GDPR WEBSITE DISCLOSURES
POP-UP BOX LANGUAGE:
NOTICE OF YOUR PRIVACY RIGHTS UNDER THE EUROPEAN UNION’S GENERAL DATA PROTECTION REGULATION
To comply with the GDPR, the University makes the following disclosures to you.
1. The “data controller,” as defined by the GDPR, is University of Arkansas at Monticello.
2. Your personal data may be used by the University to provide educational services and related goods and services to you. For example, we may store or process information you provide when you inquire about or apply for admission, when you apply for or participate in University programs or activities, or when you apply for financial aid or housing or request health services. Your personal data will also be used to perform related administrative, regulatory and financial functions of the University. If you make purchases, such as instructional materials, we may process your personal data in order to complete transactions or provide the materials to you, and we may provide personal data to vendors, to the extent required by the University’s agreements with such vendors.
3. Your personal data may also be processed by the University in order to comply with legal obligations of the University. These obligations may be imposed by United States federal law, the law of one of the United States, the law of the EU, or the law of an EU member state.
4. Your personal data may be processed in order to protect your vital interests or the vital interest of another person when you are incapable of giving consent, for reasons of public interest in the area of public health, for the purpose of protecting student health or safety, for the purpose of fulfilling legal obligations imposed upon the University or when you have consented to the processing of your personal data. Personal data to be processed may include sensitive personal data, which the GDPR defines as information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of identifying a person and data concerning health, sex life or sexual orientation.
5. Your personal data may be transmitted to, and stored in, facilities located in the United States of America, or in other facilities outside of the EU.
6. In order to provide goods or services to you, or to perform other functions described in this disclosure, your personal data may be viewed or processed by the University’s registrar, academic officers and staff, athletic staff, administrative and legal staff, instructors, financial aid officers and public safety officials. Your personal
data may also be viewed or processed by contractors engaged by the University to process data for the purposes described in this disclosure.
7. Your de-identified personal data may be used by the University to assist the University in assessing its programs and services, to provide information to assist the University in directing its recruitment efforts, for administrative purposes, and for research purposes.
8. If you are an employee of the University, your personal data may also be processed for purposes related to your employment. These uses include tax and regulatory reporting, creating and maintaining personnel, payroll and benefits records, and providing or administering employee benefits or employment related insurance plans or products.
9. Your personal data will be stored until it is no longer required for the University to accomplish the purposes described in this document. At a minimum, your personal data will be stored for the periods of time required by the University’s legal obligations, including contractual obligations and obligations imposed by United States and Arkansas law.
10. Under the GDPR you have the right to access your personal data, to receive a copy of the personal data you provided the University, and to have inaccurate personal data corrected. You may also have the right to have your personal data erased when it is no longer needed for the purposes for which it was obtained.
11. Under the GDPR you may also have the right to restrict processing where: (a) you contest the accuracy of your personal data, (b) where the processing is unlawful and you request a restriction instead of erasure, and (c) where the University must retain the data to establish or exercise the defense of a legal claim.
12. You may also have the right to restrict processing of your personal data: (a) if you contest the accuracy of your personal data; (b) if your personal data has been unlawfully processed and you request restriction of the data instead of erasure; (c) when the University no longer needs your personal data for the purposes described in this disclosure, but is required to maintain your data in order to establish or defend a legal claim; and (d) when, pursuant to Article 21 of the GDPR, you have objected to processing your personal data.
13. Under Article 21 of the GDPR, you have the right to object to further processing of your personal data, on grounds specific to you, when the processing is not specific to your relationship to the University but is for carrying out a task in the public interest or in the exercise of the University’s official authority.
14. You have the right to object to use of your personal data for direct marketing purposes.
15. Your personal data must be processed in order to administer your enrollment, to provide you with opportunities to attend classes or engage in field work or study-abroad programs, to purchase materials and to participate in University programs. The University cannot provide you with educational or other goods or services, or the opportunity to engage in University programs, without processing certain types of personal data described in this disclosure document.
16. To exercise your right to correction or erasure of your personal data, to request a copy of your personal data, or revoke any consent you have given, you must make your request, preferably in writing, to Anissa Ross, P.O. Box 3626 Monticello 71656.