Last Updated: January 1, 2021
These privacy disclosures (the “Disclosures”) provide information about the collection, use, processing and sharing of data about individuals located in the European Union, Iceland, Liechtenstein or Norway (the “European Economic Area” or “EEA”).
These Disclosures also provide information about the collection, use, processing and sharing of data about individuals located in the United Kingdom, which has left the European Union but has adopted legislation substantially similar to the GDPR. With respect to individuals in the UK, references to the GDPR in these Disclosures are to be read as referring to the UK’s similar legislation, the Data Protection Act 2018.
In these Disclosures,
- GDPR” means the European Union’s General Data Protection Regulation;
- Personal Data” means information relating to an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, by use of any identifier or factor specific to that individual; and
- GDPR Processing Activities” means the collection, use, processing or sharing of Personal Data when those activities are within the scope of the GDPR.
These Disclosures apply only to the use of Personal Data in GDPR Processing Activities. Further, these Disclosures apply only to the Harvard University Schools, Centers, and other Harvard units and controlled entities (collectively, “Harvard Entities”) that link to these Disclosures or expressly adopt them in writing. In these Disclosures the words “we,” “us” or “our” refer to any such Harvard Entities. In some cases a Harvard unit may provide other information about its GDPR Processing Activities in its own supplemental or separate disclosures.
These Disclosures apply to GDPR Processing Activities by any means, including hardcopy (such as paper applications or forms) and electronic means (such as websites and mobile applications).
A. How We Collect and Use Personal Data
We collect several categories of Personal Data in circumstances that may involve GDPR Processing Activities, including data you provide, data collected automatically (potentially including location data), and data we obtain from third party sources.
We use the Personal Data that we collect to carry on various institutional and educational activities. As described in more detail below, we rely on a number of legal bases to lawfully process your Personal Data.
The ways in which we collect and use your data vary depending on the relationship between you and us. The following sections of these Disclosures describe in more detail how we collect and use Personal Data in various circumstances that may involve GDPR Processing Activities.
Please note that, depending on the situation, some of the processing of Personal Data we do in the various circumstances described below may not fall within the scope of the GDPR.