This Privacy Notice applies to Oakland University's Athletic Department and is intended to comply with the European Union's ("EU") General Data Protection Regulation ("GDPR"). This Privacy Notice applies to personal data that Oakland University collects or processes about an individual ("Data Subject") while the Data Subject is located in the EU, regardless of whether the Data Subject is a citizen or permanent resident of an EU country. "Personal Data" means any information relating to an identified or identifiable Data Subject.
Lawful Basis or Bases for Collecting and Processing Personal Data
Oakland University is an institution of higher education that offers courses to undergraduate, graduate and continuing education students, conducts academic and sponsored research, and participates in various community engagement activities. The Athletic Department collects, processes and uses Personal Data to recruit student-athletes and staff, determine initial and continuing eligibility of student-athletes, hire appropriate personnel, fundraise for the Athletic Department, provide student-athletes medical treatment and care, manage NCAA and university reporting, market and provide media information about the Athletic Department, encourage community service opportunities, and collect information necessary to abide by NCAA rules and regulations on behalf of Oakland University.
Oakland University's and the Athletic Department's lawful basis or bases for collecting and processing personal data include the following:
- Processing is necessary for the legitimate interests pursued by Oakland University or third parties in providing education, entertainment, community programs, athletic opportunities, health care, and NCAA compliance guidance.
- Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
- Processing is necessary for compliance with a legal obligation to which Oakland University is subject.
- The Data Subject has given consent for the processing of his or her Personal Data for one or more specific purposes. In the case of a Data Subject who is under 16 years of age, consent must be given or authorized by the Data Subject's parent or legal guardian.
- Processing is necessary to protect the vital interests of the Data Subject or of another person.
- Processing is necessary for the performance of a task carried out in the public interest.
Types of Personal Data Collected/Processed and Purpose
The Athletic Department collects the following categories of Personal Data in order to provide the programs, activities and services described above:
- Contact information including, without limitation, email address, physical address, phone number, and other location data
- Unique personal identifiers and biographical information (e.g. date of birth)
- Photographs and/or videos of you
- Details of your education and/or employment qualifications
- Medical information including, without limitation, immunization records
- Information related to visa requirements, copies of passports and other documents to ensure compliance with U.S. laws
- Financial information gathered for the purposes of administering fees and charges, loans, grants, scholarships, etc.
- Information related to the prevention and detection of crime and the safety of employees, students and visitors of Oakland University
- Academic information including, without limitation, transcripts, standardized test scores, and NCAA eligibility information
- Information related to athletic ability and performance
- Social media identifiers, posts, and information
- Biometric Information
The Personal Data that the Athletic Department collects may be shared with: Office of Institutional Research, Recreational Center, First Year Advising Center, Admissions, Registrar, Legal, Student Affairs, Public Safety, Oakland University Police, Graham Health Center, each individual college within Oakland University, Business Office, Human Resources, ISSO, Financial Aid, Housing Office, Title IX Office, WES and/or other translation and evaluation services, NCAA, Horizon League, and outside medical facilities and personnel.
If you have specific questions regarding the collection and use of your Personal Data, please contact the Athletic Director at 248-370-3131 or via email firstname.lastname@example.org.
If a Data Subject refuses to provide Personal Data that Oakland University requires in connection with one of Oakland University's lawful basis or bases for collecting such Personal Data, such refusal may make it impossible for Oakland University to provide education, employment, research or other requested services.
Where Oakland University gets Personal and Sensitive Personal Data
Oakland University receives personal and sensitive Personal Data from multiple sources. Most often, Oakland University gets this data directly from the Data Subject or under the direction of the Data Subject who has provided it to a third party (for example, application for undergraduate admission to Oakland University through use of the Common App). However, the Athletic Department may gather certain information from third party sources. This information can include, without limitation, biographical information, location details, information related to athletic ability and performance, medical information biometrics, physical appearance, photos and/or video files, contact information, academic information, college recruitment information, employment information and history, educational history, criminal records, and any other information that third parties make available. The information may be collected from, without limitation, public and/or subscription recruiting websites (e.g. 247sports.com, hudl.com, verbalcommits.com, University Athlete, collegeswimming.com, swimswam.com, topdrawersoccer.com) NCAA databases, background check companies, newspaper and/or internet articles, state and/or national databases, other academic institutions, coaches, social media platforms, and/or outside medical facilities.
In addition, this Notice must be provided to each EU Data Subject by the earlier of the following: (a) within a reasonable time (not to exceed one month) after obtaining the Personal Data or (b) if the Personal Data are to be used for communication to the Data Subject, at the time of the first communication with that Data Subject. In addition, the Data Subject's consent is be required. These requirements do not apply if the Data Subject already has the information.
Individual Rights of the Data Subject under the GDPR
In addition to the right to receive the information provided in this Privacy Notice, Data Subjects covered by this Privacy Notice have the right to:
- Request from Oakland University access to and rectification or erasure of Personal Data or restriction of processing concerning the Data Subject, the right to object to processing and the right to portability of Personal Data;
- Where processing is based upon consent, to withdraw consent at any time, without affecting Oakland University's right to process Personal Data based upon consent before its withdrawal;
- The right to file a complaint with a supervisory authority appointed by an EU member state for the purpose of receiving complaints;
- Additional notice of the existence of automated decision-making, including profiling;
- If the Personal Data is going to be further processed for a purpose other than that for which it was collected, then notice of the purpose and basis or bases for the further processing;
- If Personal Data is collected for Oakland University's legitimate interests or for a task carried out in the public interest, then the Data Subject has the right to object, on the grounds of his or her particular situation, to the processing of Personal Data concerning him or her (including profiling);
- Where Personal Data are processed for direct marketing purposes, the right to object at any time to processing Personal Data concerning him or her for such marketing; and
- Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her; provided, however, that this right does not apply if the decision is (a) necessary for entering into, or performance of, a contract between the Data Subject and Oakland University; or (b) is based upon the Data Subject's consent.
NOTE: EXERCE OF THESE RIGHTS GUARANTEES ACCESS TO A PROCESS BUT DOES NOT GUARANTEE ANY PARTICULAR OUTCOME.
Any Data Subject who wishes to exercise any of the above-mentioned rights may do so by filling such request with the Athletic Director at 248-370-3131 or via email at email@example.com.
Cookies are files that many websites transfer to users' web browsers to enable the site to deliver personalized services or to provide persistent authentication. The information contained in a cookie typically includes information collected automatically by the web server and/or information provided voluntarily by the user. Oakland University's website uses persistent cookies in conjunction with a third party technology partner to analyze search engine usage and web traffic patterns. This information is used in the aggregate to monitor and enhance our web pages. It is not used to track the usage patterns of individual users.
Security of Personal Data subject to the EU GDPR
All Personal Data and sensitive Personal Data collected or processed by Oakland University under the scope of the GDPR must comply with the security controls and systems and process requirements and standards set forth in Oakland University's Administrative Policies and Procedures as they are amended from time-to-time, including without limitation:
- Policy No. 830, https://www.oakland.edu/policies/information-technology/830/
- Policy No. 850, https://www.oakland.edu/policies/information-technology/850/
- Policy No. 860, https://www.oakland.edu/policies/information-technology/860/
- Policy No. 870, https://www.oakland.edu/policies/information-technology/870/
- Policy No. 880, https://www.oakland.edu/policies/information-technology/880/
- Policy No. 890, https://www.oakland.edu/policies/information-technology/890/
Oakland University will not share your Personal Data with third parties except:
- as necessary to meet one of its lawful purposes, including but not limited to, its legitimate interest, contract compliance, pursuant to consent provided by the Data Subject, or as required by law;
- as necessary to protect Oakland University's interests;
- with service providers acting on Oakland University's behalf who have agreed to protect the confidentiality of the Personal Data.
Oakland University maintains records for the time periods specified in its Records Retention and Disposal Policy, Administrative Policy 481, located at https://www.oakland.edu/policies/generalgovernance/481/.