Apply Now
Chapter:
6 - Student Affairs
Contact:
Data Privacy and Compliance Officer
Approved Date:
February 26, 2019
Effective Date:
February 26, 2019

Purpose and Scope

This Student Privacy Notice explains how the University of California Education Abroad Program (“UCEAP”, “we” or “us”) collects and processes your Personal Data in connection with your studies abroad; how we use, store, transfer and protect this information Personal Data; and your rights in relation to this Personal Data.

“Personal Data” is any information that enables us to identify you, directly or indirectly, by reference to an identifier such as your name, identification number, location data, online identifier, or one or more factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.

This Privacy Notice applies to all Personal Data we collect or process about you in the context of your studies abroad. This notice will inform you of:

Who We Are

For the purposes of the General Data Protection Regulation 2016/679 (the “GDPR”), The Regents of the University of California (“University” or “UC”) of 1111 Franklin Street, Oakland, California 94607, is the data controller for all Personal Data that it holds and processes, except where it is done in the capacity of a data processor on behalf of another data controller.

How We Collect Personal Data

UCEAP obtains Personal Data about you in the following ways:

  • Collected from you directly, such as when you submit an inquiry to UCEAP and provide your contact details, when you submit photographs for identification purposes, when you apply to our programs or register as a student with UCEAP, or when you visit our website;
  • Generated by us about you, such as visual information captured by security cameras or UCEAP event photographers, or information we create in the context of your studies, student employment, or other interactions with UCEAP; and
  • Obtained by us from third party sources, such as where we partner with other study abroad providers like ACCENT, CIEE, and other institutions involved in joint programs, as well as foreign and domestic service providers.

CATEGORIES OF PERSONAL DATA THAT WE MAY COLLECT DIRECTLY FROM YOU

  • Personal details, such as your name and date of birth.
  • Contact information, such as your home address, email address, and phone numbers.
  • Demographic details, such as your age, gender, marital status, national origin, and current nationality.
  • Immigration and Identification information, such as your visa, your social security or tax identification number, passport number, or other government-issued identification number.
  • Student records, such as grades, transcripts, test scores, courses taken and other academic records; general counseling and advising records; and disciplinary records.
  • Emergency contact details, such as you may provide.
  • Health and safety information, including information regarding health conditions, disabilities,
  • and special needs accommodations.
  • Financial information, such as bank account names and numbers, credit, debit, or other payment card numbers, and loan information.
  • Employment information, such as past employer data and other information as needed for work study or employment opportunities through the University of California.
  • Travel Information, such as locations and dates of travel.

CATEGORIES OF PERSONAL DATA THAT WE MAY GENERATE ABOUT YOU

  • Student records, which are those records that contain information directly related to a student and that are maintained by UCEAP and any of its offices abroad, UC campus, the UC Office of the President, or by any organization or institution authorized to act on behalf of UC. Student records include information such as academic evaluations, including student examination papers, transcripts, test scores, and other academic records; general counselling and advising records; disciplinary records; and financial aid records, including student loan collection records.
  • School-generated identification numbers, such as your student ID number.
  • Employment information, such as salary or pay information and other records related to work
  • study or employment opportunities through the University of California.
  • Images of you, including your likeness, image, or appearance in any images, photographs, digital, video, or audio recordings that may be captured on campus and used in promotional materials.

CATEGORIES OF PERSONAL DATA THAT WE MAY OBTAIN FROM THIRD PARTIES ABOUT YOU

  • Student records, such as test scores, transcripts and student conduct information submitted by
  • testing agencies, former schools, colleges and universities.
  • Employment information, such as prior employment information and references.
  • Health Information, such as may be provided by academic exchange partners and other providers to accommodate disability and other health needs.
  • Testimonials, such as those submitted to UCEAP through its faculty, staff or other agents, website, blog, or social media outlets.

SPECIAL CATEGORIES AND OTHER SENSITIVE TYPES OF PERSONAL DATA THAT WE MAY COLLECT AND USE

Some of the categories of Personal Data that we collect are considered “special categories” of Personal Data under European Union law. In particular, we may process the following special categories of Personal Data: Information related to unlawful activity; race and ethnic origin information; health information; and information about an individual’s sex life, as defined by the EU Data Protection Regulation, including sexual orientation, gender identity, and the facts and circumstances surrounding incidents or allegations of sexual violence or harassment.

How We Use Personal Data

UCEAP uses your personal information in connection with your studies abroad for the following purposes:

  • To provide you with information related to UCEAP programs. This is generally required to process a request made by you.
  • Carrying out our contractual obligations to you and exercising our rights in this respect, including provision of academic services, travel accommodations, insurance, housing, and related services associated with UCEAP’s study abroad programming. Our basis for doing so is the performance of the contract we have with you.
  • To inform you about UCEAP opportunities and events related to your program. This processing is necessary to serve our legitimate interest.
  • Student identification purposes, including for creating student identification cards that contain your photo. This processing is necessary to serve our legitimate interests in keeping our campus and associated facilities safe and secure.
  • Responding to emergencies, such as contacting your family in the event of an incident. This processing is necessary to serve our legitimate interests in supporting the health and wellbeing of our students.
  • For purposes of program development, travel planning, student development and tracking of academic progression. This processing is necessary to serve our legitimate interests in the efficient management and administration of our academic programs.
  • Keeping our campus and associated facilities safe and secure. This processing is necessary to serve our legitimate interests in protecting our students, property, and facilities.
  • For purposes of research and statistical analysis, including optional surveys. This processing is necessary to serve our legitimate interest in identifying trends, improving our programs and to promote access and diversity.
  • To comply with legal or regulatory obligations with respect to law enforcement agencies, courts, regulators, government authorities, or other third parties.

PURPOSES AND LEGAL BASIS FOR PROCESSING SPECIAL CATEGORIES OF DATA

  • Race and ethnic origin information. To the extent we process race and ethnic origin information, we do so to support statistical research. We will only process this information if you elect to provide it.
  • Health data. To the extent we process health data, we do so to support your health and wellbeing during your time abroad, to respond to medical and mental health issues and emergencies. In the case of information relating to disability or other accommodations, we process such data to provide learning assistance, mobility, and other necessary accommodations. Our basis for doing so is compliance with social obligations laws or where there is a substantial public interest in providing such services or accommodations. In the event of an emergency in which you are incapacitated or otherwise unable to consent, we may share your health data with healthcare providers or emergency contacts to protect your vital interests. Additionally, in some contexts we may rely on your express consent to process such data.
  • Information about sexual orientation. To the extent we process sensitive data about a student’s sexual orientation, we do so to provide you with support services and resources. We will only process this information if you elect to provide it.
  • Information about gender identity. To the extent we process sensitive data about a student’s gender identity, we so to support statistical research. We will only process this information if you elect to provide it.
  • Information about the facts and circumstances surrounding instances or allegations of sexual violence or harrassment. To the extent we process sensitive data about the facts and circumstances surrounding instances or allegations of sexual violence or harrassment, we do so only in the context of investigations of alleged unlawful behaviour. Our basis for doing so is that the processing is necessary for the defense of legal claims and that it serves a substantial public interest. To the extent such investigations do not specifically involve special categories of data, our basis for such processing is that it is necessary to serve our legitimate interests in complying with our legal obligations.
  • Information relating to unlawful activity. To the extent we process information relating to arrests or criminal offenses (for example, if a student is arrested for a criminal offense and we take disciplinary action as a result), we do so in accordance with applicable European Union or Member State law.

Who Has Access to Personal Data

We treat your Personal Data with care and confidentiality. Your Personal Data will only be available for the purposes mentioned above and only to employees on a need to know basis and to the extent reasonably necessary to perform their functions.

We may share your Personal Data with third parties under the following circumstances:

  • University of California in the US. Our international programs work closely with our US-based operations. As a result, we may share certain Personal Data about you collected or used in the context of our international programs with other UC personnel located at our facilities in the United States or elsewhere.
  • Service providers and business partners. We may share your Personal Data with service providers or business partners including host institutions, internship providers, housing services, prospective employers, other partners, suppliers, and sub-contractors for the performance of obligations arising from your enrollment, or any other contract we enter into with them or you or to provide you with the information and services that you obtain from us.
  • Law enforcement agencies, courts, regulators, government authorities or other third parties. We may share your Personal Data with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
  • Family and Emergency Contacts. We may share your Personal Data with these parties in emergency situations (e.g. evacuations, illness or serious injury). In some contexts, we may rely on your express consent to process such data.

Because we operate internationally, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). Please refer to the section below on “Transfer of Personal Data outside of the European Economic Area” for more information.

Transfer of Personal Data Outside of the European Economic Area

Your Personal Data may be transferred to, stored, and processed in a country (such as the United States, where the University of California is located) that is not regarded as ensuring an adequate level of protection for Personal Data under European Union law.

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please reach out to us via the contact information listed at the main Policy webpage.

How We Store and Protect Personal Data

We implement technical and organizational measures to ensure a level of security appropriate to the risk to the Personal Data we process. These measures are aimed at ensuring the ongoing integrity and confidentiality of Personal Data. We evaluate these measures on a regular basis to ensure the security of the processing.

We will store your Personal Data, in a form which permits us to identify you, for no longer than is necessary for the purpose for which the Personal Data is processed. Retention timelines will be determined in line with the University’s records retention schedule found here.

How to Exercise Your Rights

Where applicable under local law, you may have certain rights regarding your Personal Data. Where applicable, you have the right to access Personal Data UCEAP holds, and in some situations you have the right to have that Personal Data corrected or updated, erased, restricted, or delivered to you or a third party in a usable electronic format (the right to data portability). Where applicable, you may also object to how UCEAP uses your Personal Data if the legal basis for processing that information is our legitimate interest. For individuals in France, you may contact us to specify how your personal data may be stored, deleted, or shared after your death.

Where we are using your Personal Data on the basis of your consent, where applicable under local law you have the right to withdraw that consent at any time. You also have the right to register a complaint to the supervisory data protection authority of the country in which you are studying, where applicable. If you wish to exercise these rights or to notify us of a change in your personal details, or if you have any questions on the content of this Notice, please reach out to us via the contact information listed at the main Policy webpage.

Student Telecommunications Monitoring

UCEAP may carry out lawful monitoring of its IT systems where this is permitted by law. This is in order to comply with the law and applicable regulations, to ensure appropriate use of UCEAP’s IT systems, and to ensure compliance with other University policies.

UCEAP will not monitor students without first notifying you of how and why UCEAP intends to undertake monitoring and what the information will be used for, as required by applicable law, except in limited circumstances as provided for in the UC Electronic and Communications policy.

Personal Data obtained through monitoring will only be used for the purpose for which the monitoring was carried out, except where a potential risk to the UCEAP has been identified, such as serious misconduct or a breach of health and safety rules.

Changes to this Privacy Notice

Any changes we make to our Privacy Notice in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Questions or Concerns?

If you have any data privacy questions or concerns relating to this Privacy Notice, please reach out to us via the contact information listed at the main Policy webpage.

Last Updated

Date:
11/07/2023