NBCSS Privacy Notice
1. Who is responsible
The National Board of Cost Segregation Specialist ("NBCSS"; legal entity pending name clearance) is the controller of personal data processed through its membership platform. Contact: the support form (category "privacy") or privacy@nbcss.org. General contact: contact@nbcss.org.
2. What we collect and why
| Data | Source | Purpose | Legal basis (where required) |
|---|---|---|---|
| Account data: name, email, timezone, login events | You; authentication provider | Operate your account; security | Contract |
| Application data: work history, sample reports (redacted), contribution statements, background questionnaire, references | You | Admission review by NBCSS reviewers; appeals | Contract; legitimate interest in admission integrity |
| Payment data: saved payment method token, consent text version and hash, invoices, charges, refunds | You; Stripe | Charge only on approval; renewals; refunds; accounting | Contract; legal obligation (tax) |
| Learning data: enrollments, lesson progress, quiz attempts, completions | Your use of member education | Deliver instruction; issue completion records | Contract |
| Assessment data: attempts, answers, timing, integrity signals, practical submissions and uploaded workbooks, reviewer scores, appeals, advisory AI suggestions | Your attempts; reviewers; the advisory review service | Decide certification under the published scheme; appeals; scheme validation | Contract; legitimate interest in credential integrity |
| Credential and directory data: award record, credential number, verification page, opt-in directory profile | NBCSS decision; your profile choices | Public verification of a credential; opt-in listing | Consent (directory); legitimate interest (verification) |
| Community and jobs data: posts, reports, moderation actions, job postings, applications relayed | You; moderators | Private member community; jobs board | Contract; legitimate interest in safety |
| Communications: transactional email, delivery status, preferences, unsubscribe events | Platform; email provider | Service notices; marketing only with opt-in | Contract; consent (marketing) |
| Support and privacy requests: tickets, identity verification records | You | Support; exercise of rights | Legal obligation; contract |
| Technical data: IP address, browser, request logs (redacted) | Your device | Security, abuse prevention, reliability | Legitimate interest |
We do not sell personal data. We do not use member data to train artificial-intelligence models. The advisory review service receives only the assessment scenario, the rubric criteria and the candidate's own submission text; it returns suggestions that a human reviewer verifies.
3. Who sees what
Application files are screened before any reviewer can open them; reviewers see only what admission requires. Assessment answer keys and reviewer notes are never shown to candidates before release. Staff access is role-based, logged and reviewed. Public pages show only what you opted to publish and the credential verification record.
4. Subprocessors
Vendors that process personal data on our behalf are listed on the /privacy page only once a contract is in place. Planned categories: database and authentication hosting, payment processing (Stripe), transactional email, application hosting, background job hosting, the advisory review model provider, error monitoring (Sentry) and privacy-preserving website analytics limited to public pages (PostHog). Each vendor is bound to process data only on our instructions.
5. Retention
Personal data is kept for the periods in the Data Retention Schedule, then deleted or anonymized. Certification records are kept for the life of the credential plus the period the schedule states because they are the evidence for the credential.
6. Your rights
You can export your data, correct it, or request deletion from the member privacy page. Requests are identity-verified, fulfilled within 30 days where the law allows, propagated to contracted processors, and explained where an exception applies (for example, certification integrity records, tax records, legal holds). Marketing email requires opt-in and every message carries an unsubscribe link; service notices about your account, payments and assessments cannot be unsubscribed while you are a member.
Residents of California, Texas and other states with privacy laws have the rights those laws provide; we honor them through the same request page.
7. Security
Data is encrypted in transit and at rest by our hosting providers; access is role-based; secrets are rotated on a schedule; uploaded files are stored privately and screened; logs are redacted. No system is perfectly secure; we notify affected people and authorities of a breach as the law requires.
8. Children
The platform is for professionals and is not directed to anyone under 18.
9. Changes
We announce material changes to members before they take effect and keep prior versions available on request.
Subprocessors under contract
| Vendor | Purpose | Data | Retention |
|---|---|---|---|
| Sentry | error monitoring (website and background jobs) | error messages and stack traces with personal data removed at the source; page address without query strings; browser type | per the Sentry data processing agreement; IP address storage disabled |
Your requests
Signed-in members can export, correct or request deletion of their records from the privacy page. Requests are identity-verified and propagated to the contracted processors above. Others may write to privacy@nbcss.org.
Version 1.1, approved 2026-09-28. Text identifier sha256 2c7b8cea56bda84e…. See also: Terms · Refunds · Retention · Affiliate terms.