and passwords. If Customers become aware of any unauthorized use of an account, loss of their or their students’ account credentials or suspect a security breach, they should notify us immediately at infosec@hobsons.com.

[top]

Data Retention:

As a system of record for its Customers, we hold and retain information in Starfish at the sole discretion of Customers, and for as long as they have active agreements for Starfish. After termination of an agreement, we will retain Customer data for ninety (90) days for the convenience of Customers, so that they may retain continuity of their experience should they choose to reengage with Starfish. We do not access, use, or otherwise process Customer data during this time. At the end of the data retention period, we securely delete and destroy personal information from Customers.

However, at any time upon termination of an agreement or otherwise at their discretion, Customers may submit a written request to have their personal information that is held in Starfish deleted. We will comply with such written requests within thirty (30) days.

We may retain certain Customer information for lawfully required business record keeping purposes, however this does not include User information.

We do retain non-personal information, including aggregated, de-identified data for the purposes described in the section titled, “How We Use and Disclose Information.”

[top]

Opt-Out Policy:

We send emails to Customers with information about our products that we believe may be of interest. Customers may opt out of receiving email messages from Starfish by contacting us at privacypolicy@hobsons.com or by clicking on the “unsubscribe” link found at the bottom of every email that we send.

If Customers have opted out of receiving communications from us, we may still send essential communications regarding Starfish, such as password change messages, to Customers’ or students’ accounts.

We do not send email messages on behalf of third parties.

We do allow Customers to send messages to students through Starfish. These messages are part of the Starfish functionality, and students should contact their institution if they would like to discuss opting out of those messages.

[top]

Notice For California Residents

California residents have certain rights with respect to their personal information, as described below. Before we may fulfill your requests, we are required by law to verify your identity in order to prevent unauthorized access to your data. This may require us to contact your Starfish Administrator directly to validate your identity.

We Don’t Sell Your Personal Information.

Right to Know and Access Information: You may access information we maintain about you using the methods provided below. If we grant your request, we will provide you with a copy of the personal information we maintain about you in the ordinary course of business. This may include what personal information we collect, use, or disclose about you. We may not fulfill some or all your request to access as permitted by applicable law.

Deletion of Information: You may request that we delete your personal information. Depending on the scope of your request, we may refrain from granting your request, as permitted by applicable law. For example, we may be legally required to retain your information in our business records. You may submit a deletion request using the methods provided below.

Authorized Agent: California residents may use an authorized agent on their behalf to exercise a privacy right discussed above. If you are an authorized agent acting on behalf of a California resident to communicate with us or to exercise a privacy right discussed above, you must be able to demonstrate that you have the requisite authorization to act on behalf of the resident and have sufficient access to their laptop, desktop, or mobile device to exercise these rights digitally. If you are an authorized agent trying to exercise rights on behalf of a Starfish user, please contact us at the contact information below with supporting verification information, which includes a valid Power of Attorney in the State of California, proof that you have access to the consumer’s interface, and proof of your own identity.

To Exercise Your Rights

Since Starfish is used at the direction of the Client, and since FERPA requires that we remain under the direct control of the education institution with respect to our use and maintenance of student data that is part of the education record, please contact your education institution to exercise your rights, and we will work with them to facilitate your request.

Please note that your exercise of the above rights is subject to certain exemptions to safeguard the public interest (e.g., the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege). We will try to comply with your request as soon as reasonably practicable. Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and applicable law. Where required by applicable law, we will notify you if we reject your request and notify you of any reasons, we are unable to honor your request.

Non-discrimination: We shall not discriminate or otherwise penalize anyone for exercising their rights under this Privacy Policy.

Categories of Personal Information we collect
  • Identifiers such as a real name, unique personal identifier, online identifier, Internet Protocol address, email address, account name
  • Personal Information described in subdivision (e) of California Business and Professions Code Section 1798.80: name
  • Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).
  • Internet or other electronic network activity information regarding your interaction with Starfish
Categories of sources from which the Personal Information is collected
  • We collect the Personal Information directly from you or from your educational institution.
Business or commercial purpose for collecting or selling Personal Information We collect your Personal Information to provide the services and for the following business purposes:

  • Performing services in accordance with our contract with the Customer and the terms of use including maintaining or servicing accounts, providing customer service, processing, or fulfilling orders and transactions, verifying customer information, and processing payments.
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
  • Debugging to identify and repair errors that impair existing intended functionality.
  • Sending you product communications.
Categories of third parties with whom we share Personal Information We do not share your Personal Information with “third parties” as the term is defined in CCPA. That is, we do not share your Personal Information with individuals or organizations to use for their own commercial purposes.
Specific pieces of Personal Information we have collected Customers: first and last names, email addresses and passwords; student unique identifier, first name, last name, password, and email address.

Customers may optionally provide: city and state, age, gender, race, ethnicity, additional demographic information, attendance data, course plans, academic interests, academic performance data, personal attributes, behavioral data and information about student well-being.

Students and Prospective  Students: identification card, first and last name;

Prospective students: email address and one or more of the following: date of birth, home phone or postal code, and optionally additional information about their appointment.

[top]

Additional Data Rights

Please note that the rules in your country may provide you with additional rights or may limit these rights. In all cases, our provision of the rights will comply with the applicable laws.

If you are based in the EEA, for example, you may have the right to access, update or correct your Personal Information, to request deletion of such Personal Information, and to object to certain processing, including that related to marketing, to receive a machine-readable copy of the Personal Information concerning you that you provided to us or request us to transfer such data to an applicable third party in certain circumstances.

In addition, where you provided your consent in respect of any processing by us of your Personal Information, you may withdraw such consent by contacting us using the details provided in the “Contact” section. You may also restrict how we use your information while a complaint is being investigated.

Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g. the maintenance of legal privilege). If you exercise any of these rights, we will check your entitlement and respond in most cases within a month.

If you are using Starfish through a Customer account, please contact the Customer to exercise your rights, and we will work with them to facilitate your request. Otherwise, to exercise these rights with respect to your Personal Information, please contact us at privacypolicy@hobsons.com.

[top]

For International Users:

If you are located outside of the United States, please be aware that your information will be transferred to, processed, and stored in the United States.

By submitting your Personal Information, you acknowledge that we may transfer, process, and store your data in this way. Wherever the data is, it will be treated securely and in accordance with this Privacy Policy and applicable privacy laws the United States. These laws may be different from the privacy laws in your country. However, this does not change our commitments to safeguard your privacy and we will comply with all applicable laws relating to the cross-border data disclosure of your personal information. Where required, we will implement Standard Contractual Clauses with our third parties or rely on such other transfer mechanism or derogation to ensure that the transfer of your Personal Information outside of the EEA is lawful. You may request details of the transfer mechanisms that we rely on to transfer Personal Information outside of the EEA by emailing us at dataprotection@dmgt.com.

[top]

Updates to This Policy:

As our product evolves, we may make changes to this Privacy Policy. The “last updated” note at the top of this page indicates when it was last revised. Material changes to the Privacy Policy will be provided to the business contacts for our Customers, and such changes will be effective when accepted by Customers on behalf of their employees and students, and when the Privacy Policy is posted within Starfish, or otherwise as required by law. Non-material changes will become effective when we post the revised Privacy Policy within Starfish.

[top]

Contact:

If you have any concerns or complaints about how we handle your personal information, or if you have questions regarding this Privacy Policy, please contact us at:

400 E-Business Way, Suite 400
Cincinnati, OH 45241
Attn: Privacy Office Email: privacypolicy@hobsons.com

If you have concerns or complaints regarding this Privacy Policy or our data handling procedures, you may have a right to lodge a complaint with a supervisory authority. Our EU Representative may be reached at dataprotection@dmgt.com and our Data Protection Officer may be reached at privacypolicy@hobsons.com.

[top]