Effective Date: May 13, 2019

Vanta Education, Inc. (“Vanta Education,” “we,” “us” or “our”) values your privacy.  This privacy policy (“Privacy Policy”) describes how we collect and process your personal data, including any data you may provide through our website, www.vantaedu.com (our “Website”).

It is important that you read this Privacy Policy, together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data.

1. Who We Are and Important Information

Who We Are

Vanta Education is an education company specializing in helping students transform both their personal future and that of their communities through the network of educational institutions that we manage around the world.  Vanta Education institutions are universities, colleges and schools committed to enhancing student learning through innovative, robust programs, with an emphasis on higher education and its resultant effect on the global economy.  In the course of our managing relationship with these universities, colleges and schools (collectively, our “Affiliate Schools”) we may receive your personal data from our Affiliate Schools in the very limited circumstances explained below. 

Data Controller

Vanta Education, Inc. is the controller and responsible for your personal data.  This is a legal term – it means that we make decisions about how and why we process your personal data, and because of this, we are responsible for making sure your personal data is used in accordance with data protection laws.

If you are a student or employee of any of our Affiliate Schools, the fair processing information you receive from them will explain how they process your personal data as part of your education or employment.

Contact Details

If you have any questions regarding this Privacy Policy, including any requests to exercise your legal rights, please contact us using the following details:

Vanta Education, Inc.

4025 S. Riverpoint Parkway, Mail Stop CF-K301, Phoenix Arizona 85040

Email Address: privacy@vantaedu.com

Changes to the Privacy Policy and Your Duty to Inform Us of Changes

All changes to this Privacy Policy are effective when they are posted on our Website.  When we change this Privacy Policy in a material way, we will let you know via a prominent notice on our Website, prior to the change becoming effective and update the ‘effective date’ at the top of this page.

It is important that the personal data we hold about you is accurate and current.  Please keep us informed if your personal data changes during your relationship with us.

Third-Party Links

Our Website may include links to third-party websites, plug-ins and applications.  Clicking on these links or enabling these connections may allow third parties to collect or share data about you.  We do not control these third-party websites and are not responsible for their privacy statements.  We encourage you to read the privacy policy of every website you visit.

2. The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified.  It does not include data where the identity of an individual has been removed (“anonymous data”).

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

• Contact Data includes postal address, email address and telephone numbers.

• Financial Data includes bank account, billing information and information from any financial institution you may provide us.

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.

• Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our Website.

• Usage Data includes information about your visit to our Website, including the Uniform Resource Locators (URL) clickstream to, through and from our Website (including date and time), page response times, download errors, lengths of visits to certain pages, page interaction information (such as scrolling, clicks and mouseovers) and methods used to browse away from the page and any phone number used to call us.

We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it.  Anonymized data cannot be linked back to you.  We may use anonymized data to conduct research and analysis, including to produce statistical research and reports, for example, to calculate the percentage of users accessing a specific website feature.

Special Categories of Personal Data

“Special categories” of personal data include information relating to your race, ethnicity, religious or other beliefs, health, sex life and/or sexual orientation, political beliefs and criminal convictions and offenses.

On very rare occasions, we will receive “special categories” of Personal Data indirectly in the following circumstances:

• From time to time, our Affiliate Schools will “special categories” of Personal Data about their students or employees where they require our advice or managerial assistance. We ask our Affiliate Schools to anonymize such information where possible, but from time to time, it may be necessary for them to share such information with us to allow us to perform our advisory and managerial roles effectively. We will process such information on one of or a combination of the following legal bases:

• where the relevant Affiliate School has obtained your explicit consent to share it with us for these purposes;
• where you are an employee of an Affiliate School, where it is necessary to share it with us in connection with your employment;
• where it is necessary for us to receive it in connection with the establishment, exercise or defense of legal claims; and/or
• where it is necessary for reasons of substantial public interest.

• In addition, in connection with our uncompromising commitment to our Code of Business Ethics (the “Code”), we operate an ethics and compliance hotline (via a third party at https://www.integritycounts.ca/org/VantaEducation). Anyone can report a suspected breach of the Code using our hotline, including our own employees, students and employees of our Affiliate Schools and any member of the public.  Depending on the nature of a person’s allegation and the details they provide, we may indirectly receive “special categories” of Personal Data about the person making the report and/or the subject of their report. This could include, for example, information about a suspected offense such as fraud or information relating to health or race in respect of alleged discrimination on the grounds of disability or race.   In such cases, the legal basis for our use of such information will be one of or a combination of the following:

• where it is necessary to share it with us in connection with employment, social security or social protection law;
• where it is necessary in connection with the establishment, exercise or defense of legal claims; and / or
• where it is necessary for reasons of substantial public interest.

Please also see Section 3 below for information around the other categories of personal data that we may receive about you indirectly.

If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you.  In this case, we may have to cancel a service you have with us but we will notify you if this is the case at the time.

3. How Is Your Personal Data Collected?

We use different methods to collect data from and about you including through:

• Direct Interactions. You may give us your Contact, Financial and Identity Data directly by filling in forms or by corresponding with us by post, telephone, email or otherwise.  This includes personal data you provide when you:

• submit an online query or request a call back;
• provide data to us, including through our ethics and compliance hotline and our third- party due diligence screening tool;
• speak with us about your inquiry; and give us feedback.

• Indirectly as a result of your studies or employment at our Affiliate Schools. We may receive Contact Data, Identity Data and data relating to your studies or employment indirectly from our Affiliate Schools in the event that they require our advice or managerial assistance (“Student Data”).  For example, if a student or employee makes a complaint about one of our Affiliate Schools or vice versa, that Affiliate School may share certain limited factual and personal data with us in order to seek our guidance as an overarching body.  This may include personal data relating to:

• attendance at lectures, seminars, webinars or other learning sessions;
• submitting work for assessment;
• exams or other forms of assessment;
• any applications relating to your studies (for example mitigating circumstances applications);
• any legal complaint or dispute you may have or be involved with;
• issues or questions with your lecturer/personal tutor or in relation to your course;
• contact with member of the student advice team for support; or
• work related performance, complaints, disputes or other issues.

• Automated Technologies or Interactions. As you interact with our Website, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns.  We collect this personal data by using cookies, server logs and other similar technologies.

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to.  Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you;
• Where it is necessary for our legitimate interests (or those of a third party, including our Affiliate Schools) and your interests and fundamental rights do not override those interests;
• Where we need to comply with a legal or regulatory obligation; or
• Where we have your consent.

Where we are relying on your consent as a legal basis for processing your personal data, you may withdraw your consent to this processing at any time by contacting us; provided, however, that if you choose to withdraw your consent, we may not be able to enter into a business relationship with you or we may be required to terminate our business relationship with you.

Purposes for Which We Will Use Your Personal Data

We have set out below, in a table format, a description of the ways we plan to use your personal data, and legal basis we rely on to do so.  We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.  Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.


Purposes/Activity Type of Data Lawful Basis for Processing
Suppliers and Business Partners
To register you as a supplier (a) Identity

(b) Contact

(c) Financial


·   Performance of a contract with you


To process and receive goods/services:

• Manage payments, fees and charges

• Keep records for audit/accounting purposes

• Defend any legal claims brought against us or our Affiliate Schools


(a) Identity

(b) Contact

(c) Financial


• Performance of a contract with you

• Necessary for our legitimate interests (to recover debts due to us or defend legal claims)

• Necessary to comply with a legal obligation


Students or Prospective Students
To respond to inquiries or requests for information or assistance from our Affiliate Schools (a) Identity

(b) Contact

(c) Student Data

Necessary for our legitimate interests (to make reasonable inquiries into complaints and/or defend complaints and/or legal claims)


For All
To manage our relationship with you, which will include notifying you about changes to our terms or this Privacy Policy


(a) Identity

(b) Contact


·   Performance of a contract with you

·   Necessary to comply with a legal obligation

·   Necessary for our legitimate interests (to keep our records updated)


To investigate and respond to claims made via our ethics and compliance hotline


(a) Identity

(b) Contact

(c) Student Data


·  Necessary to comply with a legal obligation

·  Necessary for our legitimate interests (for running our business)


To administer and protect our business and our Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) (a) Identity

(b) Contact

(c) Technical

·   Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganization or group restructuring exercise)

·   Necessary to comply with a legal obligation


To deliver relevant Website content to you and measure or understand the effectiveness of any advertising we serve to you (a) Identity

(b) Contact

(c) Usage

(d) Technical


Necessary for our legitimate interests (to keep our website updated and relevant and to develop our business)
To use data analytics to improve our Website (a) Technical

(b) Usage

Necessary for our legitimate interests (to keep our Website updated and relevant)



Change or Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.  If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above statements, where this is required or permitted by law.

5. Disclosures of Your Personal Data

We may share your personal data with the parties set out below for the purposes set out in the table “Purposes for Which We Will Use Your Personal Data” above.

• Inside our Group: We may share your personal data with our Affiliate Schools and our parent company, Socrates Global Parent Limited, for our general business and management purposes as explained above in this Privacy Policy and for purposes of leadership reporting and seeking strategic managerial advice from our parent company.

• External Third Parties:

• From time to time, we may ask third parties to carry out certain business functions for us, such as due diligence screening; administering an ethics and compliance hotline on our behalf; IT support, systems software and maintenance; back up and server hosting providers; and payroll processing. These third parties will process your personal data on our behalf (as our processor).  We will disclose your personal data to these parties so that they can perform those functions.  Before we disclose your personal data to other people, we will make sure that they have appropriate security standards in place to make sure your personal data is protected, and we will enter into a written contract imposing appropriate security standards on them.

• In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above, in particular:

• if we transfer, purchase, reorganize, merge or sell any part of our business or the business of a third party, and we disclose or transfer your personal data to the prospective seller, buyer or other third party involved in a business transfer, reorganization or merger arrangement (and their advisors); and
• if we need to disclose your personal data in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our employees or others.

• We have set out below a list of the categories of recipients with whom we are likely to share your personal data:

• Professional advisers acting as processors, including lawyers, bankers, consultants, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• Regulators and other authorities who require reporting of processing activities in certain circumstances.

6. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.  We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

We will only retain your personal data for a limited period of time.  This will depend on a number of factors, including:

• any laws or regulations that we are required to follow;
• whether we are in a legal or other type of dispute with each other or any third party
• the type of information that we hold about you; and
• whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

7. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data.  You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.  Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, which we will notify you of, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information, which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.  Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.  If you withdraw your consent, we may not be able to provide certain services to you.  We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us at:

Vanta Education, Inc.

4025 S. Riverpoint Parkway, Mail Stop CF-K301, Phoenix Arizona 85040

Email Address: privacy@vantaedu.com

What We May Need From You if You ask to Exercise Your RightsWe may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).  This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.  We may also contact you to ask you for further information in relation to your request to speed up our response.

8. International Transfers

We comply with the EU-U.S. Privacy Shield Framework (“Privacy Shield”), as set forth by the U.S. Department of Commerce, regarding the collection, use, and retention of personal information transferred from the European Union and the United Kingdom to the United States in reliance on Privacy Shield.  We have certified to the Department of Commerce that we adhere to the Privacy Shield Principles of Notice; Choice; Accountability for Onward Transfer; Security; Data Integrity and Purpose Limitation; Access; and Recourse, Enforcement and Liability with respect to such information. Such individuals may have the right to limit the use and disclosure of their personal information as required by the Privacy Shield Principles, such as whether your personal information is disclosed to a third party or used for purposes materially different from the purpose for which the personal information was originally collected or subsequently authorized by you. If you wish to limit the use and disclosure of your personal information in accordance with the Privacy Shield Principles, please contact us as detailed above

We remain responsible for Vanta Education's own collection, use, and disclosure of personal information from the European Union or the United Kingdom in accordance with Privacy Shield. We are also responsible for third party agents that process such information on our behalf, unless we prove that we are not responsible for the event giving rise to the damage. For any inquiries or complaints that cannot be resolved through Vanta Education's internal process (see contact information above), Vanta Education has committed to cooperate with the panel established by the EU Data Protection Authorities to serve as our independent dispute resolution body for the Frameworks. We are also subject to the investigatory and enforcement powers of the FTC with respect to the Framework. In addition, under certain conditions, more fully described on the Privacy Shield website, data subjects whose personal information is transferred from the European Union or the United Kingdom may invoke binding arbitration for non-monetary issues when other dispute resolution procedures have been exhausted.  If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/. To view our PrivacyShield notice, please visit https://www.vantaeducation.com/privacy-policy/.

9. Cookies

• When you visit our Website, one or more “cookies” are generated and deployed.
• If you do not agree to our use of cookies, you should set your browser settings accordingly or not use our Website. Please be aware that if you disable the cookies that we use, this may impact your user experience while using our Website.
• The table below summarizes the different types of cookie we use on our Website, together with their respective purpose and duration (i.e. how long each cookie will remain on your device).
• Two types of cookies may be used on our Website – “session cookies” and “persistent cookies.” Session cookies are temporary cookies that remain on your device until you leave our Website. A persistent cookie remains on your device for much longer or until you manually delete it (how long the cookie remains on your device will depend on the duration or “lifetime” of the specific cookie and your browser settings).

Cookies used on our Website

Type of Cookie What do they do? Do these cookies collect my personal data / identify me?
Necessary Cookies that are essential to making our Website work correctly.  They enable visitors to move around our Website and use the features of our Website.  Examples include remembering previous actions (e.g. entered text) when navigating back to a page in the same session. These cookies do not identify you as an individual.

If you do not accept these cookies, it may affect the performance of our Website.

Performance/ Analytical Cookies that help us understand how visitors interact with our web properties by providing information about the areas visited, the time spent on our Website and any issues encountered, such as error messages.  They help us improve the performance of our Website, alert of any concerns and more. These cookies do not identify you as an individual.  All data is collected and aggregated anonymously.
Functionality Cookies that allow our web properties to remember the choices you make (such as language or the region you are in) to provide a more personalized online experience. The information these cookies collect may include personal data that you have disclosed.  We will always be transparent with you about what information we collect, what we do with it and with whom we share it.

If you do not accept these cookies, it may affect Website performance and functionality and may restrict access to web content.


What are Cookies?

Cookies are files or pieces of information that may be stored on your computer (or other internet-enabled devices, such as a smartphone or tablet) when you visit a website.  A cookie will usually contain the name of the website from which the cookie has come from, the “lifetime” of the cookie (i.e. how long it will remain on your device) and a value, which is usually a randomly generated unique number.

• We use cookies to make our Website easier to use and to better tailor our web presence to your interests and needs. Cookies may also be used to help speed up your future activities and experience on our Website. We also use cookies to compile anonymous, aggregated statistics that allow us to understand how people use our web properties and to help us improve web structure and content.  We cannot identify you personally from this information.
• Most internet browsers are initially set up to automatically accept cookies. You can change the settings to block cookies or to alert you when cookies are being sent to your device. There are a number of ways to manage cookies.  Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings.
• If you disable the cookies that we use, this may impact your experience while on our Website. For example, you may not be able to visit certain areas of our Website.
• If you use different devices to view and access our Website (e.g. your computer, smartphone, tablet etc.), you will need to ensure that each browser on each device is adjusted to suit your cookie preferences.
• If you would like more information about cookies, please visit aboutcookies.org and www.allaboutcookies.org as helpful resources. Both websites also provide instructions on how to reject cookies if you would like to do so.