Privacy Information

Purpose and Scope

The University of North Carolina at Chapel Hill (“UNC-Chapel Hill”, the “University”, “we”, “us”, or “our”) provides information and services to students, employees, and the public. We are committed to protecting the personal information and the security of our users and being transparent about the information we hold.

This Statement describes what personal information UNC-Chapel Hill may collect about you and how the University may use it, as well as the choices that are available to you regarding the use of the information you provide.

This Online Privacy Statement applies to the information that we collect, process, use, share, and transfer when you visit UNC-Chapel Hill’s main website (www.unc.edu) and other websites, desktop applications, or mobile applications, that we own or control and that link or refer to this Privacy Statement (together, the “Sites”).

Unless otherwise indicated on a specific Site, UNC-Chapel Hill is the data controller for all information collected under this Statement. Contact information for UNC-Chapel Hill is listed at the end of this Statement.

We are providing this Statement to help you understand our privacy practices and make informed decisions when using our Sites. This Statement is a part of the UNC-Chapel Hill Terms of Use, which is binding on all website users. This Statement, along with the Terms of Use, govern your visit to the Sites. When you access our Sites, you acknowledge that you have read this Statement and understand and agree with its contents.

Personal Information and Sensitive Personal Information We Collect and Process; Legal Basis for Processing

UNC-Chapel Hill collects personal information voluntarily supplied by you when you visit our Sites and automatically collected information collected as you navigate our Sites. When you access or use the Sites, we may collect and process the following types of information from you:

• “Personal Information” is any information that we can reasonably use to identify you. If you are located in the European Economic Area (“EEA”), Personal Information includes all “Personal Data” as defined under EEA laws.
• “Profiling” is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
• “Sensitive Personal Information” includes special categories of Personal Information (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation) for which applicable law provides enhanced protections.

The table below describes the Personal Information and Sensitive Personal Information that we collect, why we collect it, and our legal basis for processing it.

Information We Collect from Third Parties and Combining of Information

In addition to the information you provide us directly, we may obtain certain Personal Information about you from third-party sources, which we may use to serve our legitimate interests, comply with legal obligations, perform contracts, or in some cases, in accordance with your consent. Some of these third parties may have Personal Information about you that we may not otherwise have (e.g., test scores, recommendations) and may share some or all of this information with us, such as:

Service Providers and Contractors: We use service providers and contractors (e.g., for payment processors, analytics, donor prospects), to provide additional information to UNC-Chapel Hill or perform services on our behalf.

Schools, References, Family Members, and Education Partners (e.g., The Common Application, Inc., Law School Admissions Council, The College Board, etc.): We may obtain Personal Information about you as part of an application package for prospective undergraduate and graduate students.

We may receive additional Personal Information from third-party sources and public databases, which we may append to existing Personal Information we have obtained directly from you. We may use this combined information to process transactions or services that you have requested (e.g., admissions, employment, donations, etc.).

How We Use Your Information

We use the information we collect on our Sites in one or more of the following ways:

• To administer our Sites, including Site protection and improvement, account management, customer support, communication, and market analysis;
• For marketing, including communicating with you about UNC-Chapel Hill events, programs, or other offerings that we think may be of interest to you;
• For recruiting candidates for employment;
• To collect and process donations to UNC-Chapel Hill;
• Processing graduate and undergraduate applications, financial aid, housing, and other student services;
• Where we have a legitimate interest as described in the section above, “Personal Information and Sensitive Personal Information We Collect and Process; Legal Basis For Processing”;
• When required by law to do so, or to comply with and enforce legal requirements, agreements, and policies;
• For other purposes disclosed to you at the time you provide Personal Information to us.

When and How We Share Your Personal Information

We share your Personal Information internally at UNC-Chapel Hill to facilitate and manage the purposes listed above. We may also share your Personal Information with third parties whom UNC-Chapel Hill engages to process your Personal Information on our behalf for the purposes stated above, such as vendors who help UNC-Chapel Hill with our marketing, application processing, web hosting, analytics providers, donor prospect organizations, and payment card processors. UNC-Chapel Hill may also share your Personal Information with government and law enforcement agencies or regulators to:

1. comply with a legal process, subpoena, order or other legal or regulatory requirement applicable to us;

2. enforce our terms of use or other policies; or

3. pursue available legal remedies or defend against legal claims.

We may share your Personal Information with third-parties pursuant to a request made by you, as permitted by this policy and other UNC-Chapel Hill policies and applicable laws and regulations.

UNC-Chapel Hill does not sell any confidential Personal Information to third parties for their use in direct marketing, advertising, or promotion of their products or services.

Please note that we may also use and disclose information about you that does not identify you individually. For example, we may conduct research and publish reports that contain aggregated and statistical data about our programs, students, employees, donors, and others. We may also disclose aggregated, anonymized information about users for marketing, advertising, research, compliance, or other purposes.

When Are We Required to Disclose Public Records?

UNC-Chapel Hill is subject to the North Carolina Public Records laws. This means that records, in all forms including email, provided to UNC-Chapel Hill are subject to public disclosure, unless the record is designated by law as confidential or not a public record. Some examples of confidential records include:

• education records of students;
• personnel records of employees;
• medical records;
• law enforcement records;
• research data, records, or information of a proprietary nature; and
• information received by the University deemed as trade secrets and marked “confidential.”

For more information regarding public records, please visit the UNC-Chapel Hill Public Records Office website.

How We Keep Your Personal Information Safe

UNC-Chapel Hill has taken steps to help protect the Personal Information we collect and use and we review the security practices of service providers trusted to process data for UNC-Chapel Hill. We use physical, technical, organizational, and administrative safeguards designed to protect against loss, misuse, unauthorized access, disclosure, alteration or destruction of the information we collect through our Sites. Our security controls are designed to maintain data confidentiality, integrity, and an appropriate level of availability. But no transmission and storage of data is completely secure, and submissions are at your sole risk. As such, we cannot ensure or warrant the security of any information you transmit or provide through our Sites. For more information on UNC-Chapel Hill’s information security practices, visit: safecomputing.unc.edu.

Messages that you send to us by email, including by use of the contact us form on Sites, may not be secure, and use of email is not recommended for sending us confidential or sensitive information. DO NOT SEND ANY PERSONAL INFORMATION, INCLUDING, BUT NOT LIMITED TO, W-9S, SOCIAL SECURITY NUMBERS, DRIVER’S LICENSE INFORMATION, OR PAYMENT CARD INFORMATION TO US VIA EMAIL.

Please remember that any information you share in public areas, such as social media platforms, becomes public, and therefore this Statement does not apply to information you choose to make public. Please be careful about what you choose to disclose. Do not post any personal information that you expect to keep private.

You are responsible for notifying us immediately of any known or suspected unauthorized use(s) of any accounts you may have on our Sites, or any known or suspected breach of security, including loss, theft, or unauthorized disclosure of your account credentials, or any other personal information. Any fraudulent, abusive, or otherwise illegal activity on your account may be reported to appropriate law enforcement agencies by us. In the event of a confirmed security incident that involves Sites user’s personal information, we will notify you, the respective regulator, law enforcement, and/or individuals of such incident as required by applicable law or where UNC-Chapel Hill deems appropriate.

Links to Other Websites

Our Sites may contain links to sites operated by third parties (“Third-Party Sites”). Please be advised that the practices described in this Statement do not apply to information gathered through these Third-Party Sites. UNC-Chapel Hill does not endorse, review, or have any control over the content, products, or services of linked websites or their privacy policies, and UNC-Chapel Hill is not responsible for the privacy practices of unaffiliated companies or organizations, and once you leave the Sites, you should read the applicable privacy policy of the other company. If you decide to access any of the linked websites, you do so at your own risk.

International Transfer of Personal Information of People Living Outside the United States

Personal Information provided to us by users outside of the United States may be transferred to other countries such as the United States, where data protection laws may differ from those of your home country. By providing us with your information you are giving your affirmative consent that your Personal Information will be transferred to the United States and processed and stored on servers in the United States. However, all reasonable steps will be taken to protect your privacy in accordance with the applicable data protection laws.

European Economic Area Data Subject Rights

If you are an individual located in the European Economic Area (“EEA”) only, to the extent required by and in accordance with applicable law, you will have the following rights regarding your Personal Information:

1. Right of access. You may request details of your Personal Information that we hold. We will confirm whether we are processing your Personal Information and we will disclose supplementary information including the categories of Personal Information, the sources from which it originated, the purpose and legal basis for the processing, the expected retention period, and the safeguards regarding Personal Information transfers to non-EEA countries, subject to the limitations set out in applicable statutes, regulations and other laws.

2. Right of correction. We will comply with your request to edit and update incorrect Personal Information promptly.

3. Right to be forgotten. At your request, we will delete your Personal Information promptly if:

i. it is no longer necessary to retain your Personal Information;

ii. you withdraw the consent which formed the basis of your Personal Information processing;

iii. you object to the processing of your Personal Information and there are no overriding legitimate grounds for such processing;

iv. the Personal Information was processed illegally; or

v. the Personal Information must be deleted for us to comply with our legal obligations.

We will inform any third parties we might have shared your Personal Information with of your deletion request.

We will decline your request for deletion if processing of your Personal Information is necessary:

vi. to comply with our legal obligations;

vii. in pursuit of a legal action;

viii. to detect and monitor fraud; or

ix. for the performance of a task in the public interest.

4. Right to restrict processing of your Personal Information. At your request, we will limit the processing of your Personal Information if:

i. you dispute the accuracy of your Personal Information;

ii. your Personal Information was processed unlawfully and you request a limitation on processing, rather than the deletion of your Personal Information;

iii. we no longer need to process your Personal Information, but you require your Personal Information in connection with a legal claim; or

iv. you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists.

5. Right to notice related to correction, deletion, and limitation on processing. In so far as it is practicable, we will notify you of any correction, deletion, and/or limitation on processing of your Personal Information.

6. Right to data portability. At your request, we will provide you free of charge with your Personal Information in a structured, commonly used, and machine readable format, if:

i. you provided us with Personal Information;

ii. the processing of your Personal Information is based on your consent or required for the performance of a contract; or

iii. the processing is carried out by automated means.

7. Right to object. Where we process your Personal Information based upon our Legitimate Interest then you have the right to object to this processing.

8. Right not to be subject to decisions based solely on automated processing. You will not be subject to decisions with a legal or similarly significant effect (including profiling) that are based solely on the automated processing of your Personal Information, unless you have given us your explicit consent or where those decisions are necessary for a contract with us.

9. Right to withdraw consent. You have the right to withdraw any consent you may have previously given us at any time. If you withdraw your consent, this will not affect the lawfulness of our collecting, using and sharing of your Personal Information up to the point in time that you withdraw your consent. Even if you withdraw your consent, we may still use your information that has been fully anonymized and does not personally identify you.

10. Right to complain to a supervisory authority. If you are not satisfied with our response, you have the right to complain to or seek advice from a supervisory authority and/or bring a claim against us in any court of competent jurisdiction.

If you wish to contact us in connection with the exercise of your rights listed above, including your right to opt-out of targeted advertising and profiling, please email us at privacy@unc.edu. We will respond to your written request as soon as possible and in accordance with any deadlines imposed by law. Unless we notify you at the time of your request, we will not charge you any fee in connection with the exercise of your rights. We will require that you verify your identity before exercising your individual rights. UNC-Chapel Hill will inform you of any action taken, and if UNC-Chapel Hill refuses to take action in response to your request to exercise a right, will provide you with a written explanation of its reasoning. You may appeal this response by contacting us via the email provided in this Section. If you have any concerns about the result of your appeal, you may file a complaint with the appropriate supervisory authority.

Please note that these rights are not absolute. Your request does not ensure complete or comprehensive removal, as the content or information may be retained subject to applicable law.

When and How We Collect and Process Non-Personally Identifiable Information

Standard, non-personally identifiable internet log information such as browser type and navigation to various parts of the Sites, in an aggregated form, is collected for analytical purposes to improve the browsing experience of our Sites, update relevant content, and improve the overall design of our Sites.

When and How We May Market to You, and How You Can Opt-Out

Personal Information you submit through our Sites, such as your name, address and other contact information, may be collected by UNC-Chapel Hill for internal marketing and development purposes as well as to respond to your inquiry, complete a transaction for you, or fulfill other forms of customer service. You can choose not to receive marketing from us by “unsubscribing” using the instructions in any marketing email you receive from us. You may also opt-out of any mailings at any time by contacting us at privacy@unc.edu and indicating you changed your preference. If you choose to no longer receive marketing information, we may still communicate with you regarding transactional or administrative topics such as your account or service requests.

How UNC-Chapel Hill Students, Faculty, Staff, and Other Affiliates Can Manage Their Privacy Settings

UNC-Chapel Hill students can manage privacy settings for their directory information in ConnectCarolina. Faculty, staff, and other UNC-Chapel Hill affiliates can manage their privacy settings in ConnectCarolina.

You can choose not to receive marketing emails from us by “unsubscribing” using the instructions in any email you receive from us. This will not stop us from sending emails about your account or your transactions with us.

Children Program Participation Activities

UNC-Chapel Hill offers programs and activities designed for children and youth (e.g. summer camps or other programs provided to children and youth). Parents and guardians may register or apply their children for these University programs through UNC-Chapel Hill Sites. Consistent with the Federal Children’s Online Privacy Protection Act of 1998 (COPPA), these registration and application websites are intended to be used only by adults and not by children under the age of 13. UNC-Chapel Hill does not knowingly collect personal information from children under the age of 13. If we discover that a child under 13 has provided us with personal information, we will promptly delete such personal information from our systems, unless we are legally obligated to retain it. Any personal information of children provided to UNC-Chapel Hill on these sites should be shared with UNC-Chapel Hill only by a child’s parent or legal guardian. Information that may be requested from parents and guardian, and voluntarily provided to UNC-Chapel Hill, includes:

• Child
  • Name
  • Birthdate
  • Grade Level
  • Gender
• Parent or Legal Guardian:
  • Name
  • Residential or Mailing Address
  • Email Address
  • Phone Number

How Long Do We Keep Your Personal Information?

We keep your Personal Information for as long as needed to fulfill the particular purpose for which it was collected. We may also retain your Personal Information if legally required or to fulfill a Legitimate Interest.

Updates to Privacy Statement

UNC-Chapel Hill reserves the right to change this Privacy Statement at any time. We will let you know before we make any changes to the Privacy Statement. The updated Privacy Statement will be posted on the UNC-Chapel Hill Privacy Statement webpage before the updated Privacy Statement takes effect. Your continued use of the Sites after any change in this Privacy Statement means that you accept the change(s). This Statement is current as of the Effective Date set forth below. If we decide to change this Statement in the future, we will post or provide an appropriate notice on the home page of the Sites. If we make material changes to the Statement, we will provide notice or obtain consent regarding such changes as may be required by law. The date on which the latest update was made is indicated at the top of this document. Your continued use of our Sites following the posting of changes to this Statement will mean you accept those changes.

Cookies and Similar Technologies

We may use cookies and similar technologies to provide our Sites.

We use cookies at UNC-Chapel Hill to improve the digital experience. Some cookies we use are essential for some services to work, and others are used to collect information of the use of the website (statistics) so that we can make sites more convenient and useful. Some cookies are temporary and will disappear when you close your browser, others are persistent and will stay on your computer for some time.

Some of the cookies are strictly necessary for the functionality of the site while others are used to enhance performance and your experience.

We or third parties may combine this information with other information, including personal information, we or they may collect about you. Third-party cookies may be set by organizations other than UNC-Chapel Hill. Because the cookie policies of these third-party service providers may change over time, you should review their policies by visiting their privacy policies directly. We also use targeting and advertising cookies by third parties such as Google and Facebook, which may be set by UNC-Chapel Hill or by third parties.

Pixel tags display tiny graphics with a unique identifier, similar in functions to cookies. In contrast to cookies, which are stored on your device, pixels are embedded on pages. We may use pixel tags (also referred to as clear GIFs or beacons), in connection with our Sites to understand activities of users of our Sites. We or our third-party service providers may use similar methods in emails to help us understand email response rates and identify when our emails are viewed.

Strictly necessary cookies are used to:

• Make the website work properly
• Remember your preferences

Functional cookies are used to:

• Allow you to stay logged in (authenticated) across multiple services
• Make sure you are secure when logged-in
• Make sure that the website looks consistent
• Offer live chat support

Performance cookies are used to:

• Analyze, evaluate, and enhance the performance of the website
• Enhance the user experience
• Ensure digital accessibility
• Collect statistical data on visitors’ behavior on the website. Used for internal analytics by the website operator.
• Examples of analytics tools we may use for performance include Google Analytics and SiteImprove.

Targeting, advertising, social and/or marketing cookies are used to:

• Allow you to share and like UNC content on your social media
• Allow site owners to embed social media feeds into their websites
• Examples of these cookies include social media platform plugins like Facebook, Instagram, Twitter, HubSpot, and LinkedIn.
• Allows site owners to embed videos into their websites, including, but not limited to, the use of YouTube.

Examples of use

The cookies are used to improve services for you. Examples include:

• Enabling a service to recognize your device so you do not have to give the same information several times during one task.
• Measuring how many people are using services, so they can be made easier to use and to ensure that there’s enough capacity to ensure they are fast.
• Enabling the functionality of some specific services like payment which will not work without those cookies.
• Analyzing data to help us understand how you use online services so we can improve them.

If you choose not to allow those cookies during your visit by using a browser extension or plugin, you should be aware that certain functions and pages may not work as expected.

If you want to delete any cookies already on your computer, please refer to your browser vendor’s instructions by clicking “Help” in your browser menu.

You can also find out more about cookies and how to delete and control them on www.aboutcookies.org or click “Help” in your browser menu.

Do Not Track Signals

Some web browsers have a “Do Not Track” (“DNT”) feature that tells websites that users do not want to have their online activity tracked. Not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, UNC-Chapel Hill does not currently require that websites respond to DNT signals.

How Do I Contact You?

Please contact privacy@unc.edu for more information on how we collect and process your Personal Information, or if you have any complaints.