This Notice describes the practices of Hartwick College with respect to the collection, use, storage, and disclosure of personal information associated with activities covered by the European Union’s General Data Protection Regulation relating to employees, students, alumni, applicants, and other friends of Hartwick College who are located in the European Union, or the additional countries located in the European Economic Area (EEA).For the purposes of this Notice and the GDPR, the collection, use, storage and disclosure of information is called “processing”. This Notice applies to Hartwick College (referred to below as “College”, “we,” “us” or “our”) located at 1 Hartwick Drive, Oneonta, NY 13820, as well as, to its affiliated legal entities. All natural persons in the EU or EEA who are associated with Hartwick College (referred to below as “you” or “your”) should carefully read the provisions of this Privacy Notice.
Under the GDPR, “Personal Data” means any information relating to an identified or identifiable Data Subject; specifically including, but not limited to, name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject. A Data Subject is an identifiable natural person, i.e., one who can be identified, directly or indirectly, in particular, by reference to Personal Data. Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process” and “processed” have a corresponding meaning.
The GDPR prohibits the processing of “special categories” of Personal Data unless certain exceptions apply, because this type of data could create more significant risks to a Data Subject’s fundamental rights and freedoms. For example, an unauthorized disclosure of “special categories” of Personal Data may put Data Subjects at risk of unlawful discrimination. For this purpose, processing of “special categories” of Personal Data includes processing of: (i) Personal Data that reveals; (A) racial or ethnic origin, (B) political opinions, (C) religious or philosophical beliefs, or (D) trade union membership; or (ii) (A) genetic data, (B) biometric data for the purpose of uniquely identifying a natural person, (C) data concerning health; or (D) data concerning a natural personal’s sex life or sexual orientation.
Our College Compliance Officer serves as our Data Protection Officer (“DPO”), who can be contacted with any questions about this notice, our data collection practices, or your rights.
Hartwick College Compliance Officer
P.O. Box 4020
Shineman Room 104
Oneonta, NY 13820
+1 607-431-4293
compliance@hartwick.edu
This general notice may be supplemented by additional notices at the point of any data collection. If you have specific questions about any of the data processing activities described in this or any other notice, please contact our DPO.
We process information we collect from you directly, including during our communications with you during your enrollment, employment, participation in student or alumni activities or programs, when you work as a vendor or contractor, as a result of your other association with Hartwick College, when you attend one of our events, when you make contributions, when you communicate with the College for any purpose, when you apply for employment, employment benefits, admission or financial aid, when you make use of Hartwick equipment, systems, facilities, programs, resources, and/or Hartwick services provided by third-party vendors, and when you request services from Hartwick. In some cases, we will require that certain information be provided in order for us to provide you with a service, benefit, or to take an action related to a request that you make. We will indicate when such information is required and failure to provide required or mandatory information may result in our being unable to provide you with a service, benefit, or take an action you request.
We also employ cookies and may collect background information about you when you use our website, including your IP address, date and time of connection, operating system, browser type, and the webpages you visit.
Hartwick maintains video surveillance and card swipe systems for the security of our premises. The College or our contracted service providers may process images and video of you, and information about your use of and access to our premises, in connection with the operation of these systems.
Alumni and Friends of Hartwick
For purposes of this document, “Friends of Hartwick” includes former employees, family of students and employees, donors to Hartwick and their families, potential donors and their families, and others who have expressed an interest in supporting Hartwick or in participating or engaging in College-sponsored activities.
We may also collect the following kinds of information about you from third parties:
Employees or Applicants for Employment at Hartwick
The information we process may include information about your employment history with Hartwick, your job performance, compensation and benefits, and your dependents and emergency contacts. We use automated decision-making processes to process your data in certain contexts. For example, we may automatically evaluate information about your compensation and benefits to withhold taxes or determine your eligibility for employee benefits or other programs, or key terms in your application to determine if you meet the qualifications for a position to which you apply for employment.
We may also collect the following kinds of information about you from third parties:
Students and Applicants for Enrollment at Hartwick
In addition to submitting an application directly to us, you may submit an application through the Common Application or via other third party sites through which Hartwick collects prospective student information or financial aid related data. We may use automated decision making processes to screen applicants for both admission and financial aid according to predetermined criteria. For example, the information in your financial aid application may be used to generate a profile of your financial circumstances that is used to make decisions about your eligibility for scholarships, loans, and other financial assistance.
In addition, we collect the following kinds of information about you from third parties:
Alumni and Friends of Hartwick
We process your personal information in order to support and operate Hartwick College and its programs, to provide you with alumni support and related services (such as job placement, email, reunion planning, transcripts, and library services), to assure continuity in our communications with you, and to contact you to offer you services and request financial support for Hartwick College. We also use this data to:
We combine the data that we collect in order to provide these functions.
We have the following legal basis for processing the information you provide us or that we collect about you.
The lawful and legitimate purposes for which we may use other Personal Data (including “special categories” of Personal Data) we collect while you visit our website (e.g., the background information such as IP address, date and time, and the webpages you visit) is that it is in our legitimate interests to provide and monitor the usefulness of our website and to ensure it is kept secure.
Employees or Applicants for Employment at Hartwick College
We process your Personal Information to administer and manage Hartwick College programs and services, evaluate your eligibility for employment, communicate with you about your application, to onboard you as a new employee, administer, manage, and evaluate your employment with Hartwick, communicate with you regarding your employment, and provide you with access to Hartwick programs, benefits, services, and facilities.
We also use data to:
We combine the data that we collect in order to provide these functions.
We have the following legal basis for processing the information you provide and that we collect about you during your employment.
Students and Applicants for Enrollment at Hartwick College
We process your Personal Information to recruit prospective students, evaluate applications for admission, evaluate your eligibility for financial aid, communicate with you about Hartwick and your application, and, if you are admitted, to award you financial aid and to enroll you in programs if you choose to attend. We also use this data to:
We combine the data that we collect in order to provide these functions.
We have the following legal basis for processing the information you provide us in your application or that we collect about you during the application process.
In the case of Sensitive Personal Information (which includes (i) information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (ii) genetic and biometric data, and (iii) data concerning health, sex life, or sexual orientation), we process information because it is necessary for our legitimate business interests and have concluded that our interests do not inappropriately impact your fundamental rights and freedoms. We may also be required to process certain information to comply with applicable laws. You can obtain more information about these laws by contacting the DPO.
If Hartwick requested, and you provided your explicit consent for the processing of your Personal Data (or where a parent or legal guardian provided consent on your behalf because you were under the age of 16 at the time consent was required), you (or your parent or legal guardian, as applicable) have the right (in certain circumstances) to withdraw that consent at any time. However, withdrawal of consent will not affect the lawfulness of the processing before your consent was withdrawn.
Finally, we process your Personal Information for additional purposes that are compatible with those already described, including for the purposes of conducting scientific, statistical, or historical research or for the purpose of creating archives in the public interest. Where possible, we do not use identifiable information for these purposes, or we take steps, including making use of pseudonymous data, to limit the amount of Personal Information we use in our research or archives.
You can obtain additional information about the legitimate interests, contracts or agreements, or processing we do to comply with applicable laws by contacting the DPO.
Hartwick College is concerned with ensuring adequate protection of all Personal Information. In this regard, Hartwick endeavors to restrict Personal Information to only those needing access to carry out their duties. Your personal information will be received and processed by Hartwick employees and personnel, students, as well as third parties who provide services to Hartwick in connection with the purposes of the processing described above. We share your Personal Information with our service providers only when they have agreed to process your Personal Information only to provide services to us and have agreed to protect your Personal Information from unauthorized use, access, or disclosure. We also disclose your information to government authorities as required by laws that regulate immigration, tax, national security, and criminal activity. We may provide your information to other colleges, universities, or entities for purposes such as, but not limited to:
We may also disclose your Hartwick contact information in employee and student directories available to Hartwick students, employees, and the general public. You may request that your information be removed from this directory. We will not share your personal information with any company or organization outside the College except as stated within this document.
Non-personalized identifiable website visitor information (i.e. information that has been “pseudonymised” as described in the GDPR) may be provided to other parties for marketing, advertising, or other uses without restriction.
Hartwick College is located and operates primarily in the United States. We transfer your data within the United States and to the countries where we operate Global Exchange and Study Abroad programs. Hartwick offers study abroad programs in countries around the world inside and outside the EU.
You can find more information about how long we retain personal data by consulting our Records Management, Retention, and Disposal Policy. If you have any questions, you may contact the DPO.
You have the right to the following information regarding our processing of your Personal Information:
This Privacy Notice is intended to provide this information. Any questions about these details may be directed to the DPO.
You also have the following additional rights with respect to your Personal Information:
If individuals in the EU (including students, alumni, and employees) wish to exercise their rights under GDPR, please download the Hartwick GDPR Data Request Form (PDF), fill it out, sign, and send it to GDPR Data Request.
If you have questions, concerns, or complaints about how we are using your Personal Data, we may be able to resolve your complaints, and we request that you contact the DPO using the contact information contained in this Notice. You also have the right to file a complaint with the data protection authority in any Member State where you habitually work, live, or believe an infringement of EU data protection law occurred if you believe that we have not complied with the requirements of the GDPR with regard to your Personal Data, or if you are not happy with the response you receive from us regarding your complaint. You may consult the list of data protection authorities provided by the European Commission.
Effective: August 15, 2018
