International Privacy Notice

International Privacy Notice

1. DEFINITIONS USED IN THIS NOTICE

1. Personal data: Any information relating to an identified or identifiable individual. Some privacy laws call it personal information.
2. Process/processing: Any operation or set of operations performed on personal data, for example collecting, organizing, consulting, storing, and sharing.
3. Data subject: The individual whom the data relates to. Some privacy laws use a different term, for example individual or natural person.
4. GDPR: The European Union’s General Data Protection Regulation.
5. PIPL: China’s Personal Information Protection Law *
6. Controller: The entity that determines the “purposes and means” of the processing, in effect that is in charge of it. Some privacy laws use a different term for the same concept, for example PIPL uses “personal information processor”.
7. Processor: An entity that processes personal data on behalf of a controller.

* Under PIPL: Personal data = 个人信息, data subject = 自然人, controller = 个人信息处理者方, processor = 受托人

2. SCOPE OF THIS NOTICE

This Privacy Notice (“Notice”) describes how Union College (“Union”, “we”, “us”, “our”) processes personal data collected from or about data subjects located outside of the United States. This Notice meets the requirements of applicable international privacy laws (notably the GDPR and China’s PIPL) for personal data controllers to provide certain information to data subjects concerning the processing of their data.

In this Notice, “you” refers to anyone located outside of the United States about whom we process personal data. You will usually be a prospective student, an applicant to study at Union, or an applicant’s parent. You may also be a Union alum or, less commonly, an applicant for a position at Union.

IMPORTANT NOTE: This Notice does not cover the processing of your personal data when you are located in the United States, regardless of your citizenship. For example, if you are an international student at Union, this Notice does not apply to most processing related to your stay on campus.

This Notice applies to personal data collected via our website (www.union.edu); mobile app; their associated sites, platforms, and media (for example, our applicant portal); and in the course of any offline contact with you.

Union College is the controller in relation to the processing.

3. CHANGES TO THIS NOTICE

We may update this Notice from time to time and will communicate material changes to you through an appropriate channel (for example, via an email to you). The Notice was last updated on May 2, 2023.

4. PERSONAL DATA WE COLLECT

We nearly always collect your personal data directly from you. In other words, you submit it to us and you know what it consists of. This data might include, for example, your name, contact details, interests, and the personal data contained in your application.

Please note that the personal data you submit to us may contain “special categories of personal data”, also known as “sensitive personal information”. This could include, for example, your ethnicity, gender identity, and financial data. We never request sensitive data from you that is not necessary for us to process your, or your student’s, application. When required by law, we will obtain your explicit consent to process your sensitive data for this purpose, or other purposes we may specify.

Personal data that you submit to us may relate to a minor, for example in connection with early admission to Union. When required by law, we will obtain consent to process that data from the holder(s) of parental responsibility over the minor.

Are you obligated to provide personal data? As described above, we may ask you to submit certain personal data so that we can process your application to study at Union or for employment. This data is necessary if we are to enter into a contract with you, and its collection may also be a legal requirement for Union. If you do not provide the personal data we request, we will be unable to proceed with your application.

We also collect personal data about you indirectly when:

• Other individuals or organizations provide us with information required for your application, for example your high school may provide your transcript and standardized test scores, and financial information provided by your parents may also relate to you.
• We receive information about you as a prospective student from organizations that help to connect students to colleges.
• We observe your activity on our website using cookies and other standard online technologies. Cookies enable us to recognize your device. We use them to collect information about your device and how you use our site; for example, which pages you visit and how long you stay on them. Cookies also facilitate, for example, logging into and navigating parts of our website.

5. HOW WE USE YOUR PERSONAL DATA

Union College uses your personal data for the following purposes:

• To respond to your requests or inquiries, for example if you email a question to our Admissions Office.
• To process your, or your student’s, application to study at Union and, if admitted, to prepare for their student life. This processing includes managing student financial accounts, for example by issuing invoices, processing payments, and administering financial assistance programs.
• To process your application for a position at Union.
• To maintain contact with you as an alum and/or donor, for example by sending you magazines, newsletters, and other communications; and to seek donations from you, such as during our “phonathons”.
• To understand how our website is being used, and by whom.
• To send you engagement or marketing communications, which may be based on interests that you have shared or made known to us (see Section 10 for information about opting out of such messages).

Union does not use “automated individual decision-making” tools. In other words, we do not make decisions affecting you (for example, concerning your application) based solely on automated means or algorithms.

Lawfulness of processing:

GDPR requires that we provide EU individuals with our legal bases for processing their personal data. A similar requirement applies in some other jurisdictions, for example China and the United Kingdom. Our legal basis depends on the purpose of processing:

6. DISCLOSURE OF YOUR PERSONAL DATA

Who we disclose your personal data to depends on the types of data and the purposes we use them for. Your personal data may be disclosed to the following categories of recipients:

• Faculty, staff, and contractors of Union: These personnel have roles that require access to your data (a “need to know”). They are bound by employment or engagement terms that cover their obligation to keep personal data confidential and secure.
• Federal and state departments and agencies: We will share your data with US federal and state departments and agencies as required by them, for example with the US Department of Education and the New York State Board of Education.
• Service providers (“processors”): We use service providers to perform certain tasks for us, for example, to host student data in Cloud applications or to perform website analytics. Service providers process your data on our behalf and according to our instructions. They are contractually bound to protect your data and are prohibited from using it for their own purposes.
• Third parties who may (i) underwrite, administer, or provide services related to the Union’s health insurance, benefits, and pension and retirement programs, or (ii) assist in originating, monitoring, and collecting student loans, scholarships, and other financial aid programs.

We will also disclose your personal data in the following exceptional circumstances:

• Legal necessity: We will disclose your data to government agencies, law enforcement, courts, and other authorities and parties if required to by applicable law.
• Individual’s vital interests: If we reasonably believe based on information we collect that the safety or vital interests of an individual are at risk, we will disclose personal data to relevant parties as necessary to assist the individual.

7. INFORMATION SECURITY

We employ technical, physical, and administrative security measures appropriate to the categories of personal information we process. Union classifies all sensitive (“special categories of”) personal data as high-risk and implements security controls appropriate to that classification.

No matter how carefully we safeguard your data, it is unfortunately not possible to guarantee that it will never be accidentally or illegally breached.

8. DATA RETENTION

We will retain your personal data as long as necessary to fulfill the purposes for which it was collected, and to satisfy Union’s legal, accounting, and reporting obligations. Personal data is deleted according to our record and data retention policies.

Section 10 of this Notice below describes your right to request deletion of your data outside of our normal retention schedule.

9. INTERNATIONAL TRANSFER

Your personal data is processed and stored by Union on our systems in the United States. US privacy laws may be different from those of your own country. If you reside in the EU, European Economic Area, or UK, note that the EU and UK authorities do not consider the US to offer an adequate level of personal data protection. However, as set out in this Notice, Union strives to protect your data and your rights regardless of any international transfer.

10. YOUR PRIVACY RIGHTS

International laws give you various rights, subject to certain conditions and limitations, over your personal data. These may include the right to:

• Access personal data held about you
• Correct inaccurate or out-of-date personal data
• Request deletion of your personal data
• Restrict processing of your personal data
• Data portability: Receive your personal data in a readily useable format
• Object to processing for which the legal basis is our legitimate interests

Requests to exercise privacy rights should be addressed to us using the contact information in Section 11 below.

If you believe that we have infringed your privacy rights, please contact us so that we can try to resolve the issue. However, if you are an EU/EEA/UK resident, you have the right to lodge a complaint with your EU/EEA local supervisory authority or, in the UK, with the ICO.

Marketing:

You can opt out of our engagement and marketing communications at any time using, for example, the “unsubscribe” in an email message.

11. CONTACT US

Ellen Yu
Chief Information Officer
Information Technology Services | Union College
807 Union Street
Schenectady, New York 12308, USA
yue@union.edu