Privacy Policy

We may collect the following categories of personal information about consumers who use our Services:

• Contact details, such as name, email address, mailing address, phone number, and username
• Demographics, such as age, race, gender, and date of birth
• Education information, such as student records
• Payment information, such as credit card information
• Network activity information, collected via cookies and other tracking technologies, including IP addresses, mobile advertising IDs, other unique online identifiers, and related browsing information
• Inferences drawn from any of the information listed above

We may collect, use, and disclose the above categories of personal information to:

• Provide our Services to you
• Manage, analyze, and improve our Services
• Communicate with you, including to respond to requests and send updates about our Services
• Provide special offers from the NCAA, respective affiliates, subsidiaries and other third parties
• Send you promotional material on behalf of our partners and third party affiliates
• Inform you of a prize you have won
• Fulfill an order you made
• Engage with current and prospective advertisers, vendors, and third parties
• Analyze and better understand consumers’ needs, preferences, and interests
• Conduct internal business analysis and research
• Advertise and promote our Services
• Comply with our legal and regulatory obligations, and enforce our rights and policies
• Administer, monitor, and secure our information technology systems, websites, applications, databases, and devices, including by detecting and preventing against security incidents and fraudulent activity

We may also anonymize personal information and analyze such data for statistical or any other purposes permitted by law. When we do so, we take reasonable measures to ensure that the information cannot be associated with an individual, and we will not attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer personal information and is not subject to this Privacy Policy.

We may collect personal information directly from consumers when they interact with us. We also may collect personal information from vendors and third parties, when they provide information to us. Finally, we may collect personal information from vendors and third-party providers of cookies and other tracking technologies used on our Services.

We may disclose the categories of personal information listed in Section I as detailed below:

• To our vendors. We may disclose personal information to our vendors who process personal information on our behalf, including vendors who provide website hosting, information technology and infrastructure, data analytics and modeling, email delivery, order fulfillment, auditing, payment processing, marketing and analytics services, and other services to us. We impose contractual limitations on our vendors’ use of personal information they collect in conjunction with providing services to us.
• To third parties for marketing purposes. We may disclose personal information to third parties, such as third-party marketing and analytics providers, and other organizations for marketing purposes, including to support our business operations and the business efforts of third parties.

• To our affiliates, members, partners, and subsidiaries. We may also disclose personal information with our affiliates, members, partners, and subsidiaries so that they may understand the kinds of visitors using our Services.
• To other third parties, at your direction or with your consent. We may disclose your personal information to any other third parties at your direction and/or with your consent.

We may also disclose personal information in the following context:

• For legal purposes. We may disclose personal information to protect our rights, defend or pursue a legal claim, investigate or prosecute illegal activities, comply with a subpoena, court order, governmental inquiry, legal process, or other legal obligation, or to protect the rights, property, or safety of us, you, or any other consumers.

We may also disclose anonymized data to any other entities to the extent permitted by law.

Our Services are not intended for children under age 16 and are not designed to attract the attention of children under age 16. We do not knowingly collect personal information from children under age 16. If you are a parent or guardian and believe we have collected personal information from your child in error, please contact us immediately at privacy@ncaa.org, so that we can make reasonable efforts to promptly remove such information from our systems.

Our site contains links to other websites that are owned by third parties. If you use these links, you will leave our Services. We are not responsible for the content or privacy practices of any linked websites, and we make no representations or endorsements about them. If you decide to leave our Services to access third party links, please be aware that this Privacy Policy will no longer govern. You should review the applicable terms and policies, including any privacy policies, of such websites when you visit them.

We implement reasonable security measures to promote the confidentiality, integrity, and availability of the personal information we collect. Such measures are designed to protect your personal information from loss, unauthorized access, disclosure, alteration, or destruction. However, while the security of your personal information is of the utmost importance to us, we cannot guarantee the security of any information you choose to disclose online. Any information you choose to disclose to us is done at your own discretion and risk.

We retain personal information for the period reasonably necessary to provide our Services to you, support our business operational purposes listed in Section II, and ensure compliance with applicable law.

This section provides disclosures applicable to residents of U.S. states with comprehensive privacy laws that apply to us.

• Data Subject Rights. Residents of some U.S. states have certain rights with respect to the processing of their personal information. Depending on your state of residence, these rights may include rights to access, correct, and delete your personal information, or to opt out of certain types of processing of personal information. For example:
  • Colorado Residents. Colorado residents have rights to access, correct, and delete their personal information, to obtain their personal information in a portable format, to opt out of sales of their personal information, processing of their personal information for purposes of targeted advertising, and profiling of their personal information in furtherance of decisions that produce legal or similarly significant effects, and to revoke their consent to certain types of processing activities.
  • Minnesota Residents. Minnesota residents have rights to access, correct, and delete their personal information, to confirm whether or not their personal information is being processed by the organization, to obtain their personal information in a portable format, to opt out of sales of their personal information, processing of their personal information for purposes of targeted advertising, and profiling of their personal information in furtherance of decisions that produce legal or similarly significant effects, to question the results of and obtain information about profiling decisions about them, to obtain a list of the specific third parties to which the organization has disclosed their personal information, and to revoke their consent to certain types of processing activities.
• Exercising Data Subject Rights & Authorized Agents. To exercise data subject rights applicable to you, you may email us at privacy@ncaa.org. Residents of some states, including Colorado, may also authorize an agent to make data subject requests on your behalf. In such instances, authorized agents may use the same method as you to submit requests on your behalf. To verify your identity and protect your personal information, we may ask the requestor to provide information that will enable us to verify your identity in order to comply with your data subject request, such as asking your agent to provide proof of signed permission from you or asking you to confirm with us directly that you provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
• Appeals. If we deny your request, residents of some states may appeal our decision by contacting us at the contact methods listed above. If you submit an appeal, please enclose or otherwise specifically reference your initial request so that we may appropriately assess and respond to your appeal. We will process appeals in accordance with applicable law.
• Processing for Purposes of Targeted Advertising. We process personal information for targeted advertising purposes, as those terms are defined by state comprehensive privacy laws. For example, we disclose personal information to third parties for marketing purposes. To opt out of such processing, you may contact us at privacy@ncaa.org.
• Opt-Out Preference Signals. Some web browsers or devices offer settings where you may pre-set a signal to websites that you do not want to have your online activity and behavior sold or processed for targeted advertising purposes. We recognize opt-out preference signals to the extent we are required to do so for compliance with applicable law. Please note, however, that our websites are not currently configured to recognize the “Do Not Track” signal.
• Profiling. We do not process personal information for profiling in furtherance of legal or similarly significant effects.

Please note that some state privacy laws, including the California Consumer Privacy Act (“CCPA”), do not regulate processing of personal information by 501(c)(3) non-profit organizations like NCAA. The disclosures in this section do not apply to consumers who reside in states with state privacy laws that do not apply to us.

• To unsubscribe from promotional emails from NCAA, you can click the “Unsubscribe” link in the footer of any promotional emails you receive from us, or you can send an email request to privacy@ncaa.org, with the subject line “Unsubscribe.”
• California Residents Under 18. If you are under the age of 18 and a registered user of our website, you may ask us to remove content or data that you have posted to the website by writing to privacy@ncaa.org. Please note that your request does not ensure complete or comprehensive removal of the content or data as, for example, some of your content or data may have been reposted by another user.
• Direct Marketing Disclosure for California Residents. California’s “Shine the Light” law regulates the disclosure of certain personal information to third parties by a company for the recipients’ direct marketing purposes by requiring companies to provide certain information upon request and allow consumers to opt out of such disclosures. To make such a request, please contact us privacy@ncaa.org with the subject “Shine the Light Request.” We process such requests in accordance with applicable law.
• Disclosure for Nevada Residents. We sell certain covered information, as defined by Nevada Revised Statute § 603A, as described in more detail in Section IX. To opt out of the sale of your covered information, Nevada residents may contact us at privacy@ncaa.org.

We may update our Privacy Policy from time to time. When we do so, we will post the updated Privacy Policy on this page. When we make material changes, we may notify users, such as by posting a prominent notice on our homepage or by sending an update via email.