GDPR Notice for University Students

The European Union’s General Data Protection Regulation (“GDPR”) and other countries’ privacy laws provide certain rights for data subjects concerning the use of personal information.

This page provides a summary concerning the use of personal information you provide to the University of Massachusetts (“University”) while you are in the European Union (“EU”) in connection with your enrollment at the University.

What is ‘personal information’?

Personal information’ means any information which relates to or identifies you as an individual.

How does this webpage relate to other information about data protection?

When you applied to become a student at the University you were told how the University would use your personal information to process your application and for related purposes (GDPR Notice for Student Applicants). You were referred to this webpage for a fuller statement of the uses we would make of your personal information if you became a student of the University. In addition to the information published here, when you use specific services and facilities offered by the University, you may be told about other uses of your personal information. For example, there are separate privacy notices for users of University websites 

Who will process my personal information?

The information published here applies to the use, sharing and disclosure of your personal information by the University.  The University is based in the United States and any personal information we collect from you may be transferred out of the European Union and processed and maintained in the United States.

What personal information will be processed?

The University will keep a record of the details you provided on your application form, any supporting documents requested as part of your admission and additional details provided by any references or during any interview process. We will also maintain records about your studies at the University, and about your use of the academic and non-academic facilities and services that we offer. This personal information will include data such as your name, home address, date of birth, courses studied, tuition and fee payments, and information about your examinations, assessments and grades.

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, including some databases that are shared between the University’s President’s Office and the individual University campuses. Access to your personal information is limited to University staff who have a legitimate interest in it for the purpose of carrying out their employment duties.

In addition to this, the University may process some information about you that is deemed ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, union membership, religious beliefs or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or reasonable accommodations. For certain courses of study, other sensitive information may be processed, such as information about past criminal convictions, working with children or vulnerable adults, and your fitness to practice in certain regulated professions. 

What is the purpose and legal basis of the processing?

The University will process your personal information for a range of contractual, statutory or public interest purposes, including the following:

  • To deliver and administer your education, record the details of your studies (including any placements with external organizations), and determine/confirm your academic achievements (e.g. grades, awards).
  • Where relevant (e.g. for graduate students), to monitor, evaluate and support your research activity.
  • To administer the financial aspects of your relationship with us and any outside funding sources (e.g. student lenders).
  • To provide access to facilities and services to you (e.g. IT, athletics, libraries, accommodations, career placement).
  • To enable your participation at events (e.g. campus functions, graduation).
  • To communicate effectively with you by mail, email and phone, including the distribution of relevant newsletters and notices.
  • To operate security, governance, disciplinary (including plagiarism and academic misconduct), complaint, audit and quality assurance processes and arrangements.
  • To support your training, medical, safety, welfare and religious requirements.
  • To compile statistics and conduct research for internal and statutory reporting purposes.
  • To fulfill and monitor our responsibilities under equal opportunity, immigration and public safety legislation.
  • To enable us to contact you or others in the event of an emergency.

We consider the processing of your personal information for these purposes to be either necessary for the performance of our contractual obligations with you (e.g. to manage your student experience and welfare while studying at the University), or necessary for compliance with a legal obligation (e.g. equal opportunity monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. teaching and research), or necessary for the pursuit of the legitimate interests of the University or an external organization (e.g. to enable your access to external services). If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.

Who will my personal information be shared with?

As described above, your personal information is shared with relevant staff at the University as required. In addition, it is shared as necessary to maintain your enrollment and provide you certain services,  or as required by law with a range of external organizations, including the following:

  • Agencies of the Commonwealth of Massachusetts (e.g. Department of Revenue, Department of Higher Education)
  • Agencies of the United States Government (e.g. Citizenship and Immigration Services, U. S. Department of Education)
  • Your funders and/or lenders (e.g., as relevant, student loan companies, the funders of any scholarships, awards or prizes).
  • The providers of any external/collaborative learning and training placements or fieldwork opportunities.
  • External examiners and assessors.
  • Any relevant professional or statutory regulatory bodies.
  • Any relevant University student union(s) and student clubs and societies, in order to facilitate your membership of those bodies.
  • Local authorities.
  • On occasion and where necessary, the police and other law enforcement agencies.
  • On occasion and where necessary, external auditors.
  • On occasion and where necessary, affiliated entities of the University (e.g. UMass Foundation).
  • Companies or organizations providing specific services to, or on behalf of, the University.

We will normally confirm details of your results and degrees awarded to external inquirers or organizations, and will provide references to third parties as you request. Your name and the type of degree awarded will be published in the relevant graduation program.

How is my personal information used after I graduate?

After you graduate a core record of your studies at the University is retained indefinitely so that the details of your academic achievements can be confirmed and for statistical or historical research. Your contact and core personal details are passed to the Development and Alumni Relations office while you are still a student so that you can be added to the alumni database.

How can I access my personal information?

You have the right to access the personal information that is held about you by the University. You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information (subject to certain exceptions), or otherwise limit our processing, or to object to processing or to receive an electronic copy of the personal information you provided to us.

If you have any questions about how your personal information is used, or wish to exercise any of your rights, please consult the University’s GDPR website.

How long is my information kept?

We store your personal information as part of your student record for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at the University). Information about how long different types of information are retained by the University is published in the Massachusetts Statewide Records Schedule Quick Guide

How do I complain? 

If you are not happy with the way your information is being handled, or with a response received from us, please review the European Commission’s redress options.

Are changes made to this webpage?

This webpage was last updated in May 2018. It is reviewed when necessary and at least annually. Any changes will be published here and you will be notified via this webpage and/or by email.