Northeastern University (“University,” “Northeastern,” “we,” “us,” or “our”) is a U.S.-based institution of higher learning offering undergraduate, graduate, and continuing education programs, curriculum content, and services in a traditional campus setting and through our central websites (each a “Site”) Northeastern.edu, neu.edu, the Employee Hub portal, and our mobile applications (“Apps”) (collectively, the “Services”).
Personal data: This Privacy Statement describes the type of personal data that we collect, how we use and share that data, and your choices concerning our data practices. Personal data (“Personal Data”) means any information about you from which you can be identified.
For more information about this Privacy Statement and your rights under applicable law, please contact us at firstname.lastname@example.org.
Specific departments, units, or functions: Other University departments’ websites and services may have additional privacy and data practices. The privacy and data practices of those sites and services may be further governed by supplemental privacy notices, and you should read any supplemental privacy notices available on the websites and services of the specific department, unit, or function you interact with for more information on their practices.
University-based or sponsored research: Likewise, additional and/or different practices may apply to data collected from participants in University-based or sponsored research studies or surveys that may be governed by a protocol approved by the Institutional Review Board. When you participate in such research studies, you will be provided with an informed consent form which may describe the additional and/or different data practices and policies that will apply to the study and which may supersede the practices set out in this Privacy Statement.
What information do we collect?
We collect Personal Data that you voluntarily give us when you visit the Site, use the Apps or the Services to inquire about admission to the University, enroll in one of our programs, inquire about or obtain financial aid, apply or are hired to work at the University, or participate in our alumni activities including fundraising. This data includes:
- Name, title, age, and date of birth
- Social Security Number (SSN) as required by law for applicants for admission and financial aid, employees and for validation purposes, the last four digits are required for sponsored network account applicants
- Northeastern University Identification (NUID) Number (as the student identification number and as an administrative system identifier for faculty and staff)
- Contact information including address, city, state, postal code, country of residence, email address, home, cellular and other contact telephone number(s)
- Campus address and telephone number
- Emergency contact information (names, phone numbers, and email addresses)
- Academic credentials
- Academic, leisure, or other interests
- Attendance at Northeastern University events
- Records of communications between you and the University
- Other information pertinent to your specific interests and activities at Northeastern
We also collect information you choose to provide to us when you complete any “free text” boxes in our forms (for example, support requests, blogs, or forums).
We may collect other information to assist us in maintaining or managing our systems, diagnosing problems, assisting you with a help request, or informing investigations.
Our admissions departments, including for our lifelong learning network, purchase Personal Data from testing companies for use in identifying individuals who may be interested in applying for admission to the University or enrolling in a University course or program.
Automatically collected data
When you use the Services the following information is created and automatically logged in our systems:
- Log data: Information (“log data”) that your browser automatically sends whenever you visit the Site, or that the Apps automatically send when you use them. Log data includes your Internet Protocol (“IP”) address (so we understand which country you are connecting from when you visit the website), browser type and settings, the date and time of your request, and how you interacted with the Services. We may archive this information in anonymous form for historic records.
- Device information: Includes type of device you are using, operating system, settings, unique device identifiers, network information, and other device-specific information. Information collected may depend on the type of device you use and its settings.
- Carrier-related information: Collection of carrier-related information including the name of your wireless carrier, and IDs related to the cellphone hardware in your phone as well as the network to which the device is connected.
- Platform-specific identifiers: Such as Apple’s Identifier for Advertising and Identifier for Vendor, and Android ID or Android’s advertising identifier.
- Geolocation information: Including precise location data.
- Usage information: Types of content that you view or engage with, the features you use, the actions you take, the other users you interact with and the time, frequency, and duration of your activities.
Social network or third-party plug-ins or widgets
Our Services may include social network or third-party plug-ins or widgets that may provide information to their social networks or third parties about your interactions with our web pages, even if you do not click on or otherwise interact with the plug-in or widget. The information is transmitted from your browser and may include an identifier assigned by the social network or third party, information about your browser type, operating system, device type, IP address, and the URL of the web page where widget appears. Please read the privacy policies of these sites before you visit them or use their tools to learn what information they collect, use, and share. We are not responsible for the privacy policies or data practices of social network or third-party sites or their party plug-ins or widgets.
How we use your information
We use your Personal Data for the purposes described below:
- To process applications for admission to the University’s undergraduate and graduate programs, employment, and enrollment in courses and programs
- To administer and assess our educational programs, as well as hiring and maintaining our employee workforce
- To fulfill public safety obligations to our faculty, staff, and students
- To deliver and administer your education, record the details of your studies (including any placements with external organizations for co-op or academic coursework taken at another institution), and determine/confirm your academic achievements (e.g., results, prizes)
- To administer the financial aspects of your relationship with us and any funders
- To provide facilities to you (e.g., IT, sport, libraries, accommodation, careers)
- To operate security (including CCTV), governance, disciplinary (including plagiarism and academic misconduct), complaint, audit, and quality assurance processes and arrangements
- To support your training, medical, safety, welfare, and religious requirements
- To compile statistics and conduct research for internal and statutory reporting purposes
- To fulfill and monitor our responsibilities under EEO, immigration, and public safety legislation
- To administer HR-related processes, including those relating to payroll, benefits administration, performance/absence management, disciplinary issues, and complaints/grievances
- To notify your designated emergency contact(s) of an emergency or crisis that may affect you and/or the University community
- To send you updates and information about our new programs and services, upcoming events, or other promotions or news. Where required by law, we will only send you marketing information if you consent to us doing so at the time you provide us with your Personal Data. You may opt out of receiving such communications by following the instructions contained in each promotional email we send you. In addition, if at any time you do not wish to receive future marketing communications, please contact us at email@example.com.
- If you ask us to delete your data or to be removed from our marketing lists and we are required to fulfill your request, we will retain basic data to identify you and prevent further unwanted processing
- To prevent fraud or criminal activity, misuse of our products or services, and ensure the security of our IT systems, architecture, and networks
- To (a) comply with legal obligations and legal process; (b) respond to requests from public and government authorities including public and government authorities outside your country of residence; (c) enforce our terms and conditions; (d) protect our operations; (e) protect our rights, privacy, safety or property, and/or that of you or others; and (f) allow us to pursue available remedies or limit the damages that we may sustain.
We use your information described above to fulfill contractual and legal obligations to applicants, students, and employees; perform tasks we carry out in the public interest to promote access to higher education, and inform prospective students, parents, and the public of the educational opportunities at Northeastern.
We consider the processing of your Personal Data for these purposes to be either (i) necessary for the performance of our contractual obligations with you (e.g., to manage your student experience and welfare while you are enrolled at or employed by Northeastern), or (ii) necessary for compliance with a legal obligation (e.g., equal opportunity and nondiscrimination monitoring), or (iii) necessary for the performance of tasks we carry out in the public interest (e.g., teaching and research), or (iv) necessary for the pursuit of the legitimate interests of the University or a third party (e.g., to enable your access to external services).
If we require your consent for any specific use of your Personal Data (such as for marketing activities, where required by the law), we will collect it at the appropriate time and you can withdraw this at any time. In the limited circumstances where we might use Personal Data to carry out wholly automated decision-making that affects you, we will inform you of the automated processing at the point where any such data is collected.
How we share and disclose
Except as otherwise described in this Privacy Statement, we do not sell, rent, or share your Personal Data with third parties.
Sharing and disclosure outside Northeastern
We may share your Personal Data in the following circumstances:
- Vendors and service providers: To assist us in meeting business operations needs and to perform certain services and functions your Personal Data may be shared with third-party providers of hosting, email communication and support services, analytics, marketing, advertising, employee background checks, administrative and technical services (including Amazon Web Services and Google in the United States, both certified to the Privacy Shield), providers of recruitment models, providers of degree verification services and electronic transcript for delivery. Following our instructions, these parties may access, process, or store Personal Data in the course of performing their duties for us. They are contractually prohibited from using or sharing your Personal Data for any purpose other than providing their services to us.
- Legal requirements: If required to do so by law pursuant to valid legal process, applicable regulation or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend our rights or property, and/or those of you or others, (iii) act in urgent circumstances to protect the personal safety of you or others, or the public, or (iv) protect us against legal liability.
Sharing and disclosure within Northeastern
Your Personal Data may be shared with other departments and business units at the University for the purposes described in this Privacy Statement, notably for delivery, personalization, and improvement of services at Northeastern and other departments and business units. This may be necessary to satisfy local, state, and federal laws and regulations or in furtherance of our and our departments’ and units’ legitimate interests in providing and improving educational services, furthering the advancement of knowledge through research and academic pursuits, and providing employment opportunities in connection with operating a large University.
Cookies and other tracking technologies
We and our partners use certain technologies to collect information about your use of our Services, in order to operate the Services, conduct analytics, improve your user experience, and for advertising purposes.
Our Site use ‘cookies,’ which are text files placed on your device when you visit a site and help us understand how you use our Site. Some cookies remain on your computer after you leave the Site (these are called ‘persistent’ cookies). Others are deleted automatically when you close your browser, and others simply expire (these are called ‘session’ cookies). For more details on cookies, please visit All About Cookies.
We use the following cookies:
- Strictly Necessary Cookies/session—Used to operate the Site and provide users with the Services available through our Site, including log-in and access to secure areas. These cookies are essential for using and navigating the Site, and without them basic functions of our Site would not work. Because these cookies are strictly necessary to deliver the Site and the Services, you cannot refuse them.
- Analytics—Used to better understand the behavior of the users on our Services and improve our Services accordingly, for example by making sure users are finding what they need easily.
- Google Analytics—A web analytics service provided by Google Inc. (“Google”). The information collected by Google (including your IP address) will be transmitted to and stored by Google on servers in the United States (Google is certified to the Privacy Shield for data transfers). How long a Google Analytics cookie remains on your computer or device depends on what it is and what it is used for. Some Google Analytics cookies expire at the end of your browser session, while others can remain for up to two years. You can prevent your data from being collected by Google Analytics on our Site by downloading and installing the Google Analytics Opt-out Browser Add-on for your current web browser. For more information on Google Analytics privacy practices, read here.
- Functionality—Used to enhance the performance and functionality of the Site and our Services.
Local shared objects (“Flash” cookies) are associated with non-browser software like Flash Player. Local shared objects can be used like cookies to distinguish your device from others, but will not be deleted or blocked using browser cookie controls. Please visit adobe.com to learn how to delete and block Flash cookies.
HTML5 local storage enables browsers to distinguish your device from others and remember data that may be important for the functioning of the website. Typically, HTML5 local storage is only deleted if all internet history, cache, and cookies are deleted. Please check your browser software for how to delete HTML5 local storage.
E-tags are used to prevent duplicative downloading of content to your browser, which can enhance browser performance. E-tags use unique identifiers for content that can also be used to distinguish your browser in certain instances from others. Typically e-tags are only deleted if all internet history, cache, and cookies are deleted. You should check your browser software for how to delete e-tags in your particular case.
Our mobile applications may use the following technologies for features, services, advertising, or analytics:
- Collection of device identifiers, such as Android ID, MAC address, or UDID
- Collection of geolocation, including precise geolocation
Sharing cookies and technical information with third parties
We have relationships with authorized third-party providers whose services are accessed through the Employee Hub portal or other University website. We may automatically send one or more of your cookies to the third-party site or service to enable you to access third-party services without reentering your Employee Hub user ID and password, or other required information, each time.
Your privacy and choices
On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please see the links below for guidance on how to modify your web browser’s settings on the most popular browsers:
- Internet Explorer
- Mozilla Firefox
- Google Chrome
- Apple Safari
If you reject, turn off, or block cookies, some parts of our Site may not function correctly. Also, blocking cookies will not stop third-parties from collecting the IP address, data stored in “Flash” cookies, and certain other types of technical information that may uniquely identify your browser. You can make decisions about your privacy and the ads you receive. You can control whether companies serve you online behavioral advertising by visiting the Digital Advertising Alliance website and using its opt-out: http://www.aboutads.info/choices/. The DAA opt-out requires that cookies not be blocked in your browser. If you are located in the European Union, visit the European Interactive Digital Advertising Alliance’s Your Online Choices opt-out tool here. As an alternative to the DAA opt-out, you can elect to block browser cookies from first parties (such as those from our website) and browser cookies from third parties (such as advertisers) by using the cookie blocking options built into your browser software.
Digital marketing and ad networks
Third parties may collect personal data from other sources. Some third parties involved in advertising operations may maintain their own proprietary consumer databases that allow them to personally identify or track website visitors. Other third parties have proprietary technologies to determine what additional devices you may use, on which it can display relevant advertisements.
We take reasonable administrative and technical steps to protect the Personal Data from loss, misuse and unauthorized access, disclosure, alteration, or destruction and, where feasible, systems that solicit or display personally identifiable information are protected by authentication and authorization controls and web-based experiences involving personal information are generally secured by SSL (Secure Sockets Layer protocol) with 128-bit encryption. However, no method of transmission over the internet is 100% secure. Therefore, while we strive to protect your data, we cannot guarantee its absolute security.
We will keep your Personal Data pursuant to our retention schedules which authorize retention for as long as reasonably necessary for the purposes described in this Privacy Statement, while we have a legitimate business need to do so, or as required by law (e.g., for tax, legal, accounting, or other purposes), whichever is the longer.
If you have elected to receive marketing communications from us, we retain information about your marketing preferences until you opt out of receiving these communications and in accordance with our policies.
To determine the appropriate retention period for your Personal Data, we will consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we use your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances, we may anonymize your Personal Data so that it can no longer be associated with you, in which case it is no longer Personal Data.
Update your information
If you need to change or correct your Personal Data, or wish to have it deleted from our systems, you may contact us. We will address your request as required by applicable law.
European Union individuals
Scope: This section applies to individuals in the EU (for these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein, and Norway). Please read below for important information on your rights with respect to the Personal Data we hold about you.
Data controller: Northeastern University is the data controller for your Personal Data, and may be contacted at the Office of Information Security located at 216 Massachusetts Avenue, Suite 302, Boston, MA 02115 and also at GDPR@northeastern.edu.
Your Rights: Subject to EU law, you may have the following rights in relation to your Personal Data:
- Right of access: If you ask us, we will confirm whether we are processing your Personal Data and, if so, provide you with a copy of that Personal Data along with certain other details. If you require additional copies, we may need to charge a reasonable fee.
- Right to rectification: If your Personal Data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your Personal Data with others, and if you ask us, where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.
- Right to erasure: You may ask us to erase your Personal Data in some circumstances, such as where we no longer need it or you withdraw your consent (where applicable). If we shared your information with others, we will alert them to the need for erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.
- Right to restrict processing: You may ask us to restrict or “block” the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to us processing it (please read below for information on your right to object). We will tell you before we lift any restriction on processing. If we shared your Personal Data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.
- Right to data portability: You have the right to obtain your Personal Data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you. We will give you your Personal Data in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
- Right to object: You may ask us at any time to stop processing your Personal Data, and we will do so:
- If we are relying on a legitimate interest (described under the “How We Use Your Information” section above) to process your Personal Data—unless we demonstrate compelling legitimate grounds for the processing; or
- If we are processing your Personal Data for direct marketing.
- Rights in relation to automated decision-making: You have the right to be free from decisions based solely on automated processing of your Personal Data, unless this is necessary in relation to a contract between you and us or you provide your explicit consent to this use.
- Right to withdraw consent: If we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time, but this will not affect any processing of your data that has already taken place.
- Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your Personal Data, you can report it to the data protection authority that is authorized to hear those concerns.
You may contact us to exercise your rights.
Publicly posted information
Links to other websites
The Website and Apps may contain links to other websites not operated or controlled by us (“Third-Party Sites”), including social media websites and services. We are not responsible for the privacy policies or data practices of such sites. By providing these links we do not imply that we endorse or have reviewed these sites. Please read the privacy policies of these sites before you visit them to understand their privacy practices and policies.
Do not track
Do-Not-Track is a public-private initiative that has developed a “flag” or signal that an internet user may activate in the user’s browser software to notify websites that the user does not wish to be “tracked” by third-parties as defined by the initiative. The online community has not agreed on what actions, if any, should be taken by the websites that receive the “do not track” signal, and therefore Do-Not-Track is not yet standardized. Our website does not alter its behavior or change its services when it receives a “do-not-track” flag or signal from your browser.
Forwarding email: Students’ private email addresses
If you forward email from your University-assigned email address to a private (non-Northeastern University) email address, we may send email to either or both addresses. We may also share your private email address with service providers inside and outside the University.
Faculty and staff University-assigned email addresses
Faculty and staff University-assigned email addresses appear in the Northeastern email directory and are publicly available through the directory at northeastern.edu.
How to request access to or deletion of information and files pertaining to you
You have the right to request access to and removal of information and records pertaining to you stored in Northeastern University systems. You may exercise these rights by contacting the appropriate office. We require that such requests be made in writing and include the following information:
- your name and role (applicant, student, or employee);
- contact information, including your email and postal addresses;
- the item(s) of information you wish to access or want removed; and
- the reason for requesting access to, or removal of, the information.
You may contact the Office of Information Security
216 Massachusetts Avenue, Suite 302, Boston, MA 02115
There are some instances where the University may deny a request to remove information. For example, the University may decline to remove the following types of information, including, but not limited to:
- information required to be maintained by the University as part of student or employment records, or pursuant to local, state, or federal law or regulation, or in performance of contractual obligations
- information compiled in reasonable anticipation of, or for use in a civil, criminal, or administrative action or proceeding
The University will generally respond to requests no later than sixty (60) days after receipt, unless a shorter time period is provided under applicable law. If a request is denied, we will send a written explanation explaining the reason for the denial and a notification of your right to file a written statement of disagreement. The University may also provide a right to have the denial reviewed. If the University is unable to act within sixty (60) days, or the time period under applicable law, we may extend that time by no more than an additional thirty (30) days. If we need to extend this time, we will notify you of the delay and the date by which we will complete action on your request.
If you are not satisfied with the outcome of a privacy inquiry, you have the right to seek redress. To exercise this right, please contact the applicable department in writing:
Applicants for undergraduate programs may contact:
Office of Undergraduate Admissions
150 Richards Hall, 360 Huntington Avenue, Boston, MA 02115
Applicants for graduate programs may contact the Office of Graduate Admissions for their specific college:
Bouvé College of Heath Sciences
123 Behrakis Health Science Center, 360 Huntington Avenue, Boston, MA 02115
College of Engineering
130 Snell Engineering Center, 360 Huntington Avenue, Boston, MA 02115
D’Amore-McKim School of Business
350 Dodge Hall, 360 Huntington Avenue, Boston, MA 02115
firstname.lastname@example.org (graduate programs)
email@example.com (accounting programs)
firstname.lastname@example.org (certificate programs)
Employees and applicants for employment may contact:
250 Columbus Place, 360 Huntington Avenue, Boston, MA 02115
Alumni, donors, and friends of Advancement may contact:
402 Columbus Place, 360 Huntington Avenue, Boston, MA 02115
The following information is required:
- your name and role (applicant, student, or employee);
- a description of the problem or concern;
- your contact information, including email and postal addresses;
- the names of person(s) you have contacted about the problem; and
- copies of responses received from them.
The University will respond to requests for redress no later than sixty (60) days after receipt, unless a shorter time period is provided under applicable law. If a request is denied, we will send a written explanation explaining the reason for the denial, and a notification of your right to file a written statement of disagreement. The University may also provide a right to have the denial reviewed. If the University is unable to act within sixty (60) days, or the time period under applicable law, we may extend that time by no more than an additional thirty (30) days. If we need to extend this time, we will notify you of the delay and the date by which we will complete action on your request.
Northeastern University does not knowingly solicit or collect Personal Data from users under the age of 13. If you believe we have inadvertently collected information about a child under 13 through this Site or the Services, please contact us at email@example.com and we will endeavor to delete the information.
The Privacy Statement is subject to change at any time, and the revision date will be noted here. We encourage users to regularly review the Privacy Statement for any changes. We will notify you if we make any material changes, pursuant to the applicable law. The most recent changes to the Privacy Statement occurred on June 11, 2018.