CINXE.COM

<!doctype html> <html lang="en-US"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <link rel="apple-touch-icon" sizes="180x180" href="https://privacyportal.utah.edu/wp-content/themes/umctheme3/apple-touch-icon.png"> <link rel="icon" type="image/png" sizes="32x32" href="https://privacyportal.utah.edu/wp-content/themes/umctheme3/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="16x16" href="https://privacyportal.utah.edu/wp-content/themes/umctheme3/favicon-16x16.png"> <link rel="manifest" href="https://privacyportal.utah.edu/wp-content/themes/umctheme3/site.webmanifest"> <link rel="mask-icon" href="https://privacyportal.utah.edu/wp-content/themes/umctheme3/safari-pinned-tab.svg" color="#cc0000">   <script async src='https://www.googletagmanager.com/gtag/js?id=G-PWS5BDCQ5E'></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-PWS5BDCQ5E'); </script>    <meta name="keywords" content="The University of Utah, UofU, The U, GDPR Privacy Notice - Information Privacy Portal" /> <meta name="description" content="GDPR Privacy Notice 1. Purpose The University of Utah (the “University”) is committed to respecting and protecting the privacy rights of persons in the EEA,…" /> <meta property="og:description" content="GDPR Privacy Notice 1. Purpose The University of Utah (the “University”) is committed to respecting and protecting the privacy rights of persons in the EEA,…" /> <meta property="og:title" content="GDPR Privacy Notice - Information Privacy Portal" /> <meta property="og:type" content="website" /> <meta property="og:url" content="https://privacyportal.utah.edu/gdpr-privacy-notice/" /> <meta property="og:image" content="/mnt/nfs/html/capitolreef.umc.utah.edu/wp-content/themes/umctheme3/img/og-image-placeholder.jpg" /> <meta name="twitter:card" content="summary_large_image" />  <meta name="twitter:title" content="GDPR Privacy Notice - Information Privacy Portal" /> <meta name="twitter:description" content="GDPR Privacy Notice 1. Purpose The University of Utah (the “University”) is committed to respecting and protecting the privacy rights of persons in the EEA,…" /> <meta name="twitter:image" content="/mnt/nfs/html/capitolreef.umc.utah.edu/wp-content/themes/umctheme3/img/og-image-placeholder.jpg" /> <meta name="msapplication-TileColor" content="#ffffff"> <meta name="theme-color" content="#ffffff">   <title>GDPR Privacy Notice – Information Privacy Portal</title> <meta name='robots' content='max-image-preview:large' /> <style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style> <link rel='dns-prefetch' href='//kit.fontawesome.com' /> <link rel="alternate" type="application/rss+xml" title="Information Privacy Portal » Feed" href="https://privacyportal.utah.edu/feed/" /> <link rel="alternate" type="application/rss+xml" title="Information Privacy Portal » Comments Feed" href="https://privacyportal.utah.edu/comments/feed/" /> <script> window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/privacyportal.utah.edu\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.2"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); </script> <link rel='stylesheet' id='formidable-css' href='https://privacyportal.utah.edu/wp-content/plugins/formidable/css/formidableforms105.css?ver=3182208' media='all' /> <style id='wp-emoji-styles-inline-css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='https://privacyportal.utah.edu/wp-includes/css/dist/block-library/style.min.css?ver=6.7.2' media='all' /> <style id='classic-theme-styles-inline-css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <style id='global-styles-inline-css'> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} :root :where(.wp-block-pullquote){font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='siteorigin-panels-front-css' href='https://privacyportal.utah.edu/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.5' media='all' /> <link rel='stylesheet' id='uu-umctheme3-style-css' href='https://privacyportal.utah.edu/wp-content/themes/umctheme3/style.css?ver=6.7.2' media='all' /> <link rel='stylesheet' id='uu-umctheme3-custom-style-css' href='https://privacyportal.utah.edu/wp-content/themes/umctheme3-child-privacy/css/custom.css?ver=1743147708' media='all' /> <link rel='stylesheet' id='aos-style-css' href='https://privacyportal.utah.edu/wp-content/themes/umctheme3/css/vendor/aos/aos.css?ver=1743147708' media='all' /> <link rel='stylesheet' id='umctheme3-custom-css' href='https://privacyportal.utah.edu/wp-content/themes/umctheme3/css/main.css?ver=1743147708' media='all' /> <link rel='stylesheet' id='umctheme3-style-css' href='https://privacyportal.utah.edu/wp-content/themes/umctheme3-child-privacy/style.css?ver=3.0' media='all' /> <script src="https://privacyportal.utah.edu/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script> <script src="https://privacyportal.utah.edu/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script> <script src="https://kit.fontawesome.com/5bdd1a2820.js?ver=6.0" id="fa-js-js"></script> <script src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/js/vendor/aos/aos.js?ver=1.0" id="aos-js"></script> <link rel="https://api.w.org/" href="https://privacyportal.utah.edu/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://privacyportal.utah.edu/wp-json/wp/v2/pages/131" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://privacyportal.utah.edu/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 6.7.2" /> <link rel="canonical" href="https://privacyportal.utah.edu/gdpr-privacy-notice/" /> <link rel='shortlink' href='https://privacyportal.utah.edu/?p=131' /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://privacyportal.utah.edu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fprivacyportal.utah.edu%2Fgdpr-privacy-notice%2F" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://privacyportal.utah.edu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fprivacyportal.utah.edu%2Fgdpr-privacy-notice%2F&format=xml" /> <script>document.documentElement.className += " js";</script> <style media="all" id="siteorigin-panels-layouts-head">/* Layout 131 */ #pgc-131-0-0 , #pgc-131-1-0 { width:100%;width:calc(100% - ( 0 * 30px ) ) } #pg-131-0 , #pl-131 .so-panel { margin-bottom:30px } #pl-131 .so-panel:last-of-type { margin-bottom:0px } #pg-131-0> .panel-row-style { background-color:#be0000;padding:100px 0px 100px 100px } #pg-131-0.panel-has-style > .panel-row-style, #pg-131-0.panel-no-style , #pg-131-1.panel-has-style > .panel-row-style, #pg-131-1.panel-no-style { -webkit-align-items:flex-start;align-items:flex-start } #pgc-131-0-0 { align-self:auto } @media (max-width:780px){ #pg-131-0.panel-no-style, #pg-131-0.panel-has-style > .panel-row-style, #pg-131-0 , #pg-131-1.panel-no-style, #pg-131-1.panel-has-style > .panel-row-style, #pg-131-1 { -webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column } #pg-131-0 > .panel-grid-cell , #pg-131-0 > .panel-row-style > .panel-grid-cell , #pg-131-1 > .panel-grid-cell , #pg-131-1 > .panel-row-style > .panel-grid-cell { width:100%;margin-right:0 } #pl-131 .panel-grid-cell { padding:0 } #pl-131 .panel-grid .panel-grid-cell-empty { display:none } #pl-131 .panel-grid .panel-grid-cell-mobile-last { margin-bottom:0px } } </style>  </head> <body class="page-template page-template-page-templates page-template-page_with-subnav page-template-page-templatespage_with-subnav-php page page-id-131 uu-body siteorigin-panels siteorigin-panels-before-js">      <div id="sidenav" class="uu-sidenav">  <div class="uu-mobile-sidenav-toggle"> <div id="mobile_sidenav_toggle_btn" class="hamburger uu-hamburger sidenav-open"> <div class="hamburger-box"> <div class="hamburger-inner"></div> </div> </div> </div>   <div class="uu-sidenav-header"> <div class="uu-sidenav-header-logo"> <a href="https://privacyportal.utah.edu/" class="uu-sidenav-dept-logo" aria-label="Visit Site Homepage"> <img src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/img/universityofutah.png" alt="University of Utah Logo" title="University of Utah"> </a> </div> </div>   <div class="uu-sidenav-menu-block"> <div class="sidenav-menu-title">Privacy Portal</div><hr class="left"><nav class="menu-privacy-portal-container"><ul id="menu-privacy-portal" class="sidenav-menu" rel="top"><li id="menu-item-45" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-45"><a href="https://privacyportal.utah.edu/how-to-exercise-your-rights/"><span>How to Exercise Your Rights</span></a></li> <li id="menu-item-57" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-57"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/"><span>Privacy Policies</span></a> <ul class="sub-menu"> <li id="menu-item-68" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-68"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/privacy-statement/"><span>Privacy Statement</span></a></li> <li id="menu-item-11214" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-11214"><a href="https://healthcare.utah.edu/patient-privacy"><span>Patient Privacy</span></a></li> <li id="menu-item-66" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-66"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/student-privacy/"><span>Student Privacy</span></a></li> </ul> </li> <li id="menu-item-130" class="menu-item menu-item-type-post_type menu-item-object-page current-menu-ancestor current-menu-parent current_page_parent current_page_ancestor menu-item-has-children menu-item-130"><a href="https://privacyportal.utah.edu/regulators-portal/"><span>Regulators and Supervisory Authorities</span></a> <ul class="sub-menu"> <li id="menu-item-11249" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11249"><a href="https://privacyportal.utah.edu/regulators-portal/"><span>Regulators Portal</span></a></li> <li id="menu-item-138" class="menu-item menu-item-type-post_type menu-item-object-page current-menu-item page_item page-item-131 current_page_item menu-item-138"><a href="https://privacyportal.utah.edu/gdpr-privacy-notice/" aria-current="page"><span>GDPR Privacy Notice</span></a></li> <li id="menu-item-91" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-91"><a href="https://privacyportal.utah.edu/regulators-and-supervisory-authorities/pipl-privacy-notice/"><span>PIPL Privacy Notice</span></a></li> </ul> </li> <li id="menu-item-109" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-109"><a href="https://ai.utah.edu/"><span>AI Regulations</span></a></li> <li id="menu-item-106" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-106"><a href="https://privacyportal.utah.edu/compliance-with-privacy-laws-and-regulations/"><span>Compliance with Privacy Laws and Regulations</span></a></li> </ul></nav> </div>   <div class="uu-sidenav-menu-block"> </div>   <div class="uu-sidenav-menu-block"> </div>   <div class="uu-sidenav-footer"> </div>  </div>   <div class="uu-search" id="main_search">  <form role="search" method="get" class="uu-search-form search-form" id="site_search" action="https://privacyportal.utah.edu/"> <div class="input-group"> <div class="search-icon"> <i class="far fa-search"></i> </div> <label class="search-label-for-accessibility" for="site_search_input">Search Site</label> <input type="search" id="site_search_input" name="s" value="" class="global-search-input search-field" placeholder="Search Site"> <input type="hidden" name="gcse_action" id="search_gcse_action" value="site"> </div> <div class="form-powered-by powered-by-uofu"> <span>Powered by the University of Utah</span> </div> <div class="form-powered-by powered-by-google"> <span>Powered by</span> <img src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/img/google-logo.png" alt="Powered By Google Search"> </div> <div class="search-type-toggle"> <label class="uu-switch" for="search_campus_checkbox"> <input type="checkbox" name="search_campus_checkbox" value="" id="search_campus_checkbox"> <span class="uu-switch-slider"></span> <span class="uu-switch-label">Search Campus</span> </label> </div> </form>  </div>   <div id="page" class="site uu-page-container">  <header id="header" class="uu-header fixed">     <div class="uu-bottom-header">  <div id="header_logo" class="uu-header-logo"> <a href="https://www.utah.edu" aria-label="Visit University of Utah Homepage"></a> </div>   <div class="uu-header-title"> <a href="https://privacyportal.utah.edu/"> <h1> Information Privacy Portal <span>Understanding Your Rights to Your Data</span> </h1> </a> </div>   <div class="uu-search-toggle"> <div class="search-btn"><i class="far fa-search"></i></div> </div>   <div class="uu-sidenav-toggle"> <div id="sidenav_toggle_btn" class="hamburger uu-hamburger"> <div class="hamburger-box"> <div class="hamburger-inner"></div> </div> </div> </div>  </div> </header>  <aside id="sidebar" class="site-sidebar">  <nav class="uu-subnav"> <div class="uu-subnav-title"></div> <div class="subnav-header">Privacy Portal</div><hr class="left"><ul class="menu" rel="top"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-45"><a href="https://privacyportal.utah.edu/how-to-exercise-your-rights/">How to Exercise Your Rights</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-57"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/">Privacy Policies</a> <ul class="sub-menu"> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-68"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/privacy-statement/">Privacy Statement</a></li> <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-11214"><a href="https://healthcare.utah.edu/patient-privacy">Patient Privacy</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-66"><a href="https://privacyportal.utah.edu/privacy-portal/privacy-policies/student-privacy/">Student Privacy</a></li> </ul> </li> <li class="menu-item menu-item-type-post_type menu-item-object-page current-menu-ancestor current-menu-parent current_page_parent current_page_ancestor menu-item-has-children menu-item-130"><a href="https://privacyportal.utah.edu/regulators-portal/">Regulators and Supervisory Authorities</a> <ul class="sub-menu"> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11249"><a href="https://privacyportal.utah.edu/regulators-portal/">Regulators Portal</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page current-menu-item page_item page-item-131 current_page_item menu-item-138"><a href="https://privacyportal.utah.edu/gdpr-privacy-notice/" aria-current="page">GDPR Privacy Notice</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-91"><a href="https://privacyportal.utah.edu/regulators-and-supervisory-authorities/pipl-privacy-notice/">PIPL Privacy Notice</a></li> </ul> </li> <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-109"><a href="https://ai.utah.edu/">AI Regulations</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-106"><a href="https://privacyportal.utah.edu/compliance-with-privacy-laws-and-regulations/">Compliance with Privacy Laws and Regulations</a></li> </ul> </nav>  </aside>  <div id="primary" class="content-area"> <div id="uu-breadcrumbs" class="uu-breadcrumbs"><a href="https://privacyportal.utah.edu">Home</a> <i class="fal fa-angle-right"></i> <span class="current">GDPR Privacy Notice</span></div>  <main id="main" class="site-main">  <article id="post 131" class="subnav-active post-131 page type-page status-publish hentry">  <div class="entry-content"> <div id="pl-131" class="panel-layout" ><div id="pg-131-0" class="panel-grid panel-has-style" ><div class="siteorigin-panels-stretch panel-row-style panel-row-style-for-131-0" data-stretch-type="full" ><div id="pgc-131-0-0" class="panel-grid-cell" ><div id="panel-131-0-0-0" class="so-panel widget widget_sow-editor panel-first-child panel-last-child" data-index="0" ><div class="so-widget-sow-editor so-widget-sow-editor-base" > <div class="siteorigin-widget-tinymce textwidget"> <h2 class="white">GDPR Privacy Notice</h2> <hr class="thick white left" /> </div> </div></div></div></div></div><div id="pg-131-1" class="panel-grid panel-no-style" ><div id="pgc-131-1-0" class="panel-grid-cell" ><div id="panel-131-1-0-0" class="so-panel widget widget_sow-editor panel-first-child panel-last-child" data-index="1" ><div class="so-widget-sow-editor so-widget-sow-editor-base" > <div class="siteorigin-widget-tinymce textwidget"> <h3>1. Purpose</h3> <p>The University of Utah (the “University”) is committed to respecting and protecting the privacy rights of persons in the EEA, comprised of the European Union (“EU”) and the countries of Iceland, Norway, and Lichtenstein, pursuant to the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN">EU General Data Protection Regulation</a> (“GDPR”). This GDPR Privacy Notice describes the University’s commitment to the privacy of persons in the EEA, and supplements the University’s Privacy Statement for certain persons in the European Economic Area (“EEA”).</p> <h3>2. Does This GDPR Privacy Notice Apply to Me?</h3> <p>This GDPR Privacy Notice applies to you if:</p> <ul> <li>You are a “Person” or “Data Subject”—meaning a natural person, not a corporation, partnership, or other legal entity—who is physically present in the EEA;</li> <li>It is with respect to your “Personal Information”—meaning any information relating to an identified or identifiable person—that is provided while you are physically present in the EEA;</li> <li>Such Personal Information is not earlier or later provided to the University while you are outside the EEA; and</li> <li>Such Personal Information is provided to the University: <ul> <li>During the course of the University offering you goods or services;</li> <li>While the University is monitoring your behavior or health;</li> <li>While you are associated with any of the University’s programs;</li> <li>While you are participating in clinical research programs; or</li> <li>While you are receiving health treatment.</li> </ul> </li> </ul> <h3>3. <strong>What Personal Information Does the University Process?</strong></h3> <p>We process your Personal Information, meaning we collect, record, organize, structure, store, adapt, alter, retrieve, consult, use, disclose by transmission, disseminate, make available, align, combine, restrict, erase, or destroy your Personal Information.</p> <p style="padding-left: 40px;">A. General Categories</p> <p style="padding-left: 40px;">Depending on the specific purpose for processing Personal Information, the University may process the following general categories of Personal Information:</p> <ul> <li style="list-style-type: none;"> <ul> <li>Names</li> <li>Addresses</li> <li>Telephone numbers</li> <li>Email addresses</li> <li>Identification numbers including but not limited to social security numbers and driver’s license numbers</li> <li>University identification numbers</li> <li>Personal identification numbers</li> <li>Usernames</li> <li>Passwords</li> <li>Demographic information, including residential information</li> <li>Education history</li> <li>Entrance exam scores</li> <li>Background check information, including criminal records</li> <li>Personal references</li> <li>Emergency contact information</li> <li>Financial information and family financial information including credit and debit-card numbers, tax information, financial aid information, and insurance and benefits information</li> <li>Transaction history</li> <li>Business information</li> <li>Passport and visa information</li> <li>Work history</li> <li>Donation history</li> <li>Insurance information</li> <li>Military service</li> <li>IP addresses</li> <li>Location information</li> <li>Device information</li> <li>Metadata</li> <li>Education records including but not limited to coursework, correspondence, evaluations, disciplinary complaints, and other records, and files maintained by the University as part of the educational process</li> <li>Any requests for accommodations or leave</li> <li>Medical history and treatment information</li> <li>Family medical history information</li> <li>Disability information</li> <li>Biometric and genetic information</li> <li>Photographs</li> <li>Purchasing activity to secure food, lodging, and other services for you</li> </ul> </li> </ul> <p style="padding-left: 40px;">B. Special Categories</p> <p style="padding-left: 40px;">In order to fulfill certain of the purposes identified in the table below, the University may need to request special categories of Personal Information—information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; data concerning health or treatment; or data concerning a natural person’s sex life or sexual orientation.</p> <p>Before the University processes your special-category Personal Information or your criminal-conviction Personal Information, if any, the University will ask for your affirmative consent unless the University has another legal basis for the processing, in which case the University will inform you of that basis. In this Notice, these special categories are referred to as Sensitive Personal Information.</p> <h3>4. <strong>Why the University Processes Your Personal Information</strong></h3> <p>The University requires Personal Information only when necessary. The table below describes the purposes for which the University processes your personal data and the legal basis for the processing.</p> <div class="scroll-overflow"> <table class="uu-table striped header-dark"> <tbody> <tr> <td><strong>Purpose of Processing</strong></td> <td><strong>Legal Basis</strong></td> </tr> <tr> <td>As part of the admissions process, we collect applicant Personal Information to evaluate applications. We also may obtain Personal Information from third parties, such as other schools, references, family members, and education as part of an application package.</td> <td><em>Legitimate Interest</em>: Personal Information collected and processed through the application is necessary to evaluate candidates for admissions and for our internal statistical and analytics purposes.</p> <p><em>Contract</em>: Personal Information collected and processed through the University application is necessary for the performance of a contract to provide you education services or to take steps at your request prior to entering into a contract to provide you education services.</p> <p><em>Public task or public interest</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services. As part of admissions or financial aid applications, we may collect and process information related to race, ethnicity, or criminal history.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected if you have consented to the processing.</p> </td> </tr> <tr> <td>To support course registration</td> <td><em>Legitimate Interest</em>: Personal Information collected and processed for matriculated students, staff, faculty and members of the public, as appropriate for the course, to register in courses or classes</p> <p><em>Contract</em>: Personal Information collected and processed through course-registration sites is necessary for the performance of a contract to provide you education services.</p> <p><em>Public task or public interest</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services. As part of admissions or financial aid applications, we may collect and process information related to race, ethnicity, or criminal history.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected if you have consented to the processing.</p> </td> </tr> <tr> <td>To evaluate and determine whether financial aid opportunities are available to an applicant</td> <td><em>Legitimate Interest</em>: Personal Information collected and processed through the financial aid application is necessary to evaluate whether the applicant is eligible to receive financial aid and for our internal statistical and analytics purposes.</p> <p><em>Contract</em>: Personal Information collected and processed through the financial aid application is necessary for the performance of a contract to provide you financial aid or to take steps at your request prior to entering into a contract to provide you financial aid.</p> <p><em>Public task or public interest</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services. As part of admissions or financial aid applications, we may collect and process information related to race, ethnicity, or criminal history.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected if you have consented to the processing.</p> </td> </tr> <tr> <td>To facilitate housing for individuals studying or participating in programs at or through the University</td> <td><em>Legitimate Interest</em>: Personal Information will be collected and processed to facilitate housing.</p> <p><em>Contract</em>: Personal Information will be collected and processed to perform on a contract or to take steps at your request.</p> <p><em>Public task or public interest</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services. As part of admissions or financial aid applications, we may collect and process information related to race, ethnicity, or criminal history.</p> </td> </tr> <tr> <td>To provide training and educational programs</td> <td><em>Legitimate Interest</em>: To facilitate provision of on-line education courses to matriculated students, staff, faculty and members of the public, as appropriate for the course</p> <p><em>Contract</em>: Personal Information collected and processed through the application is necessary for the performance of a contract to provide you education services or to take steps at your request prior to entering into a contract to provide you education services.</p> <p><em>Public task or public interest</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services. As part of admissions or financial aid applications, we may collect and process information related to race, ethnicity, or criminal history.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected if you have consented to the processing.</p> </td> </tr> <tr> <td>To facilitate application for and sponsoring of visas to study, work, and/or research at the University, including all functions necessary to comply with applicable immigration laws</td> <td><em>Legitimate Interest</em>: To facilitate employment, research, and study opportunities and comply with relevant laws</p> <p><em>Contract</em>: Personal Information will be collected and processed to perform on a contract or to take steps at your request.</p> </td> </tr> <tr> <td>To process employment applications and independent-contractor information</td> <td><em>Legitimate Interest</em>: For individuals interested in employment opportunities, processing applications</p> <p><em>Contract</em>: Personal Information or Sensitive Personal Information will be collected and processed in order to enter into or perform a contract for employment. We may collect and process information related to race, ethnicity, or criminal history as required by law or for reporting requirements.</p> </td> </tr> <tr> <td>To receive donations</td> <td><em>Legitimate Interest</em>: To collect and process donations/gifts and donor information</p> <p><em>Legal obligation</em>: Personal Information may be collected in order to process and record donations and as required for legal reporting obligations.</p> </td> </tr> <tr> <td>To purchase tickets to events</td> <td><em>Contract</em>: To process ticket payment for a variety of events</td> </tr> <tr> <td>For event registration</td> <td><em>Legitimate Interest</em>: To process registration for sports, cultural, educational and other events</p> <p><em>Public task</em>: Personal information may be collected and processed in the exercise of our role to provider of educational services.</p> </td> </tr> <tr> <td>To purchase parking passes and permits</td> <td><em>Contract</em>: To facilitate payments for parking passes and permits</td> </tr> <tr> <td>To submit requests for services (e.g., IT, help desk, help line, etc.)</td> <td><em>Legitimate Interest</em>: To process service requests from students, staff and faculty</p> <p><em>Contract</em>: If there is a contract that governs your use of such services, Personal Information is collected and processed pursuant to that contract.</p> </td> </tr> <tr> <td>Travel arrangements</td> <td><em>Legitimate Interest</em>: To facilitate travel arrangements and coordination for students and affiliated travelers through University programs</p> <p><em>Contract</em>: If there is a contract that governs your use of travel sites, Personal Information is collected and processed pursuant to that contract.</p> </td> </tr> <tr> <td>Emergency situations</td> <td><em>Vital Interest</em>: Our collection and processing of your Personal Information to protect an interest that is essential to your life or the life of someone else</td> </tr> <tr> <td>To stay connected with University alumni</td> <td><em>Legitimate interest</em>: To maintain strong relationships with University alumni and for communicating unsolicited non-commercial messages.</p> <p><em>Contract</em>: Personal Information may be collected in order to process transactions, offer services, or process your requests.</p> </td> </tr> <tr> <td>To provide treatment and health services</td> <td><em>Legitimate interest</em>: Our collection and processing of your Personal Information for the purposes of preventative or occupational medicine, for assessing the working capacity of an employee, for medical diagnosis, for providing health or social care or treatment, or for managing health or social care systems and services on the basis of United States and state laws</p> <p><em>Contract:</em> If there is a contract that governs the terms of treatment, Personal Information is collected and processed pursuant to that contract.</p> <p><em>Medical Treatment or Public Health</em>: Personal Information or Sensitive Personal Information may be collected and processed in order to provide medical treatment or in the interest of public interest in the area of public health. We may collect and process information related to race or ethnicity in order to provide care.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected if you have consented to the processing.</p> </td> </tr> <tr> <td>To protect vital interests when the subject is incapable of providing consent</td> <td><em>Legitimate interest: </em>Our collection and processing Personal Information, such as health related personal information, when necessary to protect the vital interests of a data subject who is physically or legally incapable of giving consent.</p> <p><em>Vital Interests</em>: Personal Information or Sensitive Personal Information may be collected and processed in order to protect your interests in the event you are unable to consent, such as in emergency or health care situations</p> </td> </tr> <tr> <td>Information made public by you</td> <td><i>Legitimate interest:</i> Our collection and processing of data made public by you for purposes of processing admissions, sponsoring of visas, processing applications for employment, responding to emergency situations, providing treatment and health services, protecting vital interests when the subject is incapable of consent, as necessary for judicial proceedings, as necessary for public health<u>,</u> or for other reasons that are described when you are asked to provide the data.</td> </tr> <tr> <td>Judicial proceeding</td> <td><em>Legitimate interest: </em>Our collection and processing that is necessary for the establishment, exercise, or defense of legal claims or where courts are acting in their judicial capacity</p> <p><em>Legal obligations</em>: Personal Information or Sensitive Personal Information may be collected and processed if necessary for compliance with a legal obligation or as related to a legal claim.</p> </td> </tr> <tr> <td>Public interest such as for taxation; reporting crimes; humanitarian purposes; preventive or occupational medicine; public health; social care; or quality and safety of products, devices and services; and as required by law or for legal reporting requirements</td> <td><em>Legitimate interest: </em>Our collection and processing Personal Information necessary for reasons of substantial public interest on the basis of United States or state laws that is proportionate to the aim pursued and which contains appropriate safeguarding measures</p> <p><em>Legal obligations</em>: Personal Information or Sensitive Personal Information may be collected and processed if necessary for compliance with a legal obligation.</p> <p><em>Public task</em>: Personal information or Sensitive Personal Information may be collected or processed in the exercise of our role as a provider of educational services.</p> </td> </tr> <tr> <td>Public health and safety reporting requirements</td> <td><em>Legitimate interest: </em>Our collection and processing Personal Information that is necessary for public interest reasons in the area of public health, including protection against threats to health or ensuring high standard of quality and safety of health care, medicinal products, or medical devices</p> <p><em>Legal obligations</em>: Personal Information or Sensitive Personal Information may be collected and processed if necessary for compliance with a legal obligation.</p> <p><em>Public task</em>: Personal information or Sensitive Personal Information may be collected and processed in the exercise of our role as a provider of educational services.</p> <p><em>Public Health</em>: Personal Information or Sensitive Personal Information may be collected and processed as necessary for the public interest in the area of public health.</p> </td> </tr> <tr> <td>Research</td> <td><em>Legitimate interest: </em>Our collection and processing Personal Information for scientific and historical research purposes or statistical purposes</p> <p><em>Contract</em>: If there is a contract that governs, Personal Information is collected and processed pursuant to that contract.</p> <p><em>Public interest or public health</em>: Personal Information or Sensitive Personal Information may be collected and processed as it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.</p> <p><em>Consent</em>: Personal Information or Sensitive Personal Information may be collected and processed if you have consented to the processing.</p> </td> </tr> </tbody> </table> </div> <h3>5. <strong>How Does the University Receive Your Personal Information?</strong></h3> <ol> <li>From Third Parties:<br /> The University may also receive your Personal Information from third parties. Examples include college entrance exam scores received from testing agencies, and online course registration information received from third parties that administer online courses. The University also may receive information from other individuals or institutions who provide treatment and services, from public health services, from law enforcement, and from other clinical researchers, as well as from those who process the information provided on behalf of these entities.</li> <li>From You, the Data Subject:<br /> The University may receive your Personal Information when you visit the University’s websites, apply for or attend classes or programs, apply for or take online courses, travel with the University to a location in the EEA, attend events sponsored by the University in the EEA, participate in clinical research, voluntarily or involuntarily receive medical treatment or services, or otherwise interact with the University in the EEA.</li> </ol> <h3>6. <strong>Who Processes Your Personal Information?</strong></h3> <ol> <li>University Personnel:<br /> Your Personal Information may be processed by University trustees and employees, including faculty, researchers, medical professionals, financial-aid counselors, human-resources professionals, law-enforcement officers, and others, as may be necessary to carry out the purposes for processing the information and University activities.</li> <li>University Related Organizations:<br /> The University may share your Personal Information with the University’s related organizations.</li> <li>Third Parties:<br /> The University may share your Personal Information with third parties, such as: educational-platform providers and course partners to further the purposes for processing the information and University activities; U.S. and foreign government entities to fulfill regulatory obligations (e.g., visa processing or public health or legal processing) and to facilitate access to funding sources (e.g., financial aid); partner institutions to facilitate study abroad activities; and vendors to provide services related to your affiliation with the University (e.g., print diplomas, arrange housing) and to improve the University’s outreach efforts.The University may disclose your Personal Information to legal or governmental regulatory authorities as required by applicable law. We may also disclose your Personal Information to third parties as required by applicable law in connection with claims, disputes, or litigation, when otherwise required by applicable law, if we determine disclosure is necessary to protect the health and safety of you or us, to enforce our legal rights, or to enforce contractual commitments that you have made.</li> </ol> <p>The University may share your Personal Information with third parties who complete transactions or perform services on our behalf or for your benefit, including functions related to payment and operation, legal processes, benefits assistance, and for quality control purposes. The University also may share your information with other entities or individuals as described in the University of Utah Health’s Notice of Privacy Practices: <a href="https://healthcare.utah.edu/patient-privacy#notice">https://healthcare.utah.edu/patient-privacy#notice</a>.</p> <p>Please note that the University may provide anonymized data developed from Personal Information to third parties, such as government entities and research collaborators, and that such anonymized data is outside the scope of this GDPR Privacy Notice.</p> <h3><strong>7. How Long Does the University Keep Your Personal Information?</strong></h3> <p>The University keeps your Personal Information as required by law or our policies to perform our legitimate interests, contracts, and substantial public interests. Many of our record retention schedules can be found at the Utah Division of Archives and Record Services’ website.</p> <p>Here is a direct link to the retention schedules for the State of Utah which apply if we do not have a retention schedule for the type of records in our retention schedules <a href="https://axaemarchives.utah.gov/solr/axaem/EntityGRSItem">https://axaemarchives.utah.gov/solr/axaem/EntityGRSItem</a></p> <h3>8. <strong>What Are Your Rights as a Data Subject?</strong></h3> <p>As a Data Subject pursuant to the GDPR, you have certain rights. This GDPR Privacy Notice summarizes what these rights under the GDPR involve and how you can exercise these rights. More detail about each right, including exceptions and limitations, can be found in Articles 15-21 and 77 of <u><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN">the GDPR</a></u>.</p> <p>Please note: <em>Nothing in this </em>GDPR Privacy Notice <em>is intended by the University to waive sovereign immunity or any other defenses or immunities afforded by any or all U.S. federal law, Utah state law, other applicable state law in the United States, and EU law.</em></p> <p><u>The Right of Access</u></p> <p>You have the right to request that the University confirm whether it is processing your Personal Information. If the University is processing your Personal Information, you have the right to access that Personal Information, and the University will provide you with a copy of that Personal Information unless prevented by applicable law.</p> <p><u>The Right of Correction </u></p> <p>You have the right to request that the University correct any inaccurate Personal Information that it maintains about you. You also have the right to request that the University complete any incomplete Personal Information that it maintains about you, which could be accomplished by incorporating a supplementary statement that you submit. If the University concurs that the Personal Information is incorrect or incomplete, the University will promptly correct or complete it.</p> <p><u>The Right to Erasure</u></p> <p>You have the right to request the erasure of Personal Information that the University maintains about you in certain circumstances. These circumstances are identified in Article 17 of the GDPR and include that the Personal Information is no longer necessary in relation to the purpose(s) for which it was collected.</p> <p>Subject to applicable U.S., state, and EU law, and University policies, including but not limited to its Privacy Statement, and provided that there are no overriding legitimate grounds for the University to retain the Personal Information, the University will comply with the request and will take reasonable steps to inform any third parties with whom the Personal Information was shared.</p> <p><u>The Right to Restrict Processing of Personal Information</u></p> <p>You have the right to request that the University restrict the processing of your Personal Information where one of the reasons identified in Article 18 of the GDPR apply. These reasons include that the Personal Information is inaccurate, the processing is unlawful, or the University no longer needs the Personal Information.</p> <p>If the University grants your request to restrict processing, the University will only process that Personal Information with your consent, for the protection of the rights of another natural or legal person, for reasons of important public interest, for the establishment, exercise or defense of legal claims, or as otherwise required by applicable U.S., state, or EU law.</p> <p><u>The Right to Data Portability</u></p> <p>Where the basis for processing is either consent or performance of a contract between you and the University, and where the processing is carried out by automated means, you have the right to receive your Personal Information that you have provided to the University. The University will provide the Personal Information in a structured, commonly used, and machine-readable format. Where technically feasible and upon your request, the University will transmit the Personal Information directly to another entity.</p> <p><u>The Right to Withdraw Consent</u></p> <p>If the basis for processing your Personal Information is consent, you may revoke your consent at any time. Upon receipt of your notice withdrawing consent, and if there are no other legal grounds for the processing, the University will stop processing the Personal Information unless the processing is necessary for the establishment, exercise, or defense of legal claims. Revoking consent does not affect the lawfulness of processing that occurred before the revocation.</p> <p><u>The Right to Object to Processing</u></p> <p>In certain situations, you may have the right to object to processing of your Personal Information</p> <ul> <li><strong><em>Public Interest or Legitimate Interests</em></strong><strong><em>. </em></strong>If the basis for processing your Personal Information is public interest or legitimate interests, you have the right to object to processing the Personal Information. The University will cease processing unless it demonstrates overriding legitimate grounds for processing or the processing is necessary for the establishment, exercise, or defense of legal claims.</li> <li><strong><em>Direct Marketing</em></strong><strong><em>. </em></strong>If the University is using your Personal Information for direct marketing purposes such as fundraising, you have the right to object at any time, and the University will stop using your Personal Information for that purpose.</li> </ul> <p><u>The Right to File a Complaint</u></p> <p>You have the right to submit a complaint with an EU supervisory authority, in particular the one in the EU Member State of your habitual residence, place of work, or place of the alleged violation, if you believe that the University’s processing of your Personal Information violates the GDPR.</p> <p>For more information on the process for submitting a complaint, consult the relevant EU supervisory authority: <a href="https://ec.europa.eu/newsroom/article29/items">https://ec.europa.eu/newsroom/article29/items</a>.</p> <h3>9. <strong>How to Exercise Your Rights</strong></h3> <p>In order to exercise any of these rights, except the right to file a complaint with an EU supervisory authority, you should submit your request to the University’s Information Security Office:</p> <div style="background-color: #f7f7f7; padding: 30px;"> <p><strong>Email:</strong> <a href="mailto:iso-grc@utah.edu">iso-grc@utah.edu</a></p> <p><strong>Telephone:</strong> 801-587-1925</p> <p><strong>Address:</strong> UIT Information Security Office</p> <p>The University of Utah<br /> 102 S 200 E, Suite 110<br /> Salt Lake City, UT 84111</p> </div> <p>At that time, you will be asked to:</p> <ul> <li>Identify yourself</li> <li>Provide information to support that the GDPR applies to you (see Section 2, above)</li> <li>Identify the specific information or data that you are concerned about</li> <li>State what right(s) you wish to exercise</li> </ul> <p>To expedite processing your request, please identify the data-collection location (e.g., the website where your Personal Information was collected), if known.</p> <h3>10. <strong>How Does the University Respond to Requests for Personal Information?</strong></h3> <p>In addition to the rights provided by the GDPR, you may also have rights with respect to your Personal Information pursuant to U.S. federal law, state law, or University policy. When you submit a request to the University to exercise your rights, it will respond in accordance with existing University policies and procedures that implement the relevant privacy law(s). These include, but are not limited to, policies pertaining to student education records and policies pertaining to certain health records that the University maintains.</p> <h3><strong>11. Existence of Automated Individual Decision-Making</strong></h3> <p>The University may use automated decision-making, including profiling, to help identify prospective University supporters and its activities. The logic would take an all-factor approach to assessing a possible donor’s propensity to support the University and may result in a prospective donor being contacted to explore support opportunities.</p> <p>You will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for entering into or performing a contract or unless you explicitly consent.</p> <h3><strong>12. Transfer of Personal Information outside the EEA</strong></h3> <p>The University is based in the U.S. and is subject to U.S. and Utah law. Personal Information that you provide to the University will generally be hosted on U.S. servers. To the extent that the University needs to transfer your information either (a) from the EEA to the U.S. or another country or (b) from the U.S. to another country, the University will do so on the basis of either (i) an “adequacy decision” by the European Commission; (ii) EU-sanctioned “appropriate safeguards” for transfer such as model clauses, a copy of which you may request, if applicable, by contacting the University as set forth in Section 9; (iii) your explicit and informed consent; or (iv) it being necessary for the performance of a contract or the implementation of pre-contractual measures with the University, in which case the University will inform you of the intent to transfer the Personal Information. Please note that the U.S. is not currently considered a safe harbor country under the GDPR.</p> <h3><strong>13. How Do I Contact the University, the Data Controller?</strong></h3> <p>The University is the data controller. If you have any questions about anything contained in this GDPR Privacy Notice, please contact the University’s Information Security Office:</p> <div style="background-color: #f7f7f7; padding: 30px;"> <p><strong>Email:</strong> <a href="mailto:iso-grc@utah.edu">iso-grc@utah.edu</a></p> <p><strong>Telephone:</strong> 801-587-1925</p> <p><strong>Address:</strong> UIT Information Security Office</p> <p>The University of Utah<br /> 102 S 200 E, Suite 110<br /> Salt Lake City, UT 84111</p> </div> <h3></h3> <h3><strong>14. GDPR</strong></h3> <p>If you are interested in reviewing an English version of the GDPR, please see <u><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN" target="_blank" rel="noopener">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN</a></u>.</p> <h3><strong>15. Updates to GDPR Privacy Notice</strong></h3> <p>The University may update this GDPR Privacy Notice from time to time. Any changes will become effective upon posting of the revised GDPR Privacy Notice.</p> </div> </div></div></div></div></div> </div>  </article>  </main>  </div>   <footer id="footer">  <div id="top_footer" class="uu-top-footer"> <div class="uu-top-footer-container">  <div class="uu-footer-dept"> <a href="https://privacyportal.utah.edu/" class="uu-footer-dept-logo" aria-label="Visit Site Homepage"> <img src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/img/blocku.svg" alt="University of Utah Block U Logo" title="University of Utah"> </a> <div class="uu-footer-dept-name"> Information Privacy Portal </div> <p class="uu-footer-dept-address"> 201 PRESIDENTS CIRCLE <br> SALT LAKE CITY, UT 84112 </p> <p class="uu-footer-dept-phone"> 801-581-7200 </p> </div>  </div> </div>   <div id="bottom_footer" class="uu-bottom-footer"> <div class="uu-bottom-footer-container">  <div class="uu-footer-logo"> <a href="https://utah.edu/" target="_blank" title="University of Utah"></a> </div>   <div class="uu-footer-links"> <p>© 2025 THE UNIVERSITY OF UTAH</p> <ul> <li> <a href="https://utah.edu/nondiscrimination/" target="_blank">Nondiscrimination & Accessibility</a> </li> <li> <a href="https://utah.edu/disclaimer/" target="_blank">Disclaimer</a> </li> <li> <a href="https://utah.edu/privacy/" target="_blank">Privacy</a> </li> <li> <a href="https://attheu.utah.edu/media-contacts/" target="_blank">Media Contacts</a> </li> </ul> </div>   <div class="uu-footer-social"> <ul> <li><a href="https://twitter.com/uutah" target="_blank" aria-label="Twitter Link"><i class="fa-brands fa-x-twitter" title="Follow the University of Utah on Twitter"></i></a></li> <li><a href="https://www.facebook.com/universityofutah" target="_blank" aria-label="Facebook Link"><i class="fab fa-facebook" title="Follow the University of Utah on Facebook"></i></a></li> <li><a href="https://www.instagram.com/universityofutah" target="_blank" aria-label="Instagram Link"><i class="fab fa-instagram" title="Follow the University of Utah on Instagram"></i></a></li> <li><a href="https://www.youtube.com/user/theuniversityofutah" target="_blank" aria-label="YouTube Link"><i class="fab fa-youtube" title="Follow the University of Utah on YouTube"></i></a></li> </ul> </div>  </div> </div>  </footer>   <a href="#back-to-top" id="back-to-top-btn" class="back-to-top-btn" aria-label="back-to-top" title="back to top"> <i class="fal fa-arrow-up"></i> </a>  </div>   <link rel='stylesheet' id='so-css-umctheme3-css' href='https://privacyportal.utah.edu/wp-content/uploads/sites/105/so-css/so-css-umctheme3.css?ver=1716330168' media='all' /> <script src="https://privacyportal.utah.edu/wp-content/themes/umctheme3-child-privacy/js/custom.js?ver=1743147708" id="uu-umctheme3-custom-script-js"></script> <script src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/js/navigation.js?ver=3.0" id="umctheme3-navigation-js"></script> <script src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/js/ga_event.js?ver=3.0" id="umctheme3-ga-event-js"></script> <script id="umctheme3-app-js-extra"> var wp_urls = {"siteurl":"https:\/\/privacyportal.utah.edu"}; </script> <script src="https://privacyportal.utah.edu/wp-content/themes/umctheme3/js/app.min.js?ver=1743147708" id="umctheme3-app-js"></script> <script id="siteorigin-panels-front-styles-js-extra"> var panelsStyles = {"fullContainer":"body","stretchRows":"1"}; </script> <script src="https://privacyportal.utah.edu/wp-content/plugins/siteorigin-panels/js/styling.min.js?ver=2.31.5" id="siteorigin-panels-front-styles-js"></script> <script>document.body.className = document.body.className.replace("siteorigin-panels-before-js","");</script>  </body> </html>