China Privacy Notice
DATE OF ISSUE: February 2024
INTO University Partnerships Group Supplementary Privacy Notice for Users of our Services based in People’s Republic of China
This supplementary Privacy Notice outlines INTO’s personal information handling practices if you live in the People’s Republic of China (China), excluding Hong Kong Special Administrative Region (SAR), Macau SAR, and Taiwan Province. The following provisions relate to applicable personal information privacy laws in China including the Personal Information Protection Law of China (PIPL).
This Privacy Notice supplements INTO’s other Privacy Notices; it is not intended to supersede or override it. In the event of any conflict or inconsistency between the provisions of this supplementary Notice and our other Privacy Notices, the provisions of this supplementary Notice shall prevail.
In this notice, the terms "we", "our", and "us" refer to INTO University Partnerships Limited and IUP2 LLP, both of One Gloucester Place, Brighton BN1 4AA (ICO registration numbers Z3504921 and ZA032598 respectively). INTO University Partnerships Limited, its subsidiaries and affiliates (together “INTO”, individually an “INTO Entity”) is committed to protecting your privacy.
We are a personal information handler of your information which means that we are responsible for looking after it. We will use your personal information fairly, lawfully and in a transparent manner, and in accordance with China’s data protection laws including Personal Information Protection Law (PIPL).
Does this Supplementary Privacy Notice for the PIPL apply to you?
This notice applies to you:
if you are a person or data subject - meaning a natural person, not a corporation, partnership, or other legal entity; AND
we handle your Personal Information inside the borders of China.
you are physically located in China, and we handle your Personal Information outside the borders of China to 1) provide you with goods or services, 2) analyse or assess your activities, or 3) comply with other circumstances as provided by laws or administrative regulations.
If you are located outside China and you provide your Personal Information to us outside China, this supplementary Privacy Notice does not apply to that information.
We reserve the right to update this supplementary Privacy Notice at any time by changing it as it applies to your use of our services.
1. Important information
Purpose of this supplementary Privacy Notice
Your trust is very important to us and this supplementary Privacy Notice aims to give you information about how we collect and process your personal information, including any details you may provide when you submit an enquiry, make a direct online application for a course, or when you enter your details onto and use our websites.
What do the key terms mean under the PIPL?
"Personal information" means various kinds of information, whether recorded in electronic or another format, that relates to an identified or identifiable natural person, excluding anonymised information.
“Personal information handler” is considered by the PIPL as an organisation or individual that, for Personal Information handling activities, determines autonomously the purposes and methods for those activities.
"Sensitive personal information" means personal information that, if leaked or if used illegally, is likely to cause harm to a natural person's personal dignity or endanger his or her personal safety or the safety of his or her property. This includes personal information such as biometric identification information, religious beliefs, specifically designated status, medical health information, financial accounts, information on individuals’ whereabouts, as well as personal information of minors under the age of 14.
2. The information we collect about you
The Personal Information we collect varies depending on our relationship and interactions with you. Please refer to section 2. “The information we collect about you” in our Privacy Notice for a description of the categories of personal information handled by us. INTO may also collect your sensitive personal information, such as financial information (e.g. payment information), biometric information (e.g. security camera images), and location data (e.g. device IP address), as set out in our Privacy Notice, but only after providing you with notice and obtaining your consent as required under PIPL.
3. Collecting and processing your Personal Information
We collect and process your personal information, including sensitive personal information, only for specified, explicit and reasonable purposes and to the extent directly relevant to the purposes of processing, as set out in section 5. “How we use your personal information” of our Privacy Notice. If the purposes are modified, INTO will take the necessary measures as required by the PIPL, including obtaining separate consent. We may process your personal information for the purposes set out in our Privacy Notice if one of the following applies:
with your prior consent to the processing for one or more specific purposes as set out in INTO’s Privacy Notice;
processing your personal information when it is necessary to conclude or perform a contract to which you are party, or for human resources management in accordance with the labour rules and regulations established in accordance with the law;
processing is necessary for compliance with any statutory duties or legal obligations;
processing is necessary in an emergency, to protect the lives, health or property of natural persons;
your personal information has been made public by you or has otherwise been lawfully made public, the processing is done pursuant to the PIPL and the extent the processing is reasonable; or
the processing is done in other circumstances provided for in applicable laws or administrative regulations.
4. How we share Personal Information
As set out in section 6. “Disclosures of your personal information” in our Privacy Notice, we may share certain personal information internally with our subsidiaries and affiliates, or with selected external third parties, such as our partner universities, suppliers and service providers.
When required by applicable law, before sharing your personal information with any third parties we will notify you of the name and contact details of the third parties, the types of personal information to be shared, and the purposes and means of processing and sharing the personal information.
We will also obtain your prior consent to the sharing of personal information where required by applicable law. We will only share your personal information for specific and definite purposes pursuant to the principles of lawfulness, fairness, necessity and good faith, and only share the personal information to the extent necessary for the specific purposes you are informed of.
5. Transferring your Personal Information outside China
We may transfer your personal information outside of China for processing by INTO (head office: INTO University Partnerships, One Gloucester Place, Brighton, East Sussex, BN1 4AA, United Kingdom – contact by email to: firstname.lastname@example.org) for the purposes set out in section 5. “How do we use your personal data?” of our Privacy Notice.
INTO uses software as a service provided by third parties (such as Azure, Salesforce.com and Google Analytics) to make secure transfers of personal information so we can ensure our communications to you are managed effectively, and any online applications you submit are processed securely. Our third-party service providers are kept under regular review; you can contact us by email via: email@example.com to obtain details of the current providers used by INTO to transfer your personal information out of China, the services they provide for us, as well as their contact information.
Personal information transferred outside China may include:
details collected if you send us an enquiry: full name, date of birth, gender, current address, contact information (email address, mobile phone number), area of interest for future studies, and consent to receive future communications;
details collected if you submit an online application: full name, date of birth, gender, current address, contact information (email, mobile phone number), preferred method of communication, nationality, education history, area of interest for future studies, and study preferences.
To the extent that we transfer your personal information to any recipient based outside of China, we will obtain your prior separate consent before transferring such personal information if consent is chosen as the lawful basis. We will only transfer your personal information to the extent necessary and will work with the overseas recipients to ensure it is processed in a secure manner to protect your legitimate interests and to avoid causing harms to you. We and the overseas recipients will only retain your personal information for the minimum necessary retention period unless otherwise required by applicable laws.
You can read more about your personal information rights by visiting section 10 “Your legal rights” of our Privacy Notice. If you wish to exercise any of those rights, or require further information about any of those rights, please send us an email to: firstname.lastname@example.org or complete our Online Rights' Request form.
We shall process and transfer your personal information in accordance with the relevant data protection laws and regulations in China (including obtaining all necessary approval, filing or certification).
6. Information retention
Unless otherwise provided by laws and administrative regulations, we will only store your personal information for the shortest period necessary to achieve the purpose of processing. We determine the storage period of personal information based on the criteria described in section 9. “Information retention” of our Privacy Notice.
7. Personal information of Minors
In China, INTO does not normally collect the personal information of children under the age of 16. If we do, we will require proper consent from a parent or legal guardian, and we will verify such consent through proper methods prescribed under law. In this regard, we may ask for the name and other information relating to the parent or legal guardian to the extent required to verify proper consent. If we learn that we have collected children's personal information without a legal guardians’ consent, we will delete it from our systems.
8. Your Choices and Rights
You have the right to make decisions on the processing of your personal information. In addition to your rights set out in section 10. “Your legal rights” of our Privacy Notice, you may also ask for an explanation of our personal information processing rules.
9. How to contact INTO
INTO is the personal information handler covered by this supplementary Privacy Notice for the PIPL. If you want to exercise any of your choices or rights please complete our Online Rights' Request form or send us an email to email@example.com.
If you have any questions about this notice, please contact INTO’s Data Protection Officer by email to: firstname.lastname@example.org or in writing to the Data Protection Officer, INTO University Partnerships Limited, One, Gloucester Place, Brighton, East Sussex, BN1 4AA, United Kingdom.
Thank you for taking the time to read this supplementary Privacy Notice.