Donors Privacy Notice

This Privacy Notice describes how Columbia University (“Columbia”, “we”, “us”, or “our”) collects and processes Personal Data of our donors when processing their donations and of prospective donors in the context of our fundraising efforts.

Controller of Personal Data

Columbia is the data controller of Personal Data collected and processed for the purposes of processing donors' donations.

What Personal Data do we collect?

Personal Data is information about you through which you can be identified, including where you can be identified by combining the information with other information.

We process Personal Data you provide to us directly (for example, when you contact us with your donation or attend an event hosted by the Alumni and Development team). Personal Data we collect directly from you includes

1. Name, address, nationality, spouse, position and donation amounts
2. Age, gender, date of birth
3. Phone number, email address
4. Names of family members [e.g., parents, children, siblings, particularly when the prospect is an alumnus or related to an alumnus] and associated contact information
5. Occupation, name of employer, work history, level of education
6. Information about interests and preferences
7. Payment information such as checking account or payment card information used for donations
8. Communications with Columbia such as emails or inquiries submitted in addition to giving history

We may also collect Personal Data about you from third parties and publicly available sources. Sources of publicly available information include company websites, press releases and social media platforms such as LinkedIn. Other sources of Personal Data include third-party sources of prospective donor information (such as Factiva, Inc. and iWave), public record aggregators (such as Lexis-Nexis), and publication databases (such as Newsbank). The information we obtain from third party sources includes

1. Name, address
2. Age, gender, date of birth, relevant demographic information
3. Phone number, email address
4. Employment and education history information
5. Job title and occupation
6. Publicly available financial data, such as stock holdings and the assessed value of your home
7. Information about board memberships and similar civic engagement
8. Your philanthropic interests and preferences as well as hobbies and other interests
9. Your history of giving to other organizations
10. Known associates

In some cases, this information includes sensitive personal data such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; data concerning health (religious dietary restrictions or allergies in the context of dinner events, for example); or data concerning a natural person’s sexual orientation, political activity, as well as information about regulatory discipline and criminal convictions and proceedings, where permitted by law. We may be required to collect certain Personal Data to process your donation. Failure to provide this information may prevent us from processing your donation. We will inform you whether certain data is compulsory and the consequences of the failure to provide such data.

For what purposes do we process Personal Data?

Columbia uses your personal data in connection with our fundraising and institutional advancement efforts to:

1. Send you informational publications, such as newsletters from departments and clubs of interest to you. This processing is necessary to serve our legitimate interests in providing you information you request. Where required by law, we will obtain your consent before sending you electronic marketing communications;
2. Send you information about fundraising campaigns, events, and volunteer opportunities that may be of interest to you. Where required by law, we will obtain your consent to receive electronic marketing communications before sending such communications;
3. Conduct surveys so that we can learn more about our alumni and other supporters. This processing is necessary to serve our legitimate interests in fundraising, alumni relations, and donor outreach;
4. Conduct wealth analysis and research to understand your philanthropic interests and your ability to give, in order to tailor our fundraising efforts. This processing is necessary to serve our legitimate interests in fundraising and donor outreach;
5. Carry out our contractual obligations to you and exercise our rights in this respect, where applicable (e.g. processing payment card information or issuing tax receipts for payments). Our basis for doing so is the performance of the agreement we have with you;
6. Provide any services or information you request from us, including networking opportunities and ongoing career services. This processing is necessary to serve our legitimate interest in fundraising, alumni relations, and donor outreach;
7. Keep our records accurate and up-to-date. This processing is necessary to comply with our legal obligations (such as obligations to document charitable giving for tax purposes) and to serve our legitimate interest in maintaining accurate records;
8. Research and statistical purposes. This processing is necessary to serve our legitimate interests in understanding alumni and donor interests and improving our fundraising and outreach efforts effectiveness;
9. Comply with legal obligations to which we are subject, including to respond to subpoenas, court orders, or other legal process; to cooperate with regulators and law enforcement as required by law; and to defend our rights or the rights of any third party in legal proceedings. This processing is necessary to comply with our legal obligations and to serve our legitimate interests in complying with the laws of all jurisdictions to which we are subject;
10. Publicly acknowledge gifts. Where required by law, we rely on your consent for this processing;
11. Prevent or investigate fraud or other unlawful activity, and to protect the security of Columbia’s property, website, and other systems. This processing is necessary to serve our legitimate interests in preventing unlawful activity and protecting Columbia’s property and interests;
12. Meet the obligations of private organizations with oversight over Columbia such as accreditation organizations. This processing is necessary to serve our legitimate interests in maintaining accreditation; and
13. Manage events and reunions. This processing is necessary to serve our legitimate interest in alumni relations.

We may also process special categories of personal data in the course of the legitimate activities we carry out as a not-for-profit body. And to the extent permitted under local law, we may use information about criminal convictions and offenses to carry out due diligence on donors or prospective donors in line with our guidelines on the acceptance of gifts. In addition, we may also other sensitive data such as

1. Information revealing an individual’s racial or ethnic origin, religious or philosophical beliefs, or sexual orientation. To the extent we process these types of sensitive information, such information is processed for purposes of diversity reporting, board development and to send you information about fundraising campaigns, events and volunteer opportunities that may be of interest to you. This information may be processed to comply with our legal obligations, to serve a substantial public interest, or, in some contexts, in reliance on your consent.
2. Health and medical information. We process health and medical information to comply with obligations under social protection laws (e.g., to provide disability accommodations) or, where not required by law, in reliance on your express consent (e.g., to accommodate the dietary or other needs of our alumni and other supporters).

How do we disclose Personal Data?

We may disclose your Personal Data for certain purposes and with the entities described in this section:

1. Service Providers, including third parties that provide services such as donor screening (e.g., Factiva, Inc. and iWave), processing donations and recurring gifts, sending newsletter and marketing communications, maintaining our systems of records, or partner with us for fundraising and other initiatives.
2. Public Donor Lists, for example alumni and development donor honor rolls.
3. With other departments or associations within Columbia, for example Columbia Alumni associations to update them on information received regarding the circumstances of a particular donation.
4. Professional Advisors, for example to seek advice on a particular donation.
5. As required by law, with law enforcement agencies, courts, regulators, government authorities or other third parties, where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

What choices do I have?

Where applicable under local law, you may have the right to request access to, correct, and delete your Personal Data, and to ask for data portability. You may also have the right to object to our processing of your Personal Data or ask that we restrict the processing of your Personal Data in certain instances.

We may obtain your consent to collect and use certain types of Personal Data when we are required to do so by law. If we ask for your consent to process your Personal Data, where applicable under local law, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice.

If you wish to do any of the rights you may have under local law, please contact us at gdpr-requests@columbia.edu.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, where applicable under law, you may have the right to make a complaint to your local data protection authority.

How long do we keep Personal Data?

We will retain your Personal Data for as long as we have a relationship with you (e.g., throughout the duration of your studies and in many cases afterwards, as part of the alumni and donor community). Once our relationship with you has come to an end, we will retain your Personal Data for a period of time that enables to us:

• Maintain academic records
• Maintain the integrity of our alumni and donor records for the purpose of our institutional advancement
• Comply with record retention requirements under applicable law
• Defend or bring any existing or potential legal claims
• Resolve or otherwise address any complaints or queries relating to our programs

We will delete your Personal Data when it is longer required for these purposes. If there is any information that we are unable to delete entirely from our systems for technical reasons, we will put in place appropriate measures to prevent any further processing of the data.

Where Is Personal Data Processed?

We process Personal Data collected from you or about you in the United States, which may not be regarded as ensuring an adequate level of protection for information under the laws of your country. We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. In addition, we use technical, administrative, and physical security safeguards to protect the Personal Data that we collect or receive against loss and unauthorized access, use, modification, or disclosure.

Contacts, Notices & Revisions

If you have any questions or concerns about this Privacy Notice, please contact us at gdpr-requests@columbia.edu.

We may modify or update this Privacy Notice from time to time. If we change this Privacy Notice, we will notify you of the changes. Where changes to this policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights.

Notice Current as of 5.25.23