European Union General Data Protection Regulation (GDPR) Compliance

Westchester Community College is committed to respecting and protecting the privacy rights of persons in the European Economic Area (“EEA”), comprised of the European Union (“EU”) and the countries of Iceland, Norway, and Lichtenstein, pursuant to the EU General Data Protection Regulation (“GDPR”). This privacy notice outlines how Westchester Community College collects, processes, discloses and uses information that you share with Westchester Community College through our websites, other electronic systems, paper forms, and otherwise.

GDPR Privacy Notice

SUNY Westchester Community College (“WCC”) is committed to respecting and protecting the privacyrights of persons in the European Economic Area (“EEA”), comprised of the European Union (“EU”) andthe countries of Iceland, Norway, and Lichtenstein, pursuant to the EU General Data Protection Regulation (“GDPR”). This privacy notice outlines how Westchester Community College collects,processes, discloses and uses information that you share with Westchester Community Collegethrough our websites, other electronic systems, paper forms, and otherwise.

GDPR Privacy NoticeSUNY Westchester Community College (“WCC”) is committed to respecting and protecting the privacyrights of persons in the European Economic Area (“EEA”), comprised of the European Union (“EU”) andthe countries of Iceland, Norway, and Lichtenstein, pursuant to the EU General Data Protection Regulation (“GDPR”). This privacy notice outlines how Westchester Community College collects,processes, discloses and uses information that you share with Westchester Community Collegethrough our websites, other electronic systems, paper forms, and otherwise.

Applicability of this GDPR Privacy Notice

This GDPR Privacy Notice applies to you if all of the following factors are met:

• You are a natural person—not a corporation, partnership, or other legal entity—who is physicallypresent in the EEA;
• “Personal Information”—any information that relates to or identifies you as an individual as isfurther described below—is provided while you are physically present in the EEA;
• Such Personal Information is not earlier or later provided to Westchester Community Collegewhile you are physically outside the EEA; and,
• Such Personal Information is provided to Westchester Community College:
• During the course of Westchester Community College offering you goods or services;
• While Westchester Community College is monitoring your behavior or health;
• While you are associated with any of Westchester Community College’s programs;
• While you are participating in clinical research programs; or
• While you are receiving health treatment.

Please note that information pertaining to current, former, or prospective employment withWestchester Community College within the United States is not considered “Personal Information” andis excluded from this GDPR Privacy Notice.

Personal Information Westchester Community College Collects

Westchester Community College collects Personal Information – information relating to a personallyidentifiable individual – in order to fulfill its mission as a public institution of highereducation. Westchester Community College requires Personal Information only when necessary.

Personal Information collected by Westchester Community College typically includes an individual’sname, email address, phone number, transcript, academic record, student organization membership,work history, work performance, letters of recommendation, demographic information, documentationprovided to support financial aid applications, donor information, IP addresses, browser and computerinformation, how you interact with our websites and electronic communications, and in some casesyour medical and health information and information observed as part of a research study.

In addition to this, Westchester Community College may process some information about you that isclassed as “sensitive” or “special category” personal data, which requires additional protections. Thisincludes information concerning your ethnicity, sexual orientation, religious beliefs or health/disabilitythat we use for planning and monitoring purposes, or in order to provide care, help or suitableadjustments. For certain courses of study, other sensitive information may be processed, such asinformation about past criminal convictions, working with children or vulnerable adults, and yourfitness to practice in certain regulated professions.

Access to, and the sharing of, your “sensitive” personal data are carefully controlled. You will normallybe given further details about our use of any such data when we collect it from you.Legal Basis for Processing Your Personal InformationWestchester Community College’s processing activities of your Personal Information may rely ondifferent lawful grounds depending on the circumstances. Generally speaking, we typically rely uponone or more of the following lawful bases to process your Personal Information under the GDPR:

• Necessity to enter or for the performance of a contract (e.g., online applications,information provided when enrolling, or for payment information to pay tuition)
• Necessity of Westchester Community College’s legitimate interests or those of third parties(e.g., evaluate candidates for admissions, financial aid, housing, and/or maintain acommunity for alumni)
• Necessity of Westchester Community College’s compliance with legal requirements imposedby state or federal law
• Consent (e.g., for the research projects you may participate in; for processing of specialcategories of personal data)

We consider the processing of your Personal Information to be either necessary for the performance ofour contractual obligations with you (e.g. to manage your education, student experience and welfarewhile studying at Westchester Community College), necessary for compliance with a legal obligation(e.g., visa monitoring), necessary for the performance of tasks we carry out in the public interest(e.g., teaching and research), or necessary for the pursuit of the legitimate interests of WestchesterCommunity College or an external organization (e.g., to enable your access to external services).Westchester Community College requires you to provide us with any information we reasonably askfor to enable us to administer our relationship with you.

If we require your consent for any specific use of your personal information, we will collect it at theappropriate time, and you can withdraw this at any time. Where we ask for any “sensitive”information, such as that concerning your ethnicity, sexual orientation, religious beliefs orhealth/disability, you will normally have the option to refuse your consent by not supplying it.

How Westchester Community College Obtains Personal Information

Westchester Community College obtains your Personal Information:

• From You, the Data Subject: Westchester Community College may receive your PersonalInformation when you visit Westchester Community College’s websites, apply for or attendclasses or programs, apply for or take online courses, travel with Westchester Community Collegeto a location in the EEA, attend events sponsored by Westchester Community College in the EEA,participate in clinical research, voluntarily or involuntarily receive medical treatment or services,or otherwise interact with Westchester Community College in the EEA.
• From Third Parties: Westchester Community College may also receive your Personal Informationfrom third parties. Examples include, without limitation, exam scores received from testingagencies, and registration information received from third parties that administer online courses.Westchester Community College also may receive information from other individuals orinstitutions who provide treatment and services, from public health services, and from lawenforcement, and from other clinical researchers, as well as from those who process theinformation provided on behalf of these entities.

Certain Personal Information collected by Westchester Community College is required for WestchesterCommunity College to be able to provide you with educational services, employment, or treatment asa patient. In the event you do not provide such information, Westchester Community College may beunable to provide you with the requested services.

Use of Personal Information

How Westchester Community College uses your Personal Information depends upon the context inwhich it was provided:

• Prospective Students – Westchester Community College uses your Personal Information inorder to consider you for admission to a campus or a particular program, to award financial aidand merit-based scholarships, and to track the effectiveness of our communications andprograms
• Students – Westchester Community College uses your Personal Information to provide youhigher education services, comply with our legal obligations, enforce Westchester CommunityCollege policies and procedures, and to improve the overall student experience on our campusesand effectiveness of our programs. Some examples of these include registering you for classes,tracking attendance, evaluating your academic performance, submitting required reports tofederal and state regulatory authorities and our accrediting bodies, providing you with academicand career advising, providing housing and food services, evaluating student organizations,evaluating academic programs, and providing letters of recommendation and transcripts toprospective employers or other institutions.
• Alumni & Friends – Westchester Community College uses your Personal Information to track,maintain, and evaluate our relationship with you, provide you with communications andinvitations to campus events, assist you with obtaining employment or admission to anothereducational institution or program, and to evaluate academic and employment outcomes.
• Prospective Employees – Westchester Community College uses your Personal Information toconsider you for employment, evaluate the effectiveness of our recruitment programs, establishminimum requirements for positions, and to improve the attractiveness of WestchesterCommunity College as an employer
• Current Employees – Westchester Community College uses your Personal Information toperform necessary tasks related to your status as an employee, to contact the appropriate personin the event of an emergency, to investigate violations of Westchester Community College policy,to improve the overall employment experience at Westchester Community College.
• Research Participants – Westchester Community College uses your Personal Information tofulfill the objectives of a particular research project, and to provide any promised compensationor other incentives

Westchester Community College may use your Personal Information for other purposes and willprovide you with specific information at the time such alternate use arises.

Sharing of Your Personal Information

Westchester Community College does not sell your Personal Information and only shares yourPersonal Information with third parties if there is a legitimate institutional need to do so. WestchesterCommunity College may share your Personal Information with the following recipients:

• With SUNY System Administration and other campuses within the SUNY System in order togovern, administer, and improve the SUNY system.
• With Westchester Community College’s affiliated entities including the Research Foundationfor the State University of New York, individual campus foundations, campus faculty studentassociations, and other affiliated entities in order to provide ancillary services.
• With Westchester Community College’s service providers that need access to your PersonalInformation in order to provide Westchester Community College with services necessary tofulfill Westchester Community College’s mission or improve the Westchester CommunityCollege student or employee experience.
• With accrediting agencies in order to obtain or maintain accreditations for WestchesterCommunity College’s and its affiliates various programs.
• With the Federal, State, and local governments or regulatory authorities as required by lawor as necessary to fulfill the mission of Westchester Community College.

Please note that the College may provide anonymized data developed from Personal Information tothird parties, such as government entities and research collaborators, and that such anonymized datais outside the scope of this GDPR Privacy Notice.

Your Rights Regarding your Personal Information

Westchester Community College is committed to facilitating the exercise of the rights granted to youby the GDPR in a timely manner. In the context of our processing activities that are subject to theGDPR, you have the following rights regarding your personal information:

• Access, correction and other requests – You have the right to obtain confirmation of whetherwe process your personal data, as well as the right to obtain information about the personal datawe process about you. You also have a right to obtain a copy of this data. Additionally, and undercertain circumstances, you may have the right to obtain erasure, correction, restriction andportability of your personal data.
• Right to object – You have the right to object to receiving marketing materials from us byfollowing the opt-out instructions in our marketing emails, as well as the right to object to anyprocessing of your personal data based on your specific situation. In the latter case, we willassess your request and provide a reply in a timely manner, according to our legal obligations.
• Right to withdrawal consent – For all the processing operations that are based on yourconsent, you have the right to withdraw your consent at any time, and we will stop thoseprocessing operations as allowable by law.

In addition to the rights provided by the GDPR, you may also have rights with respect to your PersonalInformation pursuant to U.S. federal law, state law, and/or Westchester Community College policy.These include, without limitation, policies pertaining to student education records and policiespertaining to certain health records that Westchester Community College maintains.In order to exercise any of these rights, except the right to file a complaint with an EU supervisoryauthority, you should submit your request to the identified GDPR Westchester Community Collegecontact listed at the bottom of this Notice.

Please note that when you make requests based on these rights, if we are not certain of your identity,we may need to ask you for further personal information to be used only for the purposes of replyingto your request.

Security of your Personal Information

Westchester Community College implements appropriate physical, technical, and organizationalsecurity measures to protect your Personal Information consistent with the requirements of law andthe policies of the Westchester Community College Board of Trustees.

Retention and Destruction of Your Personal Information

Westchester Community College will retain your Personal Information for as long as there is alegitimate need to do so and in accordance with the SUNY Records Retention and DispositionPolicy and applicable federal and state law. Retention periods vary and are established consideringour legitimate interests and all applicable legal requirements.

Data Transfer Outside of the EEA

Westchester Community College is based in the United States and is subject to U.S. and New YorkState law. Personal Information that you provide to Westchester Community College will generally behosted on U.S.-based servers. To the extent that Westchester Community College needs to transferyour information either (a) from the EEA to the U.S. or another country or (b) from the U.S. toanother country, Westchester Community College will do so on the basis of either (i) an “adequacydecision” by the European Commission; (ii) EU-sanctioned “appropriate safeguards” for transfer suchas model clauses, a copy of which you may request, if applicable, by contacting WestchesterCommunity College as set forth below; (iii) your explicit and informed consent; or (iv) it beingnecessary for the performance of a contract or the implementation of pre-contractual measures withWestchester Community College measures generally taken at your request (e.g., for the transfer ofpersonal data necessary for your application for admission). Please note that the U.S. is not currentlyconsidered a safe harbor country under the GDPR.

Concerns and Contact Information

If you have any concerns or questions about this notice or how your Personal Information is used,please contact us at [email protected]. Westchester Community College will attempt to promptly address any concern you may have about our data collection and use policies. However, if you believewe have not been able to deal with your concern appropriately, you have a right to complain to yourlocal data protection authority, as granted by Article 77 of the GDPR. You also have the right to submita complaint in the Member State of your residence, place of work, or of an alleged infringement of theGDPR.

Updates to GDPR Privacy Notice

Westchester Community College may update this GDPR Privacy Notice from time to time. Anychanges will become effective upon posting of the revised GDPR Privacy Notice.