University of Nottingham Ningbo China
Effective Date: 15/04/2022
At the University of Nottingham Ningbo China (hereafter referred to as “we”), we recognize the importance of protecting your personal data and are committed to implement appropriate security measures to safeguard your personal data in compliance with applicable data protection laws and regulations (hereafter referred to as “applicable laws”).
This Privacy Statement (hereafter referred to as “this Statement”) is applicable when you register, use or visit our Systems, Official Websites, Official Apps and Official Social Media Platforms (hereafter referred to as “Official Services”). We will process (incl. collect, store, use, process, transfer, provide, entrust process, disclose, share, transfer and delete etc.) your personal data in compliance with applicable laws and this Statement.
Please note, this Statement does not apply to products or services provided to you by other third parties through our Official Services, nor to the personal data provided to the third parties by you, you shall check their relevant policies accordingly.
Before you use our Official Services, please make sure you have thoroughly read and understood all the terms and conditions of this Statement, especially the terms in bold. When you use our Official Services, it is deemed as you have read, understood and agreed to this Statement and its updated versions; and have consented us to collect and process your personal data in accordance with this Statement.
This Statement helps you to understand the following:
- How we collect your Personal Data
- How we use Cookie
- How we share, transfer and disclose your Personal Data
- How we protect and retain your Personal Data
- Your rights in Personal Data processing activities
- How we collect and process Personal Data of minors under the age of fourteen
- How we transfer your Personal Data abroad
- How this Statement updates
- How to contact us
- Dispute Resolution
1. How we collect and use your Personal Data
Personal data refers to all kinds of data related to identified or identifiable natural persons that are electronically or otherwise recorded, excluding data that are anonymized. Sensitive personal data refers to the personal data of which the leakage or illegal use could easily lead to the violation of the personal dignity of a natural person or harm to personal or property safety, including data on biometric identification, religious beliefs, specific identity, health care, financial accounts, personal whereabouts, and personal data of minors under the age of fourteen. When you use our Official Services or when you interact with us, we may collect and use your personal data and sensitive personal data (hereafter referred to as “Personal Data”) only for the purposes stated in this Statement and the respective Consent Form for Collecting and Processing of Personal Data and Statement of Collecting and Processing of Personal Information Indirectly Obtained of each Official Service.
It is not compulsory for you to provide Personal Data to us. However, without the provision of your Personal Data, under certain circumstances, you may not be able to use our Official Services properly, and we may not be able to respond to or resolve your issues.
1.1 Personal Data provided by you to us
When you register and use our Official Services, we will collect your Personal Data according to the respective Consent Form for Collecting and Processing of Personal Data and Statement of Collecting and Processing of Personal Information Indirectly Obtained of each Official Service.
1.2 Information automatically collected during interaction with us or using our Official Services
In order to manage the Official Services; to collect statistical data of the broad range of users and visitors; and to diagnose server and software problems based on your Personal Data, the following Personal Data might be automatically collected when you register, use, or access our Official Services:
1) Device and network information: We will collect relevant information about your device when you use our Official Services, including device type, name, model, or identifier; type and version of operating system or browser; language settings, IP address, network service provider;
2) Interactive information: Information submitted directly to us when you use our Official Services or interact with us, including your request for information, the inquiries you enter or questions/information you raised;
3) Log information: When you use our Official Services or view its contents, we will automatically collect and store necessary log information, including visit time, access path, IP address, event information.
1.3 Information from third parties and open sources
As permitted by applicable laws, we will also collect data from third parties or open sources. We may also collect and use non-identifiable data, which is the data that cannot be used to identify a specific person, such as the aggregated statistical data. And in our sole discretion, we may collect, use, process, transfer or disclose those non-identifiable data for specific purposes. We will make every effort to differentiate your Personal Data and non-identifiable data and use them separately. However, if Personal Data is mixed in the non-identifiable data, it will still be regarded and processed as Personal Data.
In order to better operate our Official Services, we will notify you and obtain your consent before processing your Personal Data when the type of the Personal Data to collect or the way to process the Personal Data is beyond the scope of the above, or use for other purposes not specified in this Statement.
2. How we use Cookie
Sometimes we will store small data files called Cookie on computers or mobile devices to make sure our Official Services operates properly. Cookie refers to plain text files stored on a computer or mobile device by a network server, and the contents of a Cookie can only be retrieved/read by the server that created it. Each Cookie is unique to your web browser or mobile application. Cookie usually contains identifiers, site names and some numbers and characters.
3. How we share, transfer and disclose your Personal Data
We respect your privacy and shall comply with the applicable laws to keep your Personal Data in strict confidence and will not unlawfully sell your Personal Data to others.
For purposes of ensuring the stable operation of our Official Services, ensuring your user experience, as well as other reasonable purposes, we may share your Personal Data with other Personal Data processors in the following circumstances. For those third parties with whom we share Personal Data, we will evaluate the legality, legitimacy and necessity of their collection of data, and require them to process your Personal Data in accordance with this Statement and other applicable laws：
1) Where the sharing of Personal Data is requested by you;
2) Where your express consent is obtained in advance;
3) Where the sharing is mandatory required by applicable laws or government authorities;
4) Where we need to share with your parents, spouse or statutory guardians for the purpose to verify the authenticity of the Personal Data collected;
5) In case of emergency, we may share your Personal Data with your designated emergency contact or third party for the purpose of protecting the life, health and safety of a natural person;
6) Other circumstances to share the Personal Data as stated in the respective Consent Form for Collecting and Processing of Personal Data and Statement of Collecting and Processing of Personal Information Indirectly Obtained of each Official Service.
We will not transfer your Personal Data to any company, organisation or individual, unless:
1) Where such transfer is requested by you;
2) Where your express consent is obtained in advance.
We will only disclose your Personal Data under the following circumstances:
1) Where such transfer is requested by you;
2) Where your express consent is obtained in advance;
3) Where the disclosure is required by applicable laws, law enforcement authorities or government authorities, or in response to legal proceedings;
4) Where the disclosure is for the purposes of research and statistical analysis, however, we will not disclose your identifiable Personal Data.
3.4 Exemptions to your prior consent of sharing, transferring or disclosure of Personal Data
You fully understand and agree that we have the right to process your Personal Data without your prior consent in the following circumstances:
1) Where it is necessary for the conclusion or performance of a contract to which you are a contracting party, or for the management of human resources in accordance with contracts signed and labour related policies and policies according to applicable laws;
2) Where it is necessary for us to fulfill statutory responsibilities or obligations;
3) Where it is necessary to respond to public health emergencies, or for the protection of life, health and safety of a natural person under emergency circumstances;
4) Where Personal Data is reasonably processed for the purposes of news reporting, supervision by public opinion, or other activities for public interests;
5) Where Personal Data disclosed by yourself or legally available from open sources are reasonably processed by us in compliance with applicable laws;
6) Other circumstances as required by laws and regulations.
4. How we protect and retain your Personal Data
We attach great importance to the security of Personal Data. We employ appropriate physical, administrative and technical safeguards to protect your Personal Data from unauthorized access, disclosure, use, modification, damage or loss. For example, we use encryption to keep data confidential; we use protection mechanisms to protect our data from malicious attacks; we deploy access control mechanisms to ensure that only authorized personnel have access to Personal Data; and we conduct security and privacy protection trainings to enhance staff's awareness of the importance of protecting Personal Data. We will do our best to protect your Personal Data, but please note that no security measure can be watertight. In the case of Personal Data leakage and other security accidents, we will immediately take remedial measures to avoid damages caused by data leakage, tampering or loss.
We will retain your Personal Data for the period necessary to achieve the purposes specified in this Statement and in the respective Consent Form for Collecting and Processing of Personal Data and Statement of Collecting and Processing of Personal Information Indirectly Obtained of each Official Service, unless the extension of the retention period is required or permitted by applicable laws. The criteria we use to determine the retention period include: the time for which Personal Data needs to be retained for the purpose of processing; whether users agree to a longer retention period; whether there are special requirements for data retention by laws or contracts, etc. And as long as your account is necessary to enable you to use our Official Services, we will retain your registration data. You can also choose to cancel your account, after which you will no longer have access to our Official Services. Once your account is deleted, we will retain your Personal Data for a period in accordance with the applicable laws, and upon the expiration of the retention period, we will remove or anonymize your Personal Data. Please note that once your cancel your account, you will not be able to login and use our Official Services and loose access to the data in your account, therefore please exercise the cancellation with caution.
5. Your rights in Personal Data processing activities
You shall ensure that all Personal Data provided by you are accurate and complete. We will do our best to maintain the accuracy and completeness of Personal Data and update such data in a timely manner.
Where permitted by applicable laws, you have the right to:
1) Access and copy the Personal Data we collected about you;
2) Request us to update or correct your inaccurate Personal Data, or complete your incomplete Personal Data;
3) Allow, refuse or limit our use of your Personal Data;
4) Request us to delete your Personal Data;
5) Request us to explain the Personal Data processing rules;
6) Request us to transfer your Personal Data to a designated Personal Data processor, provided such transfer meets the conditions stipulated by the National Cyberspace Administration.
Should you wish to exercise the above rights, please contact us and send us your requests. However, if there are reasonable grounds to believe such requests are deceptive, unenforceable, or damaging the privacy of others, we shall refuse your requests.
However please kindly understand that once you exercise the rights listed in 3) and 4) above, you may not be able to use the Official Services properly if the relevant Personal Data is necessary for the realization of the normal and full functions of the Official Services.
As permitted by applicable laws, you also have the right to revoke your consent at any time when we process your Personal Data based on your existing consents.However, revocation of consent shall not affect the legality and effectiveness of our processing of your Personal Data based on your consent before revocation, nor will it affect our processing of your Personal Data based on other appropriate justifications. Please also note that your revocation may result in certain consequences, such as you are not able to use our Official Services normally and fully.
6. How we collect and process Personal Data of minors under the age of fourteen
The users of our Official Services are mainly adults, however we also attach great importance to the protection of minors' Personal Data.
If you are a minor under the age of fourteen (hereafter referred to as “minor”), you shall obtain written consent from your parents or statutory guardians prior to using our Official Services. You shall not use our Official Services or create your own user account without written consent of your parents or statutory guardians.
If you are the statutory guardian of the minor, please contact us through the contact information set forth in Article 10 when you have queries about the Personal Data of the minor under your custody.
Where collecting the Personal Data of the minors is with the written consent of their parents or statutory guardians, we will store, use or disclose the minors’ Personal Data collected only to the extent as consented, or as permitted by applicable laws, or for the necessary protection of the minors. If we found that we have collected Personal Data from minors without prior verifiable consent from their parents or statutory guardians, we will try to delete the relevant data as soon as possible.
7. How we transfer your Personal Data abroad
In principle, your Personal Data will be processed within the territory of the People's Republic of China. However, since we are a sino-foreign university, where it is necessary and appropriate and in order to better provide services for you or for essential management purposes, your Personal Data collected by us may be provided to the University of Nottingham (hereinafter referred to as “UoN”) and may be processed in or visited by the country / region where it is located. Under such circumstances, we shall provide you with information such as the contact details of the UoN, the types of Personal Data that will be transferred abroad and the purpose and methods of processing, and the ways and procedures that you can exercise your rights to the UoN, etc. in the respective Consent Form for Collecting and Processing of Personal Data and Statement of Collecting and Processing of Personal Information Indirectly Obtained of each Official Service.
Data protection related laws may differ in these countries/regions. In such cases, we will take steps to ensure that the Personal Data we collect is processed in compliance with the requirements of this Statement and the applicable laws, such as anonymize of data prior to transferring abroad, or sign standard data processing contracts with the overseas recipients etc. If your Personal Data are not anonymized prior to transferring abroad, we shall obtain your prior consents.
8. How this Statement updates
This Statement will be updated in accordance with actual circumstances and relevant requirements of laws and regulations, and such updates form a part of this Statement. If such update results in a material reduction or change of your rights under this Statement, we will publish the notification in the prominent position on our Official Services for your attention prior to the effective date of the updated Statement, after which, your continued use of our Official Services shall be deemed as you have thoroughly read, understood and agreed to be bound by the updated Statement.
“Material changes” mentioned above includes, but not limited to the following:
1) Significant changes of data processing mode in our Official Services. For example, changes to the purpose and method of processing Personal Data, changes to the Personal Data types and their retention period, and changes to the main object of Personal Data sharing, transfer or disclosure;
2) Changes to your rights and ways of exercising your rights relating to processing of Personal Data;
3) Changes to our responsible departments, contact details or complaint channels for Personal Data protection;
4) Where the Personal Data security impact assessment report indicates the existence of high risks;
5) Other circumstances that will materially affect your personal rights and interests.
We shall not assume legal liabilities under the following circumstances:
1) Any leakage of Personal Data resulting from the disclosure of your password to or sharing of your account with others by yourself;
2) Any leakage, loss, embezzlement or alteration of Personal Data caused by hacking, computer virus intrusion or seizure, government control, or other force majeure;
3) Any legal disputes and consequences arising from Personal Data disclosure by other websites or systems linked to the Official Services;
4) The Personal Data disclosed by our Official Services in accordance with the provisions of laws, regulations or rules, or for public safety purposes.
10. How to Contact Us
This Statement is written in Chinese and English, and their contents are consistent. Where any discrepancy arises, the Chinese version shall prevail. Should you have any questions, suggestions or comments to this Statement, or wish to exercise your rights under this Statement, please contact us as follows. We shall attend to the matter and respond to you promptly in accordance with the requirements and deadlines under applicable data protection laws.
University of Nottingham Ningbo China
199 Taikang East Road, Yinzhou District, Ningbo, Zhejiang
Data Protection Team Email：DataProtection@nottingham.edu.cn
11. Dispute Resolution
The Interpretation and resolution of disputes regarding this Statement shall all be governed by the laws of the People's Republic of China. For any disputes arising from this Statement and our processing of your Personal Data, we both agree to submit the disputes to China International Economic and Trade Arbitration Commission (CIETAC) Shanghai Sub-Commission for arbitration which shall be conducted in accordance with the CIETAC's arbitration rules in effect at the time of making arbitration applications. The arbitral award is final and binding upon both parties.