Online Privacy Policy

Stanford University provides the following information relating to your privacy when using websites in the Stanford.EDU domain. This privacy policy covers all Stanford.EDU websites unless otherwise indicated on a specific website.

Online Privacy Notice

This Online Privacy Notice (“Notice”) applies to the Personal Information that Stanford University (“Stanford”, “we”, “us”, “our”) – as data controller – collects when you visit Stanford’s main website (www.stanford.edu) and other websites that we own or control and link or refer to in this Notice (together, the “Sites”), including mobile applications and through communications such as subscription to newsletters and email updates.

This Notice describes the types of Personal Information we collect, purposes for which we collect it, other parties with whom we may share it, measures taken to protect your personal information and your rights, and choices that are available to you regarding the use of the Personal Information and how you can contact us about our privacy practices.

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. This Notice does not apply to information collected from or about current or former employees, contractors, volunteers, postdoctoral fellows, and other workers of Stanford University (“Workers”) as part of or in the context of their employment or working relationship with Stanford, unless otherwise indicated on the Sites. This Notice also does not apply to and we are not responsible for the privacy practices or information of any third parties, including any third-party operating websites to which our Sites contain a link.

1. Personal Information we collect and process

When you access or use the Sites, we may collect and process the following types of information from you:

Personal Information:

“Personal Information” is any information that we can reasonably use to directly or indirectly identify you. If you are located in the European Economic Area (EEA) or the United Kingdom (UK), Personal Information includes all Personal Data as defined under EEA and UK data protection laws.

We collect the following Personal Information from you when you provide it to us:

  • Identification information, such as your first name, last name, demographic information, other relevant biographic information, postal address, email address, phone number, any other relevant contact details, Stanford unique ID, user account(s) on our Sites (including login), and passport number.

  • Information related to your application, such as information related to your application for admission (including your educational history, personal statements, reference letters, any other relevant information provided in your application), and information related to your visa application.

  • Information related to your student life, such as your courses, programs and training (including online/hybrid courses, programs and training), housing and/or dining status, travels through Stanford’s programs, and alumni status.

  • Financial and banking information, such as your salary history, tax forms, any relevant financial information to evaluate and determine your eligibility for financial aid opportunities, and payment information.

  • Information related to your donation, such as the amount of your donation, affiliation to Stanford, giving history, and legal documentation related to your donation.

  • Information related to your exchanges with Stanford, such as date, hour, and subject of your request, exchanges with Stanford’s services, and preferred means of communication. 

Information Received from Third Parties:

We collect your Personal Information from third parties, including other schools, references, family members, and education partners (e.g., The Common Application Inc., Law School Admissions Council, The College Board, etc.) where authorized by the data protection laws.

In compliance with the data protection laws, we may collect information about you from other companies and organizations, including public databases, social media platforms, our third-party marketing partners, or various independent organizations. For example, we may collect public information about you when you interact with us through social media.

Automatically Collected Personal Information:

Whenever you visit or interact with our Sites, we may use a variety of technologies that automatically or passively collect information about your online activity. This information may be collected in the following ways:

  • Through your browser: Certain information is collected by most browsers, such as your IP address and Internet browser type and version. Your “IP address” is a number that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP Address is identified and logged automatically whenever a user visits the Sites, along with the time of the visit and the page(s) that were visited. We use IP addresses for purposes such as calculating Site’s usage levels, helping diagnose server problems, administering the Sites, and presenting content that is tailored to your country.

  • Through Cookies: Cookies allow a web server to transfer data to a computer for recordkeeping and other purposes. We use cookies and other similar technologies to, among other things, better serve you with more tailored information and to facilitate your ongoing access to and use of the Sites. If you do not want your information collected by cookies and other similar technologies, please refer to our Cookies Policy. Some features of the Sites may not work properly if you decline the use of cookies and other similar technologies. To learn more about cookies, please visit http://www.allaboutcookies.org/.

  • Through pixel tags, web beacons, clear GIFs, or other similar technologies: These may be used in connection with some Sites pages and HTML-formatted email messages to, among other things, track the actions of Site users and email recipients, and compile statistics about Sites usage and response rates.

  • From you: Information such as your location, as well as other information, such as your preferred means of communication, is collected when you voluntarily provide this information.

Sensitive Personal Information:

“Sensitive Personal Information” includes special categories of Personal Information (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation) for which the applicable data protection laws provide enhanced protections.

In compliance with the applicable data protection laws, we may collect Sensitive Personal Information such as race/ethnicity, and certain financial information when you provide it to us for purposes described above, including as part of your application package for graduate or undergraduate admissions or financial aid opportunities. We do not sell or use your Sensitive Personal Information for targeted marketing purposes, and only use your Sensitive Personal Information as permitted by the applicable data protection laws.

Refusing or Withdrawing Consent:

Data protection laws that apply to you may let you refuse to consent to our proposed collection, use, or disclosure of your Personal Information.

When we need to process your Personal Information as part of your relationship with us, we usually do not process it based on your consent. But if we have asked for consent, you have the right to withdraw consent at any time. If you withdraw consent, this doesn’t affect the lawfulness of the processing before you withdrew consent. To withdraw consent, please contact us in writing using the information in the “Contact Us” section below. However, if you withdraw your consent, we may not be able to adequately provide you the assistance or services you requested.

Anonymity:

If you are located in Australia, you have the option to remain anonymous, where practicable. However, if you do not provide us with the Personal Information we require for processing, we may not be able to adequately provide you the assistance or services you requested.

Failure to Provide Personal Information:

If you fail to provide certain Personal Information when requested or if you withdraw consent to processing, we may not be able to perform the contract we have entered with you (where applicable), we may not be able to process your request, or we may not be able to properly comply with legal obligations (i.e., tax reporting). If this is the case, we may have to stop providing you any services or assistance. If we need to process requested Personal Information to provide you a service or fulfill our obligations to you, we will tell you that in the event you do not provide your consent for us to process that Personal Information where authorized by the data protection laws that apply to you.

Back to table of contents

2. Marketing

Personal Information you submit through our Sites, such as your name, address, and other contact information, may be collected by Stanford for internal marketing and development purposes as well as to respond to your inquiry, complete a transaction for you, or fulfill other forms of customer service. Where required by applicable data protection laws, we will obtain your consent prior to sending you marketing communications. You can choose not to receive marketing emails from us by “unsubscribing” using the instructions in any marketing email you receive from us.

Back to table of contents

4. Sharing your Personal Information

We share your information internally at Stanford to facilitate and manage the purposes listed above. This includes third parties whom Stanford engages to process your Personal Information on our behalf for the purposes stated above, such as vendors who help Stanford with our marketing, application processing, IT services, and web hosting.

Stanford may also share your Personal Information with government and law enforcement agencies, regulators or other relevant authorities to 1) comply with a legal process, subpoena, order or other legal or regulatory requirement applicable to us; 2) enforce our terms of use or other policies; or 3) pursue available legal remedies or defend against legal claims.

Stanford may also share your Personal Information with lawyers and all interested parties, but exclusively in the case of the management of possible disputes and other legal matters where appropriate.

Stanford may share your Personal Information following or during a restructuring, reconstitution, acquisition, debt financing, merger, sale of assets of Stanford or a similar transaction, as well as in case of insolvency, bankruptcy or receivership where personal information is transferred to one or more third parties as assets of Stanford.

Other third parties as you may so request as permitted by this and other Stanford policies and applicable laws and regulations.

Stanford does not sell any Personal Information, including Personal Information of minors, to third parties for their use in direct marketing, advertising, or promotion of their products or services.

Back to table of contents

5. International Transfer of Personal Information

Personal information that you provide to us may be transferred and stored in countries other than your home country such as the United States (U.S.), where applicable data protection laws may differ from those of your home country. By providing us with your information you acknowledge that your information will be transferred to the U.S. and processed and stored on servers in the U.S. Your Personal Information may also be processed by employees or by other third parties who work for us, or by the representatives and employees or Workers of Stanford located outside your home country.

If we transfer your Personal Information to third parties located in other countries, we will only do so if the third party offers an adequate level of protection under the data protection laws that apply to you and by implementing the appropriate safeguards where required.

In addition, we take all reasonable steps to protect your privacy in accordance with the applicable data protection laws.

We only share your Personal Information with third parties who adequately implement appropriate technical and organizational measures and who guarantee the protection of your rights as required under the laws that apply to you.

If you live in the EEA, UK, Australia, Brazil or China, if we transfer your Personal Information out of your respective area, and that area has not been deemed to provide an adequate level of protection for Personal Information, we will ensure the appropriate safeguards are implemented such as using standard contractual clauses or contracts approved by the data protection laws or the relevant authorities which gives Personal Information the same protection it has in your home country or ensure there is some other protections in place which has been approved by the law giving Personal Information the same protection it has in your home country.

Back to table of contents

6. Individual Privacy Rights

Under certain circumstances, you have rights under the data protection laws that apply to you in relation to your Personal Information. You have the right to:

a. Know What Personal Information We Have:

You may have the right to know what Personal Information is being collected about you, whether it is disclosed, and to whom (as provided in this Notice). If you are located in China and if you have questions, you have the right to ask that we explain Personal Information handling rules and policies to you.

b. Access Your Personal Information:

You can request access to your Personal Information. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the Personal Information we have about you. Your right to access the Personal Information that we hold about you is not absolute. There are instances where the applicable laws or regulatory requirements allow or require us to refuse to provide some or all the Personal Information we hold about you. If we cannot provide you with access to your Personal Information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

c. Modify or Update Your Personal Information:

We aim to ensure that Personal Information in our possession is accurate, current, and complete. If you believe that the Personal Information about you is incorrect, incomplete, or outdated, you may request the correction or update of that information. We will use reasonable efforts to revise it and, if required by the data protection laws that apply to you, to use reasonable efforts to inform other third parties if applicable, so records in their possession may also be corrected or updated. However, we reserve the right not to change any Personal Information we consider accurate or if it is necessary for our records.

d. Erasure of Your Personal Information:

You may ask us to delete or remove Personal Information where there is no legal reason for us to continue using it. You also have the right to ask us to delete or remove your Personal Information where:

  • you object to the processing of your Personal Information, and there are no overriding legitimate reasons justifying to maintain the processing of your Personal Information (e.g., legal obligation);

  • you object to marketing activities;

  • you decide to withdraw your consent on which the processing is based;

  • your Personal Information is no longer useful for the original purposes for which it was collected or for any other type of processing;

  • the use that is made of your Personal Information does not comply with the applicable legal or regulatory obligations.

Please note that we may not always be able to comply with your request of erasure for specific legal reasons including complying with legal obligations, pursuit of legal action, detection and monitoring of fraud or for the performance of a task in the public interest. We will notify you, if applicable, at the time of your request. To the extent possible and where required by the data protection laws that apply to you, we will inform any third parties we might have shared your Personal Information with of your deletion request. If you are in Brazil and believe we are processing unnecessary or excessive Personal Information, you may ask us to anonymize, block, or delete your personal information.

e. Object to Processing of Your Personal Information:

You may have the right to object to us processing your Personal Information in certain circumstances. This right applies when we are processing your Personal Information based on a legitimate interest (or those of a third party), which you may challenge if you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. However, in some cases, we may demonstrate that we have compelling legitimate grounds to process your Personal Information or legal obligations which override your rights and freedoms.

f. Restrict Processing of Your Personal Information:

You may have the right to request restricted processing of your Personal Information which if applicable, we will limit the processing if you dispute the accuracy of the Personal Information, your Personal Information was processed unlawfully and you request a limitation on processing, rather than the deletion of your Personal Information, we no longer need to process your Personal Information, but you require your Personal Information in connection with a legal claim, or you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists. You may also have the right to ask us to limit our processing of your Sensitive Personal Information to what is necessary to our relationship with you. While Stanford’s practices are to restrict processing of your Sensitive Personal Information to what is strictly necessary at all times, you are welcome to make a request by contacting us.

g. Data Portability:

You may request that we transfer your Personal Information to you or a third party where technically feasible. We will provide to you, or a third party you have chosen, your information in a structured, commonly used, machine-readable format. Please note this right only where the processing of your Personal Information is based on your consent or required for the performance of a contract and the processing is carried out by automated means (paper files are therefore not included). Your request will only relate to your Personal Information (excluding anonymous or third-party Personal Information) and your request must not adversely affect the rights or freedoms of others, in particular those of Stanford (e.g., trade secret) or any third party (e.g., intellectual property, recommendation letters that you previously agreed would remain confidential).

h. Opt Out of Marketing:

You may opt out of receiving future electronic marketing messages from Stanford and request that we not share your Personal Information with unaffiliated third parties. If you are in India or China, you may opt out of the collection of your Personal Information by contacting us. However, we may not be able to adequately provide you assistance or services you requested.

i. Automated Decision Making:

In Brazil, China, UK or the EEA, you have the right to not be subject to decisions based solely on automated processing and not be subject to decisions with a legal or similarly significant effect (including profiling) that are based solely on the automated processing of your Personal Information, unless you have given us your explicit consent or where they are necessary for a contract with us. You can request to have a human review an automated decision made by automated means (if applicable) and ask us to explain the automated decision-making process.

j. Withdraw Consent:

You have the right to withdraw any consent you may have previously given us at any time. If you withdraw your consent, this will not affect the lawfulness of our collecting, using and sharing of your Personal Information up to the point in time that you withdraw your consent. Even if you withdraw your consent, we may still use your information that has been fully anonymized and does not personally identify you.

k. Right to Make a Complaint:

If needed, you have a right to file a complaint related to our Personal Information practices or file a complaint to your country’s supervisory authority (e.g., Canada’s Office of the Privacy Commissioner, Australian Privacy Commissioner, Brazil’s National Data Protection Authority, the United Kingdom’s Information Commissioner’s Office, an EEA specific country supervisory authority, or China’s Cyberspace Administration) if you believe we have not processed your Personal Information in compliance with the data protection laws and principles that apply in your home country.

l. Non-Discrimination:

We do not discriminate against people who exercise their privacy rights.

Making a Request:

If you wish to contact us in connection with the exercise of your rights listed above, please email us at privacy@stanford.edu. Please include your name, address, email, phone number, and the specific type of request you would like to make (a request to know, erase, opt out, etc.). Current Stanford students should open a case through this form.

We will respond to your written request without unreasonable delay and in accordance with any deadlines imposed by the data protection laws that apply to you and without making our other data less secure or changing our data.

Unless specific circumstances, we will not charge you any fee in connection with the exercise of your rights. If we are not able to honor any part of your request, we will notify you in our response as well as the reason we cannot do so.

To protect you and your information, we may ask you to confirm certain information before we honor your request. For example, where permitted by the data protection laws, we will ask you to confirm your name, email address, and phone number to verify your identity, so that we can help protect your information.

Back to table of contents

7. Access and Choice

Stanford students can manage privacy settings for their directory information in Axess. Faculty, staff and other Stanford affiliates can manage their privacy settings in StanfordYou.

You can choose not to receive emails from us by “unsubscribing” using the instructions in any email you receive from us. This will not stop us from sending emails about your account or your transactions with us.

Back to table of contents

8. Document Retention

To the extent permitted by applicable law, we keep your Personal Information for as long as needed to fulfill the particular purpose for which it was collected and in accordance with this Notice. We may also retain your Personal Information if legally required or to fulfill a legitimate interest or another lawful basis for retaining the information beyond the period which is necessary, including a legal action. If the legal basis is based solely on consent, we will delete the Personal Information once consent is withdrawn.

Back to table of contents

9. Information Security

Stanford takes the security of your personal information seriously. We protect your information using security measures including physical, administrative and technical safeguards to reduce the risk of loss, misuse, unauthorized access, disclosure or modification of your information. Our minimum security standards can be found on the Information Security Office website.

Back to table of contents

11. Contact Information

For more information on how we collect and process your Personal Information, or if you have any complaints please email privacy@stanford.edu. Current Stanford faculty, staff and students should open a case through this form.

Back to table of contents

12. Updates to Notice

Stanford reserves the right to modify this Notice at any time. If we make any material changes to this Notice, we will provide you notice on our Site and make it available on the University Privacy Office website. Where we are required by the applicable data protection laws, we will also seek your consent to any material changes that affect how we use your personal information.

Back to table of contents

13. Effective Date

The effective date of this Notice is Dec. 20, 2023.

Back to table of contents