Privacy Policy

FormMaps (“FormMaps,” “we,” “us,” “our”), operated by TIMS International, provides college and career guidance software to schools, students, and families. This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights you have. It applies to this website (formmaps.com) and to the FormMaps platform.

Summary

• We use student data only to deliver the service to the school. We do not sell personal information or use it for behavioral advertising.
• When a school uses FormMaps, the school controls its students’ data and we act as its processor / school official.
• Assessment results inform recommendations; they are decision support for counselors and families, not automated decisions that produce legal or similarly significant effects.
• You have rights over your data, described below, and can contact us at any time.

Who is responsible for your data (controller & processor)

When a schoolor district uses FormMaps, the school is the data controller of its students’ personal information and FormMaps acts as a data processor / school officialunder the school’s direction and its written agreement with us, consistent with FERPA. When an individual signs up directly (not through a school), FormMaps is the controller for that account. Schools remain responsible for obtaining any consents required for their students.

Information we collect

• Account data — name, email, role, and school/organization.
• Assessment data — responses and results from the personality (PCA), aptitude (LIA), and 360° multi-rater assessments, and the roadmaps, matches, and reports generated from them.
• 360° rater data — feedback provided by teachers, peers, and family members a student invites.
• Usage data — pages viewed and actions taken, via privacy-friendly, cookieless analytics (see our Cookie Policy).
• Contact data — information you submit through our demo or contact forms: your name, email, role, organization, country, approximate number of students, any message you include, and your consent to be contacted.
• Technical data — IP address, device/browser type, and similar information processed transiently to operate and secure the service.

How we use information

• To generate personalized career roadmaps, matches, and reports.
• To provide, maintain, secure, and improve the service.
• To communicate with schools and account holders about the service.
• To detect, prevent, and address fraud, abuse, and security incidents.
• To comply with legal and contractual obligations.

Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we process personal data on the bases of contract performance (to provide the service), legitimate interests (to secure and improve the service, balanced against your rights), legal obligation, and consent where required (which you may withdraw at any time without affecting prior processing).

Automated processing & profiling

FormMaps analyzes assessment responses to produce fit scores and recommended careers, majors, and study paths. These outputs are designed to support human guidance by counselors, students, and families — they are not solely automated decisions that produce legal or similarly significant effects, and they do not determine admissions, grades, or eligibility. You can ask a human at your school, or us, to review or explain a result.

Student data & children

We are committed to responsible handling of student data. We do not sell student data, do not use it for targeted or behavioral advertising, and do not build profiles of students except to provide the educational service requested by the school. Student data is processed solely to deliver the service to the school and is not retained longer than needed for that purpose.

Where students are under the relevant age of consent, processing relies on the school’s authorization (acting under FERPA’s school official / educational-purpose framework) or on verifiable parental consent, consistent with FERPA and COPPA. Parents and eligible students may exercise their rights through the school.

Sharing & sub-processors

We do not sell personal information. We share data only as needed to operate the service: with vetted sub-processors (for example, cloud hosting, email delivery, and cookieless analytics) under contracts that require appropriate safeguards; with a school for its own students; and where required by law or to protect rights and safety. A current sub-processor list and a Data Processing Addendum (DPA) are available to schools on request — see our Trust & Security page. We may also share data in connection with a merger or acquisition, subject to this policy.

International data transfers

We may process and store data in countries other than your own, including the United States. Where we transfer personal data internationally, we use recognized safeguards such as Standard Contractual Clauses or equivalent mechanisms to protect it.

Data retention

We retain personal data for as long as an account is active or as needed to provide the service, and thereafter only as required to meet legal, accounting, or contractual obligations, after which we delete or anonymize it. School data is retained, returned, or deleted in accordance with the school’s agreement.

Security & breach notification

We protect data with encryption in transit and at rest, role-based access controls, least-privilege access, and ongoing monitoring. No system is perfectly secure, but if a breach affecting your personal data occurs, we will notify affected schools, account holders, and authorities as and when required by applicable law.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, students and families at a participating school should contact their school (the data controller); direct account holders can contact us at hello@formmaps.com. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your data-protection authority (for example, an EU/EEA supervisory authority, or the Superintendencia de Industria y Comercio in Colombia).

Colombia & Latin America

For users in Colombia, we process personal data in accordance with Ley 1581 de 2012 and Decreto 1377 de 2013, including the rights to know, update, rectify, and delete your data and to revoke authorization (habeas data). Requests may be directed to us at hello@formmaps.com. Equivalent regional data-protection laws apply elsewhere in Latin America.

California privacy rights

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct, and limit the use of your personal information, and to not be discriminated against for exercising them. We do notsell or “share” (for cross-context behavioral advertising) personal information. Student data handled on behalf of a school is processed under our service-provider obligations.

Third-party links

Our site and service may link to third-party sites or embed third-party tools (for example, a demo scheduler). Their privacy practices are governed by their own policies, not this one.

Changes & contact

We will post updates here with a revised date and, where required, provide additional notice. Questions or requests: hello@formmaps.com.