GDPR (EU General Data Protection Regulation)-Based Privacy Policy of the National
University Corporation University of Tsukuba

February 4, 2021
Determination of the President
This privacy policy has been established by the National University Corporation Universityof Tsukuba (referred to as “the Corporation” below, with the exception of Article 1 below) inresponse to the GDPR in order to set forth policies related to the processing of personal dataand its transfer to the territory of third countries or organizations in third countries (referredto as “ the extraterritorial transfer”) of data subjects who are located in countries to which
the GDPR is applicable (regardless of nationality or residency.)
1 Definitions
The definitions of terms used in this Privacy Policy are provided in the table below.
Terms

Definitions

GDPRGeneral Data Protection Regulation: EU General Data ProtectionRegulation No. 2016/679.

Countries

toThis refers to the countries that make up the European Economic Areawhichthe(the member countries of the EU, the Republic of Iceland, theGDPR

is

Principality of Liechtenstein, and the Kingdom of Norway) and theApplicable

United Kingdom of Great Britain and Northern Ireland.
* The Information Commissioner’s Office (ICO), which is the personal
data protection supervisory authority of the United Kingdom has
stated that it complies with the GDPR.

Data Subject

This refers to an identified or identifiable natural person. “Identifiablenatural person” refers to a person who can be identified directly or
indirectly in particular by reference to an identifier such as a name,identification number, location data or an online identifier (such as an
IP address, cookie, or MAC address) or by reference to one or morefactors specific to the physical, physiological, genetic, mental,economic, cultural or social identity of that natural person.

Personal Data

Any information relating to an identified or identifiable natural person(‘data subject’).

Processing

Any operation or set of operations which is performed on personal dataor on sets of personal data, whether or not by automated means, suchas collection, recording, organization, structuring, storage, adaptationor alteration, retrieval, consultation, use, disclosure by transmission,
disseminationorotherwise

makingavailable,alignment

orcombination, restriction, erasure or destruction.
Restriction of

The marking of stored personal data with the aim of limiting theirProcessing

processing in the future.

Profiling

Any form of automated processing of personal data consisting of theuse of personal data to evaluate certain personal aspects relating to anatural person, in particular to analyze or predict aspects concerningthat natural person's performance at work, economic situation, health,personal preferences, interests, reliability, behavior, location ormovements.

Controller

The natural or legal person, public authority, agency or other bodywhich, alone or jointly with others, determines the purposes and meansof the processing of personal data.

Processor

A natural or legal person, public authority, agency or other body which
processes personal data on behalf of the controller.

Third Party

A natural or legal person, public authority, agency or body other thanthe data subject, controller, processor and persons who, under the
direct authority of the controller or processor, are authorized to process
personal data.

Consent of the

Any freely given, specific, informed and unambiguous indication of theData Subject

data subject's wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal
data relating to them.

SCC

Standard Contractual Clauses*Theagreement

regarding

extraterritorialtransfers

betweenenterprises within the EU and enterprises outside of the EU thatwas provided for by the Data Protection Directive (95/46/EC) that is
applicable to the member countries of the EU.
SDPCStandard Data Protection Clauses* This is a replacement for the SCC that is provided for by the GDPR

Adequacy

A decision by the European Commission that a country or territory

Decisionensures an adequate level of protection.
* When such a decision has been made, the extraterritorial transfer of
personal data is possible without any special procedures.
* Japan received an adequacy decision in January of 2019, butgovernmental institutions, incorporated administrative agencies andthe like are not included in the framework of the adequacy decision.

2 Name and Address of the Controller
Name: National University Corporation University of Tsukuba
Address: 1-1-1 Tennodai, Tsukuba, Ibaraki
3 Use of Cookies
The main site of the Corporation and other websites of the Corporation (not including
external websites linked to by said sites; referred to as “public websites” below) use cookies,
a method of recording data for browsers that visit public websites. The use of cookies makes

it possible for information that is entered to be saved temporarily on the computer that isviewing the website, eliminating the task of reentering it the next time the website isaccessed.
Additionally, if the data subject's browser has been set to permit the sending andreceiving of cookies, the Corporation may acquire cookies that have been stored on thecomputer of the data subject and link the collected activity history with personal data.
4 Duties Subject to the Processing of Personal Data
For the types of personal data listed below, the Corporation may only carry out theprocessing of that personal data in order to carry out duties established for that particularpersonal data.
(1) The personal data of persons applying (including persons whose admission has been
approved; referred to as “applicants for admission” in the introductory clause of thefollowing section) to the University of Tsukuba (including affiliated schools; the same istrue for Items 13-F and 13-G below as well)
A The selection of admitted applicants
B The collection of and exemption from testing fees and admission fees
C Contact during emergencies, etc.
D Procedures, contact, etc. necessary for other duties(2) The personal data of the legal guardians and persons responsible for the educationalexpenses (this refers to the persons who have primary responsibility for educational
expenses; the same is true in the introductory clause of Item 4 below as well) ofapplicants for admission
AThe collection of and exemption from testing fees and admission fees

B

Contact during emergencies, etc.

CProcedures, contact, etc. necessary for other duties(3) The personal data of students (including children and pupils of affiliated schools; thesame is true below)
A

Educational affairs

B

Student support

CCareer support

DInternational exchange

E

Input into school internal systems and management

F

Health management

G

Payment of rewards, travel expenses, etc.

H

The collection of and exemption from admission fees and tuition

I

Payment procedures for scholarships, etc.

J

Procedures related to taxes, etc.

K

Contact during emergencies, etc.

L

Surveys

M Procedures, contact, etc. necessary for other duties(4) The personal data of the legal guardians and guarantors of students and the persons
responsible for their educational expenses
AThe collection of and exemption from admission fees and tuition

B

Payment procedures for scholarships, etc.

C

Contact during emergencies, etc.

D

Procedures, contact, etc. necessary for other duties(5) The personal data of graduated and completed students (referred to as “graduates, etc.”
in B below)
A

Certification of graduation or completion, performance, registration, etc.

B

Contact with graduates, etc.

C

Advertising

DDonations

ESurveys

F

Procedures, contact, etc. necessary for other duties(6) The personal data of persons who wish to be employed by the Corporation (includingpersons who have been selected for employment; referred to as “persons who desireemployment” in the introductory clause of the following Item)A

Screening for employment

B

Hiring procedures

CContact during emergencies, etc.

D

Procedures, contact, etc. necessary for other duties(7) The personal data of the families (including partners; the same is true below) ofpersons who desire employment
A

Contact during emergencies, etc.

B

Procedures, contact, etc. necessary for other duties(8) Personal data of staff
A

Personnel affairs

BPayment of salary, bonuses, travel expenses, etc.

C

Procedures for benefits

DProcedures for the Ministry of Education, Culture, Sports, Science and Technology
Mutual Aid Association and the Japan Health Insurance Association

E

Personnel management

F

Health management

G

Contact with temporary transfer destinations and origins

H

Retirement procedures

I

Procedures related to taxes, etc.

J

Input into school internal systems and management

K

Contact during emergencies, etc.

LSurveys

M Procedures, contact, etc. necessary for other duties(9) Personal data of the families of staff
A

Procedures for benefits

B

Procedures for the Ministry of Education, Culture, Sports, Science and Technology
Mutual Aid Association and the Japan Health Insurance Association

C

Procedures related to taxes, etc.

D

Contact during emergencies, etc.

E

Procedures, contact, etc. necessary for other duties

(10) Personal data of donors
A

Issuance of certificates of donation receipt

B

Sending of premiums for donations, etc.

C

Input into school internal systems and management

D

Procedures, contact, etc. necessary for other duties(11) Personal data of patients and their families
AHealthcare

B

Input into hospital internal systems and management

C

Procedures, contact, etc. necessary for other duties(12) Personal data of visitors to public websites
A

Understanding of the use of public websites

B

Improvement of public websites

C

Providing services for public websites

E

Contact, etc. necessary for other duties(13) Personal data of persons other than those provided for in the Items aboveA

Contract procedures and management for temporary personnel

B

Procedures and management related to contracts and invitations related to joint
researchC

Scientific, historical, and statistical processing related to scholarly researchD

Applications, procedures, etc. for various projectsEProcedures and management related to use of the library

F

Procedures and management related to participation in and invitations to events, etc.
held by the Corporation or the University of TsukubaG

Provision of services and information related to events, etc. held by the Corporationor the University of Tsukuba

H

Payment of rewards, travel expenses, etc. and collection of fees

I

Procedures related to taxes, etc.

JSurveys

K

Procedures, contact, etc. necessary for other duties

5 Sources of Acquired Personal Data
The Corporation shall obtain personal data from the following sources in order to carryout the duties in the Article above.
(1) Documents (including electronic records) for which the direct acquisition of consent
based on consent from the data subject (from the legal guardian if the data subject isunder 16 years of age (or under the age provided for by local law in a country to which
the GDPR is applicable and local law makes such a provision) can be proven(2) Online identifiers such as IP addresses and MAC addresses acquired by the Corporation
when the data subject is using an information service of the Corporation or is connected
to an information network of the Corporation(3) Information that is publicly available on the Internet(4) Information from social media(5) Signatories of the SCC or SDPC

6 Duration of Storage of Personal Data
Personal data shall be stored for a period provided for by the laws and regulations ofJapan or the regulations, etc. of the Corporation.
7 Lawfulness of Processing of Personal Data
When it is possible for the Corporation to process personal data lawfully, it shall bedone as described below.
(1) The data subject has given consent to the processing of his or her personal data for one
or more specific purposes(2) Processing is necessary for the performance of a contract to which the data subject isparty or in order to take steps at the request of the data subject prior to entering into acontract(3) Processing is necessary for compliance with a legal obligation to which the controller issubject(4) Processing is necessary in order to protect the vital interests of the data subject or ofanother natural person(5) Processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller(6) Processing is necessary for the purposes of the legitimate interests pursued by thecontroller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data
8 Rights of the Data Subject
Data subjects have the rights listed below. However, expenses shall be requested of thedata subject in the event of a request for disclosure as provided for in the Japanese Act on
the Protection of Personal Information Held by Incorporated Administrative Agencies, etc.
(Act No. 59 of 2003).
(1) Right of Access
Data subjects may request that the controller provide their own personal data or otherinformation provided for by the GDPR.
(2) Right to Rectification
Data subjects may request that the controller rectify without delay their own personal
data when those data are inaccurate.
(3) Right to Erasure (Right to be Forgotten)
Data subjects may request that the controller erase without delay their own personal
data when those data are acknowledged to fall under any of the items given below.
AThe personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed.

BThe data subject has withdrawn consent for processing and there is no other legal
ground for the processing.

C

The data subject objects to the processing pursuant to Article 21, Paragraph 1 of theGDPR and there are no overriding legitimate grounds for the processing, or the data
subject objects to the processing pursuant to Paragraph 2 of that Article.

D

The personal data have been unlawfully processed.

EThe personal data have to be erased for compliance with a legal obligation in EU or
Member State law to which the controller is subject.

FThe personal data have been collected in relation to the offer of information society
services referred to in Article 8, Paragraph 1 of the GDPR.

(4) Right to Restriction of Processing
Data subjects may request that the controller restrict the processing of personal datawhen Article 18, Paragraph 1 of the GDPR is applicable.
(5) Right to Data Portability
The data subject shall have the right to receive the personal data they have provided
to the controller in a structured, commonly used, and machine-readable format whenArticle 20, Paragraph 1 of the GDPR is applicable. In addition, data subjects have theright to transmit those data to another controller without hindrance from the controller
to which the personal data have been provided.
(6) Right to Object
The data subject shall have the right to object at any time, on grounds relating to their
particular situations, to processing of personal data concerning them which is based on
Item 5 or 6 of the previous Article, including profiling based on those provisions.
(7) Right not to be Subject to Decision-Making based on Automated Processing, including
Profiling
The data subject shall have the right not to be subject to a decision based solely on
automated processing, including profiling, which produces legal effects concerning themor similarly significantly affects them.
9 Provision and Sharing of Personal Data
In order to carry out the duties in Article 4, the Corporation may share personal datainternally, provide them to the third parties listed below, or share them with such thirdparties, in compliance with the Japanese Act on the Protection of Personal Information Heldby Incorporated Administrative Agencies, etc. (Act No. 59 of 2003) and other related laws
and regulations.
(1) Public authorities(2) Financial institutions(3) Private scholarship foundations(4) Medical institutions(5) Contractors(6) Signatories of the SCC or SDPC
(7) Other organizations related its duties
10 Transfer of Data
Personal data may be transferred from overseas offices in countries to which the GDPR
is applicable (sites providing support for activities supporting international cooperation,etc. for the pursuit of the Corporation’s educational and research activities and support for
educational and research activities carried out in Japan by educational and research
institutions or the like in that country in cooperation with the Corporation) to theCorporation or other overseas offices (not including overseas offices in countries to whichthe GDPR is applicable) or to third countries other than countries to which the GDPR isapplicable (not including countries or territories that have received an adequacy decision)
only as provided for by the SCC or SDPC, for reasons provided for in Article 49, Paragraph
1 of the GDPR, or when lawfulness is otherwise guaranteed.
11 Security Measures
As controller, the Corporation shall establish sufficient technical and organizational
security measures concerning the protection of personal data.
12 General Provisions
The Corporation may revise this privacy policy according to its guidelines, based on laws
and regulations. However, the Corporation will not use personal data collected with theconsent of data subjects for changed purposes without obtaining the consent of the data
subject in question.
Note
This Determination shall be effective as of February 4, 2021.