General Data Protection Regulation (GDPR) Policy

全网最大的彩票娱乐平台致力于保护所有个人隐私 由学生、雇员、校友和其他成员以及承包商提供的数据 (集体”数据对象”).

Effective May 25, 2018, the European Union (“EU”) General Data Protection Regulation (“GDPR)给亲自控制或亲自处理的组织增加了额外的义务 identifiable information about persons in Europe. 的 GDPR is designed to protect the privacy of data concerning a natural person that is collected or processed in 或转移出欧盟，并规范实体的数据隐私实践 that offer goods or services in the EU. In its capacity as a data controller, the 大学根据本条例收集、使用及公开资料当事人的资料 以下政策.  

范围

的 GDPR applies to entities both inside and outside the EU. In addition, the regulations 适用于任何在欧盟的人的数据，无论他们是否是公民 or permanent resident of an EU country; for example, GDPR includes U.S. 人当 他们的个人资料会在欧盟境内收集、储存及使用，或从 EU.

GDPR定义了“个人资料，内容如下:

“…any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or 间接地，特别是通过引用标识符，如名称、标识符 号码、位置数据、在线标识符(包括手动设置的信息) 或自动读取，如IP地址)或一个或多个因素具体到 生理、生理、基因、心理、经济、文化或社会认同 of that natural person.”

本政策描述了大学管理和保护个人数据的措施 that may be subject to the GDPR.

数据类别

为学生和员工提供服务，管理其项目，并执行 合同义务，大学可收取、处理、转让各种 types of 个人资料, including but not limited to: name; application information; attendance; academic records; employment records; contact information, including phone numbers, email addresses, and mailing addresses; and date of birth.

法律基础

GDPR要求以合法、公平和透明的方式处理个人数据 方式，仅限于必要的数据，保持准确性，存储 只有在需要或需要的时间长度，并保护未经授权的披露. 处理包括对个人资料执行一项任务，例如收集、记录、 通过传送、传播或其他方式储存、更改、检索、披露 making the data available.

的 legal bases under the GDPR which permit the University to collect and process 个人资料包括但不限于以下内容:(1)资料当事人 has given consent to the processing for a specific purpose; (2)  the processing is 为履行该资料当事人为当事人的合约所必需的;或 在资料当事人的要求下，采取步骤，以便在 contract; (3) the processing is necessary for compliance with a legal obligation to which the University, as controller of the data, is subject; (4) the processing is 为保护数据主体或其他自然人的切身利益所必需的 (5)处理是为执行某项任务所必需的 public interest or in the exercise of official authority vested in the University; (6)为了学校追求的合法利益需要处理的 or by a third party, except where such interests are overridden by the interest of 需要保护的数据主体的基本权利和自由 个人资料.

Special 数据类别

Personal data revealing ethnic origin, health, criminal convictions and offenses, and certain other sensitive matters (集体”敏感数据” as defined by the GDPR) may be requested by the University.  除了例外 of criminal convictions, 数据对象 are not obligated to provide 敏感数据 and do so on a voluntary basis.  的 University makes every effort to process Sensitive Data only with 数据对象’ consent. In some circumstances, health information may 根据州或联邦法律的要求，大学才能提供服务， or in the interest of public health and safety. Subject to the above limitations, 数据对象 may revoke their consent regarding 敏感数据 at any time.  

Data Subject Rights

根据法律规定的限制，全网最大的彩票娱乐平台的政策， and regulatory guidelines, 数据对象 have the right to:

• Access their 个人资料 that we process;
  • To rectify inaccuracies in 个人资料 that we hold about them;
  • 从我们用于处理其个人数据的系统中删除其详细信息;
  • To restrict the processing of their 个人资料 in certain ways;
  • To obtain a copy of their 个人资料 in a commonly used electronic form;
  • To object to certain processing of their 个人资料 by us; and
  • To request that we stop sending them direct marketing communications.

大学将尽可能及时和充分地履行这些权利.

数据安全 Measures

大学维持和执行旨在保护机密的政策 and security of 个人资料 and addressing records retention. 相关的政策 include but are not limited to:

数据传输

如有需要，大学可将个人资料转移至外部 并可能与欧盟内外的第三方组织共享个人数据 欧盟主席. Where we share 个人资料, we will require that there are appropriate safeguards in place to protect 个人资料. Safeguards include but are not limited to: requiring third parties to be members of the U.S. Privacy Shield, data security contract provisions, and anonymization of data.

Retention of Personal Data

根据适用的联邦法律，大学将保留个人资料 以及州法律、法规和认证指南，以及大学政策. 当大学不再需要提供服务及服务时，个人资料将会被销毁 计划，应要求或在任何适用的保留期限届满后， 以较晚的为准. 的 manner of destruction shall be appropriate to preserve and 根据信息的敏感性、价值和保密程度，确保信息的保密性 critical importance to the University.

Breach Notification

如发生涉及学生个人资料的资料外泄事件， 员工，校友或供应商，大学将通知相应的主管 在可行的情况下，在发现违规行为后72小时内，除非 这种违规行为不太可能对数据主体的权利和自由造成风险. 此外，大学也会通知个人数据主体的数据泄露 regarding their 个人资料 if the breach is likely to result in a high risk to their rights and freedoms. 的 notification to 数据对象 will include the nature 数据主体应采取的违规和建议步骤，以减轻 potential adverse effects. Initial notification may be general in nature and supplemented as additional information becomes known.

Contact Information

除了联系保存相关记录的办公室外，数据主体 可以联系UA以下办公室，询问他们对大学的问题 policies and to exercise their rights:

Additional Information Regarding GDPR

• 该大学的 General Data Protection Regulation web page
• 的 GDPR的文本
• Data subjects can also contact the appropriate Data Protection Authorities 关于GDPR