The Protege Project Privacy Policy

Effective Date: June 1, 2025 | Last Updated: May 24, 2026

The Protege Project NFP ("The Protege Project," "we," "us," or "our") is a nonprofit organization based in Chicago, Illinois, dedicated to empowering youth and young adults ages 14-24 through entrepreneurship development, workforce readiness, and community-based programming. We are committed to protecting the privacy and security of all individuals whose information we collect, including participants, families, staff, contractors, and partner organizations.

We operate in full compliance with applicable federal and state privacy laws, including the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Illinois Personal Information Protection Act (PIPA), and applicable state and municipal data governance requirements.

1. INFORMATION WE COLLECT

1.1 Participant and Program Data

In delivering services under our funded programs, we may collect the following categories of information about program participants:

• Full name, date of birth, and age
• Contact information (address, phone number, email)
• School enrollment status, grade level, and academic records where required
• Government-issued identification numbers where required for program eligibility
• Employment history, workforce readiness assessments, and training records
• Demographic information (race, ethnicity, gender) for reporting purposes
• Incident reports, case notes, and service delivery records
• Stipend and financial support records
• Attendance, participation, and completion data

1.2 Education Records

To the extent our programs involve services delivered in connection with educational institutions or school-based partnerships, we may receive or generate education records as defined under FERPA. All such data is collected solely for the purpose of delivering contracted services and is handled in strict accordance with FERPA and any applicable data sharing agreements with partnering institutions.

1.3 Website and Digital Platform Data

When individuals visit our website or interact with our digital tools, we may collect:

• IP address, browser type, and device information
• Pages visited, time on site, and referring URL
• Form submissions, inquiries, and application data
• Email addresses voluntarily submitted

2. HOW WE USE INFORMATION

We use collected information for the following purposes:

• Delivering programmatic services and tracking participant progress
• Meeting grant compliance, reporting, and audit requirements for state and city funders
• Administering stipends, incentives, and financial support to eligible participants
• Communicating with participants, families, and authorized representatives
• Evaluating program effectiveness and improving service delivery
• Responding to lawful government requests, investigations, or legal obligations
• Fulfilling contractual obligations with government and institutional partners

We do not sell, rent, or trade personal information to third parties for commercial purposes.

3. LEGAL BASIS FOR PROCESSING

Our collection and use of personal data is authorized by one or more of the following:

• Participant or guardian consent obtained prior to program enrollment
• Contractual necessity to deliver funded program services
• Compliance with legal obligations under federal and state law
• Legitimate organizational interests in operating safe and effective programs

4. DATA SHARING AND DISCLOSURE

4.1 Authorized Disclosures

We may share participant information with:

• Government funders, oversight agencies, and program monitors as required under applicable grant agreements
• Authorized subcontractors or service providers who assist in program delivery, under written confidentiality agreements
• Educational institutions or school systems where we deliver services under a formal partnership or data sharing agreement
• Government auditors or compliance entities as required by law or contract

4.2 Prohibited Disclosures

We will not disclose participant information:

• To unauthorized third parties without written consent
• For marketing, advertising, or commercial purposes
• In violation of FERPA, PIPA, COPPA, or applicable data governance requirements

4.3 Legal Compulsion

We may disclose information if required by law, court order, or to protect the safety of participants or the public. When permitted, we will notify affected individuals prior to disclosure.

5. DATA SECURITY

The Protege Project implements reasonable administrative, technical, and physical safeguards to protect personal information from unauthorized access, disclosure, alteration, or destruction. Our practices include:

• Role-based access controls limiting data access to authorized staff and contractors
• Secure storage of physical records
• Password-protected and encrypted digital systems
• Confidentiality agreements with all staff and independent contractors
• Periodic review of data handling practices

Despite these efforts, no system is completely secure. In the event of a data breach involving personal information, we will notify affected individuals and relevant authorities in accordance with the Illinois Personal Information Protection Act and applicable funder requirements.

6. DATA RETENTION

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy or as required by law, grant agreements, or funder regulations. Retention schedules are as follows:

• Program participant records: minimum 5 years from program completion, or as required by the applicable grant
• Financial and stipend records: minimum 7 years per generally accepted accounting standards
• Education records: retained and disposed of in accordance with FERPA and applicable institutional agreements
• Website and digital inquiry data: up to 2 years

Upon expiration of applicable retention periods, records are securely destroyed or de-identified.

7. RIGHTS OF INDIVIDUALS

7.1 Participants and Families

Depending on applicable law and program context, participants and their authorized representatives may have the right to:

• Access personal information we hold about them
• Request correction of inaccurate data
• Request deletion of data, subject to legal retention obligations
• Withdraw consent where consent is the basis for collection
• File a complaint with a regulatory authority

7.2 FERPA Rights

Where The Protege Project receives or handles student education records through school-based partnerships, parents and eligible students retain all rights afforded under FERPA, including the right to inspect, review, and request amendments to those records. Requests related to education records held by a partnering institution should be directed to that institution in accordance with its policies. To exercise any of the above rights, contact us using the information in Section 10.

8. CHILDREN'S PRIVACY

The Protege Project serves youth as young as 14 years of age. We collect only the minimum information necessary to deliver services and meet compliance requirements. For participants under 18, we obtain consent from a parent or legal guardian prior to collecting personal information where required. We do not knowingly collect personal information from children under 13 through our public website. Any such information received inadvertently will be promptly deleted.

9. THIRD-PARTY TOOLS AND PLATFORMS

We use third-party platforms to support program operations, including case management software, online form tools, and learning management systems. These platforms are selected based on their ability to meet applicable data security and privacy standards. We do not authorize these vendors to use participant data for purposes beyond delivering services to The Protege Project.

Links to external websites from our site are provided for convenience. We are not responsible for the privacy practices of those sites.

10. CONTACT INFORMATION

Questions, requests, or concerns regarding this Privacy Policy may be directed to:

The Protege Project NFP
Attn: Privacy Officer
Chicago, Illinois
Email: info@theprotegeproject.org
Website: www.theprotegeproject.org

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or funder requirements. We will post the updated policy on our website with a revised effective date. Material changes will be communicated directly to active program participants and partner organizations where required.