MEFA is committed to protecting the confidentiality of personal information you provide to us. This notice explains our policies regarding our use and protection of our nonpublic personal and financial information. You may also download a PDF of MEFA's Privacy Policy.

INFORMATION WE COLLECT
The type of information we collect and maintain depends on the type of product or service you obtain from us. We may collect and maintain "nonpublic personal information" about you. "Nonpublic personal information" is information about you, which is not available from public sources, obtained in connection with providing you with a MEFA Loan, a college savings program, or related products or services. For example, nonpublic personal information includes information regarding your account balance, payment history and account activity. We may collect this personal information from the following sources:

• Information we receive from you on applications or other forms you may complete and provide to us, such as your name, address, social security number, assets and income;
• Information from institutions of higher education, such as program of study, enrollment status, cost of attendance, and program eligibility;
• Information about your transactions with us, such as your account balance, payment history, products and services used; and,
• Information such as your creditworthiness and your payment history that we receive from third parties, such as credit bureaus.

INFORMATION WE DISCLOSE
Under certain circumstances, we disclose personal information about you to "nonaffiliated third parties" (i.e., entities that are not affiliated with MEFA), but only to the extent necessary to operate our programs, provide services to you, and comply with applicable law. For example, we may disclose personal information about you:

• To third parties to assist us in establishing and/or servicing your MEFA Loan or college savings account. The use of any information made available to such third parties is strictly limited to the purpose for which it is provided;
• To government entities or other parties as required by subpoena, court order or law; or,
• To consumer credit reporting agencies.

We will not disclose any nonpublic personal information about you to any other third parties without your prior consent, except as permitted or required by applicable law. MEFA does not sell or release private personal or financial information, or customer mailing lists for commercial purposes.

If you decide to close your account(s) or become an inactive customer, we will continue to adhere to the privacy policies and practices described in this notice.

OUR SECURITY PROCEDURES
We also take steps to safeguard customer information. Access to your personal and account information is restricted to those employees who need to know that information as part of their job, to service your account or to provide service to you. We maintain physical, electronic and procedural safeguards that comply with state and federal standards to guard your nonpublic personal information.

ACCURACY OF CUSTOMER
We recognize that the accuracy of your personal and account information is critical to you and to that end we follow procedures to reasonably ensure the accuracy of your information. If you find that any information we have on file or have reported to another party does not appear to be accurate, please write us at: MEFA, 125 Summer Street, Suite 300, Boston, MA 02110. Please include your account number in any correspondence.

INTERNET PRIVACY
Safeguarding your personal information when interacting with us via the internet is also important to us. MEFA presently employs the use of Secure Socket Layer (SSL) technology to encrypt certain types of data sent to us through our web site. MEFA employs standard systems to safeguard your information, including firewall security to protect its network from unauthorized entry. For additional questions, please contact Thomas Smith, Director of Information Technology at tsmith@mefa.org.