Privacy Policy - Office of the Comptroller

About

This policy applies to use of the Office of the Comptroller of the Commonwealth of Massachusetts (CTR) website, MAComptroller.org. As users navigate MAComptroller.org, users will see links that, when clicked, will take them to other Commonwealth or external websites. This policy does not apply to other Commonwealth or external websites, which may have their own privacy policies tailored to the interactions available through each site.

A Privacy Partnership

User privacy with respect to MAComptroller.org results from a partnership between the user and CTR. All information that we receive through MAComptroller.org is subject to the Public Records Law, Massachusetts General Laws Chapter 66, Section 10. Information that MAComptroller.org users provide to us through MACcomptroller.org may be made available to members of the public, unless that information falls under a specific statutory exemption.

This policy details the information that we collect from MAComptroller.org users, what we do with it, to whom it may be disseminated, and how users can access it. Based on this information. MAComptroller.org users can maximize the benefits of the privacy partnership with CTR by making informed decisions about what information to share with CTR through MAComptroller.org.

Social Media and Third Party Platforms

Social media platforms linked through MAComptroller.org are hosted by third-party providers. When visiting these third-party social media sites, users are subject to the third-party provider’s privacy policies and terms of service. Additionally, MAComptroller.org links to other web portals through which users are able to submit information (NextRequest, ServiceNow, Socrata, Formstack). These portals are also hosted by third party providers; thus, when visiting these third-party platforms, users are subject to that provider’s privacy policies and terms of service.

We strongly suggest that users read the site policies, including the privacy policies, for any external site that they visit through a link appearing on MAComptroller.org.

Information Voluntarily Provided by MAComptroller.org Users

MAComptroller.org does not collect information from users through the website itself. Occasionally, MAComptroller.org will invite users to submit information through email. Users should note that any information shared with CTR (or any department of the Commonwealth of Massachusetts) may be subject to the public records law and ultimately disclosed in response to a public request.

Information Automatically Collected and Stored by MAcomptroller.org

MAComptroller.org employs the use of “Persistent Cookies.” The purpose of these Persistent Cookies is to collect and aggregate data regarding MAComptroller.org’s user activity in order for CTR to continuously evaluate and improve its website services. MAComptroller.org users may elect to disable the Persistent Cookies. Please be advised that disabling the Persistent Cookies may affect users’ ability to view or interact with MAComptroller.org.

MAComptroller.org collects and stores users’ “Internet Protocol (“IP”) address” (which does not identify users as an individual) indefinitely, as well as information about the date, time, and duration of a user’s visit, the device and browser they are using, the approximate location of their IP address, the nature of their interaction with the website, and information on how they were referred to MAComptroller.org.

We use MAComptroller.org users’ IP addresses to assess the effectiveness of content and layout of MAComptroller.org; CTR will not attempt to match any personally identifiable information that the user provides to CTR to the user’s IP address.

Usage Data and Known Persistent Cookies

MAComptroller.org uses (or may use) the following tools (each a “Tool” and collectively, the “Tools”):

Tool name: Google Analytics™

Purpose: Collect information about use of the MAComptroller.org website

Data collected: Google Analytics collects information such as how often users visit MAComptroller.org, what pages they visit when they do so, and what other sites they used prior to coming to MAComptroller.org.

Express opt out: N/A

Special notes: N/A

Tool name: Google Tag Manager™

Purpose: Collect information about use of the Macomptroller.org website

Data collected: Google Tag Manager collects information such as how often users visit Macomptroller.org, what pages they visit, when they do so, and what actions they take while visiting the site such as clicking a link or filling out a form.

Express opt out: N/A

Special notes: N/A

Additional Information Related to Tools

We use the information we obtain from Tools only to improve users’ experience. The Tools may collect additional data such as browser information, operating system, and page views through the implementation of session cookies or Persistent Cookies.

Except as set forth in this Privacy Policy, we do not combine the information collected through the use of any Tool with personally identifiable information. Each Tool plants a persistent cookie on the user’s web browser to identify the user as a unique user the next time the user visits MAComptroller.org. This Persistent Cookie cannot be used by anyone but MAComptroller.org or the publisher of the respective Tool (the “Software Publisher”). The Software Publisher’s ability to use and share information collected by the Software Publisher about the user’s visits to MAComptroller.org is restricted by the Software Publisher’s Terms of Use and Privacy Policy, links to which have been provided above. Users may prevent the Tools from using Persistent Cookies by disabling cookies on their browser. Some of the Tools permit users to opt-out of the Tool by allowing that Tool to plant a Persistent Cookie on the user’s web browser indicating that the user has opted out. If a user disables cookies on their browser or uses a different browser, different computer, different user account, etc., the user will need to opt-out again. If the user allows Persistent Cookies in their web browser, Software Publishers have the technical ability to track the user’s activity, even if the user changes their IP address, so long as the user is using the web browser where the Persistent Cookie was planted. Users should refer to the Software Publisher’s Privacy Policy and Terms of Use to determine if they do track users via the persistent cookie.

Links to Social Media Sites

Certain links on MAComptroller.org (whether integrated with Tools or otherwise) facilitate interaction with third-party social media sites. Accessing third-party social media functions (whether through a Tool or otherwise) may require a user to log in to a social media provider, and that social media provider may plant a persistent cookie on the user’s web browser to keep users logged in.

Any interaction with such social media providers (whether through a Tool or otherwise) is subject to the social media provider’s site policies, and the provider may plant one or more additional persistent cookies on a user’s web browser as a result of the user’s interaction with it.

Online Forms on MAComptroller.org

Online forms may collect information, which would be hosted by the third party service Formstack. When a user uses this service, the user’s form is securely submitted to Formstack and stored there. Form submissions are then transmitted to CTR staff. State government staff will delete form submissions from Formstack when there is no longer an administrative need to retain. Formstack only uses form submissions for internal purposes, and the data is considered private. Formstack will not distribute or sell user information to a third party unless required by law or a valid government request. Formstack may also share information if it is acquired by or merged with another company. Please see the Formstack privacy policy at https://www.formstack.com/legal/website-privacy-policy.

Dissemination of Users’ Personally Identifiable Information

We do not sell any personally identifiable information collected through MAComptroller.org or submitted to CTR in conjunction with the use of MAComptroller.org.

If a user voluntarily submits personally identifiable information to CTR related to their use of MAComptroller.org, its dissemination is governed by the Public Records Law, the Fair Information Practices Act (Massachusetts General Laws Chapter 66A), and other applicable laws and regulations. For information on the types of data exempted from disclosure under the Public Records Law, please read the Secretary of the Commonwealth’s Guide to the Massachusetts Public Records Law.

The information users voluntarily submit will be disclosed only to Commonwealth employees or officials, or those under contract with the Commonwealth, with a “need to know” for purposes of fulfilling their job responsibilities. The information will be used for such purposes as, but not limited to: answering users’ questions; responding to any requests for assistance; generating summary statistics about website usage; auditing applications and detecting fraud; aiding in the planning, design, maintenance, and development of MAComptroller.org; and fulfilling the Commonwealth’s legal obligations.

CTR will collect and aggregate the information MAComptroller.org users provide through surveys and through MAComptroller.org’s collection of non-personally identifying analytics data to improve user experience by making MAComptroller.org more responsive to customer needs. Where appropriate, CTR may provide information submitted by MAComptroller.org users through an email to the person or company that is the subject of the MAComptroller.org user’s inquiry, or to a government agency responsible for the matters referred to in the MAComptroller.org user’s communication.

MAComptroller.org Users Access and Opportunity to Correct

For information about the public’s right to obtain information about MAComptroller.com users, please see the Public Records Law and the Fair Information Practices Act

Security

Information automatically collected from users is encrypted; however, users should not send messages containing information that users consider highly sensitive to MAComptroller.org. CTR uses standard security measures to ensure that information provided by users, including personally identifiable information, is not lost, misused, altered, or unintentionally destroyed. CTR also uses software to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. Except for authorized law enforcement, fraud or cybersecurity investigations, no attempts are made to identify individual users or their usage habits.

Special Protections Against Misuse of Personally Identifiable Information Within Commonwealth Offices

This website complies with Massachusetts General Laws Chapter 93H and other applicable privacy laws. Personally identifiable information that MAComptroller.org users submit to MAComptroller.org is protected in accordance with those laws.

Policy changes

We will post any substantive changes to this policy at least 30 days before they take effect. The terms of any new Privacy Policy adopted will apply only to the use of MAComptroller.org after the date those changes are published.

Contact Information

For questions about MAComptroller.org users’ privacy while using MAComptroller.org, please contact [email protected].