General Data Protection Regulation (GDPR)
GDPR Privacy Notice and Request for Consent
The European Union General Data Protection Regulation (GDPR)
The European Union General Data Protection Regulation, or GDPR (EU 2016/679), is a regulation concerning the collection, protection and processing of personal data provided by an individual ("data subject") while in a country that follows the General Data Protection Regulation (GDPR), regardless of citizenship or residency. Therefore, the terms and conditions contained in the Regulation and detailed in this Notice only apply while an individual is physically present in one of the countries that follows the General Data Protection Regulation. Complete information is available on the European Commission website.
Privacy Notice
Grand Valley State University continues to be committed to conducting the collection and processing of personal data with integrity and in compliance with applicable data protection laws. This Privacy Notice, required under the GDPR, presents information about how the University collects, uses and protects personal data you provide as an employee of the University.
1. Data Controller Contact Information
Grand Valley State University serves as the Data Controller and determines the purposes and means of processing your personal data. The individual below serves as the primary contact for GDPR compliance related to the employee information and is responsible for responding to questions about this Notice and requests to exercise a data subject's rights.
Megan Bravo
Manager of Talent Acquisition
Email: [email protected]
Phone: (616) 331-2215
Human Resources
1090 James H. Zumberge Hall (1090 JHZ)
Allendale, MI, 49401
2. Purposes for Collecting and Using Data
The University will keep a record of the details you provided on your application form and any supporting documents requested. We will maintain various administrative and financial records about your employment at Grand Valley, and about your use of the academic and non-academic facilities and services that we offer. Where relevant, we may supplement these records with personal data from the public domain (e.g. your publications) or other sources (e.g., where relevant, the Higher Education Academy).
Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats. Access to your personal information is limited to staff who have a legitimate interest in it for the purpose of carrying out their contractual duties, and our use of your personal information will not be excessive.
In addition to this, the University may process some information about you that is classified as 'sensitive' or 'special category' personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain roles, other sensitive information may be processed, such as information about past criminal convictions. Access to, and the sharing of, your 'sensitive' personal data are controlled very carefully. You will normally be given further details about our use of any such data when we collect it from you.
What is the purpose and legal basis of the processing?
The University will process your personal information for a range of contractual, statutory or public interest purposes, including the following:
• To assess your suitability for a particular role or task.
• To support you in implementing any health-related adjustments to allow you to carry out a particular role or task.
• To administer payroll and other standard employment functions.
• To administer HR-related processes, including those relating to performance/absence management, disciplinary issues and complaints/grievances.
• To deliver facilities (e.g. IT, libraries), services (e.g. accommodation, childcare) and staff benefits to you, and where appropriate to monitor your use of those facilities in
accordance with University policies.
• To communicate effectively with you by mail, email and phone, including the distribution of relevant newsletters and circulars.
• To support your training, health, safety, welfare and religious requirements.
• To fulfill and monitor our responsibilities under immigration and public safety legislation.
• To enable us to contact others in the event of an emergency (we will assume that you have checked with the individuals before you supply their contact details to us).
We consider the processing of your personal information for these purposes to be either necessary for the performance of our contractual obligations with you (e.g. to manage your employment contract), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring}, or necessary for the performance of tasks we carry out in the public interest (e.g. non-statutory reporting or research). We require you to provide us with any information we reasonably ask for to enable us to administer your contract. If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.
3. Sharing and Transferring Data
We will share data with the Payroll Department as well as with our third party benefits administrators.
4. Data Retention
Data is retained in accordance with University policy and as required under applicable U.S. laws and regulations. We store your personal information as part of your staff record for the duration of your employment (and it may be used as part of our assessment of any future application you make for further employment at Grand Valley). After you leave certain records pertaining to your employment are retained indefinitely so that the details of your employment can be confirmed and for statistical or historical research.
5. Sensitive Data
In addition to this, the University may process some information about you that is classified as 'sensitive' or 'special category' personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain roles, other sensitive information may be processed, such as information about past criminal convictions. Access to, and the sharing of, your 'sensitive' personal data are controlled very carefully. You will normally be given further details about our use of any such data when we collect it from you.
6. Rights of the Data Subject
While in the EU you will be able to exercise your rights as a data subject described in Article 15-22 of the GDPR: right of access to your personal data, right to correct that data, right to have the data erased, right to restrict processing, right to data portability, right to object to processing, right to withdraw consent, the right not to be subject to automated decision-making, and the right to lodge a GDPR-related complaint with an EU Supervisory Authority. Please note that the University is subject to federal and state laws that may require that we request, process and retain and report on certain types of data. These legal obligations may also affect actions we would be permitted to take in response to a request to exercise your GDPR data rights, especially the right to have your data erased.
7. Importance of Data
By you not providing the requested information, Human Resources is not able to deliver its good and services through payroll, benefits or any other Human Resource function.
8. Data Protection
The University has put in place reasonable physical, technical and administrative safeguards designed to prevent unauthorized access to or use of information collected online.
Request For Consent
After reading the above Notice, please review the request consent below and indicate your selection by checking the appropriate box.
For the transfer of my personal data between the European Union and Grand Valley State University and its representatives, pursuant to the conditions and limits specified in the EU GDPR.
____ I give my consent _____ I do not give my consent
Signature for Consent
Date ______________________________________________________________
Full Name (print) _____________________________________________________
Signature ____________________________________________________________