Version: October 2023
In order to collaborate on student admission and enrollment at DIS – Study Abroad in Scandinavia, in pursuit of institutional agreements, and in pursuit of the DIS mission, Fonden DIS and DIS Stockholm AB (DIS) will, as the joint data controller, collect, and process personal data on university partner colleagues either working at schools from which DIS students come, attending DIS-hosted conferences, dinners, and study tours, and/or as part of and customized and faculty-led programming.
1. Categories of personal of data and purposes
DIS collects and process the following types of personal data
Non-sensitive categories of personal data are: name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, building security footage, and system metadata. Tracking pixels are used in connection with newsletter communication.
University partner colleagues participating in DIS-hosted conferences will also have the following categories of personal data: arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule, payment/reimbursement details.
Sensitive categories of data can be: dietary restrictions, serious allergies, physical limitations, or when sensitive details are disclosed at the university partner’s discretion in their self-disclosed introductory biography for housing partners.
DIS processes the personal data for the following purposes:
- To collaborate on student admission and enrollment at DIS
- To make logistic, travel, and accommodation arrangements for DIS-hosted conferences, dinners, and study tours
- In pursuit of the DIS mission
- In pursuit of customized and faculty-led programming agreements
- To collaborate with partners locally and globally
- To communicate relevant updates about DIS
- For statistical and research purposes
- To comply with applicable personal data protection regulation and other legitimate interests, e.g.
- Documentation requirements
- Compliance with basic principles and legal grounds for processing personal data
- Putting in place, maintaining and testing technical and organisational security measures
- Investigating and reporting suspected personal data breaches, if any
- Handling requests and complaints from data subjects and others, if any
- Handling inspections and queries by supervisory authorities, if any
- Handling disputes with data subjects and third parties, if any
2. Sources
The personal data are collected directly from the individual university partner colleagues in nearly all instances detailed in this privacy notice. The main exception is that basic contact information (i.e. name, email, university, department, title) may be collected from other university partner colleagues at their university for the purpose of direct and improved collaboration, from DIS students who provide this information for the purpose of application approval during the application process. Building security footage at DIS is also processed based on the legitimate interest of safety and security, and roles with DIS and systems metadata are otherwise generated by DIS.
3. The legal basis for the collection and processing of the personal data
The legal basis for collection and processing of name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, tracking pixels, building security footage, and system metadata is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
DIS collects this personal data directly from university partner colleagues for the stated purposes above on the basis of the legitimate interests of DIS. These include the legitimate interests of collaborating regarding student admission and enrolment or to make necessary logistic, travel, and accommodation arrangements for dinners and/or conferences, for soliciting curriculum feedback from partners and for direct marketing purposes, and to improve communication efficacy through tracking pixels. University partner colleagues are obliged to provide this information to DIS, but university partner colleagues have the right to object that their legitimate interests as an individual outweigh the legitimate interests of DIS as an organization. To exercise this claim university partner colleagues need to contact the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest processing data subjects are objecting, and why their interests outweigh those of DIS in the specific instances. Data subjects have the absolute right to object to direct marketing based on GDPR art. 21(2), in which case this right can be exercised using the same contact information.
For processing relating to customized and faculty-led programming and to participation in the IEW/IEC conferences, including but arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule, and payment/reimbursement details, the legal basis for the collection and processing of the personal data interests is the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
The scope of personal data covered by this legal basis is determined by the individual, customized agreements. University partner colleagues are obliged to provide this information based on their agreement with DIS. Failure to provide this information could result in DIS being unable to provide the agreed to services.
4. Disclosure of the personal data to other controllers
Relevant personal data will be disclosed to and shared with the following recipients:
- Housing partners, when university partner colleagues elect to stay with them for DIS-hosted conferences
- Other university partner colleagues via DIS-hosted conference programs
- Travel or ticketing agencies for travelling with DIS
- Public transportation organizations for transportation passes
- Hotels, hostels, or other accommodation while with DIS
- Organizations hosting field studies or study tours for academic or cultural purposes
- Shipping companies to distribute DIS program catalogs
The legal basis for the disclosure of name, email, university, department, title, ID, photo, university address, phone number(s), roles with DIS, survey responses, arrival/departure flight information, gender, nationality, self-disclosed introductory biography, interests, local address, conference schedule is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
DIS discloses this personal data directly from university partner colleagues for the stated purposes above on the basis of the legitimate interests of DIS. These include the legitimate interests of collaborating regarding student admission and enrollment or to make necessary logistical, travel, and accommodation arrangements for DIS-hosted conferences, dinners, and events.
The legal basis for the disclosure of dietary restrictions, serious allergies, physical limitations, or when sensitive details are disclosed at the university partner’s discretion in their self-disclosed introductory biography for housing partners is the following:
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
University partner colleagues have the right to withdraw their consent. If consent is withdrawn, this will not affect the lawfulness of the disclosures prior to the withdrawal. Please contact DIS using the contact details below if university partner colleagues wish to exercise this right.
For disclosures explicitly relating to customized and faculty-led programming, the legal basis for the disclosure of personal data otherwise covered by legitimate interests is instead the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
The scope of personal data covered by this legal basis is determined by the individual, customized agreements. University partner colleagues are obliged to provide this information based on their agreement with DIS. Failure to provide this information could result in DIS being unable to provide the agreed to services.
5. Transfer of personal data to data processors
DIS transfers the personal data to IT providers, surveying and communication systems, and the DIS North American Office (part of the University of Minnesota) which processes and/or stores the personal data on behalf of DIS.
6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA
DIS transfers the personal data to the following recipients located in countries out-side the EU/EEA:
Transfers of personal data to a third country or an international organisation | |
Transfer basis (varies per IT provider) | |
Category of recipient:
IT Providers Including Including Sendgrid, Papertrail, Microsoft Office 365 Country:
Country: United States |
☒ EU Standard Contractual Clauses – to processors
|
Category of recipient:
DIS North American Office (University of Minnesota)
Country: United States
|
☒ EU Standard Contractual Clauses – to processors
|
EU Standard Contractual Clauses as a transfer basis, means that DIS and the other organization(s) have agreed to additional contractual language from the EU, which protects the legal rights University Partner Colleagues have as a data subject, even though University Partner Colleague personal data is shared outside of the EU. University Partner Colleagues have the right to obtain a copy of these clauses, which can be exercised by contacting dataprotectionofficer@dis.dk.
7. Retention Period
DIS stores the personal data until the university partner colleagues no longer work within the field of international education and/or at schools from which DIS students come. University partner personal data is updated and deleted on this criteria on at least an annual basis.
8. University partner colleagues’ rights
Subject to the conditions set out in the applicable data protection legislation, students enjoy the following certain rights:
- The right to request access to the personal data
- The right to rectification of the personal data
- The right to erasure of the personal data
- The right to restriction of processing
- The right to data portability
- The right to objection to the processing of the personal data, including the absolute right to object to direct marketing
University partner colleagues also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.imy.se respectively.
9. Contact
University partner colleagues should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.
Contact details of the controller(s):
Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44
DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13
Contact details of the data protection officer:
E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36