These Supplemental Privacy Provisions for Persons in the European Union (“EU Privacy Provisions”) are provided pursuant to Regulation (EU) 2016/679 (“Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”) (the “GDPR”), effective May 25, 2018.
These EU Privacy Provisions supplement UA’s Privacy Statement, and should be read together with UA’s Privacy Statement. These EU Privacy Provisions are intended to be consistent with the GDPR principles of privacy, fairness, lawfulness, transparency, purpose limitation, accuracy, storage limitation, integrity, and accountability. For more information regarding the GDPR and these principles, please refer to the full text of the GDPR. Terms in these EU Privacy Provisions are used consistent with their definitions in the GDPR.
These EU Privacy Provisions apply to you only if and to the extent that UA is Processing your EU Personal Data (as defined below), where the Processing is related to UA offering goods or services to you in the EU, or UA is monitoring your behavior in the EU (e.g., through online course proctoring, or location tracking).
Personal Data means any information, recorded in any form, relating to you that can identify you, directly or indirectly, such as your name, date of birth, addresses (including email addresses), identification numbers, location data, online identifiers, or factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.
EU Personal Data means Personal Data you submit or disclose to UA (or to a third party that transfers it to UA for Processing) while you are in the European Union (EU).
Processing (and Process) includes collecting, recording, organizing, storing, transferring, sharing, using, disclosing, erasing, or destroying your EU Personal Data, whether or not via UA’s information technologies.
UA may Process your EU Personal Data in accordance with these EU Privacy Provisions, UA’s Information Technology Policies, the UA’s Privacy Statement (along with any relevant Unit Privacy Notices), and as permitted or required by law. If you do not agree with these EU Privacy Provisions, please do not provide any EU Personal Data to UA. If you choose not to provide any EU Personal Data that is necessary for UA to accept you into UA programs or to provide you with specific products or services, UA may not be able to provide those programs, products or services to you.
Collection of Your EU Personal Data. UA collects EU Personal Data from you engage in the following activities from within the EU:
- When you apply for admission to UA
- When you register an online account from UA or update or change information for your account
- When you enroll, register, or participate in UA classes, programs or other offerings, whether online or in person (such as through a study abroad offering), including by using UA’s websites and other information technologies (such as when you turn in assignments and projects online, use online courseware or proctoring services, participate in online discussions and forums, and communicate with UA faculty and staff)
- When you communicate with UA via email, telephone, or other methods
- When you inquire about, apply for, or initiate employment with UA
- When you complete a survey for, submit information to, or request information from, UA
- When you are working for UA
- When you are a dependent of a UA employee or prospective employee
- When, as a student or prospective student, you register for or use student services or amenities provided by UA
- When you purchase products from UA (such as through UA BookStores online shop)
- When you make use of Telemedicine Services
- When you participate in continuing education programs
- When you participate in distance programs or other offerings which make use of video communications
Use of Your EU Personal Data. UA may use your EU Personal Data to: respond to your questions; provide you specific courses, products, programs and/or services you select; provide you services while travelling; satisfy our contractual obligations to you; send you updates and information regarding UA; send you messages about maintenance or updates of UA’s information technologies; and support UA’s alumni relations and fundraising. We may also: use your EU Personal Data for research and analytics purposes; use it for training and quality assurance purposes; use it for future communications with you; use it to establish, exercise, and defend legal claims; use it to comply with our legal obligations; use it for reasons of substantial public interest, including archiving purposes; use it for historical, scientific, research, or statistical purposes, subject to appropriate safeguards; and use it for the legitimate interests of UA or any third party to whom UA discloses your EU Personal Data, if your fundamental rights and freedoms do not override those interests.
Lawfulness of Processing. UA’s Processing of your EU Personal Data for the interdependent purposes set out in these EU Privacy Provisions is necessary for one or more of the following:
- Performing a contract with you, or to take steps at your request prior to contracting with you
- Protecting your vital interests or the interests of another person
- Complying with UA’s legal obligations
- Pursuing UA’s legitimate interests
- Carrying out a task in the public interest
- Exercising UA’s official authority governed by the Arizona Board of Regents as a constitutionally created institution, a body corporate of the sovereign State of Arizona, in the United States of America
In addition to the information provided above, this Section provides additional information regarding how UA Processes your EU Personal Data in specific situations.
Applications for Student Admissions from the EU. This part applies if, while you are in the EU, you apply for admission as a student to UA (including as an exchange or visiting student), whether you intend to attend UA online, remotely, or on campus, and whether you submit your application through UA’s online student application portals, through a third party such as the Common Application, or directly via communications with a UA department, program, or school. UA may use the details you provide on your application, together with any supporting documents you submit, additional details and documents provided by any references or third parties, including education records and financial aid applications and records, and any records made by UA during the application process.
In addition to the uses described in Part B above, we will process the EU Personal Data obtained during your application process for the purposes of identifying you, processing your application, verifying the information provided, deciding whether to offer you admission, and communicating that outcome. We may also use or disclose this information for the following statutory or public interest purposes: to prevent or detect fraud; for disciplinary or academic integrity proceedings; to meet reporting obligations, such as to state or federal Departments of Education; to assist in decisions regarding reasonable accommodations for a disability, as requested by you; and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published without your consent.
We consider the Processing of your EU Personal Data in connection with your student application process to be necessary for us to take steps toward creating a contractual relationship with you (e.g., to assess your application to study with UA), necessary for compliance with a legal obligation, or necessary for the performance of tasks we carry out in the public interest (e.g., admissions research). We require you to provide UA the information we request during the application process to assess your application properly.
As well as circulating your application and related materials to the appropriate people at UA, we may share your EU Personal Data, as relevant and necessary, with your references, with entities that provide services to, or on behalf of, UA, and with governmental organizations. If you are accepted, UA will include in your UA student files the EU Personal Data collected during your application process.
Enrollment and Participation in Programs and Courses while in the EU – Overview. UA offers the opportunity to participate in UA courses and programs while you are in the EU, including while traveling, and online through UA’s information technologies. If you desire to participate in a UA course or program while in the EU, you will be asked to provide certain Personal Data necessary for admission, registration, enrollment, and participation in the course or program. This information may include, among other things, your name, email address, date of birth, and registration information. Enrollment and participation in UA courses and programs and receipt of related services while you are in the EU is a contractual obligation between UA and you, and UA will need your EU Personal Data to deliver these services to you.
In addition to the uses described in Part B above, we use the EU Personal Data we collect from you when you enroll and participate in UA courses or programs while in the EU for Processing purposes, including tracking attendance, progress, and completion of a course or program. We may also share your EU Personal Data and your performance in a course or program with the instructors, teaching assistants, and other individuals designated by UA to assist with the creation, modification, or operation of the courses or programs, and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published without your consent.
Online. If you participate in courses or programs while in the EU on or through UA’s information technologies, we will collect from you certain student-generated content, such as assignments you submit to instructors, peer-graded assignments and peer grading student feedback. We also collect course data, such as student responses to in-video quizzes, stand-alone quizzes, exams, and surveys, online proctoring data and information, and other course-, program-, and degree-related information.
Study or Travel Abroad. UA travel and study abroad programs include academic and other UA programs (such as UA athletic team or official club travel). If you are a UA student participating in a UA travel or study abroad program, UA requires that you sign a GDPR Contract and Consent before departure. This Contract and Consent allows UA to use your Personal Data collected while you are in the EU. UA also needs to be able to Process your Personal Data regarding your coursework as necessary to maintain your educational and degree records consistent with UA policies, legitimate pedagogical purposes, and any applicable laws, rules, regulations, and policies. UA also may Process your EU Personal Data to provide you other services while abroad, including monitoring your safety and compliance with policies.
Disclosure of Student Personal Data. The United States Family Educational Rights and Privacy Act (FERPA), Arizona law, and UA policy provide UA students with the right to limit access to their Personal Data. Due to the GDPR's requirements, if you are participating in UA courses or programs on or through UA’s information technologies while you are in the EU, UA will endeavor to restrict third parties from access to your EU Personal Data that is directory information, as described on UA’s FERPA website. UA may disclose EU Personal Data that is confidential student information with your consent, under subpoena or court order, or to comply with other legal obligations to which UA is subject.
UA Employment in the EU. If you are a UA employee who is working for UA while in the EU, UA will collect, maintain, retain, and protect your personnel records as described in Arizona Board of Regents Policy 6-912 and University of Arizona Policy HR-403 (Access to and Release of Personnel Records and Information). As an employee, portions of your EU Personal Data may be published in the UA Directory and analytics information technologies; if you request in writing to your department management, UA will endeavor to withhold from publication in the UA Directory and analytics information technologies your EU Personal Data. UA may disclose your EU Personal Data as described in these policies, which includes disclosure with your consent, for employment verification when requested, under subpoena or court order, or to comply with other legal obligations to which UA is subject.
Employment with UA while you are in the EU is an obligation based on a contractual relationship between UA and you, and UA’s duties as your employer are subject to Arizona laws, and UA and Arizona Board of Regents Policies. UA will need your Personal Data to comply with applicable laws, rules, regulations.