Privacy Notice for University Partner Colleagues

Version: November 2018

In order to collaborate on student admission and enrollment at DIS – Study Abroad in Scandinavia, in pursuit of institutional agreements, and in pursuit of the DIS mission, Fonden DIS, DIS Stockholm AB, and DIS Properties APS (DIS) will, as the joint data controller, collect, and process personal data on university partner colleagues either working at schools from which DIS students come, attending DIS-hosted conferences, dinners, and study tours, and/or as part of and customized and faculty-led programming.

1. Categories of personal of data and purposes

DIS collects and process the following types of personal data

Non-sensitive categories of personal data are: name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, building security footage, and system metadata.

University partner colleagues participating in DIS-hosted conferences will also have the following categories of personal data: arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule, payment/reimbursement details.

Sensitive categories of data can be: dietary restrictions, serious allergies, physical limitations, or when sensitive details are disclosed at the university partner’s discretion in their self-disclosed introductory biography for housing partners.

DIS processes the personal data for the following purposes:

  • To collaborate on student admission and enrollment at DIS
  • To make logistic, travel, and accommodation arrangements for DIS-hosted conferences, dinners, and study tours
  • In pursuit of the DIS mission
  • In pursuit of customized and faculty-led programming agreements
  • To collaborate with partners locally and globally
  • To communicate relevant updates about DIS
  • For statistical and research purposes
  • To comply with applicable personal data protection regulation and other legitimate interests, e.g.
    • Documentation requirements
    • Compliance with basic principles and legal grounds for processing personal data
    • Putting in place, maintaining and testing technical and organisational security measures
    • Investigating and reporting suspected personal data breaches, if any
    • Handling requests and complaints from data subjects and others, if any
    • Handling inspections and queries by supervisory authorities, if any
    • Handling disputes with data subjects and third parties, if any

2. Sources

The personal data are collected directly from the individual university partner colleagues in nearly all instances detailed in this privacy notice. The exception is that basic contact information (i.e. name, email, university, department, title) may be collected from other university partner colleagues at their university for the purpose of direct and improved collaboration. Building security footage at DIS is also processed based on the legitimate interest of safety and security.

3. The legal basis for the collection and processing of the personal data

The legal basis for collection and processing of name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule, building security footage, system metadata, and payment/reimbursement details is the following:

  • Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.

DIS collects this personal data directly from university partner colleagues for the stated purposes above on the basis of the legitimate interests of DIS. These include the legitimate interests of collaborating regarding student admission and enrollment or to make necessary logistic, travel, and accommodation arrangements for dinners and/or conferences, for soliciting curriculum feedback from partners and for direct marketing purposes. University partner colleagues are obliged to provide this information to DIS, but university partner colleagues have the right to object that their legitimate interests as an individual outweigh the legitimate interests of DIS as an organization. To exercise this claim university partner colleagues need to contact the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest processing data subjects are objecting, and why their interests outweigh those of DIS in the specific instances. Data subjects have the absolute right to object to direct marketing based on GDPR art. 21(2), in which case this right can be exercised using the same contact information.

The legal basis for collection and processing of dietary restrictions, serious allergies, physical limitations, or when sensitive details are disclosed at the university partner’s discretion in their self-disclosed introductory biography for housing partners is the following:

  • Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

The scope of personal data covered by this legal basis is determined by the individual, customized agreements. University partner colleagues are obliged to provide this information based on their agreement with DIS. Failure to provide this information could result in DIS being unable to provide the agreed to services.

4. Disclosure of the personal data to other controllers

Relevant personal data will be disclosed to and shared with the following recipients:

  • Housing partners, when university partner colleagues elect to stay with them for DIS-hosted conferences
  • Other university partner colleagues via DIS-hosted conference programs
  • Travel or ticketing agencies for travelling with DIS
  • Public transportation organizations for transportation passes
  • Hotels, hostels, or other accommodation while with DIS
  • Organizations hosting field studies or study tours for academic or cultural purposes
  • Shipping companies to distribute DIS program catalogs

The legal basis for the disclosure of name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule is the following:

  • Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.

DIS discloses this personal data directly from university partner colleagues for the stated purposes above on the basis of the legitimate interests of DIS. These include the legitimate interests of collaborating regarding student admission and enrollment or to make necessary logistical, travel, and accommodation arrangements for DIS-hosted conferences, dinners, and events.

The legal basis for the disclosure of dietary restrictions, serious allergies, physical limitations, or when sensitive details are disclosed at the university partner’s discretion in their self-disclosed introductory biography for housing partners is the following:

  • Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.

University partner colleagues have the right to withdraw their consent. If consent is withdrawn, this will not affect the lawfulness of the disclosures prior to the withdrawal. Please contact DIS using the contact details below if university partner colleagues wish to exercise this right.

For disclosures explicitly relating to customized and faculty-led programming, the legal basis for the disclosure of personal data otherwise covered by legitimate interests is instead the following:

  • Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

The scope of personal data covered by this legal basis is determined by the individual, customized agreements. University partner colleagues are obliged to provide this information based on their agreement with DIS. Failure to provide this information could result in DIS being unable to provide the agreed to services.

5. Transfer of personal data to data processors

DIS transfers the personal data to IT providers, surveying and communication systems, and the DIS North American Office (part of the University of Minnesota) which processes and/or stores the personal data on behalf of DIS.

6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA

DIS transfers the personal data to the following recipients located in countries out-side the EU/EEA:

Transfers of personal data to a third country or an international organization
Transfer basis (varies per IT provider)
Category of recipient:
IT Providers
Including Vultr, Sendgrid, Papertrail, Zendesk
(sub-processor categorization for following IT providers is on-going and will be updated as such)Country:
United States
☒  EU Standard Contractual Clauses – to processors (in development)

☒  EU-U.S. Privacy Shield (only the U.S.)  (in development)

Category of recipient:
DIS North American Office (University of Minnesota)
Sub-processor Google Suite and Google CloudCountry:
United States
☒  EU Standard Contractual Clauses – to processors (in development)

☒  EU-U.S. Privacy Shield (only the U.S.) (for sub-processor)

Category of recipient:
Shipping companies including FedEx online, and Point B
☒ Explicit consent from the individual (updated language in development)

7. Retention period

DIS stores the personal data until the university partner colleagues no longer work within the field of international education and/or at schools from which DIS students come. University partner personal data is updated and deleted on this criteria on at least an annual basis.

8. University partner colleagues’ rights

Subject to the conditions set out in the applicable data protection legislation, students enjoy the following certain rights:

  • The right to request access to the personal data
  • The right to rectification of the personal data
  • The right to erasure of the personal data
  • The right to restriction of processing
  • The right to data portability
  • The right to objection to the processing of the personal data, including the absolute right to object to direct marketing

University partner colleagues also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.datainspektionen.se respectively.

9. Contact

University partner colleagues should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.

Contact details of the controller(s):

Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44

DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13

DIS Properties APS
Vestergade 5
DK-1456 København K
Business registration no. in Denmark: 37511404

Contact details of the data protection officer:

E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36