Policy 2180B

GDPR DATA PROTECTION PRIVACY NOTICE

Reference: Board Policy 2180B; 3910F; 3910M; 4110B; 5110C

As required by the Western Wyoming Community College District (the College) Board of Trustees, the College shall adhere to the provisions outlined in the European Union’s General Data Protection Regulation (GDPR), Article 13. This privacy notice procedure provides details relating to the collection, use, storage, and disclosure of personal information associated with Data Subjects. Each College department shall adhere to the specific Federal and/or state law requirements for that type of data when managing personal data.

The Data Protection Officer, defined below, is responsible for ensuring that this notice is made available to Data Subjects prior to the College collecting/processing any individual’s personal data. All employees/staff of the College who interact with Data Subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and that consent is given prior to the processing of the secured data.

Definitions

Data Subject: An identifiable natural person (i.e., one who can be identified, directly or indirectly, in particular, by reference to Personal Data) who is a citizen of an EU or EEA country.

Personal Data: Under the GDPR, personal data means any information relating to an identified or identifiable Data Subject; specifically including, but not limited to: name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject.

Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data the College may collect and process includes:

Personal data type:	Source (where the College obtained the personal data from if it has not been collected directly from the Data Subject. Note if the personal data has been accessed from publicly accessible sources):
Name	Data Subject
Date of Birth	Data Subject
Home Address	Data Subject
Telephone Number	Data Subject
Social Security Number	Data Subject

Email Address	Data Subject
Any information reported on the Free Application for Federal Student Aid (FAFSA)	US Department of Education
Government ID	Data Subject
WISER ID	Wyoming Department of Education
Verification Worksheet and Supporting Documentation	Data Subject
Alternative Education Loan Application	Vendor
External Agency Funding Application	Data Subject
Application Data	Data Subject
Passport	Data Subject
Visa	Data Subject
Health Insurance	Data Subject
Health History	Data Subject
Consulate Letter	Data Subject
Emergency Contact Name & Relationship	Data Subject
Emergency Contact Address	Data Subject
Emergency Contact Phone	Data Subject
Travel Information (Hotel & Flight)	Data Subject
Payment Information	Data Subject
Employment Contract	Data Subject
Salary	Data Subject
Personal Bank Account	Data Subject
Credit Card Information	Data Subject
US Military Service	Data Subject
Standardized Test Scores	Data Subject/Vendor
Academic Transcripts	Data Subject/Vendor
History of Schools Attended	Data Subject
Recruitment Event Attendance	Data Subject
Campus Visit Attendance	Data Subject
Parent(s) Name	Data Subject
Parent(s) Address	Data Subject
Parent(s) Phone Number	Data Subject
Parent(s) Email	Data Subject
Academic Interests	Data Subject
Extra-curricular Interests	Data Subject
Communication Logs	Data Subject
Resume Information	Data Subject
Personal References	Data Subject
Residency Documentation	Data Subject
Immunization History	Data Subject

Licensures	Data Subject
Criminal Offenses	Data Subject/Vendor

The personal data the College collects may be used for specific purposes. The list of purposes may be obtained at: Privacy Statement (westernwyoming.edu).

The College’s legal basis for processing of the personal data include financial aid or loan processing and required government reporting. This list is available at: Privacy Statement (westernwyoming.edu)

Any legitimate data interests pursued by the College, or third parties, are available at: Privacy Statement (westernwyoming.edu)

Consent

By consenting to this privacy notice the consumer grants the College permission to process personal data specifically for the purposes identified.

Consent is required for the College to process both personal data and special categories of personal data, but it must be explicitly given. When sensitive personal data is requested, the College is required to disclose why and how the information will be used. Data provided in response to a valid request will be limited to the specific data required to fulfill the operational data usage.

The Data Subject may withdraw consent at any time by contacting a Data Protection Officer or Representative (contact information provided below), who will provide a Data Subject Consent Withdrawal Form. Complete and return the form to a Data Protection Officer or Representative.

Disclosure

The College will not pass on personal data to third parties without first obtaining consent. The following third parties will receive personal data for the following purpose(s) as part of the processing activities:

Entity/Organization	Safeguards in place to protect personal data	Retrieve a copy of the safeguards in place here:
U.S. Department of Education, National Center for Education Statistics (NCES)	Physical & digital access, storage, and processing safeguards	Email: cio@westernwyoming.edu Request list of safeguards.
Debt Collection Vendors	Processing safeguards	Administrative Services Officer, Room 3031

Food Service Contractor	FERPA policy	Policy 5110C
College Bookstore	FERPA policy	Policy 5110C

For a full list of data sharing applications, please contact the Data Protection Officer.

Retention Period

The College will process personal data for the duration of association with the College and will store the personal data for the period(s) required by law for governmental compliance reporting and accreditation. For more details, including details on methods of data collection and storage, contact the Data Protection Officer.

Data Subject’s Rights

At any point while in possession of, or processing, a Data Subject’s personal data, the Data Subject retains the following rights:

Right of access – The right to request a copy of the information that the College has
Right of rectification – Right to correct data in the College’s possession that is inaccurate or incomplete.
Right to be forgotten – In certain circumstances, the Data Subject can ask for the data held by the College, concerning the Data Subject, be erased from the College’s
Right to restriction of processing – Where certain conditions apply, to have a right to restrict the processing.
Right of portability – Data Subject has the right to have the data held by the College concerning the Data Subject, be transferred to another organization (i.e., academic records).
Right to object – Data Subject has the right to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – Data Subject also has the right to be subject to the legal effects of automated processing or profiling.
Right to judicial review: If Western Wyoming Community College refuses Data

Subject’s request under rights of access, the College will provide data subject with a reason as to why. Data Subject has the right to complain as outlined below.

All of the above requests will be forwarded should there be a third party involved in the processing of personal data.

Complaints

In the event the Data Subject wishes to make a complaint about how their personal data is being processed by the College (or third parties as described above), or how the complaint has been handled, the Data Subject has the right to lodge a complaint directly with the supervisory authority and the College’s Data Protection Officer and/or Data Protection Representatives.

The details for each of these contacts are:

	Supervisory Authority:	Data Protection Officer (DPO):
Contact Name:	Vice President for Administrative Services	Chief Information Officer
Address line 1:	2500 College Dr	2500 College Dr
Address line 2:	Rock Springs, WY	Rock Springs, WY 82901
Address line 3:	USA	USA
Email:	vpas@westernwyoming.edu	c io@westernwyoming.edu
Telephone:	1.307.382.1621	1.307.382.1896

	Data Protection Representative:
Contact Name:	Registrar
Address line 1:	2500 College Dr
Address line 2:	Rock Springs, WY 82901
Address line 3:	USA
Email:	registrar@westernwyoming.edu
Telephone:	1.307.382.1618

PRIVACY STATEMENT

The College will distribute the following privacy statement to all Data Subjects of the College. This information shall be available for public access on the website. This privacy statement informs the Data Subject how the College will collect and use personal data.

Why does the College need to collect and store personal data?

To provide the Data Subject with educational services, the College needs to collect personal data for governmental and accreditation compliance or reporting, enrollment, housing, dining services, etc. In any event, the College is committed to ensuring that the information collected and used, is appropriate for this purpose, and does not constitute an invasion of privacy. In terms of being contacted for marketing purposes, the College will contact the Data Subject for additional consent.

Will the College share personal data with anyone else?

The College may pass the Data Subject’s personal data to third-party service providers contracted to the College in the course of dealing with the Data Subject. Any third parties that the College may share data with are obliged to keep the details secure, and to use them only to fulfill the services provided to the Data Subject on the College’s behalf. When the third party no longer needs the Data Subject’s data to fulfill this service, the third party will dispose of the details in line with the College’s procedures. If the College wishes to pass the Data Subject’s sensitive personal data on to a third party, the College will only do so once the Data Subject’s consent has been obtained, unless the College is legally required to do otherwise.

How will the College use the personal data it collects about the Data Subject?

The College will process (collect, store, and use) the information provided in a manner compatible with the European Union’s General Data Protection Regulation (GDPR). The College will endeavor to keep the Data Subject’s information accurate and up to date, and not keep it for longer than is necessary. The College is required to retain certain information in accordance with applicable governmental laws, such as information needed for income tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific accreditation and business-sector requirements and agreed practices. Personal data may be held in addition to these periods depending on individual business needs.

Under what circumstances will the College contact the Data Subject?

The College’s aim is not to be intrusive, and the College will not ask irrelevant or unnecessary questions. Moreover, the information provided will be subject to rigorous measures and procedures to minimize the risk of unauthorized access or disclosure.

What type of personal data is stored about the Data Subject?

The College, at the Data Subject’s request, can confirm what information is stored and how it is processed. The Data Subject may request the following types of information for their own identity:

Identity and contact details of the person or organization that has determined how and why to process the Data Subject’s data. In some cases, this will be a representative in the European Union.
Contact details of the Data Protection
The purpose of the processing as well as the legal basis for
If the processing is based on the legitimate interests of the College or a third party, information about those interests.
The categories of personal data collected, stored, and
Recipient(s) or categories of recipients that the data is/will be disclosed
If the College intends to transfer the personal data to a third party or international organization, information about how the College ensures this is done securely. The European Union has approved sending personal data to some countries because they meet a minimum standard of data protection. In other cases, the College will ensure there are specific measures in place to secure the Data Subject’s information.

How long the data will be
Details of the Data subject’s rights to correct, erase, restrict or object to such
Information about the Data Subject’s right to withdraw consent at any
How to lodge a complaint with the supervisory
Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the personal data and the possible consequences of failing to provide such data.
The source of personal data if it wasn’t collected directly from the Data
Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

What forms of ID are needed to access this?

The College accepts the following forms of ID when information about the Data Subject’s personal data is requested:

Passport, birth certificate, or state/federal government-issued identification (i.e., driver's license, identity card).
The College must be able to determine the Data Subject’s citizenship within an EU or

EEA country based upon the provided documentation and/or identification.

Adopted August 10, 2023