NARA Privacy Act Systems: NARA 37
System name: Order Online! (NARA Online Ordering System)
System location: Order Online! is located in the data center
at the National Archives and Records Administration in College Park, MD.
Categories of Individuals Covered by the System: Individuals covered by this system include researchers who order reproductions of NARA archival materials at www.archives.gov.
Categories of Records in the System: Order Online records may include: user login data (i.e., user ID and password; User Profile Data (e.g., name, address, phone number); credit card payment data (e.g., card type, card number, expiration date); reproduction order form data (e.g., detailed information describing the requested archival record); and transaction data (e.g., system-generated order identification information such as order number, order date, order type).
Authority for Maintenance of the System: 44 U.S.C. 2116(c), 2307 and 3504.
Routine Uses of Records Maintained in the System, Including Categories of Users and the Purposes of Such Uses: Records maintained in the system are used only for order entry, order validation, order processing, payment processing, and order fulfillment. The public may use the Order Online! system to complete and submit a reproduction order to NARA. Each night, Order Online! submissions are sent to NARA's Order Fulfillment and Accounting System (OFAS - NARA 25) via an automated XML (extensible markup language) interface that operates within NARA's secure internal network. Order Online! maintains profile data (e.g., name, address, phone number) for researchers who initiate orders of reproductions. The profile data is used to automatically complete the payment and/or shipping address sections of the order form so that customers do not have to manually re-enter the information. Neither NARA nor its agents use Order Online! customer profile data for other purposes. The routine use statements A, E, and F, described in Appendix A apply to this system of records. Appendix A was published in the Federal Register on April 2, 2002 (67 FR 15592).
Policies and Practices for Storing, Retrieving, Accessing, Retaining, and Disposing of Records in the System: Storage: Electronic records.
Retrievability: Information in the Order Online! records may be retrieved by the NARA customer using his or her user ID and password. Also, summary order data (order number, master number [OFAS order number]), status (e.g., received, processing, shipped, cancelled) and submission date) may be retrieved by the customer or the NARA customer service agent using the order number.
Safeguards: Access to the data center that houses the Order Online! system is restricted to approved systems administrators and, with the exception of a limited number of operations staff, is limited to normal business hours. Electronic records are accessible only on a "need to know basis" using controlled logins and passwords from terminals located in attended offices. Credit card information is compartmentalized so that it is available only to those NARA employees responsible for posting and billing credit card transactions. The National Archives at College Park has 24-hour security guards, controlled entrances, and electronic surveillance.
Retention and Disposal: Order Online! records are temporary records and are destroyed in accordance with the disposition instructions in the NARA records schedule contained in FILES 203, the NARA Files Maintenance and Records Disposition Manual. Individuals may request a copy of the disposition instructions from the NARA Privacy Act Officer.
System Manager(s) and Address: The system manager for Order Online! records is: Assistant Archivist for Records Services - Washington, DC (NW). The address for this location is listed in Appendix B following the NARA notices.
Notification Procedure: Individuals interested in inquiring about their records are to notify the NARA Privacy Act Officer at the address listed in Appendix B following the NARA notices.
Record Access Procedures: Individuals who wish to gain access to their records are to submit their request in writing to the NARA Privacy Act Officer at the address listed in Appendix B.
Contesting Record Procedures: NARA rules for contesting the contents and appealing initial determinations are found in 36 CFR part 1202.
Record Source Categories: Information in Order Online! records is obtained from NARA customers, employees or agents who are involved in the order process, and General Services Administration (GSA) employees who process refunds.