CMPR.edu Privacy Policy
Effective date: August 1, 2026
Last updated: August 1, 2026
CMPR.edu and the educational institution that owns or operates this website (collectively, the “Institution,” “we,” “our,” or “our”) respect your privacy and are committed to protecting personal information in accordance with applicable law. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information obtained through CMPR.edu, its subdomains, related web pages, online forms, portals, electronic communications, and other digital services that link to or reference this Privacy Policy (collectively, the “Site”).
This Privacy Policy is intended to notify you of our online privacy practices and should be read in conjunction with any supplemental privacy notices, consent forms, terms of use, student notices, employee notices, financial aid notices, or program-specific disclosures that may apply to particular services, departments, or activities.
1. Scope of this Privacy Policy
This Privacy Policy applies to personal information collected through the Site from, or about, students, prospective students, applicants, parents, guardians, alumni, donors, website visitors, employees, contractors, suppliers, and others who interact with the Institution online.
This Privacy Policy does not necessarily apply to third-party websites, services, platforms, or applications that may be linked from the Site or operated independently of the Institution, even if such third parties support institutional functions.
2. Who We Are
Institution: Puerto Rico Conservatory of Music
Postal address:
951 Ave. Ponce de Leon
San Juan, Puerto Rico 00907
Privacy contact email: privacy@cmpr.edu
Phone: 787-751-0160
For privacy-related requests, questions, or complaints, please use the contact information listed above or in Section 17 below.
3. Legal and Regulatory Context
This Privacy Policy is drafted with reference to the laws and regulations that may apply to the Institution depending on the nature of the information collected and the services provided, including: the Constitution of the Commonwealth of Puerto Rico, Article II, Sections 1 and 8; Puerto Rico Act No. 39-2012 on online privacy policy notices; Puerto Rico Act No. 111-2005 on security breach notifications; the Family Educational Rights and Privacy Act (“FERPA”); the Children’s Online Privacy Protection Act (“COPPA”), when applicable; the Gramm-Leach-Bliley Act (“GLBA”) and the FTC Safeguards Rule, when applicable to postsecondary institutions that handle covered financial information; Section 5 of the Federal Trade Commission Act; and, in limited circumstances, HIPAA when not superseded or excluded by FERPA or another law. In addition, as a public institution of higher education in Puerto Rico that receives federal financial assistance, the Institution acknowledges its obligations under: Title II of the Americans with Disabilities Act of 1990 (“ADA”), 42 U.S.C. § 12101 et seq.; Section 504 of the Rehabilitation Act of 1973, 29 U.S.C. § 794, including obligations applicable to the digital accessibility of its online services; Section 508 of the Rehabilitation Act, 29 U.S.C. § 794d, to the extent applicable to federally funded electronic and information technology; the Telephone Consumer Protection Act (“TCPA”), 47 U.S.C. § 227, and applicable FCC regulations, to the extent the Institution communicates with individuals through automated calls or text messages; and the laws of Puerto Rico that govern the administration and disposal of public records, including Act No. 5 of December 8, 1955, as amended, and Act No. 72 of June 27, 2019 (“Puerto Rico Electronic Transactions Act”), to the extent applicable to the Institution’s electronic records and transactions.
Nothing in this Privacy Policy is intended to waive any legal right, privilege, exemption, defense, or obligation available to the Institution under applicable law.
4. Categories of Personal Information We Collect
Depending on how you interact with the Site or Institution, we may collect the following categories of personal information:
a. Identifiers and Contact Information
We may collect name, postal address, email address, telephone number, date of birth, student or institutional identification number, username, account credentials, and other similar contact or identification information.
b. Educational, Admissions and Student Services Information
We may collect information related to inquiries, applications, admissions, enrollment, registration, courses, grades, academic progress, financial aid, scholarships, student support services, requests for accommodations, disciplinary matters, and other education-related records.
c. Payment, Donation and Financial Information
We may collect the information necessary to process tuition payments, fees, donations, refunds, scholarship administration, or other financial transactions. Payment card information may be collected and processed by authorized third-party payment processors rather than stored directly by the Institution, depending on the transaction workflow.
d. Technical and Usage Information
We may automatically collect certain technical data when you use the Site, such as IP address, browser type, operating system, device information, referring URLs, pages visited, date and time of access, click information, session data, and other similar usage information.
e. Information Sent Through Forms or Communications
We may collect information that you provide when you complete forms, subscribe to communications, request information, contact us, apply for programs, submit documents, or otherwise communicate with us.
f. Third-Party Information
We may receive personal information from schools, testing agencies, service providers, payment processors, government agencies, accreditation bodies, social media platforms, analytics providers, and other third parties that support institutional operations or authorized programs.
g. Sensitive or Regulated Information
When necessary and legal, we may collect information that could be considered sensitive or specially protected, such as information related to adaptations, limited health-related information, financial aid documentation, or government-issued identifiers. Such information will be handled in accordance with applicable legal requirements and institutional needs.
5. How We Use Personal Information
We may use personal information for legitimate institutional, educational, operational, compliance, and security purposes, including: operating, maintaining, evaluating, securing, and improving the Site and related services;
to answer inquiries and provide the requested information;
process admissions, enrollments, registrations, applications, financial aid, employment inquiries, donations, event registrations and similar requests; create, authenticate, administer and support accounts, portals and online services; communicate with students, applicants, parents, alumni, donors, employees and other users; provide academic, administrative, technical, student support and institutional services; comply with legal, regulatory, accreditation, audit, records management and reporting requirements;
to protect the security, rights, property, systems, operations, and legal interests of the Institution and others; to detect, investigate, prevent, or address fraud, misuse, illegal conduct, unauthorized access, or security incidents; and
send institutional notices, emergency communications and, where permitted by law, marketing, development or fundraising communications.
6. Cookies and Similar Technologies
The Site may use cookies, pixels, web beacons, tags, scripts, session replay tools, and similar technologies for operational, security, analytical, functional, and user experience purposes. These technologies may help us to:
Keep users logged in or maintain session continuity; remember preferences;
to understand traffic patterns and site performance; improve navigation and content delivery; and support security monitoring and fraud prevention.
Some cookies are necessary for the Site to function properly. Others are optional or used for analytics or convenience. You may be able to manage cookies through your browser settings; however, disabling certain cookies may affect the functionality of parts of the Site.
7. How We Disclose Personal Information
We do not sell or rent personal information for monetary compensation. We may disclose personal information as reasonably necessary and as permitted or required by law to the following categories of recipients:
a. Service Providers
We may disclose information to suppliers, contractors, consultants, hosting providers, payment processors, cloud providers, learning platform operators, analytics providers, and other service providers who perform services on our behalf under appropriate contractual or legal restrictions.
b. Institutional Staff and Authorized Users
We may disclose information internally to faculty, administrators, staff, student services personnel, compliance personnel, and other authorized individuals who have a legitimate institutional need to access the information.
c. Governmental, Regulatory and Accreditation Bodies
We may disclose information to government agencies, regulators, law enforcement, courts, auditors, accreditors, or supervisory bodies when permitted or required to do so by law, regulation, subpoena, court order, investigation, or similar legal process.
d. Educational and Program Partners
When appropriate and legal, we may disclose information to academic partners, exchange programs, scholarship sponsors, internship coordinators, or other educational collaborators related to institutional programs.
e. Protection of Rights and Security
We may disclose information when we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of the Institution, our students, our staff, or others, or to detect, prevent, or address fraud, security, or technical issues.
f. Organizational Transactions
We may disclose information in connection with a merger, consolidation, restructuring, program transfer, funding transaction, or other institutional reorganization, subject to applicable confidentiality and legal safeguards.
8. FERPA and Student Educational Records
To the extent the Institution is subject to FERPA, educational records and personally identifiable information in educational records are handled in accordance with FERPA and its implementing regulations. FERPA generally grants eligible students the right to inspect and review their educational records, request amendments to certain records, and provide consent prior to the disclosure of personally identifiable information from educational records, subject to exceptions recognized by law. FERPA rights are transferred to the student when the student turns 18 or attends a postsecondary institution, if applicable.
Annual FERPA Notice. The Institution will provide an annual notice to currently enrolled students regarding their rights under FERPA, including the right to inspect and review educational records, the right to request the amendment of inaccurate or misleading records, and the right to consent to the disclosure of personally identifiable information from educational records. This annual notice will be made available through the Student Handbook, the Institution’s website, or other means reasonably likely to inform students of their rights. Students who believe their FERPA rights have been violated may file a complaint with the U.S. Department of Education’s Student Privacy Policy Office (SPPO) at: Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW, Washington, DC 20202-8520, or electronically through the SPPO complaint portal at studentprivacy.ed.gov. Complaints generally must be filed within 180 days of the alleged violation or the date the complainant knew or reasonably should have known of the alleged violation.
The Institution may disclose “directory information,” if designated as such, in accordance with FERPA after providing any required notice and opt-out opportunity. The Institution may also disclose information without consent when permitted by FERPA, including to school officials with legitimate educational interests and in other circumstances authorized by law.
Directory Information Categories. For FERPA purposes, the Institution designates the following categories of student information as “directory information,” subject to review by posted institutional notice: student’s full name; student enrollment status (full-time, part-time, enrolled, withdrawn); academic program or major of study; dates of attendance; degrees, diplomas, certificates, and awards received; participation in officially recognized institutional activities and ensembles; and photographs used in official institutional publications. Students who wish to restrict the disclosure of their directory information must submit a written request to the Registrar’s Office. A restriction on directory information remains in effect until the student provides written notice to lift the restriction. Students are advised that imposing a restriction on directory information may limit the Institution’s ability to confirm enrollment or degree completion to third parties, including prospective employers.
Photos and videos may constitute educational records under FERPA when they are directly related to a student and are maintained by the Institution or a party acting on behalf of the Institution.
9. Children's Privacy and COPPA
The Site is not primarily directed to children under the age of 13, unless a specific page, program, or service expressly states otherwise. When the Institution operates an online service directed to children under the age of 13, or has actual knowledge that it is collecting personal information online from a child under the age of 13 in a context covered by COPPA, the Institution will provide any required notice and obtain verifiable parental consent as required by applicable law, unless an exception applies.
Parents or legal guardians may contact the Institution regarding the review, correction, or deletion of a child's information, subject to applicable law and verification requirements.
10. Information Security
The Institution maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction. These measures may include, as applicable, access controls, authentication measures, encryption, secure configuration, logging, network segmentation, backups, vendor due diligence, workforce training, and incident response procedures.
Where applicable, the Institution strives to comply with the obligations imposed on covered institutions under the GLBA Safeguards Rule and the guidance related to the protection of customer information.
No method of transmission over the Internet or method of electronic storage is completely secure. Consequently, we cannot guarantee absolute security.
11. Retention of Personal Information
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, to provide services, to maintain required academic or institutional records, and to comply with applicable legal, regulatory, tax, audit, accreditation, litigation retention, record retention, and dispute resolution obligations.
Retention periods may vary depending on the type of information, the purpose for which it was collected, and any applicable legal or institutional requirements.
12. Security Incidents and Breach Notification
If the Institution becomes aware of a security incident involving personal information, it may take steps to assess, contain, investigate, document, mitigate, and remedy the incident. When required by applicable law, including Puerto Rico’s breach notification law, the Institution will provide notice to affected individuals and, where appropriate, to government authorities in the manner and within the time frame required by law. Puerto Rico law imposes breach notification obligations on owners or custodians of databases containing covered personal information of Puerto Rico residents and requires clear and conspicuous notification in qualifying cases. Under Puerto Rico Act No. 111-2005, as amended, notification to affected residents must be provided as quickly as possible and without unreasonable delay after the discovery of a qualifying breach, except when a law enforcement agency determines that notification would impede a criminal investigation. The notification must be clear and conspicuous and include, at a minimum: a description of the incident; the type of personal information compromised; The steps individuals can take to protect themselves; a description of the steps the Institution is taking to investigate and address the incident; and contact information for the Institution’s Privacy or Compliance Officer. Where the FTC Safeguards Rule or other federal law imposes notification obligations on the Institution in its capacity as a financial or other institution, the Institution shall also comply with those federal notification deadlines, which may require notification to the FTC within thirty (30) days of the discovery of a breach affecting 500 or more customers.
13. Your Choices and Rights
Subject to applicable law and institutional process, you may be entitled to:
request access to certain personal information; request the correction or updating of certain personal information; update communication preferences; opt out of receiving certain non-essential promotional communications; exercise rights available under FERPA, where applicable; and submit privacy-related questions or complaints; file a complaint with the U.S. Department of Education’s Student Privacy Policy Office (SPPO) regarding alleged violations of FERPA, as described in Section 8 above; and
file a complaint with the Puerto Rico Department of Consumer Affairs (“DACO”) or other competent authority in Puerto Rico regarding privacy or data protection concerns under applicable Puerto Rico law.
The Institution may request information necessary to verify identity and authority before acting on a request. Certain records may be exempt from requests for access, correction, deletion, or restriction under applicable law or institutional record-keeping obligations. The Institution will endeavor to respond to verified privacy requests within forty-five (45) calendar days of receipt. If additional time is required, the Institution will notify the requester of the anticipated timeframe. This timeframe does not apply to requests for access to educational records governed by FERPA, which are subject to FERPA's statutory response timeframes.
14. Photographs, Videos, Audio, Testimonials and Directory-Type Information
The Institution may use photographs, videos, audio recordings, testimonials and similar content for academic, archival, institutional, promotional, development or public relations purposes when permitted by law and, when required, with appropriate authorization or permission.
When such materials are directly related to a student and are maintained by the institution, they may be treated in accordance with FERPA. When they are not educational records, they may still be subject to considerations of privacy, publicity, intellectual property, contracts, or institutional policies.
15. Third-Party Websites, Platforms and Services
The Site may include links to third-party websites, platforms, payment portals, social media services, integrated tools, or applications that are not owned or controlled by the Institution. We are not responsible for the privacy practices, security, or content of such third parties. Your use of third-party services is governed by the privacy notices and terms of those third parties.
We encourage users to review the privacy policy and applicable terms before providing personal information through any third-party service.
16. Changes to this Privacy Policy
We reserve the right to revise this Privacy Policy at any time to reflect changes in the law, institutional practices, technology, operational needs, or the services offered through the Site. When material changes are made, we will post the revised Privacy Policy on the Site and update the “Effective Date” or “Last Updated” date at the top of this page. Puerto Rico law requires that online privacy policies be made available in a clear, conspicuous, and unambiguous manner.
Your continued use of the Site after the posting of changes constitutes acknowledgment of the revised Privacy Policy to the extent permitted by law.
17. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or the Institution's privacy practices, please contact:
951 Ave. Ponce de Leon
San Juan, Puerto Rico 00907
Privacy contact email: info@cmpr.edu
Phone: 787-751-0160
ADA Coordinator / Section 504: Indira Bhajan Ortiz; Counselor and Student Counselor, ibhajan@cmpr.pr.gov 787-751-0160 Ext. 251.
For matters related to FERPA: Waleska Martínez Rivera; Registrar, wmartinez@cmpr.pr.gov. 787-751-0160. Ext. 229.
18. Normative Interpretation
This Privacy Policy is intended as a general statement of the Institution's online privacy practices and does not create contractual rights, except as required by law. If a separate program-specific notice, consent, agreement, or disclosure applies to a specific service, transaction, or category of information, that more specific notice will prevail to the extent of any inconsistencies.
Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes. All of the above categories exclude text message opt-in source data and consent; this information will not be shared with third parties. Message frequency may vary. Message and data rates may apply. To unsubscribe from text messages from the Institution, reply STOP to any message or contact us at the address in Section 17. For assistance, reply HELP. Unsubscribing from text messages does not affect enrollment or other institutional services.
19. Digital Accessibility
The Institution is committed to ensuring that its digital services, including the Site, are accessible to people with disabilities in accordance with Title II of the Americans with Disabilities Act of 1990, Section 504 of the Rehabilitation Act of 1973, and any applicable accessibility requirements in Puerto Rico. The Institution strives to comply with the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, and will take reasonable steps to remedy any accessibility barriers identified upon notification. If you experience difficulty accessing any part of the Site or require content in an alternative format, please contact the ADA/Section 504 Coordinator identified in Section 17 of this Policy.
20. Do Not Track Signals
Some web browsers offer a “Do Not Track” (“DNT”) setting that tells websites you do not want to be tracked. Currently, there is no universally accepted standard for how websites should respond to DNT signals, and the Site does not respond to or respect DNT signals at this time. The Institution will continue to monitor regulatory developments in this area and will update this Privacy Policy if the Institution’s practices change. For information on how to opt out of tracking by third-party analytics providers used on the Site, please refer to those providers’ privacy policies or opt-out mechanisms.
21. Divisibility
If any provision of this Privacy Policy is deemed invalid or unenforceable, the remaining provisions will remain in full force and effect.
Approved on August 1, 2026.
English 
Español