Privacy Policy and Data Protection

Introduction

Thank you for visiting a New York State Canal Corporation ("Corporation") website. This website is designed to make it easier and more efficient for individuals and businesses to interact with the Corporation. Consistent with the provisions of the Internet Security and Privacy Act, the Freedom of Information Law, and the Personal Privacy Protection Law, this policy describes the Corporation's privacy practices regarding information collected from users of this website. This policy describes what information is collected and how that information is used. Because this privacy policy only applies to this website, you should examine the privacy policy of any website, including other State agency and authority websites, that you access using this website.

For the purposes of this policy, "personal information" means any information concerning a natural person, as opposed to a corporate entity, which, because of name, number, symbol, mark, or other identifier, can be used to identify that natural person. The Corporation only collects personal information about you when you provide that information voluntarily by sending an e-mail or by initiating an online transaction, such as a survey, registration or order form.

Information Collected Automatically When You Visit this Website

When you visit this website, the Corporation automatically collects and stores the following information about your visit:

(i) User client hostname. Your hostname or Internet Protocol Address. The Internet Protocol Address is a numerical identifier assigned either to your Internet service provider or directly to your computer.

(ii) HTTP header, user agent. The type of browser you are using, its version, and the operating system on which that browser is running.

(iii) HTTP header, referrer. The web page from which you accessed this web page.

(iv) System date. The date and time of your request.

(v) Full request. Your exact request.

(vi) Status. The status code the server returned to you.

(vii) Content Length. The content length, in bytes, of any document sent to you.

(viii) Method. The request method used.

(ix) Universal Resource Identifier (URI). The location of a resource on the server.

(x) Query string of the URI. Anything after the question mark in a URI.

(xi) Protocol. The transport protocol and the version used.

None of the foregoing information is deemed to constitute personal information.

The Corporation uses the information that is collected automatically to improve this website's content and to help the Corporation understand how users are interacting with the website. The Corporation collects this information for statistical analysis, to determine what information is of most and least interest to our users, and to improve the utility of the material available on the website. The information is not collected for commercial marketing purposes and the Corporation does not sell or otherwise disclose the information collected from this website for commercial marketing purposes.

Cookies

Cookies are simple text files stored on your web browser to provide a means of distinguishing among users of this website. The use of cookies is a standard practice among Internet websites. To better serve you, the Corporation may use "session cookies" to enhance or customize your visit to this website. Session cookies can be created automatically on the device you use to access this website. These session cookies do not contain personal information and do not compromise your privacy or security. The Corporation may use the cookie feature to store a randomly generated identifying tag on the device you use to access this website. A session cookie is erased during operation of your browser or when your browser is closed.

At times you may be asked if you would like to personalize this website by allowing the Corporation to store a "persistent cookie" on your computer’s hard drive. This persistent cookie will allow the website to recognize you when you visit again and tailor the information presented to you based on your needs and interests. The Corporation uses persistent cookies only with your permission.

The software and hardware you use to access this website allows you to refuse new cookies or delete existing cookies. Refusing or deleting these cookies may limit your ability to take advantage of some features of this website.

Information Collected When You E-mail this Website or Initiate an Online Transaction

During your visit to this website you may send an e-mail to the Corporation. If so, the Corporation will collect your e-mail address and the contents of your message. The information collected is not limited to text characters and may include audio, video, and graphic information formats included in the message. The Corporation may use your e-mail address and the information included in your message to respond to you, to address issues you identify, to improve this website, or to forward your message to another State agency or authority for appropriate action. The Corporation does not collect your e-mail address for commercial purposes and the Corporation does not sell or otherwise disclose your e-mail address for commercial purposes.

During your visit to this website you may initiate a transaction such as a survey, registration, or order form. The Corporation may use the information, including personal information, that you volunteered by initiating the transaction to operate Corporation programs, including the provision of goods, services, and information. The Corporation may disclose such information for those purposes that may be reasonably ascertained from the nature and terms of the transaction in connection with which the information was submitted.

The Corporation does not knowingly collect personal information from children or create profiles of children through this website. Users are cautioned, however, that the Corporation will treat personal information submitted in an e-mail as though it was submitted by an adult, and such information may, unless exempted from access by federal or State law, be subject to public access. The Corporation strongly encourages parents and teachers to be involved in children’s Internet activities and to provide guidance whenever children are asked to provide personal information online.

Information and Choice

As noted above, the Corporation does not collect any personal information about you during your visit to this website unless you provide that information voluntarily by sending an e-mail or initiating an online transaction such as a survey, registration or order form. You may choose not to send the Corporation an e-mail, respond to a survey, or complete a registration or order form. While your choice not to participate in these activities may limit your ability to receive specific services or products through this website, it will not prevent you from requesting services or products from the Corporation by other means and will not normally have an impact on your ability to take advantage of other features of the website, including browsing or downloading publicly available information.

Disclosure of Information Collected Through This Website

The collection of information through this website and the disclosure of that information are subject to the provisions of the Internet Security and Privacy Act. The Corporation will only collect personal information through this website or disclose personal information collected through this website if the user has consented to the collection or disclosure of such personal information. The user’s participation in an online transaction resulting in the disclosure of personal information to the Corporation, whether solicited or unsolicited, constitutes consent to the Corporation’s collection and disclosure of the information for the purposes for which the user disclosed the information to the Corporation, as was reasonably ascertainable from the nature and terms of the transaction.

However, the Corporation may collect or disclose personal information without user consent if the collection or disclosure is: (1) necessary to perform the statutory duties of the Corporation, or necessary for the Corporation to operate a program authorized by law, or authorized by state or federal statute or regulation; (2) made pursuant to a court order or by law; (3) for the purpose of validating the identity of the user; or (4) of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person.

Further, the disclosure of information, including personal information, collected through this website is subject to the provisions of the Freedom of Information Law and the Personal Privacy Protection Law.

The Corporation may disclose personal information to federal or state law enforcement authorities to enforce the Corporation’s rights against unauthorized access or attempted unauthorized access to the Corporation’s information technology assets or against other inappropriate uses of this website.

Retention of Information Collected Through this Website

In general, the Corporation’s Internet services logs, comprised of electronic files or automated logs created to monitor access and use of Corporation services provided through this website, will be retained for 1 year and then destroyed. Information, including personal information, that you submit in an e-mail or when you initiate an online transaction such as a survey, registration, or order form is retained in accordance with the records retention and disposition schedule established for the records of the program unit to which you submitted the information.

Access to and Correction of Personal Information Collected Through this Website

Any user may submit a request to the Corporation Privacy Compliance Officer to determine whether personal information pertaining to that user has been collected through this website. Any such request shall be made in writing to the address below and must be accompanied by reasonable proof of identity of the user. Reasonable proof of identity may include verification of a signature, inclusion of an identifier generally known only to the user, or similar appropriate identification. The address of the privacy compliance officer is:

New York State Canal Corporation
Privacy Compliance Officer
Legal Department
200 Southern Boulevard
Albany, New York 12209

The Privacy Compliance Officer shall, within five (5) business days of the date of the receipt of a proper request: (i) provide access to the personal information; (ii) deny access in writing, explaining the reasons therefore; or (iii) acknowledge the receipt of the request in writing, stating the approximate date when the request will be granted or denied, which date shall not be more than thirty (30) days from the date of the acknowledgment.

In the event that the Corporation has collected personal information pertaining to a user through this website and that information is to be provided to the user pursuant to the user’s request, the Privacy Compliance Officer shall inform the user of his or her right to request that the personal information be amended or corrected under the procedures set forth in section 95 of the Public Officers Law.

Confidentiality and Integrity of Personal Information Collected Through this Website

The Corporation is strongly committed to protecting personal information collected through this website against unauthorized access, use, or disclosure. Consequently, the Corporation limits employee access to personal information collected through this website to only those employees who need access to the information in the performance of their official duties. Employees who have access to this information are required to follow appropriate procedures in connection with any disclosure of personal information.

In addition, the Corporation has implemented procedures to safeguard the integrity of its information technology assets, including, but not limited to, authentication, monitoring, auditing, and encryption. These security procedures have been integrated into the design, implementation, and day-to-day operations of this website as part of the Corporation’s continuing commitment to the security of electronic content as well as the electronic transmission of information.

For website security purposes and to maintain the availability of the website for all users, the Corporation employs software to monitor traffic to identify unauthorized attempts to upload or change information or otherwise damage this website.