Policy Information Date Established: 3/19/2003 Date Last Revised: 7/22/2024 Category: Information Technology Responsible Office: Vice President and Chief Information Officer Responsible Executive: Vice President and Chief Information Officer Policy Contents University at Buffalo Policy Library This policy explains the university’s operational practices with respect to visitor information collected from official University at Buffalo websites and associated third-party web applications. Policy Statement The University at Buffalo (UB, university) is committed to protecting visitors’ privacy when navigating through official University at Buffalo websites and associated third-party web applications. Visitors navigate through a majority of official UB websites and associated third-party web applications without providing personal information. However, the university implements operational practices to enhance the ease and efficiency with which visitors interact with official UB websites and associated third-party web applications. Information Collected UB collects information for various purposes including, but not limited to providing requested services and analyzing web traffic. Some information is collected automatically as website visitors navigate through and interact with UB websites. Other information is voluntarily provided by website visitors as they interact with UB websites. This may involve the website visitor providing information, including personal information, through various means including, but not limited to sending emails; filling out webforms, surveys, and applications; or completing financial transactions. Automatically Collected Visitor Information As visitors navigate through and interact with official UB websites and associated third-party web applications, the university automatically collects and stores information about visitors’ equipment, browsing actions, and patterns including: User client hostname; the hostname or internet protocol address (IP address) requesting access to the university website Type of browser and operating system used Date and time the site was visited Web pages or services accessed Website visited prior to visiting UB’s website Website visited after visiting UB’s website If information was downloaded from UB’s website, as well as what the information was None of the forgoing information is deemed to constitute personal information. Additionally, the university may automatically collect the following personal information: UBITName is logged when accessing a page on official UB websites or associated third-party web applications requiring authentication Client username, if not blocked from the web browser or computer Beacons, Cookies, and Tracking Codes The university installs tracking codes or beacons on official UB websites and associated third-party web applications. The university uses session and persistent cookie technology on official UB websites and associated third-party web applications. Refusing or deleting cookies may limit features of official UB websites and associated third-party web applications. In some cases, third-party advertising and marketing providers capture visitor information on behalf of the university. Examples of information captured by third-party service providers include: Content viewed during the website visit Date and time of the website visit Amount of time spent on the website Visitor geographic location based on IP address Demographic information Search terms entered on the UB websites Use of Automatically Collected Visitor Information Automatically collected visitor information is used to: Improve the content and function of UB’s websites Analyze visitor engagement Conduct statistical analysis of website traffic and usage Analyze visitor interests and behaviors Detect attempts to damage or gain unauthorized access to the website and UB’s associated computer systems Identify candidates and profiles for re-engagement and outreach efforts; this may include more targeted advertising and remarketing programs, performing troubleshooting and root cause analysis, and offering relevant information about services, events, research, and educational offerings to better connect with UB’s constituent audiences and the global community The university is not authorized to sell or otherwise disclose the information collected from the website for non-university commercial marketing purposes. Visitor Provided Information When interacting with the university’s website, visitors may be asked to provide information for certain articulated purposes, such as when responding to a survey, registering for a program, or completing other similar transactions. A visitor may choose not to complete such actions. Not completing these actions may prohibit the ability to receive specific services or products through official UB websites or associated third-party web applications. The choice to not complete these actions does not adversely affect a visitor’s ability to take advantage of other features of a website, including some browsing and downloading, or from accessing requested information by other means. Information Collected Website transactions include visitor-initiated actions such as filling out and submitting: Survey responses Registration or application forms Financial or business transactions Requests for authenticated file access Visitor email addresses may be used to send information, respond to inquiries and/or other requests or authorizations. UB will not share, sell, or otherwise authorize any third party to use a visitor’s email address for commercial purposes without prior permission. While navigating through official UB websites and third-party web applications associated with the university, a visitor may send an email to UB. The visitor’s email address and message content (including attachments) are collected. This information is used to: Respond to the email Address issues identified in the email Forward the information to another State University of New York or State agency for appropriate action Improve official UB websites and third-party web applications associated with the university Visitor email addresses are not collected for non-university commercial purposes. Use of Visitor Provided Information Voluntarily provided information, including personal information, is used for operational and business functions. Functions include the provision of goods, services, and information. UB retains the right to disclose voluntarily provided information to third parties for purposes reasonably ascertained from the nature and terms of the transaction in which the information was submitted. Additionally, visitor provided information may be used for analytical and statistical purposes, including improving the quality of the website. The university is not authorized to sell or otherwise disclose the information collected from the website for non-university commercial marketing purposes. Visitor collected information is retained only for as long as required by university policy or as required by law. Disclosure of Information Collected Through UB Websites UB only collects and discloses personal information collected through official UB websites or associated third-party web applications if the visitor consents to the collection or disclosure of this information. A visitor’s voluntary disclosure of personal information, whether solicited or unsolicited, constitutes consent to UB’s collection and disclosure of the information for the purposes for which the visitor disclosed the information to UB. UB retains the right to collect or disclose personal information without consent if the collection or disclosure meets one of the following criteria: Necessary to perform the statutory duties of the university, or necessary for UB to operate a program authorized by law, or authorized by state or federal statute or regulation; Made pursuant to a court order or by law; For the purpose of validating the identity of the visitor; or Of information to be used solely for statistical purposes that is in a form that cannot be used to identify any particular person.

Disclosure of information, including personal information, collected through UB websites, or associated third-party applications is subject to the provisions of the New York State Freedom of Information Law and the New York State Personal Privacy Protection Law . Records Retention UB internet service logs are automatically produced electronic files which monitor access and use of the university’s website services. UB retains automated log data collected in accordance with university policy. Log data is retained only for as long as required by university policy or as required by law. Access to automated log data is restricted. Access To and Correction of Personal Information Collected Through UB Websites Visitors to official UB websites or associated third-party web applications may submit a request to the university’s privacy compliance officer to determine if personal information was collected while navigating UB websites. Requests must be made in writing to the Privacy Compliance Officer and must be accompanied by reasonable proof of identity of the user. Reasonable proof of identity may include verification of a signature, inclusion of an identifier generally known only to the user, or similar appropriate identification. Within five business days of receipt of a proper request, the privacy compliance officer will: Provide access to the personal information; Deny access to the personal information in writing with an explanation of why the request is denied; Acknowledge receipt of the request in writing, stating the approximate date when the request will be granted or denied, provided that the date specified will not be more than 30 days from the date of the acknowledgement. If UB determines that it has collected personal information pertaining to a user through UB websites and that information is to be provided to the user pursuant to the user’s request, the privacy compliance officer will inform the user of their right to request that the personal information be amended or corrected under applicable law. Information Protection UB is committed to protecting personal and private information against unauthorized access, use, or disclosure. UB monitors system traffic to identify unauthorized attempts to upload or change information or attempts to damage official UB websites and associated third-party web applications for website security purposes. UB limits employee access to personal and private information collected through its websites to employees who need access to perform their official duties. Employees with access to such information follow appropriate university procedures and adhere to applicable university and State information security policies. The university has implemented reasonable security measures to safeguard the integrity of its information technology assets, including, but not limited to, authenticating, monitoring, auditing, and encrypting. Security procedures have been integrated into the design, implementation, and day-to-day operations of UB websites and associated third-party applications as part of the university’s continuing commitment to the security of electronic content as well as the electronic transmission of information under UB control. However, no method of transmission over the internet or method of electronic storage is one-hundred percent secure. Children Under 13 UB does not knowingly collect personal information from minors or create profiles of minors through official UB websites or associated third-party web applications. Visitors are cautioned that the collection of personal information will be treated as though it was submitted by an adult, and may, unless exempted from access by federal or state law, be subject to public access. UB strongly encourages parents, guardians, educators, and teachers to be involved in a child’s internet activities and to provide guidance whenever children are asked to provide personal information online. This policy informs visitors to official UB websites and associated third-party web applications about the technical information collected during their session. This policy also identifies and describes how personal information may or may not be collected while navigating on official UB websites and associated third-party websites. Growth of privacy-related regulations and personal interest among visitors drive the increased demand for such policies, particularly on free consumer-oriented websites where visitors may not be aware their information is collected and used or sold for profit. Some examples include free web search portals, social media platforms, and personal email services. However, university websites typically do not engage in such behavior because individuals are not visiting for consumer-aimed free services. This policy is focused on technical or mechanical aspects of information being exchanged to render website content. Other types of website privacy notices may include pop-ups about cookies, personal privacy policies, and notices of other privacy practices. These notices may detail additional information sharing or disclosure. This policy applies to: Information the university collects on its websites and associated third-party web applications Information visitors provide to UB through its website and associated third-party web applications Information collected by UB offline or through other means, including on any other website operated by UB or any third-party, or to any third-party applications or content that may link to or be accessible from or through UB’s website This policy is to be observed in conjunction with any future or previously existing departmental privacy policies. A small file stored on a visitor’s device, either temporarily for that session (session cookie) or permanently on the hard disk (persistent cookie). Cookies provide a way for the website to recognize visitors and keep track of the visitor’s preferences. Official University at Buffalo (UB) Websites Online content, both publicly accessible as well as material behind an authentication layer, owned or controlled by the university's formal academic and administrative units. These sites typically reside in, or resolve to, the buffalo.edu domain (though some may not, examples of such websites include but are not limited to, ubbulls.com, ubcfa.org, myubcard.com) and may serve any (or all) of the university's stakeholders. Personal Information Personal information means any information concerning a natural person which, because of name, number, symbol, mark, or other identifier, can be used to identify that natural person. Third-Party Web Applications Vendor-created, -provided, or -hosted technology solution that conducts official business for, or provides official service(s) to, the university or its constituents through an explicit contractual relationship. Tracking Codes or Beacons An often-transparent graphic image, usually no larger than 1-pixel x 1 pixel, placed on a website or in an email that is used to monitor the behavior of the user visiting the website or sending the email. Tracking codes or beacons do not contain personally identifiable information. Tracking codes collect traffic data and click information. This information is used to prioritize tasks, record visitor-specific web traffic, and associate web traffic history with unique visitors. A tracking code is a snippet of JavaScript code that tracks the activity of a website user by collecting data and sending it to Google Analytics to inform effectiveness of website performance. A beacon is another form of tracking that confirms content has been accessed by a user. Natural person who uses the internet to access official UB websites and third-party websites associated with the university. Enrollment Management Provide the link to this policy in all Enrollment Management website and application footers. Privacy Compliance Officer Make decisions about records disclosure in accordance with applicable laws. Respond to the UB community about inquiries or complaints. University Communications Promote awareness of this policy through established university communications channels, and demonstration of best practices. Provide a link to the Website Privacy Policy in all UB website footers. Determine that all contracts (purchases) with third-party platform providers include verbiage about compliance with this policy. This may include specific language that addresses vendor practices with respect to additional data collection, including financial data. Report practices that seem to be contrary to this policy to the Privacy Compliance Office. Control security settings on the device(s) used to visit official UB websites and third-party applications associated with the university; this includes, but is not limited to cookie settings to allow, refuse, or delete cookies. Vice President and Chief Information Officer Oversee all components of UB information technology. Contact Information Related Information University Links 7/1/26 Access to Student Information - Family Educational Rights and Privacy Act (FERPA) Policy 4/3/25 Data Risk Classification Policy 4/3/25 Freedom of Information Law (FOIL) 4/3/25 Protection of University Data Policy 4/3/25 Records Management 4/3/25 Record Retention and Disposition Policy UB Information Technology - Data Access Policy UB Information Technology - Standards for Protecting Category 2 - Private Data New York State Freedom of Information Law (FOIL) New York State Office of Information Technology Services - Information Security Policy New York State Office of Information Technology Services - Internet Privacy Policies New York State Office of Information Technology Services - Technology Law New York State Personal Privacy Protection Law New York State Public Officers Law, Section 95 - Access to Records United States Department of Education - Protecting Student Privacy - Family Educational Rights & Privacy Act (FERPA) Presidential Approval Signed by President Satish K. Tripathi Satish K. Tripathi, President