MyTC3 Privacy Policy

1. Who we are

MyTC3 is a web application of Tompkins Cortland Community College.

Data Controller: Campus Technology at Tompkins Cortland Community College
Contact: campustech@tc3.edu

2. Scope of this notice

This policy explains how MyTC3 collects, uses, discloses, and retains personal information when you access or use the MyTC3 website and related services.

3. What we collect and why

• Authentication data: Your TC3 credentials through Microsoft Entra ID (MSAL). Purpose: sign-in and session security.
• Microsoft Graph data: Profile, email/UPN, groups, and calendar information. Purpose: provide dashboards, entitlements, and events.
• Application data: Route/component permissions and user preferences stored in local/session storage. Purpose: navigation and personalization.
• Analytics (with consent): Microsoft Clarity collects usage patterns (clicks, scrolls, device info). Purpose: usability and performance improvement.

4. Legal bases

We process your data based on: service necessity, legitimate interests (security), consent (analytics), and compliance obligations.

5. Cookies and local storage

We use strictly necessary storage for authentication and security. Analytics storage is optional and only enabled with your consent. We honor browser privacy signals such as Global Privacy Control (GPC).

6. How we share information

We share information with Microsoft (Entra ID, Graph, Azure), contracted service providers, relevant TC3 departments, and as required by law. We do not sell your personal information.

7. International transfers

Data may be processed in the United States or where Microsoft and service providers operate, with safeguards as required by law.

8. Retention

Authentication/session data is kept only as long as necessary. Logs (no PII) are retained the amounts of days regulated by our policy. Analytics is retained according to the terms and agreements of the analytics platform. Records follow TC3 schedules and legal requirements.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your data, and to withdraw consent. California residents have CPRA rights (know, delete, correct, opt-out of share, limit sensitive PI). Requests can be submitted to campustech@tc3.edu.

10. Audience of information

MyTC3 is intended for students, faculty, and staff only with TC3 credentials.

11. Security

We use administrative, technical, and physical safeguards appropriate to risk. This includes secure authentication via Microsoft Entra ID, least-privilege access, and monitoring.

12. Changes

We may update this policy. Updates will be posted here with a new effective date and may also be highlighted in-app.

13. Contact

Questions or requests: campustech@tc3.edu
Tompkins Cortland Community College