Privacy Notice

 

Who We Are

The University of Chicago Booth School of Business (“Chicago Booth,” “we,” “our,” or “us”) is part of the University of Chicago and acts as a data controller for the personal data described in this notice.

 

Contact Information

University of Chicago Booth School of Business
5807 South Woodlawn Avenue
Chicago, IL, 60637, USA

• Email: privacy@chicagobooth.edu

 

Data Protection Officer (DPO)

Chicago Booth has appointed a data protection officer (DPO) who is responsible for overseeing compliance with data protection obligations.

Name: E. Yvonne McConico
Email: Yvonne.mcconico@chicagobooth.edu

 

Categories of Personal Data We Collect

Depending on your relationship with Chicago Booth, (for example, applicant, student, alumni, employee, researcher, or visitor), we may collect and process the following categories of personal data:

• Identifying information (such as name, date of birth, student or employee identification number)
• Contact details (such as email address, mailing address, and phone number)
• Academic and educational records
• Employment or professional information
• Research-related data, including information provided through surveys or academic studies
• Technical data (such as IP address, device information, and system logs)
• Communications and correspondence with Chicago Booth

We do not intentionally collect more data that is excessive or unnecessary for the purposes for which it is processed.

 

Source of the Personal Data

Chicago Booth may collect personal data from the following sources:

• Directly from you when you apply, enroll, participate in programs, engage in research, attend events, or communicate with us
• University of Chicago systems and offices that support Chicago Booth operations
• Faculty, researchers, or research collaborators in connection with academic or research activities
• Third-party service providers or partners acting on our behalf
• Publicly available sources where appropriate (such as professional profiles, publications, or directories)
• Referees, recommenders, prior institutions, or employers in connection with admissions, employment, or academic activities
• Message boards and user-provided content

Where personal data is not obtained directly from you, it is processed only where lawful and relevant to Chicago Booth’s academic, research, or administrative purposes.

 

Why We Process Personal Data

Chicago Booth processes personal data only where necessary and proportionate to support its academic mission and institutional operations, including:

• Admissions, enrollment, and academic administration
• Teaching, learning, and student support services
• Academic research and scholarly activities
• Alumni relations, advancement, and institutional communications
• Event management and program delivery
• Institutional operations, online payments, compliance, and information security
• Operation and improvement of technology platforms, including analytics and AI-enabled tools

 

Lawful Basis for Processing
Chicago Booth processes personal data under the lawful basis set out in Article 6 GDPR, and where applicable, Article 9 GDPR for special category data.

 

Chicago Booth applies additional safeguards where special category data is processed and limits such processing to what is strictly necessary for academic, research, accessibility, or employment purposes.

 

Who We Share Personal Data With

We may share personal data with:

• Service providers and vendors acting on our behalf (such as IT service providers, learning platforms, and research support vendors)
• Research collaborators, where necessary for academic or research purposes
• Public authorities or regulatory bodies, where required by law

All third-party recipients are subject to appropriate contractual, confidentiality, and data protection obligations consistent with GDPR and FERPA. Personal data is shared only where permitted by law and subject to appropriate safeguards.

 

How Long We Keep Personal Data

Chicago Booth retains personal data only for as long as necessary to fulfill the purposes described in this notice, including compliance with legal, academic, research, and operational requirements.

Retention periods are determined by reference to:

• Applicable laws and regulatory requirements
• The nature, purpose, and sensitivity of the data

When data is no longer required, it is securely deleted or anonymized.

 

How We Protect Personal Data

We implement appropriate administrative, technical, and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures are proportionate to the level of risk and are regularly reviewed and updated.

 

Automated Decision-Making and Profiling

Chicago Booth does not make decisions that produce legal or similarly significant effects solely through automated processing.

Where automated tools, analytics, or AI-enabled systems are used to support academic, administrative, or research activities, appropriate human oversight and safeguards are in place in accordance with applicable data protection laws.

 

Your Rights

Subject to applicable law, you have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data
• Restrict or object to certain processing activities
• Withdraw consent at any time, where processing is based on consent

To exercise these rights, please contact us using the details above.

 

Right to Lodge a Complaint with a Supervisory Authority

Where GDPR applies, you have the right to lodge a complaint with a competent supervisory authority if you believe your personal data has been processed unlawfully.

You may contact the supervisory authority in:

• The EU/EEA country where you reside
• The country where you work
• The country where the alleged infringement occurred

A list of EU supervisory authorities can be found on the website of the European Data Protection Board (EDPB).

We encourage individuals to contact Chicago Booth first so we may address concerns promptly and directly.

 

How to Submit a Data Subject Rights Request

Please use the DSAR Form if you would like to exercise your data privacy rights. 

 

What Happens Next

• Chicago Booth will acknowledge your request promptly.
• We may request additional information to verify your identity before fulfilling the request.
• Requests are evaluated in accordance with GDPR, FERPA, and other applicable laws.
• We will respond within one month of receiving a verified request, unless an extension of up to two additional months is required due to complexity.
• There is no fee for submitting a request unless the request is manifestly unfounded or excessive.

Chicago Booth maintains internal procedures and data inventories to ensure requests can be fulfilled accurately, securely, and within statutory timelines.

 

US State Privacy Rights Notice

This section applies to individuals residing in certain US states that have enacted comprehensive privacy laws, including but not limited to California, Virginia, Colorado, Connecticut, Utah, and Texas, where such laws apply to Chicago Booth’s processing activities.

 

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the right to:

• Know the categories of personal information collected and the purposes for which it is used
• Access the specific pieces of personal information we hold about you
• Request correction of inaccurate personal information, subject to legal exceptions
• Opt out of the sale or sharing of personal information, where applicable
• Limit the use and disclosure of sensitive personal information, where applicable
• Not be discriminated against for exercising your privacy rights

Chicago Booth does not sell personal information and does not engage in cross-context behavioral advertising.

Requests may be submitted using the contact details listed in the “How to Submit a Data Subject Rights Request” section above.

 

Other US State Privacy Laws

Residents of states with applicable privacy laws may have rights to:

• Access personal data
• Correct inaccuracies
• Delete personal data
• Obtain a copy of personal data in a portable format
• Opt out of targeted advertising, profiling, or certain disclosures

Where required by law, Chicago Booth will respond to verified requests within statutory timelines and provide an appeal process if a request is denied.

 

Contact for Privacy Request

All privacy requests may be submitted via the DSAR Form.

Please include sufficient information to allow us to verify your identity and process your request accurately.

 

Verification and Authorized Agent

To protect your personal data, we may require verification of your identity before fulfilling a request.

Authorized agents may submit requests on behalf of individuals where permitted by law, provided appropriate authorization documentation is supplied.

 

No Sale

Chicago Booth does not sell personal data.

 

Mandatory or Voluntary Data Provision

In some cases, providing personal data is required by law, contract, or institutional policy. Failure to provide required data may limit our ability to provide academic programs, services, or fulfill legal obligations.

Where data provision is voluntary, this will be clearly indicated at the point of collection.