ELEVATEU PRIVACY NOTICE

1. Who This Notice Applies To

This Notice applies to:

• Customer Organizations purchasing or using ElevateU;
• Organization Administrators;
• Managers;
• Learners; and
• other authorized users of the ElevateU Platform.

ElevateU is intended only for workplace users who are 18 years of age or older.

Minors are not permitted to use ElevateU.

Customer Organizations are responsible for enrolling only eligible adult users.

2. Information We Collect About Customer Organizations

Depending on the purchase and applicable requirements, ElevateU may collect or maintain:

• organization name;
• business contact information;
• billing information;
• purchase details;
• payment status;
• purchased seat quantities;
• administrative records associated with the organization’s ElevateU account;
• tax identification information when necessary for tax administration or exemption documentation; and
• tax-exemption forms or other supporting tax documentation when applicable.

We do not collect an organization’s tax identification number unless it is needed for tax administration, exemption documentation, or another applicable legal requirement.

3. Information We Collect About Authorized Users

ElevateU collects only information reasonably necessary to identify authorized users, provide course access, administer roles, maintain training records, and protect the Platform.

This may include:

• the name provided for the user;
• business email address;
• organization association;
• role within ElevateU, such as learner, manager, or Organization Administrator;
• manager relationship where required for training administration;
• enrollment and activation information;
• course progress;
• assessment status or results;
• completion status;
• certificate records;
• authentication information;
• session information;
• security records; and
• audit records associated with authorized Platform activity.

ElevateU does not require or independently verify a user’s legal name.

The name supplied by the Customer Organization or user is used for enrollment, reporting, and certificate purposes.

Nicknames or preferred names may be used.

4. Certificate Names

Certificates are generated using the name contained in the learner’s ElevateU record at the time the certificate is issued.

CUelevate does not independently verify legal names.

Users and Customer Organizations are responsible for ensuring that the name entered into ElevateU is the name they want displayed on the certificate.

CUelevate does not ordinarily reissue certificates solely because a learner later requests a different name.

5. Information We Do Not Need or Intentionally Collect

ElevateU does not require users to provide:

• Social Security numbers;
• personal tax identification numbers;
• dates of birth;
• home addresses;
• personal telephone numbers;
• salary information;
• employee benefits information;
• personnel files;
• disciplinary records;
• personal banking information;
• personal credit information;
• detailed job titles; or
• other employment information unrelated to administration of ElevateU.

Customer Organizations should provide only information necessary to administer the ElevateU relationship.

6. Member Information

ElevateU does not require or intentionally collect credit-union member information.

Users should not enter actual member information into ElevateU.

ElevateU does not require:

• member names;
• Social Security numbers;
• member account numbers;
• loan information;
• account balances;
• transaction histories;
• credit reports;
• member authentication information;
• member payment information; or
• other member financial records.

Training scenarios use simulated information and are not intended for use with actual member data.

7. How We Use Information

We use information maintained through ElevateU only as reasonably necessary to:

• establish and administer Customer Organizations;
• authenticate authorized users;
• provide course access;
• assign and manage user roles;
• administer learner seats;
• maintain enrollment and progress records;
• administer assessments;
• document completion;
• issue certificates;
• provide authorized manager and organization reporting;
• process and reconcile purchases;
• administer applicable taxes and exemptions;
• maintain Platform security;
• investigate suspected misuse or unauthorized access;
• provide authorized support;
• maintain required business records; and
• comply with applicable legal obligations.

8. Payments

ElevateU uses Stripe to process payments.

Sensitive payment credentials used to authorize payment remain within Stripe’s payment environment.

CUelevate does not store online-banking usernames or passwords.

CUelevate may retain transaction-related business records such as:

• order information;
• payment status;
• transaction references;
• amount;
• applicable taxes; and
• payment events needed to administer the purchase.

9. Service Providers

CUelevate uses service providers necessary to operate ElevateU and related business services.

Current providers may include:

• Cloudflare for application execution and production application data and file infrastructure, including Workers, D1, and R2 as currently used;
• Stripe for payment processing; and
• GoDaddy / Microsoft 365 for business and transactional email services.

These providers receive only the information reasonably necessary to perform their applicable function.

CUelevate does not authorize these providers to use ElevateU information for unrelated third-party marketing.

CUelevate does not use GitHub to store or process ElevateU production personal information.

10. How We Share Information

CUelevate does not sell personal information.

CUelevate does not share Customer Organization or user information for third-party advertising or unrelated marketing.

Information may be disclosed only when reasonably necessary:

• to service providers that support operation of ElevateU;
• at the direction or authorization of the Customer Organization where appropriate;
• to protect the security, integrity, or lawful operation of ElevateU;
• to investigate fraud, misuse, or unauthorized access;
• to comply with applicable law, subpoena, court order, regulatory requirement, or other lawful process; or
• to law enforcement, governmental authorities, regulators, courts, or other authorities having lawful jurisdiction.

11. Cookies and Similar Technologies

ElevateU may use cookies or similar technologies that are necessary for:

• authentication;
• session management;
• security;
• fraud prevention;
• access control; and
• core Platform operation.

ElevateU does not currently use:

• advertising cookies;
• Meta Pixel;
• Google Analytics;
• Microsoft Clarity; or
• similar nonessential marketing or behavioral-tracking technologies within the authenticated learning Platform.

If CUelevate later introduces nonessential analytics or tracking technologies, this Privacy Notice will be updated as appropriate.

12. Training and Organization Reporting

ElevateU maintains training information necessary to provide the service.

Depending on role and program, authorized Managers and Organization Administrators may receive information such as:

• learner enrollment;
• progress;
• assessment status or results;
• completion status;
• certificate information; and
• related training records.

Managers receive only information they are authorized to access for assigned learners.

Organization Administrators may receive authorized organization-wide information.

Customer Organizations are responsible for determining how they use ElevateU training information in employment, supervisory, development, or other internal decisions.

13. Data Retention

ElevateU retains operational information only while it is reasonably necessary to support an active Customer Organization relationship or another legitimate business or legal requirement.

A Customer Organization’s ElevateU access remains active while the organization has either:

• at least one learner with unexpired access; or
• at least one unused learner seat that has not reached its applicable expiration date.

While organization access remains active, ElevateU may retain:

• learner records;
• enrollment information;
• course progress;
• assessment records;
• completion information;
• certificate records;
• manager and administrator relationships;
• authentication records;
• security records;
• audit records; and
• other information necessary to administer the active ElevateU relationship.

When the organization no longer has any active learner access or unexpired unused seats, CUelevate will close the organization’s ElevateU access and delete personal and training information that is no longer required for an ongoing legal, tax, accounting, security, or other legitimate recordkeeping purpose.

14. Tax and Financial Record Retention

Tax-related records may be retained longer than ordinary Platform records when required by an applicable taxing authority or other legal requirement.

This may include:

• tax identification information;
• tax-exemption documentation;
• transaction records;
• invoices;
• payment records; and
• supporting tax records.

Such information will be retained for the period reasonably required to satisfy the applicable legal, tax, or recordkeeping obligation.

15. Deletion Requests

A Customer Organization may request deletion of information associated with an authorized user.

Where no legal, tax, accounting, security, or other legitimate recordkeeping obligation requires continued retention, CUelevate will delete the applicable information.

CUelevate does not retain learner information merely because an individual previously used ElevateU.

A record of the deletion request may be retained while the Customer Organization continues to have active ElevateU access so that CUelevate can document and administer the request.

When the organization’s remaining ElevateU records are removed, the deletion-request record may also be removed unless retention is otherwise required.

Tax-related information may continue to be retained where required by applicable law or taxing authorities.

16. Backups

Information deleted from active ElevateU systems may temporarily remain in protected system backups until those backups are overwritten or removed through normal backup-retention processes.

Backup copies are not intended for ordinary business use and will not be restored for the purpose of recreating information that has been validly deleted unless necessary for security, disaster recovery, legal compliance, or another legitimate operational purpose.

17. Security

CUelevate uses reasonable administrative and technical safeguards designed to protect ElevateU information from unauthorized access, misuse, alteration, or disclosure.

Security measures may include, as applicable:

• authenticated access;
• role-based authorization;
• organization-level access controls;
• secure session management;
• session expiration and revocation;
• audit logging;
• rate limiting;
• authentication protections; and
• restricted administrative access.

No online system can guarantee absolute security.

18. User and Customer Responsibilities

Customer Organizations are responsible for:

• providing accurate user information;
• maintaining appropriate Administrator and Manager assignments;
• promptly changing or removing access when needed;
• protecting access to their business email environment;
• ensuring users do not submit unnecessary confidential or member information; and
• notifying CUelevate of suspected unauthorized ElevateU access.

Learners experiencing problems receiving a sign-in or verification email should first contact their organization’s IT department.

Training questions should first be directed to the learner’s Manager.

Managers and Organization Administrators may contact CUelevate at:

training@cuelevate.com

19. Children and Minors

ElevateU is intended only for workplace users age 18 and older.

ElevateU is not directed to children or minors, and Customer Organizations may not enroll individuals under age 18.

CUelevate does not knowingly permit minors to use ElevateU.

If CUelevate learns that an underage individual has been enrolled, access may be removed and associated information deleted as appropriate.

20. Changes to This Privacy Notice

CUelevate may update this Privacy Notice when ElevateU, its data practices, service providers, or applicable requirements change.

The current version will identify its effective date.

Material changes may be communicated through the Platform, by email, or through another reasonable method where appropriate.

21. Contact

Questions about this Privacy Notice or ElevateU privacy practices may be submitted by an authorized Manager or Organization Administrator to:

CUelevate LLC
ElevateU
training@cuelevate.com

Learners should use their organization’s normal support channels for routine training and access questions.