Firstmark Services Privacy Center
Last Updated: October 15, 2025
1. About This Privacy Policy
Nelnet Servicing, LLC dba Firstmark Services (“Firstmark Services”, “we”, “our”, and “us”) respects your concerns about privacy. This Privacy Policy describes the types of personal information we obtain via our websites and online services that link to this Privacy Policy (collectively the “Services”), how we use the information, with whom we share it, and the choices available regarding our use of the information. This Privacy Policy also describes the measures we take to safeguard personal information and how you can contact us about our privacy practices.
Other divisions, affiliates, and subsidiaries of Nelnet, Inc. list their privacy practices on their respective websites.
This Privacy Policy also includes information specific to certain categories of users (for example, residents of California).
Please read this Privacy Policy carefully to understand our policies and practices regarding the information we collected and how we use it.
2. Information We Obtain
The types of personal information we may collect include:
- Contact information, such as name, email and postal address, and phone number.
- User credentials, such as username and password.
- Account information and preferences, such as email preferences and paperless registration.
- Payment data, such as bank account number and routing number, payment card information, including card number and expiration date.
- Identifiers, such as Social Security number or other government-issued identifier.
- Demographic information, such as date of birth; and other characteristics such as gender or marital status.
- Device data and online activity information, as described in the Automated Information Collection section below.
- Documents and uploaded content, including any materials you submit to us, such as letters, forms, notices, or supporting documents related to your account.
- Employment and education information, including résumé or job application details, education history, and related background information if you apply for a position with us or interact with our services in a professional capacity.
- Sensory and communication data, such as audio recordings (e.g., customer service calls), chat transcripts, emails, or other content you provide through our services.
- Information provided by third parties, such as personal information about you from third-party data providers or publicly available sources for anti-money laundering, for background check or similar screening purposes, to protect our business and to comply with legal and regulatory obligations.
Information You Provide Directly to Us
Personal information that you provide directly to us will be apparent from the context in which you provide it. For example:
- Filling out forms: If you fill out a form on the Site, you may provide your name, contact details (postal address, email address and telephone number) and other information requested by the form, such as the reason for your inquiry.
- Signing up for communication: If you sign up to receive electronic marketing communications from us, you may be asked to provide your name, email address and other contact information.
- Logging in to accounts: When you log into an account, while we obtain your login credentials, your information may be otherwise collected by the third party that operates the account portal and may be subject to that third party’s own privacy policies, if made available. Once you log in, additional information about you will be included in the portal, such as your name, work email address, phone number, time zone, and postal address, if applicable.
- Signing up for service features: If you sign up to a feature in connection with one of our Services, you may be asked to provide your name, contact information, and other information necessary to access the feature.
Each form in connection with our Services varies in the information required and collected. In most cases, an asterisk (*) indicates the required information on a form. You may choose to provide additional information within fields that are not required.
In addition, you may choose to submit personal information to us if you attend an event that we or one of our affiliates or partners has organized or if you otherwise communicate with us on social media or by sending us an email.
While the personal information you choose to provide is voluntary, providing certain personal information may be necessary to offer you the relevant product or service. If you choose not to provide certain information, this may affect our ability to provide you with certain products or services.
Automated Information Collection
In addition, when you interact with the Services, or open or view our emails, we may obtain certain information using various automated technologies, such as cookies, web server logs, web beacons, and other technologies (collectively, “Cookies”). The types of Cookies used on our Services may include:
- Browser Cookies: these are small text files unique to your device. They can either be session-based (in other words, lasting while your browser is open) or persistent (in other words, lasting until you delete them or they expire).
- Local Stored Objects: these are stored on your device or browser to provide the Services.
- Web Beacons: also known as an Internet tag, pixel tag or clear GIF, these are small pieces of code placed on a website or within the body of an email for the purpose of tracking activity on websites, or when emails are opened or accessed, and are often used in combination with Cookies.
- Software Development Kits: these are bits of computer code used by app developers to enable or enhance various features of an app. For example, an app developer may include an SDK within an app that enables advertisements to be shown, data to be collected, and related services or analytics to be performed in connection with the app.
- Session Replay Software: These are third-party services that can record users’ interactions, such as users’ clicks, cursor movements, and page scrolls.
We may use these technologies to collect information about your equipment, browsing actions, and usage patterns. The information we obtain in this manner may include your IP address, identifiers associated with your devices, web browser characteristics, device characteristics, language preferences, referring/exit pages, clickstream data and dates and times of visits to the Services. These technologies help us:
- Remember your information so you will not have to re-enter it;
- Understand how you use and interact with the Services and with our electronic communications with you such as our emails;
- Tailor the Services around your preferences;
- Measure the usability of the Services and the effectiveness of our communications; and
- Otherwise manage and enhance the Services and our other services, and help ensure they are working properly.
Your browser may tell you how to be notified when you receive certain types of Cookies or how to restrict or disable certain types of Cookies. Please note, however, that certain features of the Services may not work without use of Cookies.
Depending on where you are located and the type of Services you are engaging with, we use a consent management platform for you to manage your preferences for web-based Cookies.
Once you log in or create an account with us, you may be asked to acknowledge this Privacy including our use of Cookies and similar technologies. From that point on, your preferences are based on that acknowledgment, and the consent management tool is no longer used.
Other Online Services and Third-Party Features
For your convenience and information, the Services may contain links to, or integrations with, other websites, platforms, or services that include third-party features such as apps, tools, widgets and plug-ins.
However, these online services and third-party features operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy policies of these parties, which we strongly suggest that you review. To the extent any linked online services or third-party features are not owned or controlled by us we are not responsible for these third parties’ information practices
3. How We Use Information
Legitimate Business Purposes
We may use the information we gather for the following legitimate business purposes:
- Provide and manage our services, including establishing and servicing accounts, processing transactions, and managing our business relationships.
- Authenticate identity and authorize access to our platforms and services.
- Communicate with you, including responding to inquiries, providing support, sending service-related messages, and offering promotions or other marketing communications.
- Personalize your experience, such as tailoring content, offers, and interactions to your preferences, and measuring the effectiveness of our marketing efforts.
- Operate and improve our business and services, including developing new products, analyzing usage trends, evaluating the performance of communications and campaigns, and conducting accounting, auditing, and other internal operations.
- Perform data analytics and research, including market and financial analysis, customer insights, and the deidentification, anonymization or aggregation of personal information.
- Enhance security and prevent misuse, such as protecting our services, users, and systems from fraud, abuse, unauthorized access, and other harmful activity.
- Diagnose and address technical issues, support information technology (IT) operations, and ensure system reliability and continuity.
- Maintain business records and conduct internal administrative functions.
- Comply with legal and regulatory obligations, enforce our policies and terms, and respond to law enforcement or regulatory inquiries.
For these processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data.
When we deidentify, aggregate, or anonymize data for purposes such as analytics, research, product development, and to improve our services, we endeavor to maintain and use the data in a deidentified, anonymized, or aggregated form such that it cannot reasonably be used to reidentify individuals, except as permitted by applicable law.
Third-Party Analytics
We may use third-party analytics services in connection with our Services, such as:
- Google Analytics
- Pendo
- Surfly
The service providers that administer these services use automated technologies such as Cookies to help us analyze your use of the Services. For more information, see our Automated Information Collection section above. The information we obtain through our Services may be disclosed to or collected directly by these service providers. To learn more about these service providers, please consult their respective privacy policies. For example, we use Google Analytics for this purpose. You can learn more about Google Analytics and how to prevent the use of Google Analytics relating to your use of the Site by visiting Google Analytics opt-out.
The Services otherwise are not designed to respond to “do not track” signals received from browsers.
Third-Party CAPTCHA Services
We may use third-party CAPTCHA services in connection with the Services, such as Google reCAPTCHA. The information we obtain through the CAPTCHA services may be disclosed to or collected directly by these services. To learn more about Google reCAPTCHA, please visit Google’s Privacy Policy and Terms of Use.
4. How We Disclose Information
We may disclose the information we obtain about you with affiliates and subsidiaries. We also disclose personal information with affiliated and non-affiliated third-party vendors to perform certain services on our behalf, such as website hosting, data analytics, payment processing, sending communications (e.g., via email), and other services.
In addition, sometimes the law or other circumstances require that we disclose information about you. Some examples include the following:
- If we are required to do so by law or legal process (such as a court order or subpoena);
- In response to requests by government agencies, such as law enforcement authorities;
- To establish, exercise or defend our legal rights;
- To protect, defend or enforce our policies, terms, or agreements;
- When we believe disclosure is necessary or appropriate to address security or to prevent physical or other harm or financial loss;
- In connection with an investigation of suspected or actual illegal activity; or
- Otherwise with your consent.
We also reserve the right to transfer information we have about you in the event we sell or transfer all or a portion of our business or assets (such as in the event of a merger, acquisition, joint venture, consolidation, restructuring, divestiture, dissolution liquidation, or other corporate change), including during any due diligence process.
5. Your Rights and Choices
You may have certain rights and choices regarding how we collect, use, disclose and otherwise process your personal information.
- Financial Information Sharing. If you have a loan owned by Nelnet, you may have certain rights regarding the sharing of customer information with affiliates and nonaffiliated third parties. For more information, see the Additional Jurisdiction-Specific Information section.
- Access, Correction, Deletion, and Other Rights. Depending on where you reside, you may have the right to request access to, or correction or deletion of, your personal information. For more information, see the Additional Jurisdiction-Specific Information section.
- Other Choices. You can edit or remove certain information in your user account with our relevant Services.
6. How We Protect Personal Information
We maintain administrative, technical safeguards designed to protect the personal information we obtain against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.
7. Children’s Privacy
We recognize the importance of protecting children’s online privacy. The Services are intended for a general audience and is not directed to children. We do not knowingly collect personal information online from children under the age of 13.
8. Retention of Personal Information
To the extent required by applicable law, we keep the personal information for the period reasonably necessary to achieve the purposes described in our Privacy Policy, plus a reasonable period to comply with the applicable statute of limitations or if otherwise required under applicable law, unless a shorter retention period is required by applicable law.
9. Additional Jurisdiction-Specific Information
- If you have a loan owned by affiliated subsidiaries of Nelnet, Inc. (“Nelnet-owned loans”) that is serviced by Nelnet Servicing, LLC, we will use and share any information that we collect from or about you in accordance with the U.S. Consumer Privacy Notice, which offers you certain choices with respect to the use and sharing of your personal information.
- If you are a California resident, please refer to our California Consumer Privacy Notice.
10. Changes To This Privacy Policy
We may update this Privacy Policy from time to time and without prior notice to you to reflect changes in our privacy practices. We will indicate at the top of the notice when it was most recently updated. The Privacy Policy is effective as of the date listed above and applies to our services that link to this Privacy Policy. These changes or modifications supersede any prior versions of this Privacy Policy.
11. How To Contact Us
If you have any questions about this Privacy Policy, please contact us by email at AskPrivacy@nelnet.net.
U.S. Consumer Privacy Notice for Nelnet Customers
The notices referenced in this section affect only loans that we service and that are owned by affiliated subsidiaries of Nelnet Inc. (“Nelnet-owned loans”) and by Nelnet Bank.
If you have a Nelnet-owned loan please see this U.S. Consumer Privacy Notice which details the privacy practices with affiliates and other third parties, and will help you understand how information is shared and the choices you have regarding your information. For your Nelnet-owned loans, please complete the online Privacy Options Form to opt out of sharing certain information with affiliates or nonaffiliated third parties.
If you have a loan owned by Nelnet Bank, Inc. (“Nelnet Bank”) please see Nelnet Bank’s U.S Consumer Privacy Notice, which offers you certain choices with respect to the use and sharing of your personal information. For your Nelnet Bank loans, please complete the online Privacy Options Form or call 800.446.4190 to opt out of sharing certain information with affiliates or nonaffiliated third parties.
U.S. Consumer Privacy Notice for non-Nelnet Customers
Your lender’s privacy policy describes the treatment of personal information related to your loan(s). Please refer to your lender’s privacy policy for additional information. You can contact us by email or regular mail at the following address to request a copy:
Firstmark Services
P.O. Box 82522
Lincoln, NE 68501-2522
California Privacy Notice
Last Updated: October 16, 2025
This California Privacy Notice supplements the Web Privacy Policy (“Privacy Policy”) and applies solely to personal information collected about California consumers, such as visitors to the publicly-accessible areas of our websites, business partners and job applicants. This California Privacy Notice does not apply to personal information collected about personnel.
This California Privacy Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA”).
This California Privacy Notice does not apply to information we collect, process or disclose pursuant to the Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act. If you have an account that we service, please see the applicable U.S. Consumer Privacy Notice section, which offers you certain choices with respect to the use and sharing of your personal information.
Accountholders:
- If you have a loan owned by affiliated subsidiaries of Nelnet Inc. (“Nelnet-owned loans”) which we service, this California Privacy Notice does not apply to you. We use and share any information that we collect from or about you in accordance with the U.S. Consumer Privacy Notice, which offers you certain choices with respect to the use and sharing of your personal information.
- If you have a loan owned by Nelnet Bank, Inc. (“Nelnet Bank”) which we service, please see Nelnet Bank’s U.S Consumer Privacy Notice , which offers you certain choices with respect to the use and sharing of your personal information.
Non-Accountholders:
If you do not have an account serviced by us, and if we do not otherwise have contact information on file about you, then there is no reasonable method by which we can verify your identity to the level of certainty required by the CCPA. The reason for this is that we do not link information we may collect about non-accountholders (e.g., IP addresses, device identifiers or other information collected through automated means) to named actual persons. Accordingly, if you do not have an account with us and if we do not otherwise have contact information on file about you, and you request access to, correction of, or deletion of your personal information, we will not be able to process your request at this time.
Notice of Collection and Use of Personal Information
We may collect (and may have collected during the 12-month period prior to the Last Updated date of this California Privacy Notice) the following categories of personal information about you:
- Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers, and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, IP address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers
- Additional Data Subject to Cal. Civ. Code § 1798.80: signature, description, state identification card number, bank account number, credit card number, debit card number, or other financial information, education information, medical information and health insurance information
- Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, marital status, medical condition, disability, citizenship status, and military and veteran status
- Online Activity: Internet and other electronic network activity information, including, but not limited to, information regarding your interaction with our websites, or applications
- Sensory Information: audio, electronic, visual, and similar information
- Employment Information: professional or employment-related information such as résumé information, occupation details, education details, certifications and professional associations, historical compensation details, previous employment details, emergency contact information, and pre-employment screening and background check information, including criminal records information
- Education Information: education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99)
- Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, behavior, attitudes, intelligence, abilities, and aptitudes
We may use (and may have used during the 12-month period prior to the Last Updated date of this California Privacy Notice) your personal information for the purposes described in the Privacy Policy and for the following business purposes:
- Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services;
- Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
- Helping to ensure security and integrity;
- Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them;
- Debugging to identify and repair errors;
- Undertaking internal research for technological development and demonstration;
- Managing career opportunities with us; and
- Managing our relationships with current or prospective partners, corporate customers and vendors and other business partner personnel.
We do not collect or process sensitive personal information for purposes of inferring characteristics about consumers.
To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
Retention of Personal Information
We will retain your personal information for the time period reasonably necessary to achieve the purposes described in the Privacy Policy and this California Privacy Notice, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.
Sources of Personal Information
During the 12-month period prior to the Last Updated date of this California Privacy Notice, we may have obtained personal information about you from the following categories of sources:
- Directly from you, such as when you contact us
- Your devices, such as when you use our online services
- Our affiliates
- Vendors who provide services on our behalf
- Our business partners
- Data analytics providers
- Recruiting and talent agencies
- Job references, such as your employers
- Data brokers, such as background check services
Sale or Sharing of Personal Information
We do not sell your personal information in exchange for monetary compensation. We do not share your personal information with third parties (such as online advertising services) for cross-context behavioral advertising purposes.
Disclosure of Personal Information
During the 12-month period prior to the Last Updated date of this California Privacy Notice, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:
| Category of Personal Information | Categories of Third Parties |
|---|---|
| Identifiers |
|
| Additional Data Subject to Cal. Civ. Code § 1798.80 |
|
| Protected Classifications |
|
| Online Activity |
|
| Sensory Information |
|
| Employment Information |
|
| Education Information |
|
| Inferences |
|
In addition to the categories of third parties identified above, during the 12-month period prior to the Last Updated date of this California Privacy Notice, we may have disclosed personal information about you to government entities and third parties in connection with actual or proposed corporate transactions, such as mergers, acquisitions, or divestitures.
California Consumer Privacy Rights
You have certain choices regarding your personal information, as described below.
- Access: You have the right to request, twice in a 12-month period, that we disclose to you the categories of personal information collected about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information collected about you.
- Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
- Deletion: You have the right to request that we delete certain personal information we have collected from you.
How to Submit a Request
To submit an access, correction, or deletion request, please call 833.531.2511 or go to our Privacy Request Portal and follow the instructions provided. To submit a request as an authorized agent on behalf of someone else, please go to our Privacy Request Portal and follow the instructions provided. For questions or concerns about our privacy policies and practices, please contact us at AskPrivacy@nelnet.net.
Verifying Requests
To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your deletion or correction request. If you have an account with us, we may verify your identity by requiring you to sign in to your account. If you do not have an account with us and you request access to, correction of or deletion of your personal information, we may require you to verify your email address or phone number in our records and/or provide any of the following information:
- Full name & surname
- State of residence
- Physical address
- Telephone number
- Nature of your relationship with our company (Website visitor/Job Applicant/Employee/Former Employee/Contractor/Business Partner Personnel)
- Email address
In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
Additional Information
If you choose to exercise any of your rights under the CCPA, you have the right not to receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.