Privacy Information

The University of North Georgia (UNG) is an institution of higher education involved in education, research, and community engagement. For UNG to educate its students, engage in world-class research, and provide community services, it is essential and necessary that UNG collect, process, use, and maintain data of its students, employees, applicants, research subjects, and others involved in its educational, research, and community programs.

The European Union General Data Protection Regulation (“EU GDPR”) broadly applies to data about people who reside in the European Union or data about individuals when it is transferred from the EU. The EU GDPR limits when and how personal data can be collected, stored, processed, and used. It also provides these individuals with certain rights related to their personal data, including notice or consent, rights of access, and in some cases, requests for deletion.

UNG may be a data “Controller” or “Processor” with regard to certain activities as defined under the EU GDPR. UNG is committed to protecting the rights of individuals in compliance with the EU GDPR.

Definitions

Controller: Controllers are responsible for decisions about the collection, use, and protection of personal data.

Personal data:  Under the EU GDPR, personal data is defined as any information relating to an identified or identifiable natural person. An identifiable natural person is an actual person (not a corporation or other business entity) who can be identified, directly or indirectly, by reference to:

• Any identifiers, such as name, ID numbers, location data, online identifier; or
• Factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processor:  Processors are responsible for processing, analyzing, storing, and deleting personal data on behalf of the Controller.

Special Categories of Personal Data:

Any data that:

• Reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
• Is genetic data or biometric data sufficient to uniquely identify a natural person; and/or
• Is concerning a natural person’s sex life or sexual orientation.

Lawful Basis for Collecting and Processing of Personal Data

UNG has lawful basis to collect, process, use, and maintain data of its students, employees, applicants, research subjects, and others involved in its educational, research, and public service programs. The lawful basis includes, without limitation: admission; registration; delivery of classroom, online, and study abroad education; grades; communication; employment; applied research; development; program analysis for improvements; and records retention.

Most of UNG’s collection and processing of personal data will fall under the following categories:

• Processing that is necessary for the purposes of the legitimate interests pursued by UNG or third parties in providing education, employment, research and development, and public service.
• Processing that is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract. 
• Processing that is necessary for compliance with a legal obligation to which UNG is subject.
• Processing for which the data subject has given consent for UNG to use his or her personal data for one or more specific purposes.

There will be some instances where the collection and processing of personal data will be pursuant to other lawful bases. This basis will be identified for each application.

Types of Personal Data Collected and How it Will be Used

UNG collects a variety of personal data to meet lawful basis, as referenced above. Most often the data is used for admission to academic programs, enrollment, participation in educational programs, job hiring, provision of medical services, participation in research, development, and public service.

The information we hold about you may include the following:

• Personal details such as name, title, address, telephone number, email address, marital status, nationality, date of birth, photograph, household income, parental status, details of dependents;
• Emergency contact information;
• Insurance number (where you have voluntarily provided it);
• Education and employment information (including the school(s), college(s), and other educational locations you have attended; places where you have worked; the courses you have completed; dates of study and examination results);
• Other personal background information collected during the admission process, e.g. your socioeconomic classification, and details of your parents’ occupation and education;
• Examination records (including records relating to assessments of your work, details of examinations taken, and your predicted and actual examination grades);
• Information captured in your student record, including progression, achievement of milestones and progression reports;
• Visa, passport, and immigration information;
• Fees and financial support record (including records relating to the fees paid, student loan information and financial support, scholarships, and sponsorship);
• Supervision, teaching, and tutorial activities; and training needs analysis and skills acquisition records;
• Placement and internship record or study at another institution as an established component of your course of studies, or career development opportunity;
• Information about your engagement with University support services or University facilities;
• Information about your use of library facilities, including borrowing and fines;
• Information about disciplinary actions (including academic misconduct), dispensations from regulations, and any appeals and complaints raised;
• Attendance at University degree and award ceremonies and other University events; 
• Information about your use of our information and communication systems, including CCTV and building access information;
• We may also process the following "special categories" of more sensitive personal data:
  • Information about your sex and gender identity;
  • Information about your race or ethnicity and religious beliefs;
  • Information about your health, including any disability and/or medical condition;
  • Information about criminal convictions and offenses, including proceedings or allegations.

If you have specific questions regarding the collection and use of your personal data, please contact the University’s Data Protection Officer at privacy@ung.edu. 

Where UNG Acquires Personal Data

UNG receives personal data from multiple sources. Most often, UNG acquires this data directly from the data subject or under the direction of the data subject who has provided it to a third party.

Rights of the Data Subject Under the EU GDPR

If you are an individual data subject under the EU GDPR, you may obtain the following information and exercise the following rights:

• the identity and the contact details of the Controller and, where applicable, the Controller’s representative;
• the contact details of UNG’s GDPR Compliance Program;
• an explanation of the purposes and legal basis/legitimate interests of the data collection/processing;
• the identification of the recipients of the personal data;
• notice if UNG intends to transfer personal data to another country or international organization;
• notice of the time period that the personal data will be stored;
• the right to access personal data, rectify incorrect personal data, erase personal data, restrict or object to processing, and the right to data portability;
• the right to withdraw consent at any time, if processing is based on consent;
• the right to lodge a complaint with a supervisory authority (established in the EU);
• an explanation of why the personal data are required, and possible consequences of the failure to provide the data;
• notice of the existence of automated decision-making, including profiling; and
• notice if the collected data are going to be further processed for a purpose other than that for which the information was collected.

Exercising these rights is a guarantee to be afforded a process and not the guarantee of an outcome.

Any data subject who wishes to exercise any of the above-mentioned rights may do so by submitting a Data Subject Request (DSR) Form.

To the extent permitted by law, UNG and our third-party vendors may supplement the information we collect from and about you with information from other sources, such as publicly available information about your online and offline activity from social media services, commercially available sources, and information from other business partners.