General Policy Statement:

​

Bay Atlantic Federal Credit Union (Credit Union) will comply with the Children's Online Privacy Policy Protection Act (COPPA) in the operation of online services and its website; and will diligently protect the privacy of children under thirteen and the online collection of data and information from children using its website or service.

​

1. APPLICABILITY OF COPPA.
   A. Determination. The Credit Union will comply with COPPA requirements in its operation of a commercial website, or an online service directed to children under thirteen (13) that collects personal information from children; or in its operation of a general audience website and has knowledge that personal information about children under thirteen is being collected.
   B. Collection. The Credit Union is collecting information if the Credit Union gathers any personal information from a child by any means, including:
       i. Requesting, prompting, or encouraging a child to submit personal information online;
       ii. Enabling a child to make personal information publicly available in identifiable form. An operator shall not be considered to have collected personal information if it takes reasonable measures to delete all or virtually all personal information from a child's postings before it is made public and also to delete such information from its records or;
       iii. Passive tracking of a child online.

    C. Children's Personal Information. Individually identifiable information about an individual collected online, including:
       i. Full name (first and last name);
       ii. Home or other physical address, including street name and name of a city or town; Geolocation information sufficient to identify a street name and city or town;
       iii. Online contact information (email address or any other substantially similar identifier that permits direct contact with a person online, including but not limited to, an instant messaging user identifier, a video chat user identifier, a video chat user identifier, mobile number, etc.);
       iv. Telephone number;
       v. A government identifier, such as Social Security, state identification card, birth certificate, or passport number;
       vi. Photo, video, or audio file  containing a child's image or voice;
       vii. Persistent identifier that can be used to recognize a user over time and across different sites, including a cookie number, and IP address, a processor or device serial number, or a unique device identifier;
       viii. A biometric that can be used for the automated or semiautomated recognition of an individual, such a fingerprints; handprints; retina patterns; iris patterns; genetic data, including a DNA sequence, voiceprints; gait patterns; facial templates; or faceprints; or
       ix. Information concerning the child or parents of the child that the operator collects online from the child and combines with an identifier described above;

​

2. CONFIDENTIALITY OF INFORMATION
   A. The Credit Union will establish and maintain reasonable procedures to protect the confidentiality. security, and integrity of personal information collected from children.
   B. At a minimum, the Credit Union will address the safeguards that are appropriate to the sensitivity of the personal information collected from children in its Information Security Program. In addition to the regular protocol for Information Security standards, the Credit Union will;
       i. Perform additional assessments to identify internal and external risks to the confidentiality, security, and integrity of personal information collected from children and the sufficiency of any safeguards in place to control such risks;
       ii. Design, implement and maintain safeguards to control risks identified through risk assessments based on the volume and sensitivity of the children's personal information that is at risk, and the likelihood that the risk could result in the unauthorized disclosure, misused, alternation, destruction, or other compromise of such information;
       iii. Regularly test and monitor the effectiveness of the safeguards in place to control risk identified through the risk assessments; and
       iv. Annually, evaluate and modify the program to address risks that the Credit Union knows may have a material impact on its information security program or any safeguards in place to protect personal information collected from children.
       v. before allowing other service providers or third parties to collect or maintaining personal information from children on the operator's behalf, or before releasing children's personal information to such entities, the Credit union will take reasonable steps to determine that they are capable of maintaining the confidentiality, security, and integrity of the information and must obtain written assurances.

​

3. PRIVACY NOTICE. The Credit Union will be responsible for providing notice and obtaining verifiable parental consent prior to collecting, using, or disclosing personal information from children. The notice will be clearly and understandably written, complete, and will not contain unrelated, confusing, or contradictory materials. Parent includes a legal guardian.
   A. Direct Notice to the Parent. The Credit Union will make reasonable efforts to ensure that a parent of a child receives direct notice of its practices regarding the collection, us, or disclosure of personal information from children, including notice of any material change in the collection, use, or disclosure practices to which the parent has previously consented.
   B. Content of Parent Notice. The notice to obtain the parent's affirmative consent to the collection, use, or disclosure of a child's personal information shall include:
       i. That the Credit Union has collected the parent's or child's online contact information from the child, and the name of the child or the parent to obtain the consent;
       ii. That the parent's consent is required for the collection, use, or disclosure of personal information, and the operator will not collect, use, or disclose any personal information, and the operator will not collect, use, or disclose any personal information from the child if the parent does not provide consent;
       iii. The items of personal information the Credit Union intends to collect from the child, how it intends to use the information, and the potential opportunities for the disclosure of personal information, if the parent does not provide consent;
       iv. Where the Credit Union discloses personal information not one or more third parties, the identities or specific categories of such third parties and the purpose for such disclosure, should the parent provide consent, and that the parent can consent to the collection and use of the child's personal information without consent to the disclosure of such personal information to third parties except to the extent such disclosure is integral to the website or online service;
       v. A hyperlink to the Credit Union's only notice of its information practices;
       vi. The means by which the parent can provide verifiable consent to the collection, use, and disclosure of the information, and
       vii. If the Credit Union has collected the name or online contact information of the parent or child to provide notice and obtain parent consent, that is the parent does not provide consent within a reasonable time from the date the direct notice was sent, the Credit Union will delete the parent's or child's online contact information and the parent's or child's name from its records.
   C. Additional Parent Notices. Additional parent notices may be required depending on the type of communication or situation. The Credit Union will follow COPPA to ensure compliance with the communication requirements.
   D. Content of Website or Online Notice. In addition to the direct to parent notice, the Credit Union will post a notice that is prominent and clearly labeled link to an online notice of its information practices will regard to children on the home or landing page or screen of its website or online service, and, at each are of the website or online service where personal information is collected from children. The link will be in close proximity to the requests for information. The online notice will be clearly written, understandable and will contain;
       i. Credit Union's name and contact information (address, telephone number and email address;
       ii. Names of any other operator that may be collecting or maintaining children's personal information;
       iii. Description of what personal information is collected from children (including whether the website enabled the child to make personal information publicly available);
       iv. How information is collected from children and used;
       v. How the Credit Union uses the child's personal information it has collected, including the use of audio files and ow they are appropriately deleted immediately after responding to the request for which they were collected.
       vi. The Credit Union's data retention policy.
       vii. The Credit Union's disclosure practices for such information, including the identities and specific categories of any third parties which the Credit union discloses personal information the purposes for such disclosures.
       viii. If applicable, the specific internal operations for which the Credit Union has collected a persistent identified pursuant to the rule; and the means used to ensure that the identifier is not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose; and
       ix. If applicable, that the parent can review or have deleted the child's personal information and refuse to permit further collection or use of the child's information, and state the procedures for doing so.

​

4. VERIFIABLE PARENTAL CONSENT.
   A. Consent Requirement. Before collecting, using or disclosing personal information from a child, the Credit union will obtain verifiable parent consent. This includes any material change in the collection, use, or disclosure practices to which the parent has previously consented. The Credit Union will make reasonable efforts (taking into consideration available technology) to obtain verifiable parent consent. Any method to obtain verifiable parental consent must be reasonably calculated, in light of available technology, to ensure that the person who provides consent is the child's parent.
       i. Providing a consent form to be signed by the parent and returned to the Credit Union by postal mail, fax, or electronic scan;
       ii. Requiring a parent, in connection with a transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder;
       iii. Having a parent call a toll-free telephone number staffed by trained personnel;
       iv. Having a parent connected to trained personnel via video-conference;
       v. Verifying a parent's identity by checking a form of government-issued identification against databases of such information, were the parent's identification is deleted by the Credit Union from its records promptly after such verification is complete;
       vi. Verifying a parent's identity using knowledge-based authentication provided:
           1. The verification processes uses dynamic, multiple choice questions, where there are a reasonable number of questions with an adequate number of possible answers such that the probability of correctly guessing the answers is low; and
           2. The questions are of sufficient difficulty that a child aged 12 or younger in the parent's household could not reasonably ascertain the answers;
       vii. Having a parent submit a government-issued photographic identification that is verified to be authentic and compared against an image of the parent's face taken with a phone camera or webcam using face recognition technology and confirmed by personnel trained, provided that the parent's identification and images promptly deleted from the Credit Union's records after the match is confirmed; or 
       viii. Provided that the Credit union does not "disclose" children's personal information, it may use an email coupled with additional steps to provide assurances that the person providing the consent is the parent. Including, sending a confirmatory email to the parent following receipt of consent, or obtaining a postal address or phone number from the parent and confirming the parent's consent by letter or telephone call.
       ix. Provided that the Credit Union does not disclose children's personal information, it may use a text message coupled with additional steps to provide assurances that the person providing the consent is the parent. including sending a confirmatory text message to the parent following receipt of consent or obtaining a postal address or phone number from the parent and confirming the parent's consent by letter or telephone call. The Credit Union that uses this method can provide notice that the parent can revoke any consent given in response to the earlier text message.
   B. Third Party Consent. The Credit Union will give the parent the option to consent to the collection and use of the child
s personal information without agreeing to the disclosure of that information to third parties, unless that disclosure is integral to the website or online service. The Credit Union required to give the parent this option must obtain separate verifiable parental consent to such disclosure.
   C. Exceptions. Verifiable parental consent is required prior to any collection, use, or disclosure of personal information from a child except:
       i. Where the sole purpose of collecting the name or online contact information of the parent or child is to provide notice and maintain parental consent. if the Credit Union has not obtained parental consent after a reasonable time from the date of the information collection, the Credit Union must delete the information from its records.
       ii. Where the purpose of collecting a parent's online contact information is to provide voluntary notice to, and subsequently update the parent about, the child's participation in a website or online service that does not otherwise collect, use, or disclose children's personal information. In such cases, the parent's online contact information may not be sued to disclosed for any other purposes.
       iii. Where the sole purpose of collecting online information from a child is to respond directly on a one0time basis to a specific request from the child, and where such information is nor used to re-contact the child or for any other purpose, is not disclosed, and is deleted by the operator from its records promptly after responding to the child's request;
       iv. Where the purposes of collecting a child's and a parent's online contact information is to respond directly more than one to the child's specific request, and where such information is not sued for any other purpose, disclosed, or combined with any other information collected from the child.
       v. Where the purpose of collecting a child's and a parent's name and online contact information is to protect the safety of a child, and where such information is not used or disclosed for any purpose unrelated to the child's safety.
       vi. There the purpose of collecting a child's name and online contact information is to:
           1. Protect the security or integrity of the website or online service;
           2. Take precautions against liability;
           3. Respond to judicial process; or
           4. To the extent permitted under other provisions of the law, to provide information to law enforcement agencies or for an investigations on a matter related to public safety; and where such information is not used for any other purpose.
       vii. Where if the Credit Union was covered under the definition of website or online service directed to children collects a persistent identifier and not other persona information from a user who affirmatively interact with the Credit Union and whose previous registration with the Credit Union indicates that such user is not a child
       viii. Where the Credit Union collects an audio file containing a child's voice, and no other personal information, for use in responding to a child's specific request and where the operator does not use such information for any other purpose, does not disclose it, and deletes it immediately after responding to the child's request.

​

5. RIGHT OF PARENT TO REVIEW INFORMATION PROVIDED BY CHILD.
   A. Parent Request. Upon request of a parent whose child has provided personal information to a website or online service, the Credit Union is required to provide the following:
       i. A description of the personal information collected form the child, such as name, address, phone number, email address, hobbies, and extracurricular activities;
       ii. The opportunity at any time to refuse to permit the Credit Union's further use or future online collection of personal information from that child, and to direct the Credit Union to delete the child's personal information; and
       iii. Notwithstanding any other provision of law, a means of reviewing any personal information collected from the child. The means employed by the operator to carry out these provisions must:
           1. Ensure that the requestor is a parent of the child, taking into account available technology; and
           2. Not be unduly burdensome to the parent;
       iv. Neither the Credit Union or their agent shall be held liable under any Federal State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information as required by a parent's request.

​

6. CONDITIONING PARTICIPATION ON COLLECTION OF INFORMATION
   A. The Credit Union is prohibited from conditioning a child's participation in a game, the offering of a prize, or another activity on the child's disclosing more personal information than is reasonably necessary to participate in such activity.

​

7. DATA RETENTION/DELETION REQUIREMENTS
   A. The Credit Union will only retain personal information collected online from a child for only as long as reasonably necessary to fulfill the specific purpose for which the information was collected.
   B. The Credit Union will delete the information using reasonable measures to protect against unauthorized access to, or use of, the information using reasonable in connection with its deletion when it is no longer necessary.
   C. The Credit Union's written retention timeframe will be included on its website notice.