Online Privacy Policy | Stanford University Online Privacy Policy Stanford University provides the following information relating to your privacy when using websites in the Stanford.EDU domain. This privacy policy covers all Stanford.EDU websites unless otherwise indicated on a specific website. Online Privacy Notice This Online Privacy Notice (“Notice”) applies to the Personal Information that Stanford University (“Stanford”, “we”, “us”, “our”) – as data controller – collects when you visit Stanford’s main website (www.stanford.edu) and other websites that we own or control and link or refer to in this Notice (together, the “Sites”), including mobile applications and through communications such as subscription to newsletters and email updates. This Notice describes the types of Personal Information we collect, purposes for which we collect it, other parties with whom we may share it, measures taken to protect your personal information and your rights, and choices that are available to you regarding the use of the Personal Information and how you can contact us about our privacy practices. Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. This Notice does not apply to information collected from or about current or former employees, contractors, volunteers, postdoctoral fellows, and other workers of Stanford University (“Workers”) as part of or in the context of their employment or working relationship with Stanford, unless otherwise indicated on the Sites. This Notice also does not apply to and we are not responsible for the privacy practices or information of any third parties, including any third-party operating websites to which our Sites contain a link. Table of contents Personal Information we collect and process Marketing Legal Basis for Processing Sharing your Personal Information International Transfer of Personal Information Individual Privacy Rights Access and Choice Document Retention Information Security Third-Party Links Contact Information Updates to Notice Effective Date 1. Personal Information we collect and process When you access or use the Sites, we may collect and process the following types of information from you: Personal Information: “Personal Information” is any information that we can reasonably use to directly or indirectly identify you. If you are located in the European Economic Area (EEA) or the United Kingdom (UK), Personal Information includes all Personal Data as defined under EEA and UK data protection laws. We collect the following Personal Information from you when you provide it to us: Identification information, such as your first name, last name, demographic information, other relevant biographic information, postal address, email address, phone number, any other relevant contact details, Stanford unique ID, user account(s) on our Sites (including login), and passport number. Information related to your application, such as information related to your application for admission (including your educational history, personal statements, reference letters, any other relevant information provided in your application), and information related to your visa application. Information related to your student life, such as your courses, programs and training (including online/hybrid courses, programs and training), housing and/or dining status, travels through Stanford’s programs, and alumni status. Financial and banking information, such as your salary history, tax forms, any relevant financial information to evaluate and determine your eligibility for financial aid opportunities, and payment information. Information related to your donation, such as the amount of your donation, affiliation to Stanford, giving history, and legal documentation related to your donation. Information related to your exchanges with Stanford, such as date, hour, and subject of your request, exchanges with Stanford’s services, and preferred means of communication.  Information Received from Third Parties: We collect your Personal Information from third parties, including other schools, references, family members, and education partners (e.g., The Common Application Inc., Law School Admissions Council, The College Board, etc.) where authorized by the data protection laws. In compliance with the data protection laws, we may collect information about you from other companies and organizations, including public databases, social media platforms, our third-party marketing partners, or various independent organizations. For example, we may collect public information about you when you interact with us through social media. Automatically Collected Personal Information: Whenever you visit or interact with our Sites, we may use a variety of technologies that automatically or passively collect information about your online activity. This information may be collected in the following ways: Through your browser: Certain information is collected by most browsers, such as your IP address and Internet browser type and version. Your “IP address” is a number that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP Address is identified and logged automatically whenever a user visits the Sites, along with the time of the visit and the page(s) that were visited. We use IP addresses for purposes such as calculating Site’s usage levels, helping diagnose server problems, administering the Sites, and presenting content that is tailored to your country. Through Cookies: Cookies allow a web server to transfer data to a computer for recordkeeping and other purposes. We use cookies and other similar technologies to, among other things, better serve you with more tailored information and to facilitate your ongoing access to and use of the Sites. If you do not want your information collected by cookies and other similar technologies, please refer to our Cookies Policy. Some features of the Sites may not work properly if you decline the use of cookies and other similar technologies. To learn more about cookies, please visit http://www.allaboutcookies.org/. Through pixel tags, web beacons, clear GIFs, or other similar technologies: These may be used in connection with some Sites pages and HTML-formatted email messages to, among other things, track the actions of Site users and email recipients, and compile statistics about Sites usage and response rates. From you: Information such as your location, as well as other information, such as your preferred means of communication, is collected when you voluntarily provide this information. Sensitive Personal Information: “Sensitive Personal Information” includes special categories of Personal Information (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation) for which the applicable data protection laws provide enhanced protections. In compliance with the applicable data protection laws, we may collect Sensitive Personal Information such as race/ethnicity, and certain financial information when you provide it to us for purposes described above, including as part of your application package for graduate or undergraduate admissions or financial aid opportunities. We do not sell or use your Sensitive Personal Information for targeted marketing purposes, and only use your Sensitive Personal Information as permitted by the applicable data protection laws. Refusing or Withdrawing Consent: Data protection laws that apply to you may let you refuse to consent to our proposed collection, use, or disclosure of your Personal Information. When we need to process your Personal Information as part of your relationship with us, we usually do not process it based on your consent. But if we have asked for consent, you have the right to withdraw consent at any time. If you withdraw consent, this doesn’t affect the lawfulness of the processing before you withdrew consent. To withdraw consent, please contact us in writing using the information in the “Contact Us” section below. However, if you withdraw your consent, we may not be able to adequately provide you the assistance or services you requested. Anonymity: If you are located in Australia, you have the option to remain anonymous, where practicable. However, if you do not provide us with the Personal Information we require for processing, we may not be able to adequately provide you the assistance or services you requested. Failure to Provide Personal Information: If you fail to provide certain Personal Information when requested or if you withdraw consent to processing, we may not be able to perform the contract we have entered with you (where applicable), we may not be able to process your request, or we may not be able to properly comply with legal obligations (i.e., tax reporting). If this is the case, we may have to stop providing you any services or assistance. If we need to process requested Personal Information to provide you a service or fulfill our obligations to you, we will tell you that in the event you do not provide your consent for us to process that Personal Information where authorized by the data protection laws that apply to you. Back to table of contents 2. Marketing Personal Information you submit through our Sites, such as your name, address, and other contact information, may be collected by Stanford for internal marketing and development purposes as well as to respond to your inquiry, complete a transaction for you, or fulfill other forms of customer service. Where required by applicable data protection laws, we will obtain your consent prior to sending you marketing communications. You can choose not to receive marketing emails from us by “unsubscribing” using the instructions in any marketing email you receive from us. Back to table of contents 3. Legal Basis for Processing All processing and use of your Personal Information is justified by a “legal basis” for processing. In most cases, processing will rely on one of the following legal bases: Take steps prior to entering into a contract or contract performance: The processing is necessary to perform a contract with you or take steps prior to entering into a contract at your request, such as to fulfill a specific request, or to provide information about our services you have requested; Legal obligation: The processing is necessary for us to comply with legal and jurisdictional obligations (i.e. EEA, UK, Australia, Brazil or China) to which we are subject such as keeping accounting records; Legitimate interests: The processing is in our legitimate interests or the legitimate interests of a third party, which are not overridden by your interests and fundamental rights and freedoms; or Consent: You have consented to the processing. We use the Personal Information we collect for the purposes we described above relying on the following legal bases: Contract performance – to create and manage your account(s) on our Sites; to manage your admission if your application is successful; to manage your student record and your education at Stanford; to provide you with the services offered by Stanford (e.g. housing and dining services, wellness program, IT or helpdesk services, events organized by Stanford or its partners, etc.) and to manage any payment related to such services; and to manage the donations. Legal obligation – to process your visa application where required for employment or travel; to comply with legal, regulatory and jurisdictional obligations to which Stanford is subject; and to process your request when you exercise your rights in accordance with the data protection laws that apply to you. Legitimate interests – to evaluate your candidacy for admissions…