Privacy Policy

HESC automatically collects and stores the following non-personal information about your visit:

• The Internet Protocol Address, a numerical identifier assigned either to your Internet service provider or directly to your computer, and domain name used, but not the email address;
• The type of browser and operating system you used;
• The date and time you visited this site;
• The web pages or services you accessed at this site;
• The website you visited before coming to this site;
• The website you visit as you leave this site;
• If you downloaded a file, the file that was downloaded; and
• Any server error messages you may receive while using our site.

The information that is collected automatically is used to improve this website's content and to help HESC understand how users are interacting with the site. This information is collected for statistical analysis, to determine what information is of most and least interest to our users, and to make it easier to use the content. The information is not collected for commercial marketing purposes and HESC does not sell or disclose this information for commercial marketing purposes.

Cookies are simple text files stored on your web browser to distinguish among users of this website. The use of cookies is a standard practice among Internet websites. To better serve you, we use "session cookies" to enhance or customize your visit to this website. Session cookies can be created automatically on the device you use to access HESC's website. These session cookies do not contain personal information and do not compromise your privacy or security. HESC may use the cookie feature to store a randomly generated identifying tag on the device you use to access this website. A session cookie is erased during operation of your browser or when your browser is closed.

The software and hardware you use to access HESC's website allows you to refuse new cookies or delete existing cookies. Refusing or deleting these cookies may limit your ability to take advantage of some features of this website.

As noted below, HESC does not collect any personal information about you during your visit to this website unless you voluntarily provide that information by sending an email or conducting an online transaction. If you choose not to participate in these activities, your ability to receive specific services or products through this website may be limited, but it will not prevent you from requesting some of our services by other means, nor will it affect your ability to take advantage of other features of the website, including browsing or downloading publicly available information.

HESC provides users the opportunity to obtain responses to both general and specific questions through an online chat function. The chat function allows users to safely provide specific personal information to a HESC representative and receive account information back via chat. Non-public personal information, such as your name, last four digits of social security number (SSN), date of birth, etc., collected from you during your chat session may be used to research and respond to your inquiry.

The collection of information through this website and the disclosure of that information are subject to the provisions of the State's Internet Security and Privacy Act. HESC will only collect personal information through this website or disclose personal information collected through this website if the user has consented to the collection or disclosure of such personal information. Participation in an online transaction resulting in the disclosure of personal information to HESC by the user, whether solicited or unsolicited, constitutes consent to the collection and disclosure of the information by HESC for the purposes reasonably ascertainable from the nature and terms of the transaction.

However, HESC may collect or disclose personal information without user consent if the collection or disclosure is: (1) necessary to perform the statutory duties of HESC, or necessary for HESC to operate a program authorized by law, or authorized by state or federal statute or regulation; (2) made pursuant to a court order or by law; (3) for the purpose of validating the identity of the user; or (4) of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person.

HESC may disclose personal information to federal or state law enforcement authorities, or use this personal information to enforce HESC's rights against unauthorized access or attempted unauthorized access to HESC's information technology assets.

During your visit, you may send an email to HESC. Your email address and the contents of your message will be collected. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. Your email address and the information included in your message will be used to respond to you, to address issues you identify, to improve this website, or to forward your message to another state or federal agency for appropriate action. Your email address is not collected for commercial purposes and HESC does not sell or disclose your email address for commercial purposes.

If you visit this website to make a credit card payment on your outstanding student loan debt, HESC will provide a secure data entry screen that transmits your credit card information securely to virtualmerchantservices.com, a credit card service provider, to process the transaction. HESC will not receive any of your non-public, personal information. This credit card service provider will forward to HESC only that information necessary for HESC to properly credit the payment to your account. For more information about this credit card service provider’s treatment of your non-public personal information, see the privacy and other policies displayed on https://virtualmerchantservices.com.

To obtain a HESCPIN under the HESC Authentication System, you must complete the registration process, which requires that certain non-public personal information, such as your name, SSN, date of birth, etc. be collected from you. When the process is completed and your identity is confirmed, you’ll be provided with a HESC User ID and HESCPIN. You can then use your HESC User ID and HESCPIN to complete an online transaction.

The HESC Authentication System safeguards all non-public personal information that is collected.

When you log in to the HESCPIN system at a later date, you can view and update your information.

HESC’s online TAP application, TAP-on-the-Web, may be accessed via the Federal Free Application for Federal Student Aid (FAFSA) online form or by going to https://www.tap.hesc.ny.gov/totw/. Before you begin the TAP-on-the-Web process, your identity will be authenticated based upon the non-public personal information you provide, such as name, SSN, date of birth, etc. The authentication process identifies who you are, provides you with a HESC User ID and PIN, and serves to help safeguard your non-public personal information.

If you enter HESC’s TAP-on-the-Web via the Federal FAFSA online form or the direct link, the information including non-public personal information, volunteered by you during the FAFSA filing process, is pre-filled on your TAP application. This information includes your name, SSN, income, marital status, etc., and that of your spouse and/or your parent(s), if applicable.

HESC restricts access to your personal information to those individuals and entities involved in the process of administering TAP, including, but not limited to, HESC employees, other state employees/agencies, school staff with security access, as well as entities under contract with HESC to provide necessary services. All such contracts contain confidentiality provisions protecting your personal information.

All information submitted in conjunction with your TAP application for purposes of calculating your awards is subject to verification. Information is exchanged with the NYS Department of Taxation and Finance to verify income and, if applicable, with the NYS Office of Children and Family Services to determine dependent status. Information provided related to additional family member enrollment status is verified with National Student Clearinghouse. In addition, access to prescribed information on your progress in completing the FAFSA and TAP application forms is provided to secondary schools, school districts, local educational agencies, and certain designated entities to assist with accurate and timely completion of these forms.

Failure to provide HESC with all information necessary to process your TAP application will result in HESC’s inability to process your TAP application. You may apply for TAP via a paper TAP application available at your school’s financial aid office or by contacting HESC at 888-NYS-HESC (888-697-4372).

If, during your visit to this website, you want to view your TAP status, reviewing and changing data used in the processing of your TAP application, or request duplicate TAP forms, you will need to use your HESCPIN User ID and PIN. You still have the option to change your school or address on a paper form available at 888-NYS-HESC (888-697-4372). HESC needs to know the school you're attending in order to pay TAP awards.

A HESC User ID and PIN are required if you apply online for any of the following scholarships or loan forgiveness awards: NYS Masters-in-Education Teacher Incentive Scholarship Program; The NYS Achievement and Investment in Merit Scholarship (NY-AIMS); and NYS Get on Your Feet Loan Forgiveness Program.

During the online application process, your identity will be authenticated based upon the non-public personal information you provide, such as name, SSN, date of birth, etc. The authentication process identifies who you are, provides you with a HESC User ID and PIN, and serves to help safeguard your non-public personal information.

HESC restricts access to this information to those individuals and entities that need to know this information in order to administer, service and/or collect scholarship or loan forgiveness program awards including, but not limited to, HESC employees, other state employees and employees of the New York State Attorney General's Office, and contractors and agents. Failure to provide HESC with all necessary information will result in HESC's inability to process your application for a scholarship or loan forgiveness award.

If, during your visit to this website, you register for a training session, the information, including personal information, volunteered by you is used by HESC to enroll you in and provide you with your requested training. Access to this information is limited to HESC staff who require access to perform their official duties. This information will not be collected for commercial purposes and HESC is not authorized to sell or otherwise disclose your email address for commercial purposes.

Designated school employees can update student records when performing record maintenance through this website. Edited student information, including student name, reported income, student address, student SSN and student date of birth, provided by designated school employees is used by HESC to service TAP awards. Completion of all required information fields ensures timely TAP processing.

Access to this information is limited to HESC staff who require access to perform their official duties and designated school staff.

Designated school employees can view and/or correct student TAP certification information through this website. Edited student information, including student name, reported income, student address, student SSN and student date of birth, provided by designated school employees is used by HESC to service TAP awards. Access to this information is limited to HESC staff who require access to perform their official duties and designated school staff. If student TAP certification information is not corrected as necessary, student TAP awards cannot be properly processed.

If you are a designated school official and, during your visit to this website, you engage in transactions to maintain student promissory notes or student loan data, the information, including personal information, present in these transactions - volunteered by either you or the student [including student name, student address, student phone number, student email address, student SSN, student date of birth, student driver's license and state, citizenship status and alien registration, student EFT authorization information, student default information, lender and interest rate information, and personal reference information (name, address, telephone number)] is used by HESC to service student loan(s).

To protect the confidentiality of this personal information at HESC, HESC restricts access to those employees of HESC who need access to service these student loans and use auditing procedures. Additionally, HESC shares this personal information with the U.S. Department of Education, other government entities and approved schools, lenders and servicers who need to know this information to service these student loans. If the loan goes into default, this information may be furnished to credit reporting agencies. Providing personal information for student transactions is voluntary, but not providing all information required may result in the student loan not being processed.

Non-public personal information means personal information about you, which identifies you and that is not available from public sources.

1. HESC collects non-public personal information about you from the following sources, including but not limited to:
   1. Information we receive from you on loan, grant and scholarship applications and promissory notes;
   2. Information you provide us voluntarily during any interaction, including email;
   3. Information about your transactions with us or others with respect to your student loan (from parties such as your lenders and the U.S. Department of Education and their agents);
   4. Information about your New York State student financial aid (from agencies such as the NYS Education Department, the NYS Department of Taxation and Finance, and the NYS Department of Motor Vehicles);
   5. Information received from schools you attend or formerly attended, or to which you have applied for admission; and
   6. Information received from credit reporting agencies.
2. HESC does not disclose any non-public personal information about you to anyone except as permitted or required by law. For example, HESC shares such information with our contractors and agents, and with schools, lenders and the U.S. Department of Education, as needed, to administer your loan in conformance with the law.
3. HESC restricts access to non-public information about you to our employees who need to know the information, and to our contractors and agents who service and collect your student loan. We maintain physical, electronic, and procedural safeguards in compliance with federal regulations to safeguard your non-public personal information.
4. HESC does not knowingly collect personal information from children or create profiles of children through this website. Users are cautioned, however, that the collection of personal information submitted in an email will be treated as though it was submitted by an adult, and may, unless exempted from access by federal or state law, be subject to public access. HESC strongly encourages parents and teachers to be involved in children's Internet activities and to provide guidance whenever children are asked to provide personal information online.

Any user may request HESC's privacy compliance officer to determine if personal information pertaining to that user has been collected through this website. Request shall be made in writing to the address below and must be accompanied by reasonable proof of identity of the user. Reasonable proof of identity may include verification of a signature, inclusion of an identifier generally known only to the user, or similar appropriate identification. The address of the privacy compliance officer is:

NYS Higher Education Services Corporation
Gary Simpson, Privacy Compliance Officer
99 Washington Avenue
Albany, New York 12255

The privacy compliance officer shall, within five business days of the date of the receipt of a proper request: (i) provide access to the personal information; (ii) deny access in writing, explaining the reasons therefore; or (iii) acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not be more than 30 days from the date of the acknowledgment.

If HESC has collected personal information pertaining to a user through the state agency website and that information is to be provided to the user pursuant to the user's request, the privacy compliance officer shall inform the user of his or her right to request that the personal information be amended or corrected under the procedures set forth in Section 95 of the Public Officers Law.