This Notice describes the practices of Hartwick College with respect to the collection, use, storage, and disclosure of personal information associated with activities related to employees, students, alumni, applicants, and other friends of Hartwick College. This includes personal information covered by the European Union’s General Data Protection Regulation (GDPR) for individuals who are located in the European Union, or the additional countries located in the European Economic Area (EEA). For the purposes of this Notice and the GDPR, the collection, use, storage and disclosure of information is called “processing”. This Notice applies to Hartwick College (referred to below as “College”, “we,” “us” or “our”) located at 1 Hartwick Drive, Oneonta, NY 13820, as well as, to its affiliated legal entities. All natural persons in the EU or EEA who are associated with Hartwick College (referred to below as “you” or “your”) should carefully read the provisions of this Privacy Notice.

Under the GDPR, “Personal Data” means any information relating to an identified or identifiable Data Subject; specifically including, but not limited to, name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject. A Data Subject is an identifiable natural person, i.e., one who can be identified, directly or indirectly, in particular, by reference to Personal Data. Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process” and “processed” have a corresponding meaning.

The GDPR prohibits the processing of “special categories” of Personal Data unless certain exceptions apply, because this type of data could create more significant risks to a Data Subject’s fundamental rights and freedoms. For example, an unauthorized disclosure of “special categories” of Personal Data may put Data Subjects at risk of unlawful discrimination. For this purpose, processing of “special categories” of Personal Data includes processing of: (i) Personal Data that reveals; (A) racial or ethnic origin, (B) political opinions, (C) religious or philosophical beliefs, or (D) trade union membership; or (ii) (A) genetic data, (B) biometric data for the purpose of uniquely identifying a natural person, (C) data concerning health; or (D) data concerning a natural personal’s sex life or sexual orientation.

We process information we collect from you directly, including during our communications with you during your enrollment, employment, participation in student or alumni activities or programs, when you work as a vendor or contractor, as a result of your other association with Hartwick College, when you attend one of our events, when you make contributions, when you communicate with the College for any purpose, when you apply for employment, employment benefits, admission or financial aid, when you make use of Hartwick equipment, systems, facilities, programs, resources, and/or Hartwick services provided by third-party vendors, and when you request services from Hartwick. In some cases, we will require that certain information be provided in order for us to provide you with a service, benefit, or to take an action related to a request that you make. We will indicate when such information is required and failure to provide required or mandatory information may result in our being unable to provide you with a service, benefit, or take an action you request.

We also employ cookies and may collect background information about you when you use our website, including your IP address, date and time of connection, operating system, browser type, and the web pages you visit.

Hartwick maintains video surveillance and card swipe systems for the security of our premises. The College or our contracted service providers may process images and video of you, and information about your use of and access to our premises, in connection with the operation of these systems.

Alumni and Friends of Hartwick College

For purposes of this document, “Friends of Hartwick” includes former employees, family of students and employees, donors to Hartwick and their families, potential donors and their families, and others who have expressed an interest in supporting Hartwick or in participating or engaging in College-sponsored activities.

We may also collect the following kinds of information about you from third parties:

• Information we collect from other personnel or students: We may collect information about you from other persons affiliated with Hartwick. For example, we collect contact information for our student’s parents and family members from our students.
• Information we receive about you from journals, research publications, professional organizations, or other platforms through which you publish or present content.
• Information from publicly available sources, like your public social media profiles (e.g., LinkedIn), and public directories that include your professional and contact information.
• Demographic Information: We may review and process available demographic information about you.
• Information about your prior or concurrent educational history, which we collect from other educational institutions (or retrieve from our own records).

Employees or Applicants for Employment at Hartwick College

The information we process may include information about your employment history with Hartwick, your job performance, compensation and benefits, and your dependents and emergency contacts. We use automated decision-making processes to process your data in certain contexts. For example, we may automatically evaluate information about your compensation and benefits to withhold taxes or determine your eligibility for employee benefits or other programs, or key terms in your application to determine if you meet the qualifications for a position to which you apply for employment.

We may also collect the following kinds of information about you from third parties:

Your contact and demographic information, including publicly available information, which we collect from third parties who provide us information about prospective employees who may be interested in working at Hartwick College.

Any criminal convictions or offenses, information about your credit, and other information about your previous employment and education, which we collect as part of a background check process (where permitted by applicable law) from government records, credit reporting companies, your previous employers, and other academic institutions.

We collect information about your employment history and education during the application process or when taking an employment action – such as considering you for a promotion or a new position.

We may confirm information you have provided concerning your previous employers and the education institutions you attended.

Information about your professional certifications: We may confirm information you have provided about any professional certifications you might have from third parties that provide or verify those certifications.

Information about your health: Where permitted by applicable law, we may receive or communicate information to provide you with benefits to which you are entitled, such as workers’ compensation and disability claims.

Information we collect from other employees or students who may provide us with information about you, whether in the process of reporting an incident or complaint, alerting us to an emergency situation involving you, or as part of the employment process. This information can include your name, information about your behavior or activities, and other information about the situation being reported to us.

Immigration information: Governments and consulates may provide us with government identification, immigration information, or other information in order to confirm your eligibility to work in the United States or to facilitate travel related to your employment at Hartwick. The type of information provided may vary by country depending on applicable reporting requirements. For example, the Czech government may report information regarding criminal convictions and debts.

Students and Applicants for Enrollment at Hartwick College

In addition to submitting an application directly to us, you may submit an application through the Common Application or via other third party sites through which Hartwick collects prospective student information or financial aid related data. We may use automated decision making processes to screen applicants for both admission and financial aid according to predetermined criteria. For example, the information in your financial aid application may be used to generate a profile of your financial circumstances that is used to make decisions about your eligibility for scholarships, loans, and other financial assistance.

In addition, we collect the following kinds of information about you from third parties:

Your contact and demographic information, including publicly available information, which we collect from third parties who provide us information about prospective students who may be interested in attending Hartwick. We may also collect this contact information from students about their parents and family members.

Specific personal background and health details, which we may collect from third parties.

Information about your prior educational history, which we collect from other educational institutions (or from our own records in the event of a re-enrollment or enrollment for a different degree).

Alumni and Friends of Hartwick College

We process your personal information in order to support and operate Hartwick College and its programs, to provide you with alumni support and related services (such as job placement, email, reunion planning, transcripts, and library services), to assure continuity in our communications with you, and to contact you to offer you services and request financial support for Hartwick College.

We also use this data to: file required reports with applicable governmental authorities, administer our programs and provide appropriately tailored services, monitor trends within our fundraising activities, verify your identity, ensure that the college is prepared for emergencies, enforce college policies and applicable laws, manage university gift receipting, acknowledgement, billing, collecting, refunding and cashiering functions, facilitate internal research, coordinate events such as meetings, gatherings, conferences, and professional development, and facilitate alumni directories and other promotional activities. We combine the data that we collect in order to provide these functions.

We have the following legal basis for processing the information you provide us or that we collect about you.

• We have a legitimate interest in raising funds to support Hartwick College’s mission and programs; supporting our alumni and other friends of Hartwick; complying with laws and regulations; and administering programs in an efficient, ethical, and appropriate manner. We process all the information we collect from or about you to meet these purposes.
• We may also be required to process your personal information to complete a contract or agreement that you have entered into with us, including when you wish to receive a service or when the College responds to your pledge or intention to make a contribution.
• We may also be required to process your personal information to comply with laws applicable in the European Union or its member states.
• The lawful and legitimate purposes for which we may use other Personal Data (including “special categories” of Personal Data) we collect while you visit our website (e.g., the background information such as IP address, date and time, and the web pages you visit) is that it is in our legitimate interests to provide and monitor the usefulness of our website and to ensure it is kept secure.

Employees or Applicants for Employment at Hartwick College

We process your Personal Information to administer and manage Hartwick College programs and services, evaluate your eligibility for employment, communicate with you about your application, to onboard you as a new employee, administer, manage, and evaluate your employment with Hartwick, communicate with you regarding your employment, and provide you with access to Hartwick programs, benefits, services, and facilities.

We also use data to: make strategic decisions about Hartwick programs or course offerings, and administer those programs, file required reports with applicable governmental authorities, engage in financial planning, to comply with application retention requirements, and for the enforcement of Hartwick College policies and applicable laws. We combine the data that we collect in order to provide these functions.

• We have the following legal basis for processing the information you provide and that we collect about you during your employment.
  We have a legitimate interest in hiring and retaining qualified employees, complying with laws and regulations that govern our conduct in the countries where we operate, and administering Hartwick College and its programs in an efficient, ethical, and appropriate manner.
• We may be required to process your Personal Information to fulfill our obligations pursuant to an offer of employment or an agreement to receive certain other benefits.
• We may also be required to process your Personal Information to comply with laws applicable in the United States or in the European Union or its member states. For example, we may process your passport information in order to comply with our obligations under applicable employment laws.

Students and Applicants for Enrollment at Hartwick College

We process your Personal Information to recruit prospective students, evaluate applications for admission, evaluate your eligibility for financial aid, communicate with you about Hartwick and your application, and, if you are admitted, to award you financial aid and to enroll you in programs if you choose to attend.

We also use this data to: administer programs and make decisions about course offerings, file required reports with applicable governmental authorities, administer our programs and provide appropriately tailored services, including student health services, financial aid, and research and reporting activities, monitor trends within incoming classes, report application and admission statistics to appropriate publications, plan course offerings, verify identity, ensure that the College is prepared for emergencies, and enforce Hartwick policies and applicable laws. We combine the data that we collect in order to provide these functions.

We have the following legal basis for processing the information you provide us in your application or that we collect about you during the application process.

• We have a legitimate interest in recruiting and admitting qualified applicants, complying with laws and regulations that govern our conduct in the countries where we operate, and administering Hartwick and its programs in an efficient, ethical, and appropriate manner.
• Once you have accepted an offer of admission from us, we may also be required to process your Personal Information to complete a contract that you have entered into with us, including to be admitted to a program, or receive financial aid, housing, or another service from us.
• In the case of Sensitive Personal Information (which includes (i) information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (ii) genetic and biometric data, and (iii) data concerning health, sex life, or sexual orientation), we process information because it is necessary for our legitimate business interests and have concluded that our interests do not inappropriately impact your fundamental rights and freedoms. We may also be required to process certain information to comply with applicable laws. You can obtain more information about these laws by contacting the DPO.
• If Hartwick requested, and you provided your explicit consent for the processing of your Personal Data (or where a parent or legal guardian provided consent on your behalf because you were under the age of 16 at the time consent was required), you (or your parent or legal guardian, as applicable) have the right (in certain circumstances) to withdraw that consent at any time. However, withdrawal of consent will not affect the lawfulness of the processing before your consent was withdrawn.

Finally, we process your Personal Information for additional purposes that are compatible with those already described, including for the purposes of conducting scientific, statistical, or historical research or for the purpose of creating archives in the public interest. Where possible, we do not use identifiable information for these purposes, or we take steps, including making use of pseudonymous data, to limit the amount of Personal Information we use in our research or archives.

You can obtain additional information about the legitimate interests, contracts or agreements, or processing we do to comply with applicable laws by contacting the DPO.

Hartwick College is concerned with ensuring adequate protection of all Personal Information. In this regard, Hartwick endeavors to restrict Personal Information to only those needing access to carry out their duties. Your personal information will be received and processed by Hartwick employees and personnel, students, as well as third parties who provide services to Hartwick in connection with the purposes of the processing described above. We share your Personal Information with our service providers only when they have agreed to process your Personal Information only to provide services to us and have agreed to protect your Personal Information from unauthorized use, access, or disclosure. We also disclose your information to government authorities as required by laws that regulate immigration, tax, national security, and criminal activity.

We may provide your information to other colleges, universities, or entities for purposes such as, but not limited to: facilitate joint activities, including travel, collaborative events for professional affiliations or research partners documenting or transferring academic credit, printers and mailing houses, The College Board, ACT, and the National Student Clearinghouse for reporting and enrollment verification, verifying employment by providing only your title and dates of employment unless you provide a signed authorization to provide additional information.

We may also disclose your Hartwick contact information in employee and student directories available to Hartwick students, employees, and the general public. You may request that your information be removed from this directory. We will not share your personal information with any company or organization outside the College except as stated within this document.

Non-personalized identifiable website visitor information (i.e. information that has been “pseudonymised” as described in the GDPR) may be provided to other parties for marketing, advertising, or other uses without restriction.

Hartwick College is located and operates primarily in the United States. We transfer your data within the United States and to the countries where we operate Global Exchange and Study Abroad programs. Hartwick offers study abroad programs in countries around the world inside and outside the EU.

You can find more information about how long we retain personal data by consulting our Records Management, Retention, and Disposal Policy. If you have any questions, you may contact the DPO.

You have the right to the following information regarding our processing of your Personal Information: the purposes of the processing, the categories of Personal Information concerned, the recipients or categories of recipients to whom the Personal Information has been or will be disclosed, where possible, the envisaged period for which the Personal Information will be stored, or, if not possible, the criteria used to determine that period.

This Privacy Notice is intended to provide this information. Any questions about these details may be directed to the DPO.

You also have the following additional rights with respect to your Personal Information:

The right to request access to the Personal Information that we have about you as allowed by law and/or policy; as well as, the right to request rectification of any data that is inaccurate or incomplete.

The right to request a copy of your Personal Information as permitted by College Policy or law in electronic format so that you can transmit the data to third parties, or to request that we directly transfer your Personal Information to one or more third parties.

The right to object to the processing of your Personal Information for the College’s communications regarding your student, employee or alumni status, College publications relating to academic, employment and fundraising functions and other purposes where permitted by law.

Under certain circumstances, you may also have the right to erasure of your purposes where erasure is not possible.

Individuals in the EU (including students, alumni, and employees) who wish to exercise their rights under GDPR, please download and complete the Hartwick GDPR Data Request Form (PDF), with signature and notarization, and send it to GDPR Data Request at compliance@hartwick.edu.

If you have questions, concerns, or complaints about how we are using your Personal Data, we may be able to resolve your complaints, and we request that you contact the Data Protection Officer (DPO) using the contact information contained in this Notice. You also have the right to file a complaint with the data protection authority in any Member State where you habitually work, live, or believe an infringement of EU data protection law occurred if you believe that we have not complied with the requirements of the GDPR with regard to your Personal Data, or if you are not happy with the response you receive from us regarding your complaint. You may consult the list of data protection authorities provided by the European Commission.