GDPR Privacy Notice for Individuals in the European Economic Area, United Kingdom, and Switzerland
Effective Date: September 1, 2026
This GDPR Privacy Notice supplements York College of Pennsylvania’s Website Privacy Statement and applies to individuals located in the European Economic Area, the United Kingdom, or Switzerland whose personal data is collected or processed through York College of Pennsylvania’s websites, including YCP’s website, and related online services.
For purposes of this Notice, “personal data” means information relating to an identified or identifiable individual.
Controller
York College of Pennsylvania (“YCP,” “we,” “us,” or “our”) is generally the controller of personal data collected through our websites, unless we state otherwise in a specific context.
York College of Pennsylvania
441 Country Club Road
York, PA 17403-3651
United States
Email: ltshelp@ycp.edu
Phone: 800.455.8018
If YCP appoints a Data Protection Officer, EU representative, UK representative, or other designated privacy contact, YCP will identify that person or office here.
Personal Data We Collect
Depending on how you interact with our websites, we may collect the following categories of personal data:
- Contact information, such as name, email address, mailing address, telephone number, and other identifiers.
- Inquiry and request information, such as information submitted through request-for-information forms, event registrations, admissions-related forms, or other website forms.
- Prospective student information, such as academic interests, anticipated enrollment information, school or graduation-year information, and related recruitment or admissions information.
- Account or transaction information, where applicable, such as information used to process requests, registrations, purchases, payments, or other transactions.
- Communications information, such as records and copies of correspondence if you contact us.
- Website and device information, such as IP address, browser type, operating system, device identifiers, referring pages, pages visited, and information collected through cookies, pixels, web beacons, and similar technologies.
- Marketing and engagement information, such as communication preferences, event interests, interaction with emails, and website usage data.
- SMS or messaging information, such as phone number, message preferences, and opt-out records where you request or agree to receive text messages.
- Other information you choose to provide through our websites or related online services.
We may also receive information from third-party sources, such as educational organizations, testing or survey organizations, recruitment partners, service providers, event partners, or publicly available sources. This may include information relevant to admissions, recruitment, enrollment, communications, or related educational purposes.
Purposes and Legal Bases for Processing
We process personal data only where we have an applicable legal basis. Depending on the context, our legal bases may include your consent, performance of a contract or steps taken before entering into a contract, compliance with legal obligations, protection of vital interests, performance of a task carried out in the public interest where applicable, or YCP’s legitimate interests. GDPR Article 13 requires disclosure of the purposes of processing and the legal basis for processing, and, where legitimate interests are relied upon, the legitimate interests pursued.
Purpose of Processing | Examples of Personal Data | Legal Basis |
|---|---|---|
Responding to inquiries and requests | Contact information, inquiry details, submitted form information | Legitimate interests; steps prior to entering into a contract; consent where applicable |
Admissions, recruitment, enrollment, and prospective-student communications | Contact information, academic interests, school information, recruitment information | Legitimate interests; steps prior to entering into a contract; consent where applicable |
Providing website functionality and online services | Device information, account information, usage information | Legitimate interests; performance of a contract where applicable |
Processing registrations, transactions, payments, or requests | Contact information, transaction details, payment-related information where applicable | Performance of a contract; legitimate interests; legal obligations |
Sending marketing, recruitment, event, or informational communications | Contact information, preferences, engagement information | Consent where required; legitimate interests where permitted |
SMS and similar messaging | Phone number, message preferences, opt-out records | Consent; legitimate interests for administrative or service-related messages where permitted |
Analytics, website improvement, and user experience | Usage data, cookie identifiers, device information, engagement information | Consent where required for non-essential cookies; legitimate interests where permitted |
Advertising, retargeting, and campaign measurement | Cookie identifiers, device information, usage data, engagement information | Consent where required; legitimate interests where permitted |
Security, fraud prevention, troubleshooting, and system integrity | IP address, logs, device information, security-related information | Legitimate interests; legal obligations where applicable |
Legal, regulatory, compliance, accreditation, recordkeeping, and dispute-resolution purposes | Relevant records, correspondence, transaction data, request data | Legal obligations; legitimate interests |
Disclosures of Personal Data
We may disclose personal data to the following categories of recipients:
- YCP departments, offices, employees, and authorized personnel who need the information for the purposes described in this Notice.
- Service providers and vendors that support our websites, admissions, recruitment, communications, analytics, marketing, hosting, payment processing, security, information technology, or other institutional functions.
- Educational, recruitment, event, testing, survey, or admissions-related partners, where applicable.
- Government agencies, regulators, law enforcement, courts, or other third parties where required or permitted by law.
- Professional advisers, insurers, auditors, consultants, and legal counsel.
- Successors or counterparties in connection with a merger, restructuring, transfer, or similar organizational transaction involving YCP assets or operations.
- Other parties with your consent or as disclosed at the time of collection.
We do not authorize service providers to use personal data for purposes other than providing services to YCP, except as permitted by applicable law or contract.
International Transfers
YCP is located in the United States. If you are located outside the United States, your personal data may be transferred to, stored in, or processed in the United States and other jurisdictions that may not provide the same level of data protection as your home jurisdiction.
Where required by applicable law, YCP will use appropriate safeguards for international transfers of personal data, which may include standard contractual clauses, adequacy-based transfer mechanisms, approved certification frameworks, or other lawful transfer mechanisms.
Retention
We retain personal data for as long as reasonably necessary for the purposes described in this Notice, including to respond to inquiries, provide requested services, administer admissions and enrollment-related processes, provide communications, comply with legal, regulatory, accreditation, tax, accounting, and recordkeeping obligations, resolve disputes, enforce agreements, and protect the rights, safety, and security of YCP and others.
The specific retention period depends on the type of data, the purpose for which it was collected, applicable legal requirements, and YCP’s applicable records-retention practices. GDPR Article 13 requires disclosure of the period for which personal data will be stored or, if that is not possible, the criteria used to determine that period.
Your GDPR Rights
Subject to applicable law and certain limitations, individuals in the European Economic Area, United Kingdom, and Switzerland may have the following rights with respect to their personal data:
- Right of access: to request access to personal data we hold about you.
- Right to rectification: to request correction of inaccurate or incomplete personal data.
- Right to erasure: to request deletion of personal data under certain circumstances.
- Right to restriction of processing: to request that we limit processing of personal data under certain circumstances.
- Right to object: to object to processing based on legitimate interests or direct marketing.
- Right to data portability: to request a copy of certain personal data in a structured, commonly used, machine-readable format.
- Right to withdraw consent: where processing is based on consent, to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
- Right to lodge a complaint: to lodge a complaint with a data protection supervisory authority.
GDPR Article 13 identifies these rights, including the right to access, rectification, erasure, restriction, objection, portability, withdrawal of consent where applicable, and the right to lodge a complaint with a supervisory authority.
Where required by applicable law, including for individuals located in the European Economic Area, United Kingdom, or Switzerland, YCP will request consent before using non-essential cookies, pixels, advertising technologies, customer data platform technologies, or similar tracking technologies. You may manage or withdraw consent through the cookie-preference tool available on the Websites, where available.
To exercise these rights, please contact us using the contact information below.
Required or Optional Information
In many cases, providing personal data is voluntary. However, if you choose not to provide information requested in a required field or needed for a particular service, we may not be able to respond to your inquiry, process your request, provide the relevant service, complete a transaction, consider an application, or communicate with you about the relevant matter.
Automated Decision-Making
We do not use personal data collected through our websites to make decisions based solely on automated processing that produce legal or similarly significant effects, unless we disclose otherwise at or before the time of collection.
We may use automated tools to help route inquiries, personalize website content, improve communications, measure engagement, support website operations, or assist with administrative processes. We do not use personal data collected through the Websites to make decisions based solely on automated processing that produce legal or similarly significant effects, unless we disclose otherwise at or before the time of collection.
Contact Information
To ask questions, submit a request, or contact us about this Notice or our privacy practices, please contact:
York College of Pennsylvania
441 Country Club Road
York, PA 17403-3651
United States
Email: ltshelp@ycp.edu
Phone: 800.455.8018
Changes to This Notice
We may update this Notice from time to time. When we make changes, we will update the effective date above and post the revised Notice on our website.