Purpose of Privacy Statement
Your privacy is important to Northwestern University (“Northwestern”, or “we”, or “us”), and we are committed to respecting it. This Privacy Statement applies to the information we collect, process, and share from our potential students, current students, faculty, staff, and others, including members of the public, through:
- our websites;
- apps maintained by us; and
- email messages that we send to you that link to this Privacy Statement (collectively, the “Services”).
This Privacy Statement describes how we collect, use, process, protect, and disclose your information. Please read this Privacy Statement carefully.
Personal data we collect and use
The ways in which we collect, process, and secure information vary depending on the nature of the Services we offer, the type of data, and legal and regulatory requirements.
We and our third party service providers collect personal information about you from a variety of sources, including from you directly (e.g., when you fill out forms available on our websites to provide contact information or other personal information as part of a request for information to be sent by Northwestern, when you sign up for a Northwestern newsletter, or when you register an account with us to access our Services), data we generate about you in the course of our relationship with you (e.g., data collected from cookies and other similar technologies as described below), and data we collect about you from other sources, including commercially available sources, such as public databases (where permitted by law).
Personal data we collect directly from you
The categories of personal data that we may collect directly from you include the following:
- Personal details (e.g. name, date of birth);
- Contact details (e.g. phone number, email address, postal address or mobile number for yourself, your parents or guardians, and/or other emergency contacts);
- Account details (e.g. username and password);
- Transaction details (e.g. when you make purchases or respond to offers);
- Communications (e.g. when you participate in message boards or forums, participate in polls or surveys, or contact us with a question, comment or request);
- Information about your family/guests (e.g. names of relatives who may be attending an event);
- Information about your preferences (e.g. those related to housing and academic and extracurricular activities);
- Information about your application for admission (e.g. transcript, activities, test scores);
- Information about your application for financial aid (e.g. social security number, drivers license number, tax returns, account balances, investments, assets); and
- Information about your employment (e.g. payroll information, benefit elections, work history).
Personal data generated by us
In addition, we may generate the following categories of personal data about you in the context of your use of the Services:
- Records of our interactions with you; and
- Internal notes, including notes about your inquiry into our programs and services.
Personal data we automatically collect about your use of the Services
The following are examples of other categories of data that we automatically collect from you over time and across different websites when you use the Services, including through the use of “cookies” and other online tracking technologies, which are small text files that the Services save on your computer using your web browser and access when you return:
- Technical data collected from your computer or mobile device (e.g. your IP address, browser type, operating system);
- Information about your usage of our Services (e.g. the pages you visit when using the Services, the search terms you enter on the Services, how often you use the Services, and the pages you access before and after accessing the Services); and
- Data that we generate about you as a result of your use of the Services (e.g. our understanding of your interests as a result of your use of the Services and whether you are a regular or occasional user of the Services).
For more information about cookies and how we use them on our websites, please refer to our Cookie Information page: https://www.northwestern.edu/privacy/cookies.html.
You can opt out of use of cookies by turning off cookies in your browser or installing a technology blocking service like Google Analytics Opt-out Browser Add-On. If you would like more information on how to opt out of cookies, please visit: http://optout.aboutads.info or http://www.youronlinechoices.eu/.
Personal data we obtain from other sources
The following are examples of the categories of personal data we collect from other sources, including, but not limited to, publicly available databases, joint marketing partners, educational testing agencies, other academic institutions, and the federal government.
- Personal details (e.g. name, date of birth);
- Contact details (e.g. phone number, email address, postal address or mobile number);
- Details about advertising preferences (e.g. products purchased or interaction with advertisements online);
- Information about your application for admission (e.g. transcript, activities, test scores); and
- Information about your application for financial aid (e.g. social security number, drivers license number, tax returns, account balances, investments, assets).
Sensitive data we collect and use
The categories of sensitive personal data that we may collect directly from you include the following:
- Personal data revealing racial or ethnic origin;
- Biometric data; and
- Data concerning health.
When collecting sensitive personal data, the University will ask for your consent unless there is another legal basis for collecting the information.
How we use your information and the basis on which we use it
We use your personal data for the following purposes:
- Identification and authentication: We use your identification information to verify your identity when you access and use our Services and to ensure the security of your personal data. This is so we can comply with our contractual obligations to you.
- Operating the Services: We process your personal data to provide the Services you have requested. This is so we can comply with our contractual obligations to you.
- Improving our Services: We analyze information about how you use our Services to provide an improved experience for our customers of all our Services, including product testing and site analytics. It is in our legitimate business interests to use the data provided to us for this purpose, so we can understand any issues with our Services and improve them.
- Communicating with you: We use your personal data when we communicate with you, for example, if we are providing information about changes to the terms and conditions; if you contact us with questions throughout the application process; or for sending you Northwestern newsletters and publications. It is in our legitimate interests that we are able to provide you with appropriate responses and provide you with notices about our Services.
- Considering your application for admission and financial aid. Our basis for doing so is the performance of the pre-contractual relations we have with and to serve our legitimate interests in selecting a qualified student body;
- Marketing: We use your personal data to build a profile about you and place you into particular marketing segments in order to understand your preferences better and to appropriately personalize the marketing messages we send to you. It is in our legitimate interest to provide more relevant and interesting advertising messages. Where necessary or required by law, we will obtain your consent before sending such marketing messages.
- Exercising our rights: We use your personal data to exercise our legal rights where it is necessary to do so, for example, to detect, prevent and respond to claims of fraud, intellectual property infringement claims or violations of law or our standards of conduct, university policies, or our terms of use.
- Complying with our obligations: We process your personal data to, for example, carry out fraud prevention checks or comply with other legal or regulatory requirements, as required by law.
- Customizing your experience: When you use the Services, we use your personal data to improve your experience of the Services, such as by providing interactive or personalized elements on the Services and providing you with content based on your interests. It is in our legitimate interests to provide you with a customized experience.
- For purposes of program planning and development: This processing is necessary to serve our legitimate interests in the efficient management and administration of our academic programs and extracurricular activities.
- Keeping our records accurate and up-to-date: This processing is necessary to comply with legal obligations and to serve our legitimate interests in efficient management and administration.
In addition, we may use your sensitive personal data for these and other purposes, including:
- Statistical reporting: Information revealing racial or ethnic origin that may be voluntarily disclosed during the application process may be used for purposes of statistical reporting related to diversity and/or to comply with legal or regulatory requirements.
- Access to campus facilities: Biometric information used to identify an individual person may be used for access to secure facilities with affirmative consent of the individual and in accordance with university policy.
- Compliance with social protection laws: We may process health and medical information to comply with obligations under social protection laws (e.g., to provide disability accommodations, or vaccination requirements).
- Provision of medical services: Health or medical information may be processed to provide medical services under the responsibility of authorized medical professionals or when such processing is necessary to protect the vital interests of you or another person. In some contexts, this information may be processed with your consent.
We may also anonymize your personal data in such a way that you may not reasonably be re-identified by us or any other party, and we may use this anonymized information for any purpose.
Who has access to your data
We share your personal data under the following circumstances:
- Service providers and business partners: We share your personal data with our service providers and business partners that assist with academic programs, perform marketing services and other business operations for us for the purposes set forth above. For example, we partner with companies to process secure payments, fulfill orders, optimize services, serve online behavioral advertising, send newsletters and marketing messages, support email and messaging services, and analyze information. We may also partner with other companies such as learning management system providers, information technology providers. These service providers and business partners include advertising agencies and fraud prevention agencies which will use your personal data only in the ways described in this policy.
- Within Northwestern: We share personal data within Northwestern, including in the US and elsewhere for the purposes set out above. To the extent we collect information in person outside of the US (e.g. countries within Europe or the People’s Republic of China), we may share personal data about you with other Northwestern personnel located at our campus in the United States or elsewhere.
- Law enforcement agencies, courts, regulators, government authorities or other third parties: We may share your personal data with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
How we store, secure, and may transfer your personal information
The University is based in the US, and data are generally stored on servers within the US. We implement technical and organizational measures designed to ensure a level of security appropriate to the risk to the personal data we process. These measures are aimed at ensuring the ongoing integrity and confidentiality of personal data. However, no method of protection or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.
To the extent that the University needs to transfer your information, the University will do so consistent with applicable law governing such transfers. In general, these transfers occur when the University has entered into a contract containing contractual terms (e.g., standard contractual clauses) that govern the rights and responsibilities of the University and any other parties involved in the transfer.
Third-party websites
Our websites contain links to and from various third-party websites. If you follow a link to any of these websites, please note that these websites may have their own privacy statements. We do not accept any responsibility or liability for policies of third-party websites; please check these policies before you submit any personal information to third party websites.
Children's Information
Our websites are intended for general audiences. We do not intend to collect or solicit personal information online through our websites from children under the age of 13 without parental consent.
Retention
We keep your personal information for as long as needed to fulfill the particular purpose for which it was collected. We may also retain your records if legally required or to fulfill a legitimate interest.
More information about retention may be found in the University’s policy on Retention of University Records.
Your Rights
Where applicable under local law, under certain circumstances you may have the right to:
- Request access to your personal information(commonly known as a “data subject access request”).
- Request correction of the personal information that we hold about you.
- Request erasure of your personal information.
- Object to processing of your personal information where we are relying on a legitimate interest(or those of a third party).
- Request the restriction of processing of your personal information.
- Request the transfer of your personal information to another party.
- Not be subject to decisions based solely on automated decision making.
To the extent applicable under local law, if you want to exercise any of the rights described above or are dissatisfied with the way we have used your information, you should contact us as set forth in the Contact Us section below. Also, if you are not satisfied with our response, where applicable you may have the right to complain to or seek advice from your national data protection authority (i.e., a supervisory authority).
Depending on the circumstances and the nature of your request it may not be possible for us to do what you have asked, such as where there is a statutory or contractual requirement for us to process your personal information and it would not be possible to fulfill our legal obligations if we were to stop. Additionally, to protect the personal information we hold, we may also request further information from you to verify your identify when exercising these rights, to help locate your personal data, or to clarify your request. Where you have consented to the processing, and where applicable under local law, you can withdraw your consent at any time by emailing us at [email protected].
Updates to Privacy Statement
We may update this Privacy Statement at any time by posting any changes to this page. Please check back frequently to see any updates or changes to this Privacy Statement. We may also notify you in other ways from time to time about the processing of your personal information. Your continued use of our Services after any change in this Privacy Statement will constitute your acceptance of such change.
Contact Us
If you have questions or concerns about this privacy statement, please contact us by email at [email protected] or in writing to:
Northwestern University
Attn: Assistant Vice President, Risk & Compliance
2020 Ridge Ave, 4th Floor
Evanston, Illinois 60208
Last Updated: February 14, 2023
Back to top