GDPR Website Privacy Notice

Version: 2.0
Last Updated: May 2026

Introduction

We respect your privacy and are committed to protecting it through our compliance with this GDPR Privacy Notice and Cookie Policy (this “Notice”).

This Privacy Notice describes how Tulane and Tulane’s schools, centers, and other units and affiliates (collectively, “we,” “us,” or “Tulane”) collect, use, and share the Personal Data that we gather from you by any means, including hard-copy materials (such as paper applications or forms) and electronic means (such as websites, mobile apps, and other digital properties), to the extent that any such Personal Data falls within the scope of the UK and EU General Data Protection Regulation (“GDPR”).

This Privacy Notice applies to the processing of Personal Data when you are a resident or citizen in the UK or the European Economic Area (“EEA”), who visits this website or any of the websites operated by Tulane Schools, Centers, and other Tulane units and/or affiliates (collectively, the “Website”), applies to study, enrolls in one of our courses, participates in our alumni program, follows our student exchange programs in the United States (US), applies for employment, or otherwise interacts with our services (collectively, “Services”). If you have any questions about this Privacy Notice or our information practices, please contact us using the options provided at the end of this Privacy Notice.

Who we are

Tulane University is a comprehensive research university in New Orleans, Louisiana.  Tulane processes data from students, donors, research participants, alumni, patients, employees and customers.

Information we collect about you

When we use the term “Personal Data,” we mean any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of Personal Data about you, which we have grouped together as follows:

• Identity Data includes first name, last name, username or similar identifier, and title.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Application Information includes any information processed in the admission process such as information about your personal interests, tax identification number, wages, scholarships and grants, family support, extracurricular activities, recommendations, self-reported criminal records, standardized testing results, prior school results, transcripts, school activities, and disciplinary records collected and processed during the admissions process and throughout any subsequent enrollment as a student, evaluating your eligibility for financial aid and, if you are admitted, facilitating your education.
• Financial Information includes bank account details.
• Transaction Information includes details about payments from you.
• Technical Information includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Website.
• Usage Data includes information about how you use our Website.
• Marketing and Communications Data includes your preferences in receiving marketing from us, such as newsletters.
• Demographic Information includes race, ethnicity, gender, age, and marital status.

We also collect, use, and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data could be derived from your Personal Data, but is not considered Personal Data in law, as this data will not directly or indirectly reveal your identity.

For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data in a way that directly or indirectly identifies you, we treat the combined data as Personal Data and use it in accordance with this Notice.

We rely on separate legal bases to process your Personal Data. For example, it may be necessary for us to process your Personal Data in certain ways to process a transaction you have requested or otherwise in accordance with a contract between us.

The ways in which we collect and use your information vary depending on the relationship between you and Tulane, as well as the specific Tulane function with which you interact.

What Personal Data do we collect?

Website

Tulane collects Personal Data you provide, for example, when you enter the information into form fields on our Services. As with most digital platforms, we also automatically collect certain information when you use our Services.

We may collect:

How long do we hold your data for?

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice, unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights.

Who do we share and disclose Personal Data to?

We may also share your Personal Data where required to comply with applicable laws or legal obligations, including with regulators or law enforcement. Where relevant, certain types of information may also be handled in line with other legal frameworks, such as the Health Insurance Portability and Accountability Act for health data or the Family Educational Rights and Privacy Act for student records. Further details are available in our separate notices, including our Notice of Privacy Practices.

Service Providers

We share your Personal Data with third-party service providers who complete transactions or perform services on our behalf or for your benefit, such as:

• Payment and donation processing
• Marketing and analytics
• Processing employment applications
• Processing admissions applications
• Alumni outreach and engagement
• Event registration and coordination
• Course registration and coordination
• Course evaluations and assessments
• Research insights and analytics
• Performing human resources administration

Affiliates

We may share your Personal Data with affiliated legal entities within our schools, Centers, and other Tulane units and affiliates for purposes and uses that are consistent with this Notice.

Partners

We may share your Personal Data with our partners for the purposes of administering programs and services, such as:

• Cross-registration for courses with other universities
• Study abroad at foreign universities
• Online education offerings through online platforms
• Joint research arrangements with other hospitals and universities
• Events with clubs and special interest groups

Third-Party Mobile App Providers

With your knowledge and consent, the Services may collect and transfer your Personal Data, including location information, to and from other applications, functions, and tools on your mobile device.

Social Media Platforms

We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you on third-party platforms. We may do this by providing a hashed version of your Personal Data to the third party for matching purposes. For more information, including how to control your privacy settings and your ad choices, please see the “Website and Cookies Policy” portion of this Notice.

Legal Process, Safety and Terms Enforcement

We may disclose your Personal Data to legal, or government regulatory authorities as required by applicable law. We may also disclose your Personal Data to third parties as required by applicable law in connection with claims, disputes, or litigation; when otherwise required by applicable law; if we determine its disclosure is necessary to protect the health and safety of you or us; to enforce our legal rights; or to enforce contractual commitments that you have made.

Your rights over your information

For those visitors to this website from the UK or EU, your rights afforded under the General Data Protection Regulation (GDPR) are as follows:

1. The right to be informed about our collection and use of Personal Data

   You have the right to be informed about the collection and use of your Personal Data. We ensure this through our internal data protection policies and our external website policy. These are regularly reviewed and updated to ensure they are accurate and reflect our data processing activities.

2. Right to access your Personal Data

   You have the right to access the Personal Data that we hold about you in many circumstances, by making a request. This is sometimes termed ‘Subject Access Request’. If we agree that we are obliged to provide Personal Data to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within 1 month of your identity being confirmed.

   We would ask for proof of identity and sufficient information about your interactions with us so that we can locate your Personal Data.

   If you would like to exercise this right, please contact us as set out below.

3. Right to correct your Personal Data

   If any of the Personal Data we hold about you is inaccurate, incomplete or out of date, you may ask us to correct it.

   If you would like to exercise this right, please contact us as set out below.

4. Right to restrict processing

   You have the right to ask us to restrict the processing of your Personal Data. For example, this may be because you have issues with the accuracy of the data we hold or the way we have processed your data. The right is not absolute and only applies in certain circumstances.

   If you would like to exercise this right, please contact us as set out below.

5. Right to erasure

   You have the right to have Personal Data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.

   If you would like to exercise this right, please contact us as set out below.

6. Right to portability

   The right to portability gives you the right to receive Personal Data you have provided to a controller in a structured, commonly used, and machine-readable format. It also gives you the right to request that a controller transmit this data directly to another controller.

   If you would like to exercise this right, please contact us as set out below.

7. Right to object

   You have the right to object to our processing of some or all of the Personal Data that we hold about you. This is an absolute right when we use your data for direct marketing, but it may not apply in other circumstances where we have a compelling reason to do so, e.g., a legal obligation.

International Data Transfers

Tulane may transfer your Personal Data within our family of schools, Centers, and other Tulane units and affiliates and/or to the third parties discussed above. Your Personal Data may be transferred to, stored, and processed in a country other than the one in which it was collected.

If your Personal Data was collected or stored in the European Economic Area (“EEA”), we may transfer Personal Data to organizations in so-called third countries (countries outside of the EEA). Such transfers can be made if any of the following conditions apply;

• The EU Commission has decided that there is an adequate level of protection in the country in question; or
• Binding Corporate Rules (BCR) are in place (for inter-company transfers); or
• Standard Contractual Clauses* (EU model-clauses) are used; or
• Exceptions in special situations apply, such as to fulfill a contract with you or your consent to the specific transfer.

*The European Commission has adopted standard data protection clauses, which provide safeguards for Personal Data transferred outside of the EEA. We may use Standard Contractual Clauses when transferring Personal Data from a country in the EEA to a country outside the EEA. You can request a copy of our Standard Contractual Clauses by contacting us as set forth in the “How To Contact Us” section below.

Children

We do not intend to collect, and we will not knowingly collect or solicit Personal Data online from children under the age of 13 or as defined by local legal requirements, except on Services specifically directed to children. For those Services, we follow applicable data protection laws with respect to children’s privacy, as set forth in the additional disclosures posted within the relevant Service.

Updates to the Privacy Notice

This Notice is subject to occasional revision, and if we make any material changes in the way we use your Personal Data, the most up-to-date version can be found on this website. We may also notify you by sending you an email to the last email address you provided to us and/or by prominently posting notice of the changes on the Services and updating the effective date above.

Managing Communication Preferences

If you have opted in to our marketing (or, when permitted by law, if you have provided us with your contact information), we may send you email messages, direct mail, push notifications, or other communications regarding educational offerings or other products and services, depending on the method of communication you select.  You may ask us not to do so when you access our Website, mobile applications, or change your preferences by updating any accounts you have with us. At any time, you may elect to discontinue receiving messages about these offerings, products, or services from us by submitting an opt-out request to the contact information below or by following the unsubscribe instructions in the form of the communication you received, as described below.

Printed Materials

To opt out of receiving printed materials about our offerings, products, or services at your postal address, such as magazines, advertisements, flyers or postcards, please write to us at the address set forth in the “How To Contact Us” section below. Please be sure to include your name, mailing address, and description of the marketing material received exactly as they appear on the printed marketing materials you received.

Emails

To opt out of receiving communications about our offerings, products, or services via email, please send an unsubscribe request to the email address set forth in the “How To Contact Us” section below or click on the unsubscribe link at the bottom of the email that was sent to you and follow the directions on the resulting web page. Please note that you may continue to receive certain transactional or account-related electronic messages from us.

Text Messages

If you have consented to receive text messages, you may opt out of receiving them by using the method provided in the text message or by contacting us as set forth in the “How To Contact Us” section below.

Push Notifications

To opt out of receiving push notifications, please adjust your preferences in your device's settings menu.

How to Contact Us

If you have any questions, comments, requests, or concerns about this Privacy Notice or other privacy-related matters, you may contact our Data Protection Officer.

Data Protection Officer
Email: GDPRDPO@Tulane.edu     
Phone: (504) 988-0500 
Address: 1441 Canal Street, Suite 227, New Orleans, Louisiana 70112 
Tulane Mail Code: 8433

UK Representative: The DPO Centre Limited (London)
Email: GDPRUK@tulane.edu
EU Representative: The DPO Centre Europe Limited (Ireland)
Email: GDPREU@tulane.edu

Thank you for taking the time to read our Privacy Notice.