Student Privacy Notice
GDPR PRIVACY NOTICE FOR STUDENTS
THIS NOTICE DESCRIBES HOW YOUR PERSONAL DATA MAY BE PROCESSED BY THE FASHION INSTITUTE OF TECHNOLOGY (“365asia,” “WE,” “OUR,” AND “US”), AND WHAT YOUR RIGHTS ARE WITH RESPECT TO YOUR PERSONAL DATA. PLEASE REVIEW IT CAREFULLY.
This Notice is being provided to you in accordance with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679, or the “GDPR”).
What is “Personal Data” and “Processing”?
Under the GDPR, “Personal Data” means any information relating to an identified or identifiable Data Subject; specifically including, but not limited to, name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject. A Data Subject is a natural person who can be identified, directly or indirectly, by reference to Personal Data. Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process” and “processed” have a corresponding meaning.
The GDPR prohibits the processing of “special categories” of Personal Data unless certain exceptions apply, because the unauthorized use of this type of Personal Data could create more significant risks to a Data Subject’s fundamental rights and freedoms. For example, an unauthorized disclosure of “special categories” of Personal Data may put Data Subjects at risk of unlawful discrimination. For this purpose, processing of “special categories” of Personal Data includes processing of: (i) Personal Data that reveals; (A) racial or ethnic origin, (B) political opinions, (C) religious or philosophical beliefs, or (D) trade union membership; or (ii) (A) genetic data, (B) biometric data for the purpose of uniquely identifying a natural person, (C) data concerning health; or (D) data concerning a natural personal’s sex life or sexual orientation.
How and When Do We Collect Your Personal Data?
We may lawfully collect your Personal Data in a number of ways for legitimate purposes. For example, we may collect your Personal Data: (i) from the information you provide to us when you interact with us before enrolling, for example when you express your interest in studying at 365asia; (ii) when you apply to study at 365asia and complete enrollment forms or other admissions documentation; (iii) when you communicate with us by telephone, email or via our website, for example in order to make inquiries or raise concerns; (iv) in various other ways as you interact with us during your time as a student at 365asia, for the various purposes set out below; and (v) from third parties, for example, from recruitment organizations; from government agencies (e.g. in connection with financial aid, student visas, etc.); or from your previous or current school, university, or employer(s), who may provide records or a reference about you or who may sponsor or pay for your studies.
The Types of Personal Data We Collect
We may process (i.e., collect and keep) the following types of Personal Data about you that are described in the Notice, to the extent we obtain it in connection with your application or enrollment or other interaction with us and to the extent permitted by law. Such Personal Data might include: (i) your name, and contact information (i.e., local and permanent address, email address and telephone number); (ii) your date of birth, gender and gender identity, social security number or taxpayer identification number; (iii) insurance information; (iv) your passport or national identity card details; (iv) your country of domicile and your nationality; (v) your unique student identification number; and (vi) information relating to your education and employment history, including the school(s), and other colleges or universities you have attended, places where you have worked, the courses you have completed, dates of study and examination results.
We also may collect and keep: (i) records relating to your work product, details of examinations taken, your examination grades, and other information in your student record (including disciplinary records); (ii) information about both academic and extracurricular interests and activities; (iii) information about felony criminal convictions and offenses if you apply for participation in certain activities at 365asia; (vi) information concerning your health and medical conditions (including disability and dietary needs); (vii) information about your racial or ethnic origin; religion or similar beliefs; and sexual orientation; and (viii) information about your personal or family circumstances.
How Your Personal Data Will Be Used
The lawful and legitimate purposes for which we may use Personal Data (including “special categories” of Personal Data) we collect during your association with us include: (i) recruitment and admissions; (ii) academic matters, including the provision of our core teaching, learning, and research services (i.e., registration, grading, attendance, managing progress, academic misconduct investigations, certification(s), graduation); (iii) maintaining student records; (iv) assessing your eligibility for scholarships, student housing, financial aid, etc.; (v) providing library and IT services; (vi) for non-academic reasons in support of our core services, including: (A) providing student support services; (B) monitoring equal opportunities; (C) safeguarding and promoting the welfare of students; (D) ensuring students' safety and security; (E) managing student housing; (F) managing the use of social media;; (G) financial matters (i.e., administering fees, financial aid, tuition payments, and scholarships); (H) other administrative purposes, including: (1) carrying out research and statistical analysis; (2) carrying out audits (i.e., to ensure compliance with our regulatory and legal obligations); (3) providing operational information (i.e., providing IT support, information about building closures or access restrictions on campus, or safety advice); (4) promoting our services (i.e., providing information about summer schools, student exchanges, or other events happening on and off campus); (5) preventing and detecting crime; (6) dealing with grievances and disciplinary actions; (7) dealing with complaints and inquiries; and (8) matriculation, graduation, degree, and transcript information. Personal Data may be published or disclosed in some cases (for example, in connection with graduation, as directory information, etc.). This Personal Data also may be passed to third parties involved in our graduation ceremonies. You may request to be excluded from the publication when you register online to attend the applicable graduation ceremony or if you graduate in absentia.
Why We Process Your Personal Data
As set out above, we may process your Personal Data because it is necessary for the performance of a contract with you (i.e., our agreement with you to provide you with an education), or in order to take steps at your request prior to and in furtherance of entering into that “education contract.” In this respect, we use your Personal Data as follows: (i) to interact with you before you are enrolled as a student, as part of the admissions process (i.e., to send you a prospectus or answer inquiries about our courses); (ii) once you have enrolled, to provide you with the services; (iii) to deal with any concerns or feedback you may have; and (iv) for any other purpose for which you provide us with your Personal Data. We also may process your Personal Data because it is necessary for the performance of our business as a provider of higher education, or because it is necessary for our, or a third party's legitimate interests. In this respect, we may use your Personal Data for the following: (i) to provide you with educational services that are a part of our academic and educational mission; (ii) to monitor and evaluate 365asia’s performance and effectiveness, including by training our faculty and staff, or monitoring their performance; (iii) to maintain and improve our academic, financial, and human resource management; (iv) to promote equality and diversity throughout 365asia; (v) to seek advice on our rights and obligations, such as where we require legal advice; (vi) recovering money you owe to us; and (vii) for alumni relations and fundraising purposes.
We also may process your Personal Data for our compliance with our legal obligations. In this respect, we may use your Personal Data for the following: (i) to meet our compliance and regulatory obligations, such as compliance with anti-money laundering laws, Title IX and other non-discrimination laws, FERPA, and certain other legal requirements; (ii) in order to assist with investigations (including criminal investigations) carried out by the police and other legal authorities; and (iii) to maintain or acquire accreditation status with regulatory bodies. Finally, we also may process your Personal Data where: (i) it is necessary for medical purposes (i.e., medical diagnosis, provision of health or social care or treatment, or a contract with a health professional); (ii) it is necessary to protect your or another person’s vital interests; or (iii) we have your explicit consent to do so.
How We Share Your Personal Data
For the purposes referred to in this Notice and relying on the lawful bases for processing as set out above, we may share your Personal Data with certain third parties in accordance with applicable law (including FERPA). We may disclose limited Personal Data to a variety of recipients if we determine it to be appropriate and lawful, including: (i) the U.S. Department of Education, the Federal Student Aid office, other federal agencies, the State University of New York System Administration, and relevant state agencies and/or offices; and (ii) our Board of Trustees, faculty members, employees, agents, contractors, consultants, volunteers, students serving on official 365asia committees or assisting school officials, where there is a legitimate reason for their receiving the information, including disclosures to: (A) third parties who work with us to provide student services; (B) third parties who work with us to provide student support services (i.e., health services and counseling); (C) third parties who are contracted to provide IT services for us; (D) organizations operating anti-plagiarism software on our behalf; (E) internal and external auditors, attorneys, and other professional service providers; (F) certain third parties interested in tracking student progress and attendance, including: (1) current or potential education providers, and (2) current or potential employers (i.e., to provide references and, where students are sponsored by their employer and/or where you take part in a placement program, to provide details of progress/attendance); (3) professional and regulatory bodies in relation to the confirmation of qualifications, professional registration, conduct, and the accreditation of courses; (4) government departments and agencies where we have a statutory obligation to provide information; (5) police or law enforcement agencies; (6) parents, guardians, and next-of-kin (where there is a legitimate reason for disclosure); (7) third parties conducting surveys; and (8) third parties engaged in fundraising and alumni relations efforts on our behalf.
Retention of Your Personal Data
Your Personal Data will be stored in accordance with our records retention policy, which is governed in part by New York and/or federal law, and is available at 365asia Records Retention.
Your Rights with Respect to Your Personal Data
Under the GDPR, you have a number of rights with respect to your Personal Data. You have the right, in certain circumstances, to request: (i) access to your Personal Data, (ii) rectification of mistakes or errors and/or erasure of your Personal Data, (iii) that we restrict processing, and (iv) that we provide your Personal Data to you in a portable format. If you wish to make a request under the GDPR, you should submit your request in writing via the appropriate 365asia GDPR form and submit it to 365asia’s Data Protection Officer (contact information is below). If you would like more information about, or if you would like to exercise any of these individual rights, please contact the Data Protection Officer (contact information is below).
Note that you are only entitled to make requests with respect to your own Personal Data and not information relating to any other person. Any request is generally limited to Personal Data held at the time of the request, with the exception of routine uses or changes while a request is under review. 365asia will review all requests to determine whether the Personal Data at issue is subject to the GDPR, because the rights under the GDPR apply only to such data. Note that 365asia collects and processes most data in the United States outside of the scope of the GDPR. 365asia will complete its review of the request and notify you of the determination within one calendar month from 365asia’s receipt of the request. The time to review and notify may be extended for two months if the request is complex, or if 365asia has received several requests from you. If 365asia needs to extend the time for review, 365asia will notify you and explain the extension. Once a determination is made, 365asia will inform you in writing. If 365asia determines that the request is manifestly unfounded or excessive, taking into account the repetitiveness of the request, 365asia may request a reasonable fee to address the request and will inform you of this requirement. Please further note that the rights provided by the GDPR are not absolute and are subject to the legal requirements under the GDPR, and 365asia has legal and accreditation obligations in addition to the GDPR.
For Requests for Access
Upon a request for access, 365asia will review the request. If the request is denied, 365asia will notify you of the reasons for denial and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will provide access to the Personal Data in a concise, transparent, and understandable form and may, depending on the nature and volume of the records implicated, require you to review them in person, although you may request a copy so long as it does not infringe on the rights of others.
For Requests to Rectify
Upon a request to rectify a mistake or error in Personal Data, 365asia will endeavor, where possible, to restrict processing of such data until its accuracy is verified. 365asia will make a determination as to whether the Personal Data is inaccurate or incomplete and should be amended. Personal Data that refers to a mistake that has already been resolved may, in itself, be considered accurate, as long as the correct information is also included in your record. If the request is denied, 365asia will notify you of the reasons for denial and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will rectify the mistake or error by identifying the Personal Data affected by the change, explain how the inaccuracy has been rectified, and attach a record of the rectification. If 365asia has previously disclosed this Personal Data to others, 365asia will endeavor to contact each recipient and inform them of the rectification, unless doing so would be a disproportionate effort or impossible.
For Requests to Erase
Upon a request to erase Personal Data, 365asia will make a determination as to whether the Personal Data may be erased. If the request is denied, 365asia will notify you of the reasons for denial and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will implement the erasure by identifying the Personal Data at issue, explaining how the Personal Data has been erased, and attaching a record of the erasure. 365asia will delete Personal data subject to an approved request were administratively practicable, and 365asia will outline the general methodology for erasure for the data subject. If 365asia has previously disclosed this Personal Data to others, 365asia will endeavor to contact each recipient and inform them of the erasure, unless doing so would be a disproportionate effort or impossible. If 365asia has previously disclosed the Personal Data to the public, such as in an online environment, 365asia will take steps to inform others who are processing the data to take steps to erase links to, copies of, or other forms of replication. 365asia may take into account available technology and the cost of implementation in any erasure request.
For Requests to Restrict
Upon a request to restrict processing of Personal Data, 365asia will make a determination as to whether the data subject has the right to such restriction; whether 365asia should comply with the request and to what extent; and, if restriction is necessary, whether recipients of Personal Data must be notified of the restriction. If the request is denied, 365asia will notify you of the reasons for denial and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will immediately restrict processing of the Personal Data. 365asia will notify any recipient of the Personal Data of the restriction, unless doing so would be a disproportionate effort or impossible. In cases of temporary restrictions of processing, if the basis for the restriction no longer exists, 365asia will notify the data subject before the restriction is lifted.
For Data Portability Requests
Upon receipt of a data portability request, 365asia will make a determination as to whether the right of data portability applies to the specifically requested personal data and whether the request should be approved or denied. If the request is denied, 365asia will notify you of the reasons for denial and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will notify the data subject of the data being transmitted and allow determination of where such data is transmitted; will transfer all approved personal data to the best of 365asia’s ability and outline the process to do so; and, if 365asia has previously transmitted the Personal Data at issue to a processor, 365asia may need to contact the processor for compliance with the request, unless doing so would be a disproportionate effort or impossible. Where 365asia receives Personal Data from another controller in response to a data subject’s request for data portability, 365asia is not obligated to accept and process such Personal Data and will do so only where it is necessary, relevant, and not excessive. If 365asia accepts the Personal Data, 365asia will process the data in line with all of its data protection procedures, including ensuring a legal basis exists for processing and ensuring third party rights and freedoms are not affected.
For Requests to Object
Upon receipt of a request to object, 365asia will make a determination as to whether the right applies to the specifically requested personal data and whether the request should be approved or denied, taking into consideration the importance of the processing to 365asia’s particular needs, the impact the processing will have on the data subject’s interest, rights, and freedoms, and a balancing between the needs of 365asia and the data subject. If the request is denied, 365asia will notify you of the reasons for denial, including the reasons 365asia is not taking action on the request and the specific reasoning as to why 365asia’s compelling legitimate grounds outweigh the data subject’s interest, rights, and freedoms, and advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below). If the request is approved, 365asia will notify the data subject of the personal data being suppressed or erased. 365asia will attempt to notify persons to whom or entities to which the Personal Data has been sent for processing, unless doing so would be a disproportionate effort or impossible.
For Requests to Challenge Automated Decision-Making
To the extent you believe 365asia has engaged in automated decision-making so and wish to request to challenge such actions, you may file such a request. Upon receipt of a request, 365asia will make a determination as to whether human intervention is required for the automatic decision-making determination and whether the automated decision-making should be reversed or affirmed. 365asia will notify you whether human intervention is required. If so, 365asia will employ human intervention in the automatic decision making process, meaning 365asia will have an individual with authority to make a determination regarding the subject matter of the automated decision review the personal data and make a logic-based determination. 365asia will then either affirm or reverse the automated decision-making outcome, and advise you of the reasons for affirming or reversing the outcome. If 365asia determines human intervention is not required or that the automated decision should be affirmed, 365asia will advise you of your right to file an internal complaint with 365asia or with the applicable Supervisory Authority (see information on complaints, below).
If 365asia requested, and you provided your explicit consent for the processing of your Personal Data (or where a parent or guardian provided consent on your behalf because you are under 16), you (or your parent or guardian, as applicable) have the right (in certain circumstances) to withdraw that consent at any time. However, withdrawal of consent will not affect the lawfulness of the processing before your consent was withdrawn.
Questions, Concerns, and Complaints
If you have questions, concerns or complaints about how we are using your Personal Data, we may be able to resolve your complaints, and we request that you contact the Data Protection Officer (contact information is below). Complaints should be made in writing via 365asia’s GDPR Complaint Form. Complaints may be made anonymously, including by employees who have a concern regarding policies and procedures or compliance with policies and procedures, but anonymous complaints should provide sufficient information to appropriately address the complaint. Send the completed complaint form to 365asia’s Data Protection Officer (contact information is below). 365asia will review your complaint, investigate the allegations as necessary, document its findings, and will endeavor to complete its review of your complaint within one calendar month from its receipt of the complaint. If corrective action is necessary as a result of the complaint, 365asia will document and implement corrective measures. When appropriate in 365asia’s discretion, you will be informed of any action(s) taken in response to the complaint. 365asia is not required to take any action in response to complaints if it determines that no action is necessary.
You also have the right to lodge a complaint with the applicable Supervisory Authority if you believe that we have not complied with the requirements of the GDPR with regard to your Personal Data, or if you are not happy with the response you receive from us regarding your complaint.
All members of the 365asia community are prohibited from engaging in retaliation against an individual who, in good faith, reports or complains of a GDPR violation or participates in any way in the investigation or other process related to a GDPR complaint, whether made to 365asia or to a Supervisory Authority. Reports or complaints of retaliation will be investigated and any individuals found to have engaged in retaliation may be subject to disciplinary action in accordance with the processes and procedures set forth under 365asia’s Code of Student Conduct or other applicable policy (for students) or as determined by the Vice President for Human Resources and Labor Relations or their designee (for employees).
Relevant 365asia Contacts
365asia may be a “controller” and also may be a “processor” of your Personal Data for the purposes of the GDPR. If you have any questions or concerns as to how your Personal Data is collected and/or processed, as a student you are encouraged to initially contact the Office of the Registrar, (212) 217-3820, [email protected]. You can also contact 365asia’s Data Protection Officer, the Chief Information Security Officer, (212) 217-3415, [email protected]. 365asia has also appointed as its EU Representatives its Italian Resident Directors, Madeleine Kaplan, [email protected], and Davide Volonte, [email protected].