Skip to main content

U of A's Supplemental EU Privacy Provisions

Applicability

These Supplemental Privacy Provisions for Persons in the European Union (“EU Privacy Provisions”) are provided pursuant to Regulation (EU) 2016/679 (“Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”) (the “GDPR”), effective May 25, 2018. 

These EU Privacy Provisions supplement University of Arizona (U of A)’s Privacy Statement and should be read together with the U of A’s Privacy Statement. These EU Privacy Provisions are intended to be consistent with the GDPR principles of privacy, fairness, lawfulness, transparency, purpose limitation, accuracy, storage limitation, integrity, and accountability. For more information regarding the GDPR and these principles, please refer to the full text of the GDPR. Terms in these EU Privacy Provisions are used consistently with their definitions in the GDPR. 

These EU Privacy Provisions apply to you only if and to the extent that the U of A is Processing your EU Personal Data (as defined below), where the Processing is related to the U of A offering goods or services to you in the EU, or the U of A is monitoring your behavior in the EU (e.g., through online course proctoring, or location tracking). 

Definitions:

Personal Data means any information, recorded in any form, relating to you that can identify you, directly or indirectly, such as your name, date of birth, addresses (including email addresses), identification numbers, location data, online identifiers, or factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity. 

EU Personal Data means Personal Data you submit or disclose to the U of A (or to a third party that transfers it to the U of A for Processing) while you are in the European Union (EU). 

Processing (and Process) includes collecting, recording, organizing, storing, transferring, sharing, using, disclosing, erasing, or destroying your EU Personal Data, whether or not via the U of A’s information technologies. 

The U of A may Process your EU Personal Data in accordance with these EU Privacy Provisions, U of A’s Information Technology Policies, the U of A’s Privacy Statement (along with any relevant Unit Privacy Notices), and as permitted or required by law. If you do not agree with these EU Privacy Provisions, please do not provide any EU Personal Data to the U of A. If you choose not to provide any EU Personal Data that is necessary for the U of A to accept you into the U of A programs or to provide you with specific products or services, the U of A may not be able to provide those programs, products, or services to you. 

Collection of Your EU Personal Data

The U of A collects EU Personal Data when you engage in the following activities from within the EU: 

  • When you apply for admission to the U of A. 

  • When you register an online account from the U of A or update or change information for your account. 

  • When you enroll, register, or participate in U of A classes, programs or other offerings, whether online or in person (such as through a study abroad offering), including by using the U of A’s websites and other information technologies.  

  • When you communicate with the U of A via email, telephone, or other methods. 

  • When you inquire about, apply for, or initiate employment with the U of A. 

  • When you complete a survey for, submit information to, or request information from the U of A. 

  • When you are working for the U of A. 

  • When you are a dependent of a U of A employee or prospective employee. 

  • When, as a student or prospective student, you register for or use student services or amenities provided by the U of A. 

  • When you purchase products from the U of A (such as through the U of A Campus Store's online shop). 

  • When you make use of Telemedicine Services. 

  • When you participate in continuing education programs. 

  • When you participate in distance programs or other offerings which make use of video communications. 

Use of Your EU Personal Data 

The U of A may use your EU Personal Data to: respond to your questions; provide you specific courses, products, programs and/or services you select; provide you services while travelling; satisfy our contractual obligations to you; send you updates and information regarding the U of A; send you messages about maintenance or updates of the U of A’s information technologies; and support the U of A’s alumni relations and fundraising.  

We may also use your EU Personal Data for: research and analytics purposes; training and quality assurance purposes; future communications with you; establishing, exercising, and defending legal claims; compliance with our legal obligations; reasons of substantial public interest, including archiving purposes; historical, scientific, research, or statistical purposes, subject to appropriate safeguards; and the legitimate interests of the U of A or any third party to whom the U of A discloses your EU Personal Data, if your fundamental rights and freedoms do not override those interests. 

Lawfulness of Processing 

The U of A’s Processing of your EU Personal Data for the interdependent purposes set out in these EU Privacy Provisions is necessary for one or more of the following: 

  • Performing a contract with you, or to take steps at your request prior to contracting with you. 

  • Protecting your vital interests or the interests of another person. 

  • Complying with the U of A’s legal obligations. 

  • Pursuing the U of A’s legitimate interests. 

  • Carrying out a task in the public interest. 

  • Exercising the U of A’s official authority governed by the Arizona Board of Regents as a constitutionally created institution, a body corporate of the sovereign State of Arizona, in the United States of America. 

In addition to the information provided above, this Section provides additional information regarding how the U of A Processes your EU Personal Data in specific situations. 

Applications for Student Admissions from the EU 

This part applies if, while you are in the EU, you apply for admission as a student to the U of A (including as an exchange or visiting student), whether you intend to attend the U of A online or on campus, and whether you submit your application through the U of A’s online student application portals, through a third party such as the Common Application, or directly via communications with a the U of A department, program, or school.  

The U of A may use the details you provide on your application, together with any supporting documents you submit, additional details and documents provided by any references or third parties, including education records and financial aid applications and records, and any records made by the U of A during the application process. 

In addition to the uses described above, we will process the EU Personal Data obtained during your application process for the purpose of identifying you, processing your application, verifying the information provided, deciding whether to offer you admission, and communicating that outcome. We may also use or disclose this information for the following statutory or public interest purposes: to prevent or detect fraud; for disciplinary or academic integrity proceedings; to meet reporting obligations, such as to state or federal Departments of Education; to assist in decisions regarding reasonable accommodations for a disability, as requested by you; and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published without your consent. 

We consider the Processing of your EU Personal Data in connection with your student application process to be necessary for us to take steps toward creating a contractual relationship with you (e.g., to assess your application to study with the U of A), necessary for compliance with a legal obligation, or necessary for the performance of tasks we carry out in the public interest (e.g., admissions research). We require you to provide the U of A the information we request during the application process to assess your application properly. 

As well as circulating your application and related materials to the appropriate people at the U of A, we may share your EU Personal Data, as relevant and necessary, with your references, with entities that provide services to, or on behalf of, the U of A, and with governmental organizations. If you are accepted, the U of A will include in your the U of A student files the EU Personal Data collected during your application process. 

Enrollment and Participation in Programs and Courses while in the EU 

The U of A offers the opportunity to participate in U of A courses and programs while you are in the EU, including while traveling, and online through the U of A’s information technologies. If you desire to participate in a U of A course or program while in the EU, you will be asked to provide certain Personal Data necessary for admission, registration, enrollment, and participation in the course or program. Enrollment and participation in U of A courses and programs and receipt of related services while you are in the EU is a contractual obligation between the U of A and you, and the U of A will need your EU Personal Data to deliver these services to you. 

In addition to the uses described above, we use the EU Personal Data we collect from you when you enroll and participate in U of A courses or programs while in the EU for Processing purposes, including tracking attendance, progress, and completion of a course or program. We may also share your EU Personal Data and your performance in a course or program with the instructors, teaching assistants, and other individuals designated by the U of A to assist with the creation, modification, or operation of the courses or programs, and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published without your consent. 

Online. If you participate in courses or programs while in the EU on or through the U of A’s information technologies, we will collect from you certain student-generated content, such as assignments you submit to instructors, peer-graded assignments and peer grading student feedback. We also collect course data, such as student responses to in-video quizzes, stand-alone quizzes, exams, surveys, online proctoring data and information, and other course-, program-, and degree-related information. 

Study or Travel Abroad. The U of A travel and study abroad programs include academic and other U of A programs (such as U of A athletic team or official club travel). If you are a U of A student participating in a U of A travel or study abroad program, the U of A requires that you sign a GDPR Contract and Consent before departure. This Contract and Consent allow the U of A to use your Personal Data collected while you are in the EU. The U of A also needs to be able to Process your Personal Data regarding your coursework as necessary to maintain your educational and degree records consistent with U of A policies, legitimate pedagogical purposes, and any applicable laws, rules, regulations, and policies.  The U of A may also Process your EU Personal Data to provide you other services while abroad, including monitoring your safety and compliance with policies. 

Disclosure of Student Personal Data 

The United States Family Educational Rights and Privacy Act (FERPA), Arizona law, and U of A policy provide U of A students with the right to limit access to their Personal Data. Due to the GDPR's requirements, if you are participating in U of A courses or programs on or through the U of A’s information technologies while you are in the EU, the U of A will endeavor to restrict third parties from access to your EU Personal Data that is directory information, as described on U of A’s FERPA website. The U of A may disclose EU Personal Data that is confidential student information with your consent, under subpoena or court order, or to comply with other legal obligations to which the U of A is subject. 

UA Employment in the EU 

If you are a U of A employee who is working for the U of A while in the EU, the U of A will collect, maintain, retain, and protect your personnel records as described in Arizona Board of Regents Policy 6-912 and University of Arizona Policy HR-403 (Access to and Release of Personnel Records and Information). As an employee, portions of your EU Personal Data may be published in the U of A directory and analytics information technologies; if you request in writing to your department management, the U of A will endeavor to withhold publication in the U of A directory and analytics information technologies your EU Personal Data. The U of A may disclose your EU Personal Data as described in these policies, which includes disclosure with your consent, for employment verification when requested, under subpoena or court order, or to comply with other legal obligations to which the U of A is subject. 

Employment with the U of A while you are in the EU is an obligation based on a contractual relationship between the U of A and you, and the U of A’s duties as your employer are subject to Arizona laws, and U of A and Arizona Board of Regents Policies. The U of A will need your Personal Data to comply with applicable laws, rules, and regulations. 

The U of A may permanently store and maintain, among other things, your name, subject(s), enrollment, registration and graduation details, unique U of A identification number, date of birth, verification, residency, affidavits, financial aid, grades, classes, courses, transcripts, disciplinary, and degree and employment related records containing your EU Personal Data:  

  • to comply with the U of A's obligations to you, including taking steps to enter into an employment, enrollment, or other contract with you. 

  • to comply with the U of A's legal obligations 

  • for reasons that are in the public interest 

  • to comply with the U of A's records retention policies 

  • the exercise of the U of A’s authority as an Arizona University governed by the Arizona Board of Regents.  

     

If you exercise your right to erase your EU Personal Data, we will continue to maintain a core set of your EU Personal Data, to ensure we do not contact you inadvertently in the future, to maintain your academic record for reference and archival purposes, and to meet our legal obligations. 

You have certain rights regarding your EU Personal Data, subject to certain exclusions as described in the GDPR. Your rights include:

  • The right to be informed of how your EU Personal Data are being used – this information is set forth in these EU Privacy Provisions and any documents linked to these EU Privacy Provisions
  • The right of access to your EU Personal Data
  • The right to have your inaccurate EU Personal Data rectified
  • The right to have your EU Personal Data erased
  • The right to restrict the Processing of your EU Personal Data pending its verification or correction
  • The right to object to the Processing of your EU Personal Data
  • The right to receive copies of your EU Personal Data
  • The right to file a complaint with an EU supervisory authority
  • The right to object to using your EU Personal Data for direct marketing, data mining, or research purposes where the research is not in the public interest

However, nearly all your rights are qualified in various ways and there are numerous specific exemptions (for example, almost all of the rights do not apply if your EU Personal Data are being processed solely in an academic research context).

If you have questions about your rights or would like to exercise your data subject rights, you can contact University Privacy at privacy@arizona.edu.

We will review this EU Supplemental Privacy Statement regularly and publish changes on our website.

This Privacy Statement was most recently updated on October 31, 2025.