This Notice at Collection and Cookie Policy explains how The University of Tulsa ("we", "us", "our") collects, uses, and shares Personal Information through this website, in compliance with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code §§ 1798.100 et seq.) and the implementing regulations issued by the California Privacy Protection Agency (CPPA).

Business contact

• Business name: The University of Tulsa

• Privacy contact email: [email protected]

Categories of Personal Information collected

We collect the following categories of Personal Information as defined under CCPA § 1798.140(v):

• Identifiers — IP address (hashed), device identifiers, online identifiers (cookies, beacons)
• Internet or other electronic network activity information — browsing history, search history, interactions with our website
• Geolocation data — approximate location derived from IP (country/region only; not precise GPS)
• Inferences — preferences and characteristics inferred from your interactions, used for site analytics

We do not knowingly collect:

• Sensitive Personal Information (Cal. Civ. Code § 1798.140(ae)) without your explicit opt-in
• Personal Information of consumers under 16 without affirmative opt-in (children under 13 require parental consent)

Sources of Personal Information

• Directly from you when you interact with the site (forms, banner choices, account creation)
• Automatically via cookies and tracking technologies
• From third-party services where you have authorized data sharing

Purposes for collecting Personal Information

• Operate and secure the website (necessary business purpose, § 1798.140(e))
• Audit interactions with the website
• Short-term, transient use of Personal Information
• Maintain and improve quality and safety of our service
• Conduct analytics with your consent
• Personalize advertising only with your opt-in consent

Cookies used

Third-party recipients

Where you have not opted out, we share Personal Information with the following service providers and contractors (CCPA § 1798.140(j) & (ag)):

We do not sell or share Personal Information for cross-context behavioral advertising unless you have opted in. To opt out at any time, click the "Do Not Sell or Share My Personal Information" link in the website footer.

Retention

Personal Information is retained for 12 months from collection, unless a longer period is required by law or for legitimate business purposes (CCPA § 1798.100(a)(3)).

Your CCPA/CPRA rights

As a California resident, you have the right to:

• Right to Know (§ 1798.100, .110, .115) — request what Personal Information we collect, use, disclose, or sell
• Right to Delete (§ 1798.105) — request deletion of your Personal Information
• Right to Correct (§ 1798.106) — request correction of inaccurate Personal Information
• Right to Opt Out of Sale or Sharing (§ 1798.120) — direct us not to sell or share your Personal Information
• Right to Limit Use of Sensitive Personal Information (§ 1798.121) — limit our use of Sensitive Personal Information to disclosed purposes
• Right to Non-Discrimination (§ 1798.125) — we will not discriminate against you for exercising any of these rights
• Right to Data Portability (§ 1798.130(a)(2)) — receive Personal Information in a readily usable format

To exercise the rights to know, delete, correct or port, email [email protected]. Those are verifiable consumer requests, so we will verify your identity before acting (CCPA § 1798.130(a)(2)), and we will respond within 45 days (extendable to 90 with notice, § 1798.130(a)(2)(B)).

To opt out of the sale or sharing of your Personal Information, use the "Do Not Sell or Share" and "Manage Preferences" links in the website footer. To limit our use of Sensitive Personal Information, email [email protected]. Neither an opt-out nor a request to limit is a verifiable consumer request (CPPA Reg. § 7060(b)): we will act on both without asking you to verify your identity or to create an account.

You may also designate an authorized agent to submit a request on your behalf (Cal. Civ. Code § 1798.135(c)).

Global Privacy Control (GPC)

We honor the Global Privacy Control signal as a valid opt-out of sale/sharing per California AG enforcement guidance.

Supervisory authority

Complaints may be filed with the California Privacy Protection Agency: [email protected], or at https://cppa.ca.gov/.

Changes

We may update this Notice. Material changes will be announced 30 days in advance via a banner on the homepage. The "Last updated" date above is authoritative.

Contact

Email [email protected] with any privacy question.