WCU collects and processes data and sensitive data from individuals who are students or applicants only as necessary in the exercise of the University's legitimate interests, functions and responsibilities as a higher education institution. WCU also collects and processes data and sensitive data from individuals who are research subjects in the exercise of scientific, historical research, or statistical purposes. WCU also collects and processes data from individuals who are faculty, staff or applicants for employment positions in order to enter into or administer a contract for employment with the University. WCU also collects and processes data from individuals who are alumni or donors in order to maintain an engaged alumni community, provide notification of services, donations, fundraising, and other University processes and functions.  Data is collected and may be shared with internal and external parties to register or enroll persons in the University, provide and administer housing to students, manage a student account, financial aid, provide academic advising, develop and deliver education programs, athletics, support student missions and study abroad programs, track academic progress, analyze and improve education programs, recruitment, athletics, regulatory reporting, auditing, maintenance of accreditation, and other related University processes and functions. WCU also uses data and sensitive data to conduct general demographic and statistical research to improve University programs. Sensitive data is collected, processed and may be shared internally and externally, as necessary, applicable and appropriate, to identify appropriate support services or activities, provide reasonable accommodations, enforce University policies or comply with applicable laws. Finally, data and sensitive data may be shared by WCU with third parties who have entered into contracts with the University to perform functions on behalf of the University, subject to the obligation of confidentiality and safeguarding from unauthorized disclosure.

For purposes of this Privacy Notice, sensitive data is defined as race, ethnic origin, religious or philosophical beliefs, health data, sexual orientation, and criminal convictions.

For purposes of this Privacy Notice, data refers to any other information concerning a natural person that is created by or provided to WCU from or concerning students, applicants, faculty, staff, alumni, donors and research subjects.

We may disclose your sensitive data and other data as follows:

• Consent: We may disclose sensitive data and other data if we have your consent to do so.
• Emergency Circumstances: We may share your data, and sensitive data when necessary to protect your interests and you are physically or legally incapable of providing consent.
• Employment Necessity: We may share your sensitive data when necessary for administering employment or social security benefits in accordance with applicable law or any applicable collective bargaining agreement, subject to the imposition of appropriate safeguards to prevent further unauthorized disclosure.
• Legitimate Interest: We may hold and process data if there is legitimate interest in doing so, provided this interest is balanced against an individual’s.
• Charitable Organizations: We may share your data with other not-for-profit organizations in connection with charitable giving subject to the imposition of appropriate safeguards to prevent further unauthorized disclosure.
• Public Information: We may share your data and sensitive data if you have manifestly made it public.
• Archiving: We may share your data and sensitive data for archiving purposes in the public interest, and for historical research, and statistical purposes.
• Performance of a Contract: We may share your data when necessary to administer a contract you have with the University.
• Legal Obligation: We may share your data when the disclosure is required or permitted by international, federal, and state laws and regulations.
• Service Providers: We use third parties who have entered into a contract with the University to support the administration of University operations and policies. In such cases, we share your data with such third parties subject to the imposition of appropriate safeguards to prevent further unauthorized disclosure.
• University Affiliated Programs: We may share your data with parties that are affiliated with the University for the purpose of contacting you about goods, services, charitable giving or experiences that may be of interest to you.
• De-Identified and Aggregate Information: We may use and disclose data in de-identified or aggregate form without limitation.

We implement appropriate technical and organizational security measures to protect your data when you transmit it to us and when we store it on our information technology systems.

The University's use of cookies and other data from information technology can be found in the Online Privacy Notice on the University website.

Your data will be retained by the University in accordance with applicable state and federal laws, and the applicable retention periods in accordance with the Record Retention Policy adopted by the Board of Trustees of William Carey University. Your data will be destroyed upon your request unless applicable law requires destruction after the expiration of an applicable retention period. The manner of destruction shall be appropriate to preserve and ensure the confidentiality of your information given the level of sensitivity, value and criticality to the University.

You have the right to request access to, a copy of, rectification of, restriction in the use of, or erasure of your data in accordance with all applicable laws. The erasure of your data shall be subject to the retention periods of applicable state and federal law. If you have provided consent to the use of your data, you have the right to withdraw consent without affecting the lawfulness of the University's use of the data prior to receipt of your request.

Students may exercise these rights by accessing your student account by contacting the University's Registrar, at registrar@wmcarey.edu. Employees may exercise these rights by contacting the Office of Human Resources.

Data created in the European Union will be transferred out of the European Union to the University. If you feel the University has not complied with applicable foreign laws regulating such data, you have the right to file a complaint with the appropriate supervisory authority in the European Union.