Skip to main content
Close Directory Section

Privacy Statements & Terms of Use

Tufts Websites

Privacy Statement  |  Terms & Conditions of Use 

European Economic Area (EEA) Privacy Statements

European Economic Area (EEA) Privacy Statement  |  How to Make a Subject Access Request under the GDPR  |  European Economic Area (EEA) Privacy Statement for Prospective Students and Applicants  |  EEA Privacy Statement for Students  |  EEA Privacy Statement for Students in Tufts-Sponsored Study Abroad Programs in the EEA  |  EEA Privacy Statement for Job Applicants, Faculty, Staff, Consultants and Other Persons Providing Services  |  EEA Privacy Statement for Alumni and Donors  |  EEA Privacy Statement for Research Participants

 

Privacy Statement

This Privacy Statement discloses the privacy practices for tufts.edu and other Tufts University websites (together, a "Site" or "Sites") that have pointed you to this page. Please read these terms with the Terms & Conditions of Use. Sites may have additional privacy policy or policies. If you leave a Site and visit a website operated by a third party, Tufts University cannot be held responsible for the protection and privacy of any information that you provide while visiting such third-party websites. Accordingly, please exercise caution and review the privacy statement applicable to the website in question. To the extent permissible under applicable law, by using and/or participating in these Sites, you signify that you have read these terms and agree to be bound by and comply with them. If you do not agree to be bound by these terms, please promptly exit all Sites.

An additional Privacy Statement (The European Economic Area (EEA) Privacy Statement) is provided disclosing additional information about the privacy practices for the Sites and otherwise with respect to personal data protected under the General Data Protection Regulation (GDPR) for the European Economic Area effective May 25, 2018. Various other notices are published in relation to the use of the personal data protected under the GDPR of Prospective Students and Applicants; Students; Students in Tufts-sponsored Study Abroad Programs in the EEA; Job Applicants, Faculty, Staff, Consultants and Other Persons Providing Services; Alumni and Donors; and Research Participants.

Information You May Provide Directly

The following types of information may be stored and processed by Tufts if provided by you through our Sites:

  • Your contact details including address, email address and phone number
  • Biographical information consisting of your name, title, birth date, age, and gender
  • Information about your time at Tufts University
  • Your professional activities
  • Current interests and preferences
  • Records of communications sent to you by Tufts University or received from you
  • Attendance at Tufts University events

The above categories of information are only collected through the Sites if you provide them.

There are a number of circumstances in which you may choose to provide us with your personal information. The following lists the most common ways in which we may collect your personal information:

  • When you sign up to receive e-mail newsletters from us
  • When you register for an account on a Site (e.g. Taleo for job applicants)
  • When you participate in surveys, panels, or research
  • When you register for or participate in programs, activities, initiatives, and events
  • When you request information or assistance
  • In conjunction with processing your application for admission or employment
  • When you participate with social media accounts involving Tufts programs
  • When you participate in communities, chat rooms, and other interactive services
  • In conjunction with any verification of your account information
  • In conjunction with investigations into any activity that may violate the law or the Site’s terms and conditions
  • When you communicate with us through a Site
  • When you provide user-generated content on any Site that permits it
  • In conjunction with any other place on the Site where you knowingly volunteer personal information.

When you interact with any Tufts page or account on a social media platform, such as Facebook, Twitter, Google+, LinkedIn, Tumblr, YouTube, or Pinterest, or when you use your social media account or credentials to log in to a Site, we may also collect the personal information that you make available to us on that page or through that account, including your username, account ID or “handle.”

It is Tufts’ policy to hold all personal information you supply in accordance with applicable data protection and privacy law.

Information Gathered About You or Your Devices

We collect information when you access one of the Sites and when you subscribe to our email services.

Device Information

We may collect information about the computer, mobile device or other device you use to access the Sites such as IP address, geolocation information, unique device identifiers, browser type, browser language or other information of this nature. We use this information in an aggregate fashion to track access to the Sites.

Cookies

Cookies are small files that are stored on your computer (unless you block them). This may include: which pages you see; how long you stay; what you click on our pages; if you visit the website again; and which country and city you are browsing from. We use cookies to understand and save your preferences for future visits and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business.

Cookies may be set by an organization other than the Sites. These "third-party cookies" may, for example, originate from websites such as Facebook, Twitter, Google+, LinkedIn, Tumblr, YouTube, Pinterest or other social media services. Since the cookie policies of these sites change over time, you should determine their policies by visiting the privacy policy pages of these sites directly. You may disable cookies through your individual browser options. Visit http://www.aboutcookies.org/ for information on how to do this.

Google Analytics

One or more of our Sites may also use a third-party service, Google Analytics, to track website statistics. Google Analytics collects information anonymously and reports website trends without identifying individual visitors. We use the information collected to understand how our visitors are using the website and make improvements for a better online experience.

Google Analytics uses first-party cookies to track visitor interactions and collects the Internet protocol (IP) address of website visitors in order to provide us a sense of where our visitors come from, but Google Analytics does not report visitors’ actual IP address information to us.

We do not use Google Analytics to track or collect personal information (name, email address, billing information or other data that can be reasonably linked to such information) and we do not associate personal information with web analytics information.

To see the full Google Analytics privacy policy and learn more about their privacy practices, please see Google Privacy Policy and Google Analytics: Safeguarding Your Data.

Email Terms

When you give us your email address, we may use it to respond, or to communicate information about the University or its activities. If you do not wish to receive communications from Tufts, please click on the unsubscribe link in the body of the message.

Depending on the context in which you submitted your contact information, your data may be accessible to Tufts and its schools, departments, institutes, centers, and divisions connected to Tufts. It is used and processed for a full range of communications and programs involving academic and administrative departments. These include the following communications and marketing activities (by mail, email and telephone):

  • Sending University publications
  • Promoting our services
  • Notifying you of upcoming events
  • Promoting opportunities

Tools may be used to help us improve the effectiveness of our communications with you, including tracking whether the emails we send are opened and which links are clicked within a message. Lastly, we use data to undertake analysis projects to ensure only effective and relevant communications are sent to you.

If you send us email messages, you should be aware that information disclosed in email may not be secure or encrypted and thus may be available to others. We suggest that you exercise caution when deciding to disclose any personal or confidential information in email.

How Do We Use Your Information?

We use your IP address to administer our Sites by identifying (1) which parts of a Site are most heavily used, (2) where our users come from (i.e., a referring sign or a search engine, etc.), and (3) which portion of our audience comes from within or outside the Tufts network. We do not link IP addresses to anything personally identifiable unless we are required to do so under applicable law or court order or authorized to do so under our policies.

The email address you provide may be used to send you information, respond to inquiries, and/or other requests or questions.

To the extent provided, we may use your user information in order to process student, financial aid or job applications, student or employee registrations, and other services and benefits that we provide to our students, employees and other persons.

Will Tufts share my personal information with others?

User information may be shared with third-party partners to the extent necessary for such third parties to provide services to us or to users of our Sites, or provide and improve web services or other communications to users. Any third parties who receive user information for this purpose are prohibited from using or sharing user information for any purpose other than providing services to Tufts or to users.

We may also provide your information to third parties in circumstances where we believe that doing so is necessary or appropriate to: satisfy any applicable law, regulation, legal process or governmental request; detect, prevent or otherwise address fraud, security or technical issues; or protect the rights, property or safety of us, our users or others.

Personal Information of Persons outside the United States

The Sites are published in the United States and are subject to the laws of the United States. If you are located in a country outside the United States and voluntarily submit personal information to us, your information will be used as provided in this Privacy Statement and will be transferred to, and/or be stored in, the United States.

The European Economic Area (EEA) Privacy Statement also provides information with respect to personal information that may be subject to the General Data Protection Regulation (GDPR) for the European Economic Area effective May 25, 2018. That Privacy Statement includes information about the purpose and legal basis under the GDPR for the use and other processing of that personal information, as well as the rights associated with that personal information under the GDPR.

Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page. Your continued use of the Sites following the posting of changes to this Privacy Statement will mean you accept those changes.

This Privacy Statement was last updated on May 25, 2018.

Back to top

Terms & Conditions of Use

Please read these Terms & Conditions of Use ("Terms of Use" or "Terms") and the Privacy Statement carefully before accessing tufts.edu or other Tufts University sites ("Site" or "Sites") or participating in any chatroom, newsgroup, bulletin board, mailing list, website, transaction or other online forum available at any of the Sites. Other Sites may also have additional terms and conditions. By using and/or participating in these Sites, you signify that you have read these terms and agree to be bound by and comply with them. If you do not agree to be bound by these terms, please promptly exit all Sites.

Tufts University reserves the right to modify these Terms at any time and any such changes will be posted on this page.

Content

Consistent with Tufts University policies and regulations, Tufts University upholds the principles of academic freedom and shared governance, freedom of speech, and privacy in the use of electronic resources by our faculty, students and staff.

The Tufts web space contains official pages in support of the core mission of Tufts University or related administrative business. It also contains Web pages generated by groups or individuals whose expressed views do not necessarily represent the views of Tufts University or the Board of Trustees.

You agree that Tufts University has the right and discretion to monitor any activity and content associated with its Sites, Site content, and Site services. Tufts University may investigate any reported violation of these Terms of Use or complaints relating to the Sites, Site content, and Site services, and take any action that we believe is appropriate including, but not limited to, removing materials from the Sites and terminating/suspending your access to the Sites.

Rules for Online Conduct

You agree to use the Sites in accordance with all applicable laws. Because Tufts University is a nonprofit, tax-exempt organization, you agree that you will not use the Sites for organized partisan political activities or for the promotion of for profit businesses or products. You further agree that you will not e-mail to or post any of the following content anywhere on the Sites, or on any other Tufts computing resources:

Content that defames or threatens others

Harassing statements or content that violates federal or state law

  • Content that discusses illegal activities with the intent to commit them
  • Content that infringes another's intellectual property, including, but not limited to, copyrights, trademarks or trade secrets
  • Material that contains obscene (i.e. pornographic) language or images
  • Advertising or any form of commercial solicitation
  • Content that is otherwise unlawful
  • Content or software that attempts to circumvent security protections or contains malicious software

Copyrighted material, including without limitation software, graphics, text, photographs, sound, video and musical recordings, may not be placed on the Sites without the express permission of the owner of the copyright in the material, or other legal entitlement to use the material.

Tufts employees using these Sites are expected to abide by the Tufts’ Business Conduct Policy and other Tufts policies and guidelines applicable to Tufts employees.

Tufts students using these Sites are expected to abide by the applicable student handbooks and other Tufts policies and guidelines applicable to Tufts students.

Although Tufts University does not routinely screen or monitor content posted by users to the Sites, Tufts University reserves the right to do so and to remove content that violates the above rules of which it becomes aware, but is under no obligation to do so.

Finally, you agree that you will not access or attempt to access any other user's account, or misrepresent or attempt to misrepresent your identity while using the Sites.

Permission to Use Materials

In consideration for your agreement to the terms and conditions contained here, Tufts University grants you a personal, non-exclusive, non-transferable license to access and use the Sites. User may download material from the Sites only for user's own personal, non-commercial use. User may not otherwise copy, reproduce, retransmit, distribute, publish, commercially exploit or otherwise transfer any material. The burden of determining that use of any information, software or any other content on the Site is permissible rests with user.

Limitation of Use

You may use the Sites for legal purposes only. Furthermore, you agree that, if a third party claims that any material you have contributed to a Site is unlawful, you will bear the burden of establishing that the material complies with all applicable laws. Although Tufts University does not routinely monitor the content of the Sites, Tufts University has the right to remove material from the Sites, block access, or take other action with respect to any of the material on the Sites in its sole discretion, although Tufts University is under no obligation to do so. You may not use Tufts computing resources or Sites to disseminate unsolicited advertising or promotional material of any kind.

Links to Third-Party Sites

Tufts’ Sites, Site content, and Site services may contain links or references to other websites. Tufts University does not have control over third-party websites or their content and does not assume responsibility or liability for any content, opinions, or material available on them. Tufts University does not endorse the content of any third-party site, nor does Tufts University warrant that a third-party site will be free of computer viruses or other harmful code that can impact your computer or other web-access device. If you link to any third-party site through a Tufts’ Site, Site content, or Site services, please be aware that you are doing so at your own risk. Tufts University encourages you to review any third-party website’s terms or use and privacy policy as those, and not Tufts University’s Terms of Use and Privacy Terms, are applicable to your use of their site and any information that it may collect.

Choice of Law

These Terms shall be governed in all respects by the Commonwealth of Massachusetts without giving effect to its conflicts of law provisions. Both parties submit to the personal jurisdiction of and venue in, the state and federal courts sitting in the judicial district that includes Middlesex County, Massachusetts. The parties further agree that any cause of action arising under these Terms shall exclusively be brought in such courts. If any provision of these Terms is held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall be enforced. Headings are for reference purposes only and in no way define, limit, construe, or describe the scope or extent of such section. Tufts University’s failure to act with respect to a breach by you or others does not waive its right to act with respect to subsequent or similar breaches.

Disclaimer of Warranty/Limitation of Liability

THESE SITES AND ANY INFORMATION, PRODUCTS OR SERVICES THEREIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR USE OF A PARTICULAR PURPOSE, OR NONINFRINGEMENT.

Tufts University does not warrant, and hereby disclaims any warranties, either express or implied, with respect to the accuracy, adequacy or completeness of any Site, information obtained from a Site, or link to a Site. Tufts does not warrant that Sites will operate in an uninterrupted or error-free manner or that Sites are free of viruses or other harmful components. Use of information obtained from or through these Sites is at your own risk.

YOU AGREE THAT TUFTS UNIVERSITY WILL NOT BE LIABLE TO YOU FOR ANY LOSS OR DAMAGES, EITHER ACTUAL OR CONSEQUENTIAL, ARISING OUT OF OR RELATING TO THESE TERMS, OR TO YOUR (OR ANY THIRD PARTY'S) USE OR INABILITY TO USE A SITE, OR TO YOUR PLACEMENT OF CONTENT ON A SITE, OR TO YOUR RELIANCE UPON INFORMATION OBTAINED FROM OR THROUGH A SITE. IN PARTICULAR, TUFTS WILL HAVE NO LIABILTY FOR ANY CONSEQUENTIAL, INDIRECT, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES, WHETHER FORESEEABLE OR UNFORESEEABLE, (INCLUDING, BUT NOT LIMITED TO, CLAIMS FOR DEFAMATION, ERRORS, LOSS OF DATA, OR INTERRUPTION IN AVAILABILITY OF DATA), ARISING OUT OF OR RELATING TO THESE TERMS, YOUR USE OR INABILITY TO USE A SITE, OR ANY PURCHASES OR DONATIONS ON THIS OR THROUGH THIS SITE, OR YOUR PLACEMENT OF CONTENT ON A SITE, OR TO YOUR RELIANCE UPON INFORMATION OBTAINED FROM OR THROUGH A SITE, WHETHER BASED IN CONTRACT, TORT, STATUTORY OR OTHER LAW, EXCEPT ONLY IN THE CASE OF DEATH OR PERSONAL INJURY WHERE AND ONLY TO THE EXTENT THAT APPLICABLE LAW REQUIRES SUCH LIABILITY.

Tufts makes no representation regarding your ability to transmit and receive information from or through the Sites and you agree and acknowledge that your ability to access the Sites may be impaired. Tufts disclaims any and all liability resulting from or related to such events.

Copyright

All content included in or made available through any Tufts’s Site, such as text, graphics, logos, button icons, images, audio clips, video and other multimedia, digital downloads, and data compilations is the property of Tufts University or its content suppliers and protected by United States and international copyright laws.

Copyright Complaints

We respect the intellectual property rights of others. If you are an owner of intellectual property and you believe your intellectual property has been improperly posted or distributed via the Sites, please notify us by sending an email to DMCA-Agent@tufts.edu or by sending a notice by U.S. Mail to: Office of University Counsel, Tufts University, Ballou Hall, Medford, MA 02155. In your e-mail or letter, you will need to include all of the notice elements listed in the DMCA at 17 U.S.C. § 512(c)(3). Please be aware that the DMCA makes copyright owners liable if they materially misrepresent that a user’s content is infringing.

Trademarks

The logo, name and all graphics on the Sites of Tufts University or any of its schools, clinics or affiliates, are trademarks of Tufts or its affiliates. Use, reproduction, copying or redistribution of trademarks, without the written permission of Tufts or its affiliates is prohibited. All other trademarks or servicemarks appearing on the Sites are the marks of their respective owners.

SMFA and the SCHOOL OF THE MUSEUM OF FINE ARTS are trademarks of the Museum of Fine Arts, Boston, and are used by permission.

Indemnification

You agree to indemnify and hold Tufts harmless from any claims, losses or damages, including legal fees, resulting from your violation of these Terms, your use of a Site or your placement of any content onto a Site, and to fully cooperate in Tufts’ defense against any such claims.

Your Account

If you use a Site, you are responsible for maintaining the confidentiality of your account and password, if any, and for restricting access to your computer, and you agree to accept responsibility for all activities that occur under your account or password. Tufts University and its affiliates reserve the right to refuse service, terminate accounts, remove or edit content, or cancel orders in their sole discretion.

Other

The Sites may contain errors and omissions relating to any information disclosed therein. We reserve the right to correct or modify any information without prior notice.

Complete Agreement

These Terms must be read in conjunction with Tufts University’s Privacy Statement, and the provisions of such Privacy Statement are incorporated herein. To the extent the Privacy Statement conflicts with the terms of these Terms of Use, the terms of the Privacy Statement shall control. Please note that these Terms of Use only apply to your use of Tufts University Sites.

Effective Date

These Terms are effective as of October 30, 2015.

Tufts University reserves the right to change, modify, or otherwise these Terms at its sole discretion and at any time as it deems circumstances warrant.

Back to top

European Economic Area (EEA) Privacy Statement

Effective starting May 25, 2018

This European Economic Area (EEA) Privacy Statement discloses information about the privacy practices with respect to personal data protected under the General Data Protection Regulation (GDPR) for the EEA. The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

In addition to this statement, other notices have been published applying to the use and other processing that may be subject to the GDPR of personal data of Prospective Students and Applicants; Students; Students in Tufts-sponsored Study Abroad Programs in the EEA; Job Applicants, Faculty, Staff, Consultants and Other Persons Providing Services; Alumni and Donors; and Research Participants.

The information provided in this statement applies to any of your EEA Personal Data that we may collect, use or otherwise process under the GDPR. An explanation of EEA Personal Data is provided below.

1. Information associated with tufts.edu and other Tufts Websites

For information associated with a Tufts website, this EEA Privacy Statement should be read together with the Privacy Statement for tufts.edu and other Tufts University websites that have pointed you to that statement (together, a "Site" or "Sites").

The Sites are published in the United States and are subject to the laws of the United States. If you are located in the EEA and you voluntarily submit personal information to us, your information will be used as provided in the Privacy Statement [add link] and in this EEA Privacy Statement and will be transferred to, and/or stored in, the United States.

2. Why have I been directed to this webpage?

The general information published on this page is intended to supplement specific information that you may have already been given in connection with your engagement with a particular service, facility, event or initiative run by Tufts. You may have been directed here, for example, because you are accessing an optional staff or student service or using a Tufts facility, or because you are using a particular website or online resource, or because you have signed up to attend an event aimed at prospective students or members of the public. The below information is the same for many such situations, and we thought it would be helpful to have it in one place.

3. What is “EEA Personal Data?”

Your personal information is EEA Personal Data if:

  1. It is “personal data” as defined in the GDPR; and

  2. The GDPR includes protection of the personal data in its scope.

What is “personal data” under the GDPR?

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

What is the scope of the GDPR?

The GDPR generally applies to collecting, using or other “processing” (please see below) of personal data (as provided in Article 3):

  1. When the processing is part of the activities of an organization that acts in an established way in the EEA. It’s not required that the processing take place in the EEA.

  2. When the processing is by an organization that is not established in the EEA and the organization offers goods or services to persons who are physically in the EEA. A payment for the goods or services is not required.

  3. When the processing is by an organization that is not established in the EEA and the processing activities are related to the monitoring of the behavior of a person who is physically in the EEA, as far as their behavior takes place within the EEA.

For example, if you provide personal information to Tufts when you are physically present in the EEA or while you participate in an established Tufts program occurring in the EEA, that personal information may be EEA Personal Data.

“Processing” is a term used by the GDPR to cover any way of working with personal data, from collecting to using to sharing to destroying. GDPR Article 4 (2).

4. What is the purpose and lawful basis under the GDPR for processing your EEA Personal Data?

It is Tufts’ policy to collect, use and process EEA Personal Data about you only where we have a legal basis for doing so under the GDPR. A legal basis under the GDPR may be:

  • We need it to perform a contract with you, such as to provide you services.

  • It satisfies a legitimate interest (which is not overridden by your data protection interests), such as to promote and provide goods and services to you and to protect our legal rights and interests.

  • You give us consent to do so for a specific purpose.

  • We need to process your data to comply with a legal obligation.

  • We need to process your data in connection with your or another person’s vital interest.

  • We need to process your data in connection with the public interest.

  • We have another legal basis permitted under the GDPR.

If you have consented to our use of information about you for a specific purpose, you have the right to change your mind at any time, but this will not affect any processing that has already taken place.

Unless you are told otherwise, there is no requirement to supply us with any of your EEA Personal Data. It is Tufts’ policy to not use EEA Personal Data to carry out any automated decision-making that affect you without an appropriate legal basis as required by the GDPR.

What are the purposes and lawful bases under the GDPR for processing your EEA Personal Data in connection with the Sites?

Tufts will process your EEA Personal Data in connection with the Sites for a variety of service- and business-related purposes, including for analyzing and improving website performance; email and other communications; processing you have requested; third-party services; and security and legal requirements.

The use of your EEA Personal Data in the manner described above and in the Privacy Statement are necessary for the legitimate interests of the University in operating and improving its Sites, analyzing their use, and ensuring their security. The Sites collect limited EEA Personal Data and we use it in ways that are compatible with your individual rights and freedoms. Where you enter your EEA Personal Data into an online form on any of our Sites for any specified purpose, you will be told about the use we will make of that information (e.g., to send you newsletters or to enable your attendance at an event).

5. Will Tufts share my EEA Personal Data with others?

We will use reasonable measures to ensure that your EEA Personal Data is only transferred to third parties who also maintain at least the standard of protection required under the GDPR.

6. How long will my EEA Personal Data be kept?

Information about how long different types of information are retained by Tufts is published at Records Retention Schedules.

7. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.

  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.

  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.

  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.

  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.

  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

8. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights with respect to your EEA Personal Data, please see How to make a Subject Access Request under the GDPR or contact Tufts' Data Privacy Team at dataprivacy@tufts.edu.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside, where you work, or where you believe an infringement of the GDPR occurred.

9. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

How to Make a Subject Access Request under the GDPR

The General Data Protection Regulation (GDPR) for the European Economic Area (EEA) provides individuals with rights relating to their EEA Personal Data.

Tufts’ EEA Privacy Statement describes what personal information qualifies as EEA Personal Data protected by the GDPR. For example, if you provide personal information to Tufts when you are physically present in the EEA or while you participate in an established Tufts program occurring in the EEA, that personal information may be EEA Personal Data.

The rights provided by the GDPR for EEA Personal Data include:

  • The right of access.
  • The right to correct.
  • The right to erasure (also known as the right to be forgotten).
  • The right to restrict processing.
  • The right to data portability (to move the data to another party).
  • The right to object.

All of these rights are subject to certain exemptions and limitations. More information about these rights may be found in the GDPR and in the EEA Privacy Statement.

Requesting to exercise your rights under the GDPR is known as making a Subject Access Request (sometimes called an SAR). A Subject Access Request form is made available for your convenience. The form sets out where you should send your request and asks that you provide us with proof of your identity.

Subject Access Request Form [PDF]

Before we can act on your request, we must:

  • Confirm your identity
  • Be supplied with sufficient information from you in order to locate the information you seek.

On receipt of your completed request, verification of your identity, and sufficient details to enable us to locate the information, Tufts is obliged to provide you information on our actions on your request within one month. That period may be extended by two months where necessary, taking into account the complexity and number of the requests.

If we determine not to fulfill your request, we are required to notify you within one month of our reasons for not doing so.

As provided in the GDPR, if a person’s data requests are clearly unfounded or excessive, we may charge a reasonable fee taking into account the administrative costs or decline to act on the requests.

Back to top

European Economic Area (EEA) Privacy Statement for Prospective Students and Applicants

This statement provides information about the use of EEA Personal Data provided by prospective students and applicants for admission to the schools’ programs and for financial aid for those programs. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This statement should be read together with the EEA Privacy Statement.

1. What is “EEA Personal Data?”

For purposes of this statement for prospective students and applicants, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us in connection with your interest in our academic programs and/or applying for admission to, or financial aid for, those programs.

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR Article 4 (2).

2. Who will process my EEA Personal Data?

The information provided here applies to the collection, use, sharing, disclosure and other processing of your EEA Personal Data by Tufts University and its schools (www.tufts.edu) as part of the admissions and financial aid process. The schools assessing your application for admission and for financial aid may provide you with additional statements about how they will collect, use, share, disclose and otherwise process your EEA Personal Data as you progress through the admissions and financial aid process.

3. What EEA Personal Data will be collected, used or otherwise processed?

For prospective students and applicants to undergraduate and graduate degree and certificate programs of the School of Arts and Sciences, the School of Engineering, and the School of the Museum of Fine Arts at Tufts:

Tufts will use the details provided, including on your Common Application, the Coalition Application, or the Questbridge application (undergraduate programs) or the graduate program application, supplementary application materials, together with the supporting documents requested and additional details provided by the persons submitting letters of recommendation or recorded following an interview, if one is conducted. Tufts will also use personal details you provide on any inquiry form (web-based, hand-written inquiry cards at recruitment events and information sessions), registration forms and inquiry email.

If applicable, Tufts also processes the information submitted in connection with your financial aid application. For certain degree programs, we will also conduct background screening checks for safeguarding purposes.

Additional information about the collection, use, combining and other processing of your EEA Personal Data is available by contacting the Admissions and Financial Aid offices of each school.

For prospective students and applicants to the School of Medicine, Sackler School of Graduate Biomedical Sciences, School of Dental Medicine, Gerald J. and Dorothy R. Friedman School of Nutrition Science and Policy, the Cummings School of Veterinary Medicine and The Fletcher School of Law and Diplomacy:

Tufts will use the details provided, including on your application, supplementary application materials, together with the supporting documents requested and additional details provided by the persons submitting letters of recommendation or recorded following an interview, if one is conducted. If applicable, some Tufts schools also process the financial information submitted in connection with your financial aid application. For certain degree programs, the school may also conduct background screening checks for safeguarding purposes and to make sure that its students are available for professional rotations and licensure.

Additional information about the collection, use, combining and other processing of your EEA Personal Data is available by contacting the Admissions and Financial Aid offices of each school.

All Schools.

In addition to the personal information referred to above, Tufts may process some EEA Personal Data about you that is classified as “special category” EEA Personal Data, which requires additional protections under the GDPR. This includes information you may provide concerning your race, ethnicity, sexual orientation, or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain programs of study, other sensitive information may be processed, such as information about past criminal convictions and your fitness to practice in certain regulated professions. Access to, and the sharing of, this sensitive or “special category” EEA Personal Data are controlled very carefully.

4. What is the purpose and lawful basis of the processing?

Tufts will use your EEA Personal Data provided on your admission application, the financial aid application, and the other information referred to above for the purposes of answering questions you may have, identifying you, processing your application, verifying the information provided, assessing your candidacy for admission to the programs to which you applied and deciding whether to offer you admission to those programs, assessing your eligibility for financial aid and determining what financial aid will be offered to you, and communicating to you those outcomes.

Additionally, Tufts may use or disclose the information provided for statutory, public interest and other purposes, including:

  • To prevent or detect fraud.
  • To comply with applicable laws and regulations and Tufts’ policies, including but not limited to its non-discrimination policy.
  • To help us to make reasonable accommodations for any disability, as requested by you.
  • To allow for consideration of any future accommodation requirements.
  • To offer and deliver university goods, services, and experiences to you.
  • To help inform and support university and school planning and decision making.
  • To provide information required by governmental and accrediting organizations.
  • To conduct research and statistical analysis. No information that could identify you will be published.

The University considers the processing of your personal information for the above purposes necessary to create a contractual relationship with you (e.g. to assess your application for admission), to comply with a legal obligation (e.g. non-discrimination), or to perform tasks carried out in the public interest (e.g. admissions research), and/or for the purposes of Tufts’ legitimate interests, including providing educational and academic programs. We require you to provide your personal information (except for questions marked as optional) during the admissions and financial aid processes in order to assess your candidacy properly. Admissions and financial aid decisions are not automated.

5. Will Tufts share my EEA Personal Data with others?

Your application and related materials will be shared with the appropriate faculty and staff at Tufts. Each school has developed its own practices for sharing your personal information based on its consideration of the type and sensitivity of the personal information, the purpose for which the information was provided or otherwise collected, the purpose for sharing the personal information, and the safeguards used to protect the shared information. Accordingly, under certain, considered circumstances, and when relevant, your personal information may also be shared with:

  • Parents and Guardians. In some cases, we may share your information with a parent or guardian if necessary to properly complete the admissions process or in the event of an emergency.
  • Service Providers. We may use third parties to support our operations and provide services to our students. In such cases, we may share your information with these third parties.
  • School Counselors and Administrators. We may share your information with your school counselors and administrators.
  • University Affiliated Programs. We may share your information with third parties that are affiliated with the University for the purpose of contacting you about goods, services, or experiences that may be of interest to you.
  • Research and Studies. We may share your information with third parties that study admissions or other topics related to higher education. We may also share your information with third parties that conduct research or develop products or services designed to improve admissions and other higher education functions.
  • Required by Law. We may share your information with third parties to the extent we are required to do so by law, court order, or subpoena. In the case of international applicants, we may share your information with appropriate agencies including the U.S. Citizenship and Immigration Services in order to act as your sponsor for visa purposes.
  • Emergency Circumstances. We may share your information with third parties if, in our sole judgment, such disclosure is necessary to protect the health, safety, or property of any person.
  • Compelling Purpose. We may share your information in other cases when there is a compelling purpose regarding benefit to Tufts or members of our community.
  • De-Identified and Aggregate Information. We may use and disclose information about our applicants in de-identified or aggregate form without limitation.

6. How is my EEA Personal Data used if I am admitted and decide to enroll?

If you are accepted and decide to enroll, we will use your personal information for the purposes described at How is my EEA Personal Data used? in the EEA Privacy Statement for Students as amended from time to time. Further information about this will be provided in your offer of admission, and if applicable, your financial aid decision.

If you are accepted and decide to enroll, Tufts will also provide data about you to the National Student Clearinghouse and other external agencies and funding bodies, as required.

7. How long will my EEA Personal Data be kept?

We will store your EEA Personal Data for as long as necessary to complete the application process. Some schools store applicant information permanently. If you are admitted, your personal information will normally be kept for at least one year or longer after the completion of the application process, depending on the policy of the school to which you applied. If you are admitted and decide to enroll, your personal information will be kept as part of your student record for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at Tufts). Details about how long different types of information are retained by Tufts is published at Records Retention Schedule and is available from the school to which you applied. Additional information about how long student information may be retained is available in the EEA Privacy Statement for Students.

8. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

9. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu, or your prospective school as appropriate.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside, where you work, or where you believe an infringement of the GDPR occurred.

10. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

EEA Privacy Statement for Students

The following statement has been prepared to provide notice to students whose EEA Personal Data is collected, used or otherwise processed by Tufts University, including its schools, while they are students at Tufts. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This statement should be read together with the EEA Privacy Statement.

In addition to the information provided in this statement, students are encouraged to review the information about the Family Educational Rights and Privacy Act (FERPA) for their school. FERPA permits the disclosure of certain personal information classified by a school as “directory” information. See School of Arts and Sciences and School of Engineering FERPA Notice; The Fletcher School FERPA Notice; Cummings School of Veterinary Medicine FERPA Notice; Friedman School of Nutrition Science and Policy FERPA Notice; School of Dental Medicine FERPA Notice; Sackler School of Graduate Biomedical Sciences FERPA Notice; and School of Medicine FERPA Notice. Privacy Blocks are available to students who wish to prevent the University from disclosing their directory information (in student directories and commencement programs, for example) by selecting the appropriate privacy settings through SIS (http://go.tufts.edu/sis).

1. What is “EEA Personal Data”?

For purposes of this statement for students, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us in connection with being a student, or your personal information is used or otherwise processed in connection with a university established activity in the EEA.

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” The person the personal data is about is called the “data subject.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR Article 4 (2).

2. How does this webpage relate to other information about data protection?

When you applied to become a student, you were told how Tufts would use your EEA Personal Data to process your application and for related purposes (see EEA Privacy Statement for Prospective Students and Applicants). You were referred to this webpage for a fuller statement of the uses we make of your EEA Personal Data while you are a student at Tufts.

In addition to the information published here, when you use specific services and facilities offered by Tufts, you may be told about other uses of your EEA Personal Data. For example, there are separate statements for persons who use or engage with Tufts websites (see Privacy Statement), IT services (see Use of Institutional Systems Policy), the Counseling and Mental Health service (see Confidentiality), the Office of Equal Opportunity (see http://oeo.tufts.edu/), and the libraries (see Tufts University Libraries Privacy Policy).

Additional information for students participating in Tufts-sponsored study abroad programs in the EEA is available at EEA Privacy Statement for Students in Tufts-Sponsored Study Abroad Programs in the EEA.

3. Who will process my EEA Personal Data?

The information published here applies to the use, sharing and disclosure of your EEA Personal Data by Tufts University, including its schools, units, centers and other affiliated organizations.

4. What EEA Personal Data will be processed?

The EEA Personal Data that Tufts keeps a record of may include the EEA Personal Data:

  • you provided in connection with your admission to Tufts, including financial aid applications, (see EEA Privacy Statement for Prospective Students and Applicants)
  • included in records about your studies at Tufts
  • included in records about your use of the academic and non-academic facilities and services that we offer.

Among the EEA Personal Data included may be your name, home and local addresses, student identification number, Social Security number or other governmental identification numbers, date of birth, courses taken, fee payments, financial aid provided, and information about your examinations, assessments and results.

Your EEA Personal Data is created, stored and transmitted in a variety of paper and electronic formats, including databases at Tufts (such as the main student records database, or the systems used by Tufts libraries). It is Tufts’ policy to limit access to and the use of your EEA Personal Data to Tufts staff, faculty and authorized affiliates who have a legitimate interest in it for the purpose of carrying out their professional and contractual duties.

In addition to this, Tufts may process some EEA Personal Data about you that is classified as “special category” EEA Personal Data, which requires additional protections. This includes information concerning your race, ethnicity, sexual orientation, religious beliefs, health or disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain programs of study, other sensitive information may be processed, such as information about past criminal convictions and your fitness to practice in certain regulated professions. Access to, and the sharing of, this sensitive or “special category” EEA Personal Data are controlled very carefully.

Tufts’ Non-Discrimination Policy “prohibits discrimination against and harassment of any student, employee, applicant for employment, third party or community member because of race; color; national or ethnic origin; age; religion; disability; sex; sexual orientation; gender; gender identity and expression; including a transgender identity; genetics; veteran status; retaliation; and any other characteristic protected under applicable federal or state law.”

5. What is the purpose and legal basis of the processing of EEA Personal Data?

Tufts may process your EEA Personal Data for a range of contractual, statutory, or legitimate University interests, or for public interest purposes, including the following:

  • To deliver and administer your education, record the details of your studies (including any placements with external organizations), and determine or confirm your academic achievements (e.g. results, awards).
  • Where relevant, to monitor, evaluate and support your research activity.
  • To administer the financial aspects of your relationship with us and any funders.
  • To deliver services to you (e.g. IT, athletics, libraries, accommodation, careers, housing).
  • To enable your participation at events (e.g. functions, commencement).
  • To communicate effectively with you by mail, email and phone, including the distribution of relevant newsletters and circulars.
  • To operate security, governance, disciplinary (including plagiarism and academic misconduct), complaint, audit and quality assurance processes and arrangements.
  • To support your training, medical, safety, and welfare requirements and your religious, spiritual, ethical, and cultural life.
  • To compile statistics and conduct research for internal, statutory, regulatory and accreditation reporting purposes.
  • To fulfil and monitor our legal obligations under equal opportunity, immigration and public safety laws and regulations, and for the establishment, exercise or defense of legal claims.
  • To enable us to contact others in the event of an emergency.

We consider the processing of your EEA Personal Data for these purposes to be necessary for the performance of our contractual obligations with you (e.g. to manage your student experience and welfare while studying at a Tufts program in the EEA), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. teaching and research), or necessary for the pursuit of the legitimate interests of Tufts as an educational and research institution or of an external organization (e.g. to enable your access to external services). If we require your consent for any specific use of your EEA Personal Data, we will collect it at the appropriate time. We will not use your EEA Personal Data to carry out any wholly automated decision-making that affects you.

6. Will Tufts share my EEA Personal Data with others?

As described above, your EEA Personal Data may be shared with relevant Tufts staff, faculty and affiliates as required. In addition, it may be shared as permitted or required by law, on a considered and confidential basis, as appropriate, with a range of external organizations, including external examiners and auditors, and external individuals involved in relevant Tufts committees or procedures.

We may also share your EEA Personal Data as relevant with:

  • Your Funders and Sponsors. We may share your EEA Personal Data with organizations that may provide you funding or other financial sponsorship.
  • Parents and Guardians. In some cases, we may share your EEA Personal Data with a parent or guardian if necessary, including in the event of an emergency.
  • Service Providers. We may use third parties to support our operations and provide services to our students. In such cases, we may share your EEA Personal Data with such third parties.
  • University Affiliated Programs. We may share your EEA Personal Data with third parties that are affiliated with the University for the purpose of contacting you about goods, services, or experiences that may be of interest to you. These may include the providers of any external/collaborative learning and training placements or fieldwork opportunities.
  • Student Organizations. We may share your EEA Personal Data with student clubs and other organizations in order to facilitate your knowledge of those groups.
  • Research and Studies. We may share your EEA Personal Data with third parties that study topics related to higher education. We may also share your EEA Personal Data with third parties that conduct research or develop products or services designed to improve higher education functions.
  • Higher Education Organizations. We may share your EEA Personal Data with the National Student Clearinghouse and other relevant higher education organizations.
  • Required by Law and/or Governmental Authorities. We may share your EEA Personal Data with third parties to the extent we are required to do so by law, court order, or subpoena. In the case of international students, we may share your EEA Personal Data with appropriate agencies including the U.S. Citizenship and Immigration Services in order to act as your sponsor for visa purposes. On occasion and when necessary, we may share your EEA Personal Data with local governmental authorities, including the police and other law enforcement bodies, and statutory regulatory bodies.
  • Emergency Circumstances. We may share your EEA Personal Data with third parties if, in our sole judgment, such disclosure is necessary to protect the health, safety, or property of any person.
  • Compelling Purpose. We may share your EEA Personal Data in other cases when there is a compelling purpose regarding benefit to the Tufts or members of our community.
  • De-Identified and Aggregate Information. We may use and disclose information about our students in de-identified or aggregate form without limitation.

We will normally confirm details of your results and degrees awarded to external enquirers or organizations, and will provide references to third parties. Your name and the type of degree awarded will be published in the relevant graduation program.

If your EEA Personal Data includes basic contact details, that information may be included in our online directory, though you can choose to limit what information is visible (https://whitepages.tufts.edu/faq.cgi). In addition, please see the information provided at the start of this statement with respect to FERPA.

The above types of sharing may involve the transfer of your EEA Personal Data outside the European Economic Area. Such transfers usually are necessary (i) in order to meet our contractual obligations with you or contractual obligations with others that are in your interest, (ii) for the establishment, exercise or defense of legal claims, (iii) to protect your vital interest, or (iv) as otherwise permitted by the GDPR. The transfers are carried out with confidentiality and privacy safeguards in place to protect your EEA Personal Data.

7. How long will my EEA Personal Data be kept?

We store your EEA Personal Data for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at Tufts). Information about how long different types of information are retained by Tufts is published at Records Retention Schedule.

8. How is my EEA Personal Data used after I graduate?

Core records for matriculated students are generally retained indefinitely so that the details of your academic achievements can be confirmed and for statistical or historical research. See Records Retention Schedule. Your contact and core personal details are passed to the Office of Alumni Relations while you are still a student so that you can be added to the alumni database. A statement for alumni and donors setting out how their EEA Personal Data is used by Tufts is published at EEA Privacy Statement for Alumni and Donors.

9. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

10. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu, or your prospective school as appropriate.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside, where you work, or where you believe an infringement of the GDPR occurred.

11. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

EEA Privacy Statement for Students in Tufts-Sponsored Study Abroad Programs in the EEA

The following statement has been prepared to provide notice to students whose EEA Personal Data is collected, used or otherwise processed by Tufts University, including its schools, for students applying to Tufts-sponsored study abroad programs in the EEA, and for students while they are studying in those programs. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This statement should be read together with the EEA Privacy Statement and the EEA Privacy Statement for Prospective Students and Applicants.

If you are a student in a study abroad program in the EEA sponsored by another university or college, then you should contact the program’s sponsor for information about their processing of any personal information subject to the GDPR.

In addition to the information provided in this statement, students are encouraged to review the information about the Family Educational Rights and Privacy Act (FERPA) for their school. FERPA permits the disclosure of certain personal information classified by a school as “directory” information.” See School of Arts and Sciences and School of Engineering FERPA Notice; The Fletcher School FERPA Notice; Cummings School of Veterinary Medicine FERPA Notice; Friedman School of Nutrition Science and Policy FERPA Notice; School of Dental Medicine FERPA Notice; Sackler School of Graduate Biomedical Sciences FERPA Notice; and School of Medicine FERPA Notice. Privacy Blocks are available to students who wish to prevent the University from disclosing their directory information (in student directories and commencement programs, for example) by selecting the appropriate privacy settings through SIS (http://go.tufts.edu/sis).

1. What is “EEA Personal Data”?

For purposes of this statement for students, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us in connection with being a participant in a Tufts-sponsored study abroad program, or your personal information is used or otherwise processed in the EEA in connection with the program.

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” The person the personal data is about is called the “data subject.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR Article 4(2).

3. How does this webpage relate to other information about data protection?

In addition to the information published here, when you use specific services and facilities offered by Tufts, you may be told about other uses of your EEA Personal Data. For example, there are separate statements for persons who use or engage with Tufts websites (see Privacy Statement), IT services (see Use of Institutional Systems Policy), the Counseling and Mental Health service (see Confidentiality), the Office of Equal Opportunity (see http://oeo.tufts.edu/), and the libraries (see Tufts University Libraries Privacy Policy).

4. Who will process my EEA Personal Data?

Your EEA Personal Data relating to your Tufts-sponsored study abroad program will be used, shared and otherwise processed by staff, faculty, and other persons directly associated with the program, as well as other Tufts offices whose services support study abroad programs, including the Office of Global Operations, and the International Center.

The program will also share your EEA Personal Data with your school, and other Tufts departments as part of your educational record, and for a variety of other academic, educational, administrative, research and statistical purposes.

Additional information is provided about third parties that may receive EEA Personal Data collected as part of the program, including host families and other universities or colleges that may be affiliated with the Tufts-sponsored program.

5. What EEA Personal Data will be processed?

The EEA Personal Data that the study abroad program may keep a record of may include the EEA Personal Data:

  • you provided in connection with your application to the study abroad program, including financial aid applications, if any (see EEA Privacy Statement for Prospective Students and Applicants),
  • included in records about your studies at Tufts,
  • included in records about your use of the academic and non-academic facilities and services in connection with the program.

Among the EEA Personal Data included may be your name, home and local addresses, cell phone number, student identification number, Social Security number, passport number or other governmental identification numbers, date of birth, courses taken, fee payments, financial aid provided, information about your examinations, assessments and results, emergency and family contact information, travel itineraries, language competencies, health and wellness information, dietary requirements and preferences, hobbies, and photos.

Your EEA Personal Data is created, stored and transmitted in a variety of paper and electronic formats, including databases at Tufts (such as the main student records database). It is Tufts’ policy to limit access to and the use of your EEA Personal Data to Tufts staff, faculty and authorized affiliates who have a legitimate interest in it for the purpose of carrying out their professional and contractual duties.

Tufts may process some EEA Personal Data about you that is classified as “special category” EEA Personal Data, which requires additional protections. This includes information concerning your race, ethnicity, sexual orientation, religious beliefs or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain programs of study, other sensitive information may be processed, such as information about past criminal convictions. Access to, and the sharing of, this sensitive or “special category” EEA Personal Data are controlled very carefully.

Tufts’ Non-Discrimination Policy “prohibits discrimination against and harassment of any student, employee, applicant for employment, third party or community member because of race; color; national or ethnic origin; age; religion; disability; sex; sexual orientation; gender; gender identity and expression; including a transgender identity; genetics; veteran status; retaliation; and any other characteristic protected under applicable federal or state law.”

6. What is the purpose and legal basis of the processing of EEA Personal Data?

Tufts may process your EEA Personal Data for a range of contractual, statutory, or legitimate University interests, or for public interest purposes, including the following:

  • To deliver and administer your education as part of the program, record the details of your studies (including any placements with external organizations), and determine/confirm your academic achievements (e.g. results, awards).
  • To administer the financial aspects of your relationship with us and any funders.
  • To deliver services to you (e.g. IT, accommodation, careers, housing, field trips).
  • To enable your participation at events.
  • To communicate effectively with you by mail, email and phone, including the distribution of relevant program information and updates, newsletters and brochures.
  • To operate security, governance, disciplinary (including plagiarism and academic misconduct), complaint, audit and quality assurance processes and arrangements.
  • To support your training, medical, safety, welfare requirements and your religious, spiritual, ethical, and cultural life.
  • To compile statistics and conduct research for internal, statutory, regulatory and accreditation reporting purposes.
  • To fulfil and monitor our legal obligations under equal opportunity, immigration and public safety laws and regulations, and for the establishment, exercise or defense of legal claims.
  • To enable us to contact others in the event of an emergency.

We consider the processing of your EEA Personal Data for these purposes to be necessary for the performance of our contractual obligations with you (e.g. to manage your student experience and welfare while studying at a Tufts-sponsored program in the EEA), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. teaching and research), or necessary for the pursuit of the legitimate interests of Tufts as an educational and research institution or an external organization (e.g. to enable your access to external services). If we require your consent for any specific use of your EEA Personal Data, we will collect it at the appropriate time. We will not use your EEA Personal Data to carry out any wholly automated decision-making that affects you.

7. Will Tufts share my EEA Personal Data with others?

As described above, your EEA Personal Data may be shared with relevant Tufts staff, faculty and affiliates as required. In addition, it may be shared as permitted or required by law, on a considered and confidential basis, as appropriate, with a range of external organizations, including external examiners and auditors, and external individuals involved in relevant Tufts committees or procedures.

We may also share your EEA Personal Data as relevant with:

  • Affiliated Universities and Colleges. If the Tufts-sponsored program is affiliated with a university or college in the EEA, we will share EEA Personal Data with the staff and faculty of that university or college as part of providing courses and other educational offerings and experiences to you.
  • Host Families. If you will be residing with a host family, some of your EEA Personal Data will be shared with them, including your name, contact information, and other information that will be helpful for the family to provide you with a positive experience in their home.
  • Your Funders and Sponsors. We may share your EEA Personal Data with organizations that may provide you funding or other financial sponsorship.
  • Parents and Guardians. In some cases, we may share your EEA Personal Data with a parent or guardian if necessary, including in the event of an emergency.
  • Service Providers. We may use third parties to support our operations and provide services to our students. In such cases, we may share your EEA Personal Data with such third parties.
  • University Affiliated Programs. We may share your EEA Personal Data with third parties that are affiliated with the University for the purpose of contacting you about goods, services, or experiences that may be of interest to you. These may include the providers of any external/collaborative learning and training placements or fieldwork opportunities.
  • Student Organizations. We may share your EEA Personal Data with student clubs and other organizations in order to facilitate your knowledge of those groups.
  • Research and Studies. We may share your EEA Personal Data with third parties that study topics related to higher education. We may also share your EEA Personal Data with third parties that conduct research or develop products or services designed to improve higher education functions.
  • Higher Education Organizations. We may share your EEA Personal Data with the National Student Clearinghouse and other relevant higher education organizations.
  • Required by Law and/or Governmental Authorities. We may share your EEA Personal Data with third parties to the extent we are required to do so by law, court order, or subpoena. In the case of international students, we may share your EEA Personal Data with appropriate agencies including the U.S. Citizenship and Immigration Services in order to act as your sponsor for visa purposes. On occasion and when necessary, we may share your EEA Personal Data with local governmental authorities, including the police and other law enforcement bodies, and statutory regulatory bodies.
  • Emergency Circumstances. We may share your EEA Personal Data with third parties if, in our sole judgment, such disclosure is necessary to protect the health, safety, or property of any person.

We will normally confirm details of your results and degrees awarded to external enquirers or organizations, and will provide references to third parties.

The above types of sharing may involve the transfer of your EEA Personal Data outside the European Economic Area. Such transfers usually are necessary (i) in order to meet our contractual obligations with you or contractual obligations with others that are in your interest, (ii) for the establishment, exercise or defense of legal claims, (iii) to protect your vital interest, or (iv) as otherwise permitted by the GDPR. The transfers are carried out with confidentiality and privacy safeguards in place to protect your EEA Personal Data.

8. How is my EEA Personal Data used after I graduate?

Core records for students are generally retained indefinitely for statistical or historical research and so that the details of your academic achievements can be confirmed. See Records Retention Schedule.

9. How long will my EEA Personal Data be kept?

We store your EEA Personal Data for the duration of your studies (and it may be used as part of our assessment of any future application you make for further studies at Tufts). Generally, student records for matriculated students are retained permanently. Information about how long different types of information are retained by Tufts is published at Records Retention Schedule.

10. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

11. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside or where you believe an infringement of the GDPR occurred.

12. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

EEA Privacy Statement for Job Applicants, Faculty, Staff, Consultants and Other Persons Providing Services

The following statement has been prepared to provide notice to job applicants, faculty, staff, consultants and other persons providing services whose EEA Personal Data is collected, used or otherwise processed by Tufts University. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This statement should be read together with the EEA Privacy Statement.

Specific sections are as follows:

I. For job applicants:

II. Supplement for job applicants undergoing background checks (e.g. criminal records, security, visas):

III. For faculty, staff, consultants, and other persons providing services:

IV. General Information, including your GDPR rights and where you can get answers to your questions

This statement discloses the privacy practices for the EEA Personal Data of faculty, staff, consultants, and people who apply for jobs or positions with us. Please read these terms together with the Tufts University Privacy Statement, the EEA Privacy Statement, and the Statement on Personnel Records.

What is “EEA Personal Data?”

For purposes of this statement for job applicants, faculty, staff, consultants and other persons providing services, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us in connection with being a job applicant, faculty, staff, consultant or other person providing services.

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” The person the personal data is about is called the “data subject.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR. Article 4(2).

For example, if you provide personal information to Tufts when you are physically present in the EEA or when you are providing services on behalf of Tufts in the EEA, or if your personal information is used or otherwise processed in connection with a university established activity in the EEA, that personal information may be EEA Personal Data.

I. Job Applicants

1. How We Use Your EEA Personal Data

This section provides information about the use of job applicants’ EEA Personal Data by Tufts University, its schools, units, centers and other affiliated organizations for applicants for faculty (employee and non-employee), staff, consultant and other positions.

2. Who will process my EEA Personal Data?

The information published here applies to the use, sharing, disclosure and other processing of your EEA Personal Data by Tufts University, its schools, units, centers and other affiliated organizations, which work together closely and share your EEA Personal Data for a variety of administrative and statistical purposes in accordance with agreed protocols.

3. How does my Taleo account work?

If you are applying for a position through the Taleo online portal, information about how your account works is published separately. Please see the Taleo FAQ for more information. Your information remains in the Taleo database indefinitely.

4. How does my Interfolio account work?

If you are applying for a faculty position through the Interfolio online portal, information about how your account works is published separately. Please see Job Applicant's Guide to Interfolio for more information.

5. What EEA Personal Data will be processed?

Tufts will use the details you provide on your application form, together with the supporting documents requested and additional details provided by any persons submitting letters of recommendation, and information recorded following any interview process.

If you are required to undergo certain background checks or procedures as part of the job application and offer process (e.g. criminal convictions checks or visa application procedures), we will use this information as described at Background Checks Data [link to background checks section below].

6. What is the purpose and lawful basis of the processing?

Tufts will process the EEA Personal Data provided on your application and the other information referred to above for the purposes of identifying you, processing your application, verifying the information provided and assessing your suitability for the role, deciding whether to offer you a job or position, and communicating that outcome.

We may also use or disclose the information provided for the following statutory or public interest purposes:

  • To prevent or detect fraud.
  • To comply with applicable laws and regulations and Tufts’ policies, including its non-discrimination policy.
  • To help us to make reasonable adjustments for any disability, as requested by you.
  • To allow us to consider any future accommodation requirements.
  • To help inform and support University and school planning and decision making.
  • To provide information required by governmental and accrediting organizations.
  • For research and statistical purposes.

We consider the processing of your EEA Personal Data for the above purposes to be either necessary for us to take steps with a view to considering your employment application, or necessary for compliance with a legal obligation (e.g. non-discrimination), or necessary for the performance of tasks we carry out in the public interest (e.g. reporting or research). We require you to provide us with the information we ask for during the application process in order to assess your application properly except where its supply is marked as optional. Applications decisions are not automated.

7. Will Tufts share my EEA Personal Data with others?

As well as circulating your application and related materials to the appropriate hiring staff, reviewers, and interviewers at Tufts, we will share your EEA Personal Data for the above purposes as relevant and necessary with:

  • Recommendations. In checking your references, we may share your information with persons submitting letters of recommendation. For most staff applications, Tufts contracts with a third-party service that solicits information from references on an anonymous basis.
  • Service Providers. We may use third parties to support our operations and provide services to our applicants. In such cases, we may share your information with such third parties.
  • Required by Law. We may share your information with third parties to the extent we are required to do so by law, court order, or subpoena. In the case of international applicants, we may share your information with appropriate agencies including the U.S. Citizenship and Immigration Services for visa and right to work check purposes.
  • Emergency Circumstances. We may share your information with third parties if, in our sole judgment, such disclosure is necessary to protect the health, safety, or property of any person.
  • Compelling Purpose. We may share your information in other cases when there is a compelling purpose regarding benefit to Tufts or members of our community.
  • De-Identified and Aggregate Information. We may use and disclose information about our applicants in de-identified or aggregate form without limitation.

8. How is my EEA Personal Data used if I become a member of faculty, staff, a consultant or otherwise selected for a position at Tufts?

If you receive an offer of employment and you accept it, we will use your EEA Personal Data for the purposes described at Faculty, Staff, Consultants and Other Persons Providing Services [add link to section below], as amended from time to time.

9. How long will my EEA Personal Data be kept?

We store your EEA Personal Data for as long as necessary to complete the application process. Your EEA Personal Data may also be used as part of our assessment of any future application you make for further employment or engagement at Tufts. If you are offered a position and accept that position, your information will normally be kept as part of your personnel record for the duration of your employment plus six years or permanently for faculty. After you leave, certain records pertaining to your employment or engagement are retained indefinitely so that the details of your employment or engagement can be confirmed and for statistical or historical research. If you are not offered a position, your information will normally be kept for six years after the completion of the application process. Currently, Taleo retains information submitted to it indefinitely. Other information about how long different types of information are retained by Tufts is published at Records Retention Schedule.

In addition, if you apply for a faculty appointment, the school may also retain records including your EEA Personal Data in accordance with the policy adopted by the school(s) and administered by each faculty affairs office.

II. Background Check Data

This page describes how your EEA Personal Data is used and stored if you are required to undergo certain background checks or procedures as part of the application and offer process. It supplements the general information about how we use your EEA Personal Data as an applicant for a position (see Job Applicants) [add link to job applicant section]. The checks and procedures covered by this section include basic background checks, including verification of education and prior employment, CORI reports, security clearance checks, any application for immigration purposes including where visa sponsorship is required, and similar processes that will only affect some applicants, whether because of the type of position you are applying for or because of your individual status. The sensitive information that may be processed may include information about past criminal convictions, including sex offender convictions, motor vehicle records, and your fitness to practice in certain regulated professions. If any of these checks affect you, we will make this clear to you at the relevant point in the application process.

In all cases, we will only use any information gathered as part of any relevant check or procedure for that specific purpose, and it is our policy to handle, store, retain and destroy relevant materials in accordance with applicable laws and regulations and standards of practice. This means that access to any relevant materials (including any forms completed by Tufts) is strictly controlled. We retain the results of the relevant checks. We will only share any relevant information with external parties insofar as we are required to do so or doing so is necessary (this may include partner organizations or employers and third party vendors who provide associated services).

III. Faculty, Staff, Consultants and Other Persons Providing Services

1. How We Use Your EEA Personal Data

This section provides information about the use of EEA Personal Data while you are a member of faculty, staff, consultant, or other person providing services at Tufts University. Tufts University respects the privacy of its employees and other persons providing services and strives to keep its personnel files confidential. The Human Resources Department maintains a personnel file for each employee. See Statement on Personnel Records.

As a member of faculty, staff, consultant or other person providing services at Tufts, you also have certain legal responsibilities to protect the EEA Personal Data of other people (e.g. other employees, students, research participants) by handling it appropriately; relevant policies and guidance on the University’s policy on handling EEA Personal Data are available at the Tufts University Privacy Statement and the EEA Privacy Statement.

2. How does this webpage relate to other information about data protection?

When you were a job applicant, you were told how Tufts would use your EEA Personal Data during the recruitment process and for related purposes. (see Job Applicants [add link to section above]). You were referred to this webpage for a fuller statement of the uses we would make of your EEA Personal Data if you became a member of faculty, staff, consultant, or other person providing services at Tufts University. In addition to the information published here, when you use specific services and facilities offered by Tufts, you will be told about other uses of your EEA Personal Data. For example, there are separate statements for persons who use or engage with Tufts websites (see Privacy Statement), IT services (see Use of Institutional Systems Policy), the Office of Equal Opportunity (see http://oeo.tufts.edu/) and the libraries (see Tufts University Libraries Privacy Policy).

3. Who will process my EEA Personal Data?

The information published here applies to the use, sharing and disclosure of your EEA Personal Data by Tufts University, its schools, units, centers and other affiliated organizations, which work together closely and share your EEA Personal Data for a variety of administrative and statistical purposes in accordance with agreed protocols.

4. What EEA Personal Data will be processed?

Tufts will keep a record of the details you provided on your application form, any supporting documents requested and additional details provided by any person submitting a letter of recommendation and/or recorded following any interview process. We will maintain various administrative, including financial, records, about your employment or engagement at Tufts, and about your use of the academic and non-academic facilities and services that we offer. Where relevant, we may supplement these records with personal data from the public domain (e.g. your publications) or other sources.

Your EEA Personal Data is created, stored and transmitted securely in a variety of paper and electronic formats, including some databases at Tufts (such as the systems used by Human Resources and Tufts Support Services). It is Tufts’ policy to limit access to your EEA Personal Data to staff and others who have a legitimate interest in it for the purpose of carrying out their duties.

In addition to this, Tufts may process some EEA Personal Data about you that is classified as “special category” EEA Personal Data, which requires additional protections. This includes information concerning your race or ethnicity, health or disability that we use for providing employment benefits, planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain positions, other sensitive information may be processed, such as information about past criminal convictions and your fitness to practice in certain regulated professions. Access to, and the sharing of, this sensitive or “special category” EEA Personal Data are controlled very carefully.

Tufts’ Non-Discrimination Policy “prohibits discrimination against and harassment of any student, employee, applicant for employment, third party or community member because of race; color; national or ethnic origin; age; religion; disability; sex; sexual orientation; gender; gender identity and expression; including a transgender identity; genetics; veteran status; retaliation; and any other characteristic protected under applicable federal or state law.”

5. What is the purpose and lawful basis of the processing?

Tufts will process your EEA Personal Data for a range of contractual, statutory or public interest purposes, including the following:

  • To assess your suitability for a particular role or task.
  • To support you in implementing any health-related accommodations to allow you to carry out a particular role or task.
  • To administer remuneration, payroll, benefit, and other standard employment functions.
  • To administer HR-related processes, including those relating to performance/absence management, disciplinary issues and complaints/grievances.
  • To operate security, governance, audit and quality assurance arrangements.
  • To deliver facilities (e.g. IT, libraries), services and staff benefits to you, and where appropriate to monitor your use of those facilities in accordance with Tufts policies (e.g. on the acceptable use of IT).
  • To communicate effectively with you by mail, email and phone, including the distribution of relevant newsletters and announcements.
  • To support your training, health, safety, and welfare requirements.
  • To compile statistics and conduct surveys and research for internal, statutory and regulatory reporting purposes.
  • To fulfil and monitor our responsibilities under equality, immigration and public safety laws and regulations, and for the establishment, exercise or defense of legal claims.
  • To enable us to contact others in the event of an emergency (we will assume that you have obtained the consent of the individuals before you supply their contact details to us).

We consider the processing of your EEA Personal Data for these purposes to be necessary (i) for the purpose of Tufts’ legitimate interests since employing and retaining qualified persons is necessary to conducting our operations as a university; (ii) if a contractual relationship exists, in order to meet our contractual obligations with you, or contractual obligations with others that are in your interest; (iii) for compliance with a legal obligation (e.g. non-discrimination); or (iv) for the performance of tasks we carry out in the public interest (e.g. reporting or research). We require you to provide us with any information we reasonably ask for to enable us to administer your relationship with Tufts. It is Tufts’ policy not to use your EEA Personal Data for any wholly automated decision-making that affects you, other than in connection with enrollment in some of our benefit plans when you first become a benefit eligible employee. Benefit information is provided to you at the time you become eligible and periodically thereafter.

6. Will Tufts share my EEA Personal Data with others?

Your EEA Personal Data is shared as permitted or required by law, on a considered and confidential basis, with a range of external organizations, including the following:

  • The external providers of any employee benefits or retirement programs.
  • The external providers of other services or benefits to our employees, consultants and service providers.
  • Relevant government departments, executive agencies or non-departmental public bodies, and other institutes of higher education.
  • Any relevant professional or statutory regulatory bodies.
  • Prospective and actual research funders or sponsors.
  • Any relevant simultaneous employers.
  • As required by applicable law, the relevant trade unions.
  • On occasion and where necessary, the police and other law enforcement agencies.
  • On occasion and where necessary, auditors.
  • Companies or organizations providing specific services to, or on behalf of, Tufts.

Our policy is to provide limited information about you to external enquirers or organizations to verify employment dates and job title, and, if the person requesting the information already has the information, to confirm salary.

We will include your basic contact details in our online directory (https://whitepages.tufts.edu/). If your EEA Personal Data includes basic contact details, that information may be included in our online directory, though you can choose to limit what information is visible (https://whitepages.tufts.edu/faq.cgi). Some departments may expect faculty and staff to maintain a publicly available personal profile or webpage. Some information about Tufts officers, faculty and other staff (e.g. appointments or committee memberships) is published in Tufts Now, Tufts Announcements, Tufts magazines, brochures, and newsletters, press releases, social media accounts, and other Tufts communications.

The above types of sharing may involve the transfer of your EEA Personal Data collected or otherwise processed in the European Economic Area to outside the European Economic Area. Such transfers usually are necessary (i) if a contractual relationship exists, in order to meet our contractual obligations with you, or contractual obligations with others that are in your interest; (ii) for the establishment, exercise or defense of legal claims; (iii) to protect your vital interest; or (iv) as otherwise permitted by the GDPR. The transfers are carried out with confidentiality and privacy safeguards in place to protect your EEA Personal Data.

Other than as set out above, we will not normally publish or disclose any EEA Personal Data about you to other external enquirers or organizations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).

7. How long will my EEA Personal Data be kept?

Your EEA Personal Data will normally be kept as part of your personnel record for the duration of your employment or other engagement plus six years for staff and permanently for faculty. Your EEA Personal Data may also be used as part of our assessment of any future application you make for further employment or engagement at Tufts. After you leave, certain records pertaining to your employment or engagement may be retained indefinitely so that the details of your employment or engagement can be confirmed and for statistical or historical research. Information about how long different types of information are retained by the Tufts is published at Records Retention Schedule.

In addition, if you receive a faculty appointment, the school may also retain records including your EEA Personal Data in accordance with the policy adopted by your school and administered by its faculty affairs office.

IV. General Information

1. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

9. How can I access my personnel file?

In addition to your rights to access your EEA Personal Data, as described above, you may also request a copy of your personnel file. See Statement on Personnel Records.

10. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside, where you work, or where you believe an infringement of the GDPR occurred.

11. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

EEA Privacy Statement for Alumni and Donors

The following Statement has been prepared to provide notice to alumni and donors whose EEA Personal Data is collected, used or otherwise processed by Tufts University. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This Statement discloses the privacy practices for the EEA Personal Data of Tufts alumni and donors. Please read these terms together with the Tufts University Privacy Statement, the EEA Privacy Statement, and the Privacy Policy for Alumni Data.

The Tufts University Alumni Association and the Tufts University Advancement Division respect your right to privacy and will only use your information for university-related purposes. It is Tufts’ policy to use legally required and industry standard methods to secure such data.

This Statement explains how Tufts handles and uses the EEA Personal Data we collect about our alumni and our past, current and future supporters, whether donors, volunteers or participants in membership groups that we run. “Tufts” in this context means the central university, our individual schools, departments and research institutes, and the libraries and other cultural and recreational facilities that we operate. Developing a better understanding of our alumni and donors allows us to keep in touch with you, in order to keep you apprised of our activities and developments, to provide services to you, and to identify ways in which you can support us, through donations or other forms of financial and non-financial support.

1. What is “EEA Personal Data”?

For purposes of this statement for alumni and donors, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us. in connection with being an alumnus or donor.

The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” The person the personal data is about is called the “data subject.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR. Article 4(2).

For example, if you provide personal information to Tufts when you are physically present in the EEA, that personal information may be EEA Personal Data.

2. EEA Personal Data held by Tufts

We may hold information relating to you from a number of sources. A significant proportion of the EEA Personal Data we hold on alumni and donors is provided to us directly (for example, an alumnus may give us information by filling in forms on the Tufts website, or by corresponding with us by telephone, email or otherwise). If you are a student or studied at Tufts, some of your personal information is transferred from your student record to Tufts University Advancement databases.

The information we hold about you may or may not be EEA Personal Data within the scope of the GDPR.

Among the information records may contain are:

  • details of your education (e.g. your school(s), areas of study, dates of study)
  • unique personal identifiers and biographical information (e.g. student number, date of birth)
  • your contact details (and we update these whenever you let us know that they have changed)
  • details of your interactions with Tufts, including:
    • your membership of clubs, societies, and alumni groups
    • your attendance at Tufts events
    • other contact with us or our partners
    • your relationships with other Tufts alumni or donors
  • details about your family (e.g. your marital status, the name of your partner or spouse)
  • personal data provided by you for a specific purpose (e.g. disability and dietary preferences for event management purposes)
  • your communication preferences, to help us provide tailored and relevant communications

We also record, where applicable, based on information that you provide to us and, in some cases, publicly available information and information from our partners:

  • financial information relating to you and your family, including:
    • your history of donations made to Tufts
    • your ability and willingness to make donations, including our assessment of your income and whether particular donations or funding appeals may be of interest to you
    • your philanthropy and other giving, including donations to other organizations and other support that you provide (e.g. details of volunteering roles)
  • your career highlights and other life achievements
  • information about your areas of interest and extra-curricular activities

We augment the data we hold from Tufts with data from our collaborators and publicly available data. We use targeted internet searches and may search the following (either directly or using search engines), where relevant in order to obtain and maintain the accuracy of the data listed above:

  • Public sources for companies (in order to find personal data of those companies' employees, etc.), including company websites
  • Public sources for charities (in order to find personal data of those charities' employees, trustees, etc., and to find information about donations and support)
  • Public sources for individuals
  • Press sources

In addition to this, Tufts may process some EEA Personal Data about you that is classified as “special category,” EEA Personal Data, which requires additional protections. This may include information concerning your race, ethnicity, sexual orientation, political opinions, religious beliefs or health/disability that we use for planning purposes, or in order to provide help or suitable assistance. Access to, and the sharing of, this sensitive or “special category” EEA Personal Data are controlled very carefully.

3. How your EEA Personal Data is used by Tufts

We may use automated or manual analyses to link EEA Personal Data together to help us identify your potential for supporting Tufts, to provide you with an improved experience, to send you communications which are relevant and timely, to identify volunteering opportunities or opportunities for providing support which may be of interest to you, and to avoid approaching you with opportunities which are not of interest. All of this enables us to raise more funds, sooner, and more cost-effectively, in support of Tufts’ strategic research and teaching objectives. We always seek to ensure that any opportunities we present are aligned with your interests, based on the research we conduct.

Your EEA Personal Data is used by us for a number of interdependent purposes in support of alumni relations, communications and fundraising. These include:

  • sending you publications, alumni magazines, and news and updates about Tufts
  • conducting surveys, including research on when and whether particular donations or funding appeals may be of interest to you
  • providing services, including access to Tufts facilities and alumni and donor email accounts
  • providing an alumni directory within the password-protected Tufts University Online community
  • sending you information about giving opportunities, tailored proposals, appeals and requests for donations
  • sending you details of volunteering opportunities
  • inviting you to alumni, donor, and other Tufts events
  • the promotion of other opportunities and services available to you (e.g. offers and opportunities available through Tufts’ network of alumni and donor groups)
  • wealth analysis and research in order to improve our understanding of our alumni and donors, inform our fundraising strategy and target our communications more effectively
  • internal record keeping, including the management of any feedback or complaints
  • administrative purposes (e.g. in order to process a donation you have made or to administer an event you have registered for or attended)

The Tufts University Alumni Association and the Tufts University Advancement Division has also occasionally approved sharing alumni and donor data with companies and institutions that desire to offer services and benefits to Tufts alumni and donors at a discounted rate. Any third parties who receive alumni and donor data for this purpose are prohibited from using or sharing the data for any purpose other than providing services to Tufts or to its alumni and donors.

Communications to you may be sent by mail, telephone or electronic means, depending on the contact details we hold and the preferences expressed by you about the types of communications you wish to receive. Alumni may at any time opt-out of receiving all emails from the alumni association, or just emails from companies and institutions offering services and benefits to alumni, by clicking on the "update your email subscription preferences" link in emails and following the specified instructions, or by calling 1-800-THE-ALUM (1-800-843-2586) or 617-627-3532, by faxing a request to 617-627-3938, or by mailing a request to Tufts University Alumni Association, 80 George St., Ste. 100-3, Medford, MA 02155.

4. The lawful basis under the GDPR for processing your EEA Personal Data

The lawful basis for processing your EEA Personal Data under the GDPR include being necessary for the pursuit of our legitimate interests, the carrying out of a task in the public interest, and in some instances, the performance of a contract. We always endeavor to handle your EEA Personal Data securely and minimize its use.

5. How we protect your EEA Personal Data

It is Tufts’ policy to have appropriate data sharing agreements in place before sharing your EEA Personal Data.

We do not sell your EEA Personal Data to third parties under any circumstances, or permit third parties to sell the EEA Personal Data we have shared with them. In addition, it is Tufts policy to prohibit any third party (except those selected by the Tufts University Alumni Association and University Advancement) from using alumni or donor data for any commercial or business marketing.

The above types of sharing may involve the transfer of your EEA Personal Data outside the European Economic Area. Such transfers usually are necessary (i) in order to meet our contractual obligations with you or contractual obligations with others that are in your interest, (ii) for the establishment, exercise or defense of legal claims, (iii) to protect your vital interest, or (iv) as otherwise permitted by the GDPR. The transfers are carried out with confidentiality and privacy safeguards in place to protect your EEA Personal Data.

6. How long will my EEA Personal Data be kept?

We will retain your EEA Personal Data indefinitely in support of your lifelong relationship with Tufts or until you request us to do otherwise. Further information about Tufts’ record retention practices can be found at our Records Retention Schedule.

7. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

8. Where can I go if I have questions?

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside, where you work, or where you believe an infringement of the GDPR occurred.

9. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top

EEA Privacy Statement for Research Participants

The following statement has been prepared to provide notice to research participants whose EEA Personal Data is collected, used or otherwise processed by Tufts University, including its schools. This statement provides notice under the General Data Protection Regulation (GDPR) for the European Economic Area (EEA). The GDPR became effective on May 25, 2018. The GDPR is a regulation adopted for the EEA that governs the use and processing of personal information. Tufts is committed to processing your EEA Personal Data in compliance with the GDPR and has prepared this statement to provide you with information about your rights under the GDPR.

This statement should be read together with the EEA Privacy Statement.

1. What is “EEA Personal Data”?

For purposes of this statement for participants, your personal information is EEA Personal Data if it is “personal data” (as defined in the GDPR) and you are in the EEA when you provide the personal information to us in connection with being a research participant. The GDPR defines “personal data” broadly. It includes “any information relating to an identified or identifiable natural person.” The person the personal data is about is called the “data subject.” Examples of personal data include your “name, an identification number, location data, an online identifier [and] factors specific to [your] physical, physiological, genetic, mental, economic, cultural or social identity.” GDPR. Article 4(1).

The GDPR often uses the term “processing,” which includes any way of working with personal data, from collecting to using to sharing to disposing of it. GDPR Article 4(2).

3. How does this webpage relate to other information about data protection?

The general information published on this page is intended to supplement the specific information that you have already been given (for example on a participant information sheet or a consent form) in connection with your participation in a research study or project run by academic researchers affiliated with Tufts University. The below information applies to all studies and projects that are conducted by Tufts researchers. In the unlikely event that there is any contradiction between this general information and the specific information that you have already been given, the specific information takes precedence.

In addition to the information published here, when you use specific services and facilities offered by Tufts, you may be told about other uses of your EEA Personal Data. For example, there are separate statements for persons who use or engage with Tufts websites (see Privacy Statement) and IT services (see Use of Institutional Systems Policy).

4. What EEA Personal Data will be processed, who will process my EEA Personal Data, and who will my EEA Personal Data be shared with?

You have already been told about the types of personal information we will use in connection with the specific research study or project you are participating in and (where applicable) its sources, any data sharing or international transfer arrangements, and any automated decision-making that affects you.

You have already been told about the types of personal information we will collect and process in connection with the specific research study or project you are participating in and where and how we might collect those data, any data sharing or international transfer arrangements that may be part of the research project, and any automated decision-making that affects you.

5. What is the purpose and legal basis of the processing of EEA Personal Data?

In general terms, we use your EEA Personal Data (including, where appropriate, EEA Personal Data that is sensitive) to carry out academic and/or translational research in the public interest.

6. How long will my EEA Personal Data be kept?

You have already been told about the long-term use (and, where applicable, re-use) and retention of your EEA Personal Data in connection with the specific research study or project you are participating in. General information about how long different types of information are retained by Tufts is published at Records Retention Schedule.

7. What rights do I have with respect to my EEA Personal Data?

The GDPR provides you with several specific data protection rights with respect to your EEA Personal Data. These are generally described below. Further details, including how to submit a request, are published at How to make a Subject Access Request under the GDPR.

  • The right of access. You have the right to confirmation of the EEA Personal Data that is processed about you by Tufts and to a copy of the information. This right is subject to limitations, including that providing a copy will not adversely affect the rights of others.
  • The right to correct. The GDPR includes a right for you to have inaccurate EEA Personal Data rectified, or taking into account the purposes of the processing, completed if it is incomplete.
  • The right to erasure (also known as the right to be forgotten). The GDPR includes a right for individuals to have their EEA Personal Data erased in certain limited circumstances. This right is not absolute.
  • The right to restrict processing. You have the right to request the restriction or suppression of your EEA Personal Data. This is not an absolute right and only applies in certain circumstances. If processing is restricted, Tufts would not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or other exceptions. Tufts would be permitted to continue to store the information.
  • The right to data portability. The right to data portability allows you to obtain an electronic copy of your EEA Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy or transfer EEA Personal Data easily from one IT environment to another. This right only applies to information you have provided to Tufts and depending on the context, applies to some of your information, but not to all of your information.
  • The right to object. The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances, in the absence of a compelling reason for the continued processing.

8. Where can I go if I have questions?

If you have any questions about the particular research study you are participating in, please use any contact details you have already been supplied with.

If you have any questions about how your EEA Personal Data is used, or wish to exercise any of your rights, please consult the EEA Privacy Statement and How to make a Subject Access Request under the GDPR. If you need further assistance, please contact Tufts’ Data Privacy Team at dataprivacy@tufts.edu.

If you are not happy with the way your EEA Personal Data is being handled, or with the response received from us, you have the right to lodge a complaint with the GDPR supervisory authority in the EEA country where you habitually reside or where you believe an infringement of the GDPR occurred.

9. Changes to this Privacy Statement

Tufts University reserves the right to change, modify, or otherwise amend this Privacy Statement at its sole discretion and at any time as it deems circumstances warrant. Any such changes will be posted on this page.

This Privacy Statement was last updated on May 25, 2018.

Back to top