HESC Internet Privacy Policy

Thank you for visiting the New York State Higher Education Services Corporation (HESC) Web site. This Web site is designed to make it easier and more efficient for individuals and businesses to interact with HESC. HESC recognizes it is critical for individuals and businesses to be confident their privacy is protected when they visit HESC's Web site. 

Consistent with the provisions of New York's Internet Security and Privacy Act, Freedom of Information Law and Personal Privacy Protection Law, and applicable federal laws, this policy describes HESC's privacy practices regarding information collected from users of this Web site. This policy describes what information is collected and how that information is used. Because this privacy policy applies only to this Web site, you should examine the privacy policy of any Web site, including other state agency Web sites, that you access while using this Web site. In particular, you can initiate transactions from our site on the "New York's College Savings Program" Web site and the "New York Mentor" Web site. You can also initiate credit card loan payments on HESC's Web site. HESC will link you to the Web site of "Virtual Merchant", the credit card service provider, for processing of these transactions. When you link from HESC's Web site, please refer to the linked site's own privacy policy before you volunteer any personal information. 

For purposes of this policy, "personal information" means any information concerning a person that, because of name, number, symbol, mark, or other identifier, can be used to identify that person. 

Information Collected Automatically When You Visit This Web Site

When you visit this Web site, HESC automatically collects and stores the following non-personal information about your visit:

  • The Internet Protocol Address and domain name used, but not the e-mail address. The Internet Protocol Address is a numerical identifier assigned either to your Internet service provider or directly to your computer;
  • The type of browser and operating system you used;
  • The date and time you visited this site;
  • The Web pages or services you accessed at this site;
  • The Web site you visited before coming to this site;
  • The Web site you visit as you leave this site;
  • If you downloaded a file, the file that was downloaded; and
  • Any server error messages you may receive while using our site.

The information that is collected automatically is used to improve this Web site's content and to help HESC understand how users are interacting with the Web site. This information is collected for statistical analysis, to determine what information is of most and least interest to our users, and to make it easier to use the material on the Web site. The information is not collected for commercial marketing purposes and HESC does not sell or disclose this information for commercial marketing purposes. 

Cookies

Cookies are simple text files stored on your Web browser to distinguish among users of this Web site. The use of cookies is a standard practice among Internet Web sites. To better serve you, we use "session cookies" to enhance or customize your visit to this Web site. Session cookies can be created automatically on the device you use to access HESC's Web site. These session cookies do not contain personal information and do not compromise your privacy or security. We may use the cookie feature to store a randomly generated identifying tag on the device you use to access this Web site. A session cookie is erased during operation of your browser or when your browser is closed. 

The software and hardware you use to access HESC's Web site allows you to refuse new cookies or delete existing cookies. Refusing or deleting these cookies may limit your ability to take advantage of some features of this Web site. 

Information and Choice

As noted below, HESC does not collect any personal information about you during your visit to this Web site unless you voluntarily provide that information by sending an e-mail or conducting an online transaction. If you choose not to participate in these activities, your ability to receive specific services or products through this Web site may be limited, but it will not prevent you from requesting some of our services by other means, nor will it affect your ability to take advantage of other features of the Web site, including browsing or downloading publicly available information. 

On-line Chat Session

HESC provides users the opportunity to obtain responses to general questions through an on-line chat function. Because the chat function is to be used solely for general questions it is not located in secure area of the HESC web site and users are warned not to provide personal information when submitting a question. Users are informed that HESC will not answer questions that require personal information and will not request non-public personal information from users.

The New York State Internet Security and Privacy Act

The collection of information through this Web site and the disclosure of that information are subject to the provisions of the state's Internet Security and Privacy Act. HESC will collect or disclose personal information through this Web site only if you have consented to the collection or disclosure of personal information. By using the HESC Web Site, you give HESC permission to collect, use and disclose the information you voluntarily provide. 

However, HESC may collect or disclose personal information without user consent if the collection or disclosure is: (1) necessary to perform the statutory duties of HESC, or necessary for HESC to operate a program authorized by law, or authorized by state or federal statute or regulation; (2) made pursuant to a court order or by law; (3) for the purpose of validating the identity of the user; or (4) of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person. 

HESC may disclose personal information to federal or state law enforcement authorities, or use this personal information to enforce HESC's rights against unauthorized access or attempted unauthorized access to HESC's information technology assets. 

Information Collected When You E-mail This Web Site

During your visit to this Web site you may send an e-mail to HESC. Your e-mail address and the contents of your message will be collected. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. Your e-mail address and the information included in your message will be used to respond to you, to address issues you identify, to improve this Web site, or to forward your message to another state agency for appropriate action. Your e-mail address is not collected for commercial purposes and HESC does not sell or disclose your e-mail address for commercial purposes. 

Information Collected When You Make A Credit Card Loan Payment

If you visit this Web site to make a credit card payment on your outstanding student loan debt, HESC will provide a data entry screen that transmits your credit card information to the Web site of Virtual Merchant, a credit card service provider, to process the transaction. HESC will not receive any of your non-public, personal information. The credit card service provider "Virtual Merchant" will forward to HESC only that information necessary for HESC to properly credit the payment to your account. For more information about Virtual Merchant's treatment of your non-public personal information, see the Privacy and other policies displayed on Virtual Merchant's Web site. 

Information Collected When You Register With the HESC Authentication System (HescPIN)

In order to obtain a HescPIN under the HESC Authentication System, you need to complete the registration process. As part of that process, certain non-public personal information such as your name, social security number, date of birth, etc. will be collected from you. When the process is completed and your identity is confirmed, you’ll be provided with a HESC User ID and PIN. You can then use your HESC User ID and PIN to complete an online transaction.

The HESC Authentication System safeguards all non-public personal information that is collected. 

You may later view your non-public personal information within HESC’s authentication system via a 128-bit HTTP secure online session.

Information Utilized When You Use TAP-on-the-Web

HESC's TAP-on-the-Web may be accessed via the Federal Free Application for Federal Student Aid (FAFSA) online form or by going to https://webapps.hesc.ny.gov/hescpub/main?target=renderer_tap_student_inq. Before you begin the TAP- on- the- Web process, your identity will be authenticated based upon the non-public personal information you provide such as name, Social Security Number, date of birth, etc. The authentication process identifies who you are, provides you with a HESC USER ID and PIN, and serves to help safeguard your non-public personal information.

If you enter HESC's TAP- on- the- Web via the Federal FAFSA online form, the information, including non-public personal information, volunteered by you during the FAFSA filing process is pre-filled on your TAP- on- the- Web application. This information includes your name, Social Security Number, income, marital status, et al. and that of your spouse and/or your parent(s), if applicable. If you enter HESC's TAP- on- the- Web by going to https://webapps.hesc.ny.gov/hescpub/main?target=renderer_tap_student_inq, you will be required to provide non-public personal information to complete your TAP- on- the- Web application, including your name, Social Security Number, income, marital status et al. and that of your spouse and/or parent(s). Non-public personal information you provide to HESC during the TAP- on- the- Web process is used to verify data, to determine your eligibility, and award amounts under TAP . Access to this information is limited to HESC staff that require access to perform their official duties and to school staff with security access, as initiated by a designated school official. In addition, access to prescribed information on your progress in completing the FAFSA and TAP application forms is provided to secondary schools, school districts, local educational agencies, and certain designated entities to assist with accurate and timely completion of these forms. Your personal information is retained for 10 years from the date your last TAP award payment was made by HESC.  If you owe a refund, your personal information is retained for 7 years from the date your obligation was paid in full.

Failure to provide HESC with all information necessary to process your TAP- on- the- Web application will result in HESC's inability to process your TAP application. You may apply for TAP via a paper TAP application available at your school's financial aid office or by contacting HESC at 1-888-NYS-HESC (1-888-697-4372) or 1-800-445-5234 (TDD) .

Information Collected When You Change Your TAP Information on This Web Site

If, during your visit to this web site, you want to view your TAP status, reviewing and changing data used in the processing of your TAP application, or request duplicate TAP forms, you will need to use your HescPIN user ID and PIN. You still have the option to change your school or address on a paper form available at 1-888-NYS-HESC (1-888-697-4372) or 1-800-445-5234 (TDD). HESC needs to know the school you're attending in order to pay TAP awards.

Information Collected When You Apply On-line for a Scholarship or Loan Forgiveness Award

A HESC User ID and PIN are required if you apply on-line for any of the following scholarships or loan forgiveness awards: Flight 587 Memorial Scholarship; Military Service Recognition Scholarship (MSRS); NYS Memorial Scholarships for Families of Deceased Firefighters, Volunteer Firefighters, Police Officers, Peace Officers, and Emergency Medical Service Workers; NYS World Trade Center Memorial Scholarship; Licensed Social Workers Loan Forgiveness Program; NYS Math & Science Teaching Incentive Program; District Attorney and Indigent Legal Services Attorney Loan Forgiveness Program; NYS Regents Award for Children of Veterans; Veterans Tuition Awards; Senator Patricia K. McGee Nursing Faculty Scholarship; NYS Nursing Loan Forgiveness Program; Flight 3407 Memorial Scholarship; John R. Justice Student Loan Repayment Program. 

You will begin the process by responding to general questions (without disclosing non-public personal information) in order for HESC to make a preliminary determination as to your eligibility. If you are eligible for the scholarship or loan forgiveness award, then you will be required to use your HESC User ID and PIN. If you don't have a User ID and PIN, you will be able to apply for them. If, based on the responses to the questions you are determined to be ineligible for a scholarship or loan forgiveness award, then you will receive an ineligibility message. 

After your identity has been verified by the HESC Authentication System and you have entered your User ID and PIN, you can begin applying for the scholarship or loan forgiveness award. You will receive the terms set forth in the Personal Privacy Notice. After reading the terms, you must indicate that you accept them in order to proceed. Then you will provide non-public personal information including your name, SSN, date of birth, etc. Non-public personal information you provide to HESC is used to verify data, and process the scholarship or loan forgiveness award. Access to this information is limited to HESC employees that require access to perform their official duties and if necessary, New York State Education Department employees, employees of the New York State Attorney General's Office, and contractors and agents who need to know this information to service and/or collect the scholarship or forgiveness awards. Personal information may be retained for up to six years beyond the terms of your service agreement, contract, or the eligible period of the program you receive. Failure to provide HESC will all necessary information will result in HESC's inability to process your application for a scholarship or loan forgiveness award. 

Use of the HESC Authentication System (HescPIN) to Sign a Stafford Electronic Master Promissory Note (e-MPN) or PLUS Electronic Master Promissory Note (PLUS e-MPN) on this Web Site

If you complete a Stafford Electronic Master Promissory Note (e-MPN) or PLUS Electronic Master Promissory Note (PLUS e-MPN) online, the information, including personal information volunteered by you during this transaction [including your name, your address, your telephone number, your e-mail address, your driver’s license number and state, your Social Security Number, your date of birth, personal information for your references (name, address, telephone number, e-mail address, relationship to you), and your lender information] is used by HESC to service your e-MPN/PLUS e-MPN. For PLUS loans, applicable personal information also includes your employer name, address and telephone number, Social Security Number, date of birth, student name, student Social Security Number and student date of birth. 

You will also need to use your HescPIN user ID and PIN when you need to view or print your electronically signed master promissory note, view your loan status, and view your defaulted loan repayment status.

Access to the non-public personal information is limited to HESC staff that require access to perform their official duties. Additionally, HESC protects the confidentiality of your information through auditing procedures. HESC also shares your information with the U.S. Department of Education, other government entities and approved schools, lenders and servicers who need to know this information to service your loan(s). If your loan goes into default, your information may be shared with credit reporting agencies. This information is retained for the life of your loan plus 3 years. Providing personal information for e-MPN/PLUS e-MPN transactions is voluntary, but failure to provide all information required will result in your e-MPN/PLUS e-MPN transaction not being processed and loans will not be guaranteed. 

Information Collected When You Register for Training Sessions on This Web Site

If, during your visit to this Web site, you register for a training session, the information, including personal information, volunteered by you is used by HESC to enroll you in and provide you with your requested training. Access to this information is limited to HESC staff who require access to perform their official duties. This information will not be collected for commercial purposes and HESC is not authorized to sell or otherwise disclose your e-mail address for commercial purposes. 

Information Collected When Designated School Employees Perform Student Record Maintenance on This Web Site

If you are a designated school employee and during your visit to this Web site you change or add student information used to determine TAP, the information, including personal information, present in these transactions - volunteered by either you or the student (including student name, reported income, student address, student Social Security number and student date of birth) is used by HESC to service student TAP awards. Access to this information is limited to HESC staff who require access to perform their official duties and school staff with security access, as initiated by a designated school official. This information is retained for seven years by HESC as part of the student academic record. Not providing HESC with all information required on the screen to change/add TAP information will delay processing. 

Information Collected When Designated School Employees View/Correct Student TAP Certification Information

If you are a designated school official and during your visit to this Web site you view/correct student TAP certification information, the information, including personal information, present in these transactions - volunteered by either you or the student (including student name, student address, student social security number and student date of birth) is used by HESC to service student TAP awards. Access to this information is limited to HESC staff who require access to perform their official duties and school staff with security access, as initiated by a designated school official. All submitted certification transactions are retained for three years. The last submitted transaction for each term is retained for 10 years. If student TAP certification is not corrected as necessary, student TAP cannot be properly processed. 

Information Collected When Designated School Employees Engage in Student Loan Transactions

If you are a designated school official and during your visit to this Web site you engage in transactions to maintain student promissory notes or student loan data, the information, including personal information, present in these transactions - volunteered by either you or the student [including student name, student address, student phone number, student e-mail address, student Social Security number, student date of birth, student driver's license and state, citizenship status and alien registration, student EFT authorization information, student default information, lender and interest rate information, and personal reference information (name, address, telephone number)] is used by HESC to service student loan(s). To protect the confidentiality of this personal information at HESC, HESC restricts access to those employees of HESC who need access to service these student loans and use auditing procedures. Additionally, HESC shares this personal information with the U.S. Department of Education, other government entities and approved schools, lenders and servicers who need to know this information to service these student loans. If the loan goes into default, this information may be furnished to credit reporting agencies. This information is retained for the life of your loan plus three years. Providing personal information for student transactions is voluntary, but not providing all information required may result in the student loan not being processed. 

Federally Required Disclosures

Nonpublic personal information means personal information about you, which identifies you and that is not available from public sources. 

  1. We collect nonpublic personal information about you from the following sources:
    • Information we receive from you on loan, grant and scholarship applications and promissory notes;
    • Information you provide us voluntarily during any interaction, including e-mail;
    • Information about your transactions with us or others with respect to your student loan (from parties such as your lenders and the U.S. Department of Education and their agents);
    • Information about your New York State student financial aid (from agencies such as the NYS Education Department, the NYS Department of Taxation and Finance and the NYS Department of Motor Vehicles);
    • Information received from schools you attend or formerly attended, or to which you have applied for admission; and
    • Information received from credit reporting agencies.
  2. We do not disclose any nonpublic personal information about you to anyone except as permitted or required by law (for example, we share such information with our contractors and agents, and with schools, lenders and the U.S. Department of Education, as needed, to administer your loan in conformance with the law).
  3. We restrict access to nonpublic information about you to our employees who need to know the information, and to our contractors and agents who service and collect your student loan and service your TAP award. We maintain physical, electronic, and procedural safeguards in compliance with federal regulations to safeguard your nonpublic personal information.
  4. HESC does not knowingly collect personal information from children or create profiles of children through this Web site. Users are cautioned, however, that the collection of personal information submitted in an e-mail will be treated as though it was submitted by an adult, and may, unless exempted from access by federal or state law, be subject to public access. HESC strongly encourages parents and teachers to be involved in children's Internet activities and to provide guidance whenever children are asked to provide personal information online

Access to and Correction of Personal Information Collected Through This Web Site

Any user may request HESC's privacy compliance officer to determine if personal information pertaining to that user has been collected through this Web site. Request shall be made in writing to the address below and must be accompanied by reasonable proof of identity of the user. Reasonable proof of identity may include verification of a signature, inclusion of an identifier generally known only to the user, or similar appropriate identification. The address of the privacy compliance officer is:

NYS Higher Education Services Corporation
Privacy Compliance Officer
99 Washington Avenue
Albany, New York 12255

The privacy compliance officer shall, within five (5) business days of the date of the receipt of a proper request: (i) provide access to the personal information; (ii) deny access in writing, explaining the reasons therefore; or (iii) acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not be more than thirty (30) days from the date of the acknowledgment. 

If HESC has collected personal information pertaining to a user through the state agency Web site and that information is to be provided to the user pursuant to the user's request, the privacy compliance officer shall inform the user of his or her right to request that the personal information be amended or corrected under the procedures set forth in Section 95 of the Public Officers Law. 

Disclaimer

The information provided in this privacy policy should not be construed as giving business, legal, or other advice, or warranting as fail proof, the security of information provided through this Web site. 

Contact Information

For questions regarding this Internet privacy policy, please contact: 

NYS Higher Education Services Corporation
Privacy Compliance Officer
99 Washington Avenue
Albany, NY 12255