Sorry, the page you requested was not found

Privacy Notice

University of Chicago Booth School of Business

Last updated: 2/18/2026

Who We Are

Pathways to Research and Doctoral Careers (“PREDOC,” “we,” “our,” or “us”) is part of the University of Chicago and acts as a data controller for the personal data described in this notice.

Contact Information

University of Chicago Booth School of Business
5807 South Woodlawn Avenue
Chicago, IL 60637, USA
Email: privacy@chicagobooth.edu

Data Protection Officer (DPO)

Chicago Booth has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with data protection obligations.

Name: E. Yvonne McConico
Email: Yvonne.mcconico@chicagobooth.edu

Categories of Personal Data We Collect

Depending on your relationship with PREDOC, (for example, applicant, student, event attendee, employee, researcher, or visitor), we may collect and process the following categories of personal data:

  • Identifying information (such as name, student or employee identification number)
  • Contact details (such as email address, mailing address, and phone number)
  • Research-related data, including information provided through surveys or academic studies
  • Technical data (such as IP address, device information, and system logs)
  • Communications and correspondence with PREDOC

Special Categories

  • We may request you provide other personal information, such as your race/ethnicity, gender, gender identity, dietary restrictions, health information, sexual orientation, (if any) etc. If we collect such information, we will obtain your consent as appropriate.

We do not intentionally collect more data that is excessive or unnecessary for the purposes for which it is processed.

Source of the Personal Data

PREDOC may collect personal data from the following sources:

  • Directly from you when you apply, enroll, participate in programs, engage in research, attend events, or communicate with us
  • University of Chicago systems and offices that support PREDOC operations
  • Faculty, researchers, or research collaborators in connection with academic or research activities
  • Third-party service providers or partners acting on our behalf
  • Publicly available sources where appropriate (such as professional profiles, publications, or directories)
  • Referees, recommenders, prior institutions, or employers in connection with admissions, employment, or academic activities
  • From publicly available sources, to supplement information you provide to us

Where personal data is not obtained directly from you, it is processed only where lawful and relevant to PREDOC’s academic, research, or administrative purposes.

Why We Process Personal Data

PREDOC processes personal data only where necessary and proportionate to support its academic mission and institutional operations, including:

  • Program admissions and academic administration
  • Teaching, learning, and support services
  • Academic research and scholarly activities
  • Alumni relations, advancement, and institutional communications
  • Event management and program delivery
  • Institutional operations, compliance, and information security
  • Operation and improvement of technology platforms, including analytics and AI-enabled tools

Lawful Basis for Processing

PREDOC processes personal data under the lawful basis set out in Articles 6 GDPR, and where applicable, Article 9 GDPR for special category data.

Processing Activity

Examples

Lawful Basis

Participant Support Services

LMS use, participation tracking, academic analytics

Public interest; Legitimate interests

Research Activities

Surveys, studies, research datasets, academic research

Public interest; Legitimate interests

Events and Program Delivery

Event registration, marketing, outreach, attendance, communications

Contract; Legitimate interests

Institutional Operations and Security

IT systems, logs, cybersecurity monitoring

Legal obligation; Legitimate interests

Technology, Analytics, and AI Tools

System analytics, AI-assisted services, service improvement

Public interest; Legitimate interests

Employment and HR Administration

Payments & Reimbursement

Recruitment, payroll, performance management

Processing stipends, expense reimbursements, financial transactions

Contract; Legal obligation

Contract; Legal obligation; Legitimate interests

PREDOC applies additional safeguards where special category data is processed and limits such processing to what is strictly necessary for academic, research, accessibility, or employment purposes.

Who We Share Personal Data With

We may share personal data with:

  • Service providers and vendors acting on our behalf (such as IT service providers and research support vendors)
  • University affiliated programs for the purpose of contacting you about good, services, or experiences that may interest you
  • Research collaborators, where necessary for academic or research purposes
  • Public authorities or regulatory bodies, where required by law

All third-party recipients are subject to appropriate contractual, confidentiality, and data protection obligations consistent with GDPR. Personal data is shared only where permitted by law and subject to appropriate safeguards.

How Long We Keep Personal Data

PREDOC retain personal data only for as long as necessary to fulfill the purposes described in this notice, including compliance with legal, academic, research, and operational requirements.

Retention periods are determined by reference to:

  • Applicable laws and regulatory requirements
  • The nature, purpose, and sensitivity of the data

When data is no longer required, it is securely deleted or anonymized.

How We Protect Personal Data

We implement appropriate administrative, technical, and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures are proportionate to the level of risk and are regularly reviewed and updated.

Automated Decision-Making and Profiling

PREDOC does not make decisions that produce legal or similarly significant effects solely through automated processing.

Where automated tools, analytics, or AI-enabled systems are used to support administrative, or research activities, appropriate human oversight and safeguards are in place in accordance with applicable data protection laws.

Your Rights

Subject to applicable law, you have the right to:

  • Be Informed
  • Data portability
  • Access your personal data
  • Request correction of inaccurate or incomplete data
  • Request erasure of your personal data
  • Restrict or object to certain processing activities
  • Withdraw consent at any time, where processing is based on consent

To exercise these rights, please contact us using the details above.

How You Can Control Your Data Collection

You can use Google Ads Settings to manage the Google ads you see and opt-out of interest-based ads. Even if you opt-out of interest-based ads, you may still see ads based on factors such as your general location derived from your IP address, your browser type, and recent, previous searches related to your current search.

You can also opt-out of anonymous website and/or application traffic behavior by clicking on the following opt-out privacy links:

You may specifically opt-out of data being collected and used by Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

You can also opt-out from email communication by following the opt-out instructions included in such email newsletters and promotions.

International Data Transfers

PREDOC may transfer personal data outside the European Economic Area (EEA), including to the United States. Where such transfers occur, we implement appropriate safeguards, such as:

  • Adequacy decisions issued by the European Commission
  • Standard Contractual Clauses (SCCs)
  • Other lawful transfer mechanisms permitted under GDPR

Right to Lodge a Complaint with a Supervisory Authority

Where GDPR applies, you have the right to lodge a complaint with a competent supervisory authority if you believe your personal data has been processed unlawfully.

You may contact the supervisory authority in:

  • The EU/EEA country where you reside
  • The country where you work
  • The country where the alleged infringement occurred

A list of EU supervisory authorities can be found on the website of the European Data Protection Board (EDPB).

We encourage individuals to contact PREDOC first so we may address concerns promptly and directly.

Email: privacy@chicagobooth.edu

How to Submit a Data Subject Rights Request

Request may be submitted by contacting:

Email: privacy@chicagobooth.edu

Please include:

  • Your full name
  • Your relationship to PREDOC (for example: student, applicant, employee, research participant, visitor)
  • The specific right you wish to exercise
  • Sufficient information for us to verify your identity
  • Any relevant details to help us locate your data

What Happens Next

  • PREDOC will acknowledge your request promptly.
  • We may request additional information to verify your identity before fulfilling the request.
  • Requests are evaluated in accordance with GDPR, FERPA, and other applicable laws.
  • We will respond within one month of receiving a verified request, unless an extension of up to two additional months is required due to complexity
  • There is no fee for submitting a request unless the request is manifestly unfounded or excessive.

PREDOC maintains internal procedures and data inventories to ensure requests can be fulfilled accurately, securely, and within statutory timelines.

U.S. State Privacy Rights Notice

This section applies to individuals residing in certain U.S. states that have enacted comprehensive privacy laws, including but not limited to California, Virginia, Colorado, Connecticut, Utah, and Texas, where such laws apply to PREDOC’s processing activities.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the right to:

  • Know the categories of personal information collected and the purposes for which it is used
  • Access the specific pieces of personal information we hold about you
  • Request correction of inaccurate personal information, subject to legal exceptions
  • Opt-out of the sale or sharing of personal information, where applicable
  • Limit the use and disclosure of sensitive personal information, where applicable
  • Not be discriminated against for exercising your privacy rights

PREDOC does not sell personal information and does not engage in cross-context behavioral advertising.

Requests may be submitted using the contact details listed in the “How to Submit a Data Subject Rights Request” section above.

Other U.S. State Privacy Laws

Residents of states with applicable privacy laws may have rights to:

  • Access personal data
  • Correct inaccuracies
  • Delete personal data
  • Obtain a copy of personal data in a portable format
  • Opt out-of targeted advertising, profiling, or certain disclosures

Where required by law, PREDOC will respond to verified requests within statutory timelines and provide an appeal process if a request is denied.

Contact for U.S. Privacy Request

All U.S. privacy request may be submitted via:

Email: privacy@chicagobooth.edu

Please include sufficient information to allow us to verify your identity and process your request accurately.

Verification and Authorized Agent

To protect your personal data, we may require verification of your identity before fulfilling a request.

Authorized agents may submit requests on behalf of individuals where permitted by law, provided appropriate authorization documentation is supplied.

No Sale or Targeted Advertising

Chicago Booth does not sell personal data and does not use personal data for targeted advertising as defined under applicable U.S. state privacy laws

Mandatory or Voluntary Data Provision

In some cases, providing personal data is required by law, contract, or institutional policy. Failure to provide required data may limit our ability to provide academic programs, services, or fulfill legal obligations.

Where data provision is voluntary, this will be clearly indicated at the point of collection.