Privacy Policy

Please read this Privacy Policy carefully. By accessing and/or using the Sites, you accept, consent and agree to the terms of this Privacy Policy. You also agree to be bound by our Terms of Use. If you do not agree to be bound by our Terms of Use and this Privacy Policy or any subsequent modifications, you should not visit or use our Sites or disclose any personal information through our Sites.

We reserve the right to change or update this Privacy Policy at any time. You are responsible for reviewing this Privacy Policy periodically, and your’ continued use of our Sites following changes to this Privacy Policy will be considered acceptance of any changes. Any changes or updates will be effective immediately upon posting to the Site.

If you have any questions or comments about this Privacy Policy, our privacy practices, or you wish to obtain the name of our current Privacy Officer, you can contact us at:

National Association of State Boards of Accountancy

Attn: Data Protection Officer/Chief Legal Officer

150 Fourth Ave. North

Suite 700

Nashville, TN 37219-2417

Email: privacy@nasba.org

Phone: 1-866-696-2722

In order to provide NASBA services, we collect data which may be personal in nature.

“Personal Data” is information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data that you provide or that we otherwise collect might include, but is not limited to, the following categories:

• Identifiers:  first and last names, mailing or physical address, email address, telephone number; birthdate, passport, drivers license, or other government-issued identification numbers; unique personal identifier; emergency contact information; and Internet Protocol (IP) address.
• Identity Documents and Images: government-issued or other identity documents, the information contained within those documents, metadata about the images, and time of image capture and/or upload. 
• Financial Information: including payor name; billing address; and billing/payment information, bank account,  credit or debit card number and type, security code and expiration date.
• Audiovisual Information: photographs, audio or video recordings.
• Biometric information: Fingerprints, Facial signatures and facial embeddings (vector representations of facial features) derived from the facial photographs on your government-issued identity document and/or selfie. 
• Professional, Educational, Employment, or License Information: job title and company; details of other accounting designations held; educational history and qualifications; details of educational credit hours; details of continuing education credits; professional credentials, including license number and expiration date; past employment history; legal actions; professional license history and enforcement actions.
• Demographic Information: gender; language; ethnicity/race; country of residence and country of citizenship.
• User Data: data or other information entered voluntarily into a contact form via the Sites that personally identifies you.
• Device, Browser, Internet or Other Electronic Network Activity Information:
  • Browse history: Data about the webpages you visit.
  • Search history: Data about the search terms you enter.
  • Device, connectivity, and configuration data: Data about your device and nearby networks, including browser type and regional and language settings.
  • Internet Protocol (IP) address, unique device identifier, device serial number, device type, device make and model, device operating system,
  • mobile carrier, online identifier, language and time zone settings, referrer URL, and other information about the browsers, network, and devices you use when interacting with NASBA sites.
• Geolocation Data: data about your device’s location, which may be inferred from your IP address. 
• Sensitive Personal Data: ethnicity/race; national origin; age; apparent gender; medical or disability information revealed from dietary requirements or accommodation requests.

a. Information You Provide to Us

We collect information from you when you provide it voluntarily to NASBA or third parties as necessary to access and use NASBA Sites and Services, which include but are not limited to:

• NASBA.Org Website
• NASBA Exam Services
• CPA Portal
• NASBA CPA Mobile App
• NASBA Academic Credential Evaluation Service
• National Candidate Database (NCD)
• NASBA International Qualification Examination (IQEX)
• NASBA International Evaluation Services (NIES)
• NASBA Licensing Services
• NASBA Individual Substantial Equivalency evaluations 
• National Qualification Appraisal Service (NQAS), CredentialNet
• Accountancy Licensee Database (ALD)
• National Registry of CPE Sponsors
• CPE Audit Service
• NASBA Center for Public Trust
• Student Center for the Public Trust and the NASBAstore
• American Institute of Certified Public Accountants (AICPA)
• Prometric

b. Information Provided by Third Parties

In addition, we may collect Personal Data about you from third parties in connection with our Sites, including from the following sources:       

• State Accountancy Boards
• Prometric (Exam Service Provider)
• American Institute of Certified Public Accountancy (AICPA)
• Service providers (including hosting providers and payment processors)
• Data analytics service providers
• Email, survey, feedback, and other communications service providers
• Advertising providers
• Social media platforms
• Promotional partners

We also collect data automatically when you access our Site. We collect Personal Data from you and any devices (including mobile devices) you use when you: use our Sites, contact us via email or other means, or respond to our communications to you, such as surveys or requests for feedback. This may include information about your interactions with our Sites, such as the date and time of any visit or information you enter into our Sites and your interactions with content or features that you access. It may also include technical data such as URL information and your IP address, the types of devices you are using to access or connect to our Sites, unique device identifiers, device attributes, network connection type, and other device and network information.

We may collect this information ourselves or through third parties, such as service providers (including hosting providers) and data analytics service providers. We may collect some of this information through cookies and similar technologies as described below.

d. Cookies

As you navigate our Sites, we also may collect information using commonly used information-gathering tools, such as cookies. Cookies are small files that are saved to, and during subsequent visits to our sites retrieved from, your computer or mobile device. The use of these “session” cookies are essential to the operation of our Sites and are used to simplify your visit.

We also may contract with third party service providers, who assign cookies and/or web beacons to conduct site tracking for us and collect information about your visits to our Sites. The use of these “analytics” cookies are used to provide information about goods and services of interest to you, your preferences, and how you share information about our products and services with others.  For example, we use Google Analytics for this purpose. To provide this service, Google Analytics may collect certain information about you from your computer using cookies. You can learn more about Google Analytics and how it collects and processes data by visiting: www.google.com/policies/privacy/partners/. You can opt-out of the use of Google Analytics here: https://tools.google.com/dlpage/gaoptout?hl=en.

Your web browser may allow you to block, disable, or delete cookies from your device. Your mobile device may also allow you to refuse cookies by activating the appropriate setting on your device. To learn more about how to block, disable, or delete cookies, review your browser’s or device’s privacy and security features. To learn more about how to control cookies generally, you can visit www.aboutcookies.org. However, if you disable or block cookies on your browser or device, the features on our Sites and services may not work correctly. In addition, if you disable or block all cookies, you will not be able to make a purchase, set up an account profile or register for a program or event using our Sites.

Some browsers have a “do not track” feature that lets you indicate that you do not wish to have your online activities tracked. These features are not yet uniform, so we do not currently respond to such features or signals. Therefore, if you select or turn on a “do not track” feature in your web browser or block or delete tracking cookies, we and our third-party providers may continue collecting information about your online activities as described in this Privacy Policy.

a. Basis for Collection and Use

You provide NASBA with most of the data we collect. NASBA collects and uses your personal information generally as follows:

    i. By Consent: You are providing clear, voluntary, and specific permission to collect and use your data so that you can use NASBA services.

    ii. Contract: Data collection is necessary to make or fulfill a legal agreement with you if you are an exam / license applicant, a licensee, or otherwise have access to         NASBA systems or services.

    iii. Legal obligation/Public Task: NASBA must collect, process and save your data in their role in performing official duties on behalf of State Boards of Accountancy         who have been assigned by law to carry out all CPA licensing and enforcement duties for their state.

    iv. Legitimate interests: Some data is needed for NASBA to meet its own operational goals and does not interfere with your rights to maintain the safety and         confidentiality of your information.

b. National ID numbers, including passport numbers, driver’s license numbers, and/or social security numbers (collectively “National ID Numbers”), may be used only for verifying your identity and detecting and investigating cheating, infringement of intellectual property rights, breaches of Test-related agreements, fraudulent activity, and compliance with applicable mandatory legal requirements. Access to National ID numbers shall be restricted to employees, agents, service providers and government entities with a need to access them for these purposes, and reasonable efforts shall be made to protect National ID numbers from unlawful disclosure and keep them confidential by maintaining physical, electronic and procedural safeguards that comply with applicable regulations.

c. All other Personal Data may be used for the following purposes:

    i. NASBA may receive and access your Personal Data for purposes of facilitating the application process for licensure with the State Boards, investigating any         suspected fraudulent or inappropriate activity, including without limitation cheating, infringement of intellectual property rights, violating Test-related agreements,         and verifying and tracking your licensure status;

    ii. NASBA or the State Boards determining your eligibility to sit for the Test and obtain a CPA license;

    iii. NASBA’s administration and operational purposes (e.g., in relation to attendance at exams, communicating results, Test times and other details);

    iv. Helping NASBA and the State Boards to track your license status;

    v. Verifying compliance with the State Board and NASBA’s Test-taking and application policies;

    vi. Backing up records to prepare for events that may make it difficult for NASBA to access original copies of your Personal Data;

    vii. Helping NASBA and State Boards comply with contractual, legal or regulatory obligations;

    viii. NASBA‘s and the State Boards’ detection and investigation of fraudulent activity; and

    ix. NASBA’s reasonable and legitimate business management purposes, including without limitation, the protection of their respective copyright, trade secret, and trademark rights, and the analysis and public release of aggregated and fully anonymized Personal Data.

d. Table 1: Purpose Specifications and Use Limitation.

In the table below, we have set out the purposes, use and legal basis for NASBA to collect and process your information, and the categories of information (as described in the “Information We Collect” section above) used for these purposes. If we wish to process your existing information for a new purpose other than as stated below, we may inform you and provide information surrounding your information’s use.

Where NASBA relies on legitimate interests as the basis for collecting and processing your personal information, we carry out a balancing exercise taking into consideration your reasonable expectations of Privacy, your request for NASBA services, and NASBA’s responsibilities to validate identities, assess risk, and prevent, detect, protect or defend against, or respond to security incidents, identity theft, fraud, harassment, malicious, deceptive, or illegal activities.
We therefore, ensure your rights as an individual are not impacted unnecessarily.

We consider that it is reasonable for us to collect and process your Personal Data for the purposes of our legitimate interests when, on balance, (a) we process your Personal Data only so far as is necessary for such purpose, and your rights and freedoms do not outweigh such purposes, and (b) it can be reasonably expected for us to process your Personal Data in this way. In most cases, the information is being processed for your benefit as an exam or license Applicant, Licensees, or State Boards employee or contractor, as well as NASBA’s obligations as stated herein. For example, we have a legitimate interest in processing Personal Data where we need the information to:

• Provide you the ability to take the licensing exams;
• Provide assistance to your State Board that enables your licensure;
• Respond to your inquiries or to send you information; and
• We would be unable to provide our services without processing your information.

f. Withholding Consent

You have the right to withhold your consent for NASBA to collect, process and use your Personal Data as described in this Privacy Policy.  However, if you withhold your consent, depending on the purpose of the data collection, you may not be able to sit for the examinations, submit your application to a state board, obtain licensure, obtain required licensee audits, register your CPE credits or perform your duties as an employee of NASBA, State Boards, AICPA, Prometric, Contractor or Consultant.  If you have questions about withholding consent to certain specific data, please contact NASBA or your State Board for further information.

a. General

NASBA follows it’s Cyber Security Policy and uses commercially reasonable physical, electronic, and procedural safeguards to protect information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction, in accordance with applicable law, and we require our Users and third-party service providers to do the same.

NASBA complies with the standards set out in the NIST Cyber Security Framework 2.0.

Personal data is stored in an end-to-end encrypted state and in secure environments maintained by NASBA, its Contractors, and third-party Vendors. Biometric information receives the same rigorous privacy and security protection as other sensitive personal information. This includes encryption in transit and at rest, strict access controls, data minimization, and data governance procedures. NASBA employes regular external security testing to remove potential vulnerabilities.

Audit

NASBA’s data protection practices are audited on a recurring basis, and we maintain ISO 27001 and SOC 2 Type 2 certifications. That said, there is simply no way to guarantee that any safeguards or security measures will be sufficient to prevent a security incident.

b. Retention

NASBA will keep Personal Data only for the length of time necessary to fulfill the purposes. After that period of time has passed, we will securely destroy or anonymize Personal Data.

NASBA protects your personal data and only shares it with third parties when necessary to perform an essential function. Third partes are bound by law and contract to protect your Personal Data and can only use your information according to our instruction, in connection with the services performed for us, and not for their own benefit.

a. Third Parties include Prometric, AICPA, CGI, Consultants, Data Security Providers, Financial Transaction processors, Data Analytics and Marketing Companies.

b. NASBA will disclose personal data to third parties for the following purposes:

• Prometric, AICPA, Payment Processors to pay for exam applications, conduct testing at test sites, maintain security and prevent cheating during testing, and grade examinations.
• Consultants to assist NASBA in processing licenses, testing applications, and performing education and experience evaluations, and reviewing CPE programs, and other duties as necessary to perform NASBA key functions and services.
• Data Analytics to assist NASBA to better provide you with services and information.

c. If you opt in, as described in the “Opt into Marketing” section below, we may share your name, email, and mailing address with other organizations for their marketing purposes.

d. Please note that we also use and disclose information about you that is not personally identifiable. For example, we may publish reports that contain aggregated and statistical data about our candidates or website visitors. These reports do not contain any information that would enable the recipient to contact, locate or identify you.

e. In addition, where ordered by State or Federal Authorities, we may disclose Personal Data about you in the following circumstances:

• To comply with valid legal requirements such as a law, regulation, search warrant, subpoena or court order; and
• In special cases, such as to investigate, prevent or take action regarding illegal activities, suspected fraud, to protect and defend our rights and property, to protect against misuse or unauthorized use of our sites, to protect against potential threats to the physical safety or property of any person.

* Please note that we may not provide you with notice prior to disclosure in such cases.

f. Users should also be aware that courts of equity, such as U.S. Bankruptcy Courts, may have the authority under certain circumstances to permit Personal Data to be shared or transferred to third parties without permission. We may share aggregate information, which is not personally identifiable, with others.

g. Within some of our Sites, we may provide bulletin boards, blogs, or chat rooms, or we may host forums or maintain groups for examination candidates on social media sites, such as Facebook. Any Personal Data you choose to submit in such a forum or group may be read, collected, or used by others who visit these forums or groups, and may be used by such parties to send you unsolicited messages. You should exercise caution when deciding whether to disclose your Personal Data in such a manner and you should make sure you are comfortable with the information the operators of such social media sites may make available by reviewing privacy policies of those providers and/or modifying your privacy settings directly with those sites. We are not responsible for the Personal Data you choose to submit on social media sites, including in these forums or groups nor the communications or acts of third parties who use or view information you have disclosed social media sites, including in such forums or groups. However, NASBA or the managers of a site may choose to remove your information from the site at their sole discretion.

a. The Personal Information we collect or receive through your visits to, and use of, the NASBA Sites and Services will be transferred to, or processed by, recipients located in countries outside of the country of your citizenship/residence. If you are located outside the United States and are visiting the Sites, you should be aware that your Personal Data will be transferred to the United States, and possibly other Countries the laws of which may be deemed by your country to have inadequate data protection.

b. If you are located in a country outside the United States and voluntarily submit Personal Data to us, you thereby consent to the uses of such information as provided in this Privacy Policy and to the transfer of that information to, and/or storage of that information in, the United States.

c. We may transfer Personal Data to our service providers in the United States or in other countries for the purposes identified in the “How We Share Personal Data” section above. To the extent your Personal Information is transferred to a third party in a country that does not provide for an adequate level of data protection, as defined by applicable law, we will use appropriate safeguards, such as standard data protection clauses adopted by the applicable supervisory authority. If you would like more information about how we transfer Personal Information to the United States and elsewhere you may contact us as set forth in the “How to Contact Us” section above.

d. When transferring your data, we will protect your data in accordance with the security standards described in the Data Security section herein. Your information may be subject to access by the United States government, and courts, law enforcement or regulatory agencies located in the United States.

e. Please note that, at this time, NASBA is not subject to industry- or state-specific data protection laws such as the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, or the California Consumer Privacy Act.

f. NASBA endeavors to meet to the greatest extent possible of the following country specific data protections:

General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data which can be found at General Data Protection Regulation (GDPR) Compliance Guidelines

India’s Digital Personal Data Protection (DPDP) Act of 2023 as amended.

Japan’s Act on the Protection of Personal Information prep prepared by the Japanese Personal Information Protection Commission.

Canada’s  Personal Information Protection and Electronic Documents Act (PIPEDA)

a. You have the right to:

• Obtain certain information about the collection and use of your Personal Data;
• Access and obtain copies of your Personal Data;
• Update or correct your Personal Data;
• Request that the processing of your Personal Data be limited;
• Object to how your Personal Data is processed;
• Withdraw consent to processing of Personal Data;
• Request your Personal Data be deleted; and
• Have your complaints with respect to your data rights addressed.

b. You may exercise these rights or contact us to address any grievances with respect to your rights by contacting NASBA at privacy@nasba.org or 150 4th Avenue North, Suite 700, Nashville, Tennessee 37219. We will respond to your request promptly, and in any case, in the time required under applicable law. Additionally, if you have registered for an online account, you may update or correct certain account information by logging into your account, or by contacting NASBA’s client services at clientservices@nasba.org; NASBA’s Accountancy Licensing Library at alllibrary@nasba.org; CPE Audit Services at cpeauditservices@nasba.org; and/or CPE sponsors at cpe@nasba.org.

c. Before we respond to a communication or request, we may take certain steps to verify the requestor's identity and the authenticity of a request. Where we have reasonable doubts concerning the identity of the person making the request, or the authenticity of a request, we may request such additional information as we deem necessary to satisfy ourselves of their identity and authenticity of their request. If we cannot satisfactorily verify the identity of a requestor and the authenticity of a request, we will not be able to take any action pursuant to the request. Instead, we will only annotate the information, noting that the correction was requested but not made. If we refuse a request, we will explain our refusal and outline further steps available to you.

d. If you are sitting for a test outside of the United States, you may object to the collection of your Personal Data for any legitimate purpose. However, you understand and agree that if you object to such collection of any non-optional Personal Data, NASBA will be unable to process your application and you will forfeit your application and right to sit for a test or have it scored.

You may have the right to lodge a complaint with local data protection authorities if you believe we have not complied with applicable data protection laws. The local authority differs depending on the country. For more information on the local authority where you are located, you may want to visit https://iapp.org/resources/global-privacy-directory for more information.

e. If you reside in the EU and you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact the appropriate Data Protection Authority, whose contact information can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

a. NASBA would like to send you information about our products and services that we think you might like as well as those of our partner companies such as AICPA and Prometric.

b. If you provide your consent and Opt-In to Marketing, we may also share some of your Personal Data with our third-party partners who may send you information about products and/or services that may be of interest to you. If you Opt-In, you consent to and agree that NASBA anddesignees acting on our behalf may send you marketing communications, offers, promotions, and information that may be of interest to you at any email address, phone number (including via text message to a mobile phone number), postal address, or other contact information that you have provided NASBA does not sell your contact information to third parties for their independent direct marketing purposes, but we may engage partners or service providers to market to you.

c. You may withdraw your consent or “Opt-Out” to receive such marketing communications at any time as described below.

d. For domestic applicants using the NASBA online application to register to take the CPA examination, if you want to permit us to release your name and address to other organizations, please select “Yes” from the drop-down menu. International applicants using the NASBA products and services must read and expressly consent to all sections of the Informed Consent agreement.

e. For both domestic and international applicants, if you receive a specific email from NASBA regarding special offers, products, conferences or other communications, and no longer want to receive these types of emails from us, please click the “opt out” link located at the bottom of the NASBA email that was sent to you. You may also send an email marked “remove from email list” in the subject line to privacy@nasba.org. Once this information is shared with our Communications Department and NASBA has finished processing your request, we will make reasonable efforts to remove personally identifiable information from our databases. Please note that while you will no longer receive marketing communications from NASBA, you may still receive emails containing important or relevant information specific to your individual account. If you receive a marketing communication through text message, you may opt-out by following the instructions provided in the message.

If you believe your credit card and/or password are stolen from or used without your permission on any of our Sites, immediately notify your card provider in accordance with its rules and procedures, and contact us. Upon notification, we will further investigate and, if necessary, cancel any verified false transactions and compromised passwords, and will update any affected records.

Our Sites may contain links to other third-party websites. The information practices or the content of such other websites is governed by the privacy statements of such other websites. We encourage you to review the privacy statements of other websites to understand their information practices. We are not responsible for the nature, quality or accuracy of the content or opinions expressed on such websites, or of the services provided through such websites. Such websites are not investigated, monitored or checked for quality, accuracy or completeness by us. Inclusion of any linked website on our Sites does not imply or express an approval or endorsement of the linked website by us, or of any of the content, opinions, products or services provided on these websites. Even if an affiliation exists between our Sites and a third-party website or application, we exercise no control over linked websites.

Our Sites are controlled, operated and administered entirely within the United States. By using our Sites, you signify your agreement to the terms of this Privacy Policy. If you do not agree with this Privacy Policy, please do not disclose any Personal Data through our Sites. This Privacy Policy and the use of our Sites are governed by Tennessee law and United States federal law. Any claim related to our Sites or this Privacy Policy shall be brought only in a federal or state court in Davidson County, Nashville, Tennessee, within one year after the claim arises. Users of our Sites consent to the exclusive jurisdiction and venue of such courts as the most convenient and appropriate for the resolution of disputes concerning this Privacy Policy. This Privacy Policy and the notices outlined herein are not intended to and do not create any contractual or other legal rights in or on behalf of any third party. The information we collect from you through our Sites may be collected and transferred by and to our affiliates located throughout the world, to the extent necessary to provide services and/or products that you have requested.

Under the California Civil Code, residents of the State of California that have provided any personally identifiable information to us have the right to request a list of all third parties to which we have disclosed personally identifiable information during the preceding year for direct marketing purposes. Alternatively, the law provides that if we have a privacy policy that gives either an opt-out or opt-in choice for use of personally identifiable information by third parties (such as advertisers or affiliated companies) for marketing purposes, we may instead provide you with information on how to exercise your disclosure choice options free of charge. We qualify for the alternative option and have adopted a policy of not disclosing the personal information of users of our Sites to third parties for the third parties’ direct marketing purposes if the user has exercised an option that prevents that information from being disclosed to third parties for those purposes. We have established this Privacy Policy that provides you with details on how you may either opt-out of the use of your personally identifiable Information by third parties for direct marketing purposes. If you are a California resident and would like to request information about how to exercise your third-party disclosure choices, please call us with a preference on how our response to your request should be sent.

This is an English-only legal document containing significant legal duties and requiring a high degree of competency in the English language. The language of this Privacy Policy is English and it shall be interpreted exclusively in English. Any translation into another language is unauthorized and shall not be binding nor constitute evidence of the intent or meaning of any part or whole of this Privacy Policy.

We do not knowingly collect Personal Data from or market online to children under the age of 16, and users under the age of 16 should not submit any Personal Data to us. If we have actual knowledge that Personal Data about a child under 16 years old has been collected, then we will take the appropriate steps to delete this Personal Data. If users are a parent or guardian and users are aware that a child under 16 has provided us with Personal Data, please contact us though one of the methods listed under “Contact Us” below. If users are under 18, users may purchase products through our sites only with the involvement and consent of a parent or guardian.

For more information about the Children’s Online Privacy Protection Act (“COPPA”), which applies to websites that direct their services to children under the age of thirteen (13), please visit the Federal Trade Commission’s website: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions.