Version: October 2023
In connection with developing and maintaining the Alumni Community for former and future DIS students, Fonden DIS and DIS Stockholm AB (DIS) will, as the joint data controller, collect and process personal data about Alumni .
1. Categories of personal of data and purposes
DIS collects and processes the following types of personal data:
Full name, age, home address, email addresses, phone numbers, payment and purchase details, delivery address, transcripts, graduation term, DIS semester details, awards and media roles, home university, communication preferences, photos, field of work, workplace details, family details, and self-disclosed personal stories text. When relevant, health and dietary accommodation details may be processed when participating in DIS-arranged events. Tracking pixels are used in connection with newsletter communication.
DIS processed the personal data for the following purposes:
- To develop and maintain the Alumni program for former and future students, including:
- Hosting in-person and virtual events
- Raising funds and receiving donations for use with future students
- Increasing the overall value of the DIS brand for former and future students
- To collaborate with partners locally and globally
- In pursuit of the DIS mission
- To fulfill purchases for merchandise
- To comply with applicable personal data protection regulation and other legitimate interests, e.g.
- Documentation requirements
- Compliance with basic principles and legal grounds for processing personal data
- Putting in place, maintaining and testing technical and organizational security measures
- Investigating and reporting suspected personal data breaches, if any
- Handling requests and complaints from data subjects and others, if any
- Handling inspections and queries by supervisory authorities, if any
- Handling disputes with data subjects and third parties, if any
2. Sources
The personal data is collected from the data subject, or in some instances from family members of the data subject. Transcripts are generated by DIS.
3. The legal basis for the collection and processing of the personal data
The legal basis for collection and processing of full name, age, hometown, email addresses, tracking pixels, transcripts, graduation term, DIS semester details, awards and media roles, and home university is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
When DIS processes personal data collected directly from Alumni for the legitimate purposes of developing and maintaining the Alumni program for former and future students and increasing the overall value of the DIS brand for former and future students, to improve communication efficacy through tracking pixels, and having available an official copy of their DIS transcript on their request, personal data which Alumni provided while former students is processed to meet this legitimate interest. Alumni were obliged to provide this information to DIS as former students, but Alumni have the right to object that their legitimate interests as an individual outweigh the legitimate interests of DIS as an organization. Alumni may exercise this right by unsubscribing from communications, or by fully opting out of the Alumni program at any time. The consequence of fully opting out is that Alumni would need to resubmit this personal data on a consent basis in order to re-enroll in the Alumni program.
The legal basis for collection and processing of home address, phone numbers, payment details for donations, communication preferences, photos, field of work, workplace details, family details, self-disclosed personal stories text, and when relevant, health and dietary accommodation details for DIS-arranged events, is the following:
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
When DIS collects this personal data directly from Alumni for the purpose of developing and maintaining the Alumni program for former and future students, for hosting events, raising funds, and receiving donations, Alumni provide this personal data voluntarily. Alumni are not obliged to provide this information to DIS. The consequences of not providing information on the basis of consent is that certain aspects of the Alumni program may not be available without this data. For health and dietary accommodation details for DIS-arranged events, the consequences of not providing information on the basis of consent is that those accommodations cannot be provided.
The legal basis for collection and processing of payment and purchasing details, delivery address, and name and phone number in connection with purchases, is the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
When DIS collects this personal data directly from Alumni for the purpose of fulfilling purchases made by the Alumni. Alumni are obliged to provide this information to DIS, and the consequences of not provide the information on the basis of a contract, is that the purchase will not be able to be fulfilled.
4. Disclosure of the personal data to other controllers
Relevant personal data may be disclosed to and shared with the following recipients:
- Financial auditors
- Governmental entities
- Fund for Education Abroad
- Travel or ticketing agencies for DIS-arranged events
- Hotels or other accommodation for DIS-arranged events
- Organizations hosting academic and cultural visits for DIS-arranged events
- Fellow Alumni in the Alumni program
The legal basis for the disclosure of full name, home address, and payment details to financial auditors or governmental entities is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for compliance with a legal obligation to which the controller is subject.
The legal basis for the disclosure of the remaining categories of personal data when relevant is the following:
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
Alumni have the right to withdraw this consent. If Alumni withdraw the consent, this will not affect the lawfulness of the disclosure prior to the withdrawal. Please contact DIS using the contact details below if you wish to exercise this right.
5. Transfer of personal data to data processors
DIS transfers the personal data to IT providers, transcripting services, the DIS North American Office (part of the University of Minnesota), and the DIS Alumni Community Foundation which processes and/or stores the personal data on behalf of DIS.
6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA
We transfer the personal data to the following recipients located in countries:
| Transfers of personal data to a third country or an international organization | |
| Transfer basis | |
| Category of recipient:
DIS North American Office, the DIS Alumni Community Foundation, Parchment, Microsoft Office 365 Country: United States Category of recipient: Shopify Country: United States and Canada |
|
EU Standard Contractual Clauses as a transfer basis, means that DIS and the other organization(s) have agreed to additional contractual language from the EU, which protects the legal rights Alumni have as a data subject, even though Alumni personal data is shared outside of the EU. Alumni have the right to obtain a copy of these clauses, which can be exercised by contacting dataprotectionofficer@dis.dk.
An adequacy decision as a transfer basis, means that the EU has determined that data protection laws in a given country, are similar enough to the EU data protection laws, so that personal data can be transferred there without further transfer basis such as the contractual language referred to above.
7. Retention period
We store the personal data for as long as necessary to fulfil the purposes above, and in recognition of the life-long learning nature of the Alumni program, personal data is retained as part of the program until the data subject decides to unenroll from the Alumni program. Grade transcripts are retained indefinitely unless requested to be deleted by Alumni.
8. Your rights
Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:
- The right to request access to the personal data
- The right to rectification of the personal data
- The right to erasure of the personal data
- The right to restriction of processing
- The right to data portability
- The right to objection to the processing of the personal data
Alumni also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at datatilsynet.dk or imy.se respectively.
9. Contact
Alumni should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.
Contact details of the controller(s):
Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44
DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13
Contact details of the data protection officer:
E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36