Skip to content

Privacy Policy

Last Updated: This Privacy Statement was last updated on March 11, 2024.

In this Privacy Statement, we explain what we do with the data we obtain about you via our website (the “Website”) located at https://www.whoi.edu. We recommend you carefully read this Statement. In our processing of personal information we comply with the requirements of privacy legislation. That means, among other things, that:

  • we clearly state the purposes for which we process personal information (we do this by means of this privacy statement);
  • we aim to limit our collection of personal information to only the personal information required for legitimate purposes;
  • we first request your explicit consent to process your personal information where such consent is legally required for such processing;
  • we take appropriate security measures to help protect your personal information and also require this from parties that process personal information on our behalf;
  • we respect your right to access your personal information or have it corrected or deleted, at your request.

If you have any questions about this Privacy Statement, or want to know what personal information we keep about you, please contact us as indicated below.

1. Purpose and categories of personal information

We may collect or receive personal information for a number of purposes connected with our business operations which may include the following: (click to expand)

1.1 Contact - Through phone, mail, email and/or webforms

The following categories of data are collected

  • A first and last name
  • Account name or alias
  • An email address
  • A telephone number
  • IP address

Retention period

We retain this data upon termination of the service for the following number of months: 3

1.2 Payments

The following categories of data are collected

  • A first and last name
  • Account name or alias
  • A home or other physical address, including street name and name of a city or town
  • An email address
  • A telephone number
  • IP address

Retention period

Upon termination of the service we retain this data for the following period: 24.

1.3 Registering an account

The following categories of data are collected

  • A first and last name
  • Account name or alias
  • An email address
  • A telephone number

Retention period

We retain this data until the service is terminated.

1.4 Newsletters

The following categories of data are collected

  • A first and last name
  • Account name or alias
  • An email address
  • IP address

Retention period

We retain this data until the service is terminated.

1.5 To be able to comply with legal obligations

The following categories of data are collected

  • A first and last name
  • Account name or alias
  • An email address
  • IP address

Retention period

We retain this data until the service is terminated.

1.6 Compiling and analyzing statistics for website improvement.

The following categories of data are collected

  • Account name or alias
  • IP address

Retention period

We retain this data upon termination of the service for the following number of months: 12

2. Sharing personal data with other parties

We only share or disclose personal information with third parties for the following purposes:

  • We disclose personal information if we are required by law or by a court order or in response to a legitimate request from a law enforcement agency;
  • To the extent permitted under other provisions of law;
  • For an investigation by governmental authorities on a matter related to public safety;
  • To service providers that help us operate the Website and perform other functions for our organization;
  • To fulfill requests made by you or on your behalf; and
  • If our Website or organization is acquired, sold, or involved in a merger or acquisition, your personal information may be disclosed to our advisers and any prospective acquirers (and in the case of acquirers, transferred to such acquirers).

3. Response to Do Not Track signals

Our Website does not respond to and does not support Do Not Track (DNT) settings at this time.

4. Cookies

Our Website uses cookies and similar tracking technologies. For more information about our use of cookies, please refer to our Cookie Policy.

We have concluded a data processing agreement with Google, under which Google may not use any personal information for any other Google services.

The inclusion of full IP addresses is blocked by us.

5. Security

We are committed to the security of personal information that is maintained by us. We take appropriate security measures to limit unauthorized access to and use of personal information. These measures help us ensure that only authorized persons have access to your personal information and that our security measures are regularly reviewed.

However, no data transmission over the Internet or any wireless network can be guaranteed to be perfectly secure. Because of this, while we try to protect your personal information, we cannot ensure or guarantee the security of any information transmitted to or from us.

6. Third-party websites

This privacy statement does not apply to third-party websites connected by links on our Website. We cannot guarantee that these third parties handle your personal information in a reliable or secure manner. We recommend you read the privacy statements of these websites prior to making use of these websites.

7. Amendments to this privacy statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly in order to be aware of any changes. We will notify you by posting the new Privacy Statement on this page, and we will update the “Last Updated” notice date at the top of this Statement. Changes to this Statement are effective when they are posted on this page.

8. Accessing and modifying your data; data rights

If you have any questions or want to know what personal information we have about you, please contact us. Please make sure to clearly state who you are, so that we can be certain that we do not modify or delete any data of the wrong person. We shall provide the requested information only upon receipt of a verifiable consumer request. You can contact us by using the information below.

You have the following rights with respect to your personal information:

  • Right to know: You have the right to know why your personal information is needed, what will happen to it, and how long it will be retained.
  • Right of access: You have the right to access your personal information that is known to us.
  • Right to rectification: You have the right to supplement, correct, have deleted or blocked your personal information whenever you wish.
  • Right to revoke consent: If we process your data based on your consent and do not have another lawful basis to process your data, you have the right to revoke that consent and to have your personal information deleted.
  • Right to object: You may object to the processing of your data, which objection we will comply with, unless there is another lawful basis for such processing.

To exercise these rights, please contact us at the “Contact details” at the bottom of this Privacy Statement.

9. Children’s information

Our Website is not designed to attract children and it is not our intent to collect personal information from children under the age of 18. We therefore request that children under the age of consent not submit any personal information to us.  If we discover or are made aware that we have received personal information from an individual who indicates that he or she is, or whom we otherwise have reason to believe is, under the age of 18, we will delete such information from our systems.  If you are a parent or legal guardian of a child under the age of 18 and believe that your child has disclosed personal information to us we welcome you contacting us as provided below so that we can address such matter.

10. Additional Rights Under Other State Laws and EU Law

California Privacy-Related Disclosures

Sharing Personal Information for Direct Marketing Purposes. Before sharing personal information of California consumers with third parties for direct marketing purposes we will obtain opt-in consent from the applicable California consumers or provide such California consumers with a cost-free method to opt out.

California Do-Not-Track Disclosure. At this time, the Website is not set up to honor web browser do-not-track settings.  Do-not-track is a privacy preference that users can set in their web browsers. When a user activates the do-not-track settings in browsers that offer this setting, the browser sends a message to websites or applications requesting them not to track the user. For more information about do-not-track matters, please visit www.allaboutdnt.org.

Information on Marketing Disclosures. California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us once a year, free of charge, information about the personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. If applicable, this information would include a list of the categories of personal information that was shared and the names and addresses of all third parties with which we shared information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us at: (i) by email (writing “Privacy Policy/Removal Request” in the subject line), or (ii) by regular mail, as applicable, by using the contact information under “Contact details” below.

Complaints. If you have any complaint about use of the Website, you may contact us in writing via email or regular mail by using the contact information under “Contact details” below.  In accordance with California Civil Code Section 1789.3, California residents may also file complaints with the Complaint Assistance Unit, Division of Consumer Services, California Department of Consumer Affairs by postal mail at 1625 North Market Road, Suite N112, Sacramento, CA 95834 or by telephone at 800-952-5210.

Other State Law Privacy-Related Disclosures

Colorado, Connecticut, Virginia and Utah each provide their residents with rights to:

  • Confirm whether we process their personal information.
  • Access and delete certain personal information.
  • Data portability.
  • Opt-out of personal data processing for targeted advertising and sales.

Colorado, Connecticut and Virginia also provide their residents with rights to:

  • Correct inaccuracies in their personal information, taking into account the information's nature processing purpose.
  • Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

For residents of Colorado, Connecticut, Virginia and Utah to exercise the above rights, please contact us (“Consumer Rights Request”) (i) by email (writing “Privacy Policy/Removal Request” in the subject line) at GeneralCounsel@whoi.edu, or (ii) by regular mail at 266 Woods Hole Road, Woods Hole, MA 02543-1050.

For residents of Colorado, Connecticut and Virginia, if we decline to take action on your Consumer Rights Request, you may appeal such refusal (i) by email (writing “Privacy Policy/Removal Request” in the subject line) at GeneralCounsel@whoi.edu, or (ii) by regular mail at 266 Woods Hole Road, Woods Hole, MA 02543-1050 within a reasonable time period after we sent you our decision.

European Union Privacy Matters

Residents of the European Union have additional personal information rights and choices. Please see “Your EU Privacy Rights” below for more information.

11. Your EU Privacy Rights

Persons who are residents of the member countries of the European Union (“EU”) or other data subjects covered by the EU’s General Data Protection Regulation, (EU) 2016/679 (the “GDPR”), have certain additional privacy rights under applicable law. The following provisions of this Policy provide an overview of these additional rights.

Legal Bases for Processing Personal Information of European Union Data Subjects

When processing your personal information, we may rely on one or more of the following legal bases (or other available legal grounds), depending on the circumstances:

  • Legitimate Interests. We may process your personal information where we have a legitimate interest in such processing for managing, operating or promoting our business, and that legitimate interest is not overridden by your interests, fundamental rights or freedoms.
  • We may process your personal information where we have obtained your consent to the processing.
  • Contractual Necessity. We may process your personal information where such processing is necessary in connection with any contract that we have with you.
  • Legal Requirements. We may process your personal information where such processing is required by applicable law.

Disclosures to Third Parties of European Data Subject Personal Information.

Your personal information will not be disclosed to third parties except for where it is necessary for fulfillment of our obligations to you or where we are obliged or permitted to do so by law (including, without limitation, through the terms of any agreement we may have with you), or where we make disclosures that are otherwise consistent with the uses described in this Policy.

We may also disclose any information (including personal information) relating to you to law enforcement authorities or any regulatory or government authority in response to any request including requests in connection with the investigation of any suspected illegal activities.

We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets, or merge with another organization. Should such a sale, transfer or merger occur, we will use reasonable efforts seeking to require that the transferee uses personal information you have provided to us a manner that is consistent with this Policy.

We will not sell, resell or lease your personal information to any third parties but we may, if required for the purpose(s) for which your personal information was collected and processed, share it with our partners and/or service providers to enable them to provide their services to us or to you, as applicable. The foregoing are in addition to the other uses described elsewhere in this Policy.

Security of Personal Information of European Citizens

We have policies and technical and organizational measures in place which are intended to safeguard and protect your personal information against unauthorized access, accidental loss, improper use and disclosure. However, you should be aware that information transmitted over the internet is not completely secure because of the nature of the internet and that systems and measures used to secure information are not flawless. For these reasons, although we will use reasonable efforts to protect your personal information, we do not warrant the security of personal information transmitted to us or stored by us, and personal information that is transmitted to us by you electronically is done at your own risk.

Retention of Personal Information of European Data Subjects.

Our policy is to retain your personal information only for as long as is necessary to fulfill the purposes for which we collected such personal information, including for the purposes of satisfying any professional, legal, accounting or reporting requirements to which we are subject. To determine the appropriate retention period for personal information, we consider the scope, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes for which we collected and processed your personal information and whether we can achieve those purposes through other means, and any applicable legal and professional requirements.

Your Rights as a European Data Subject.

You have a number of rights concerning your personal information that we hold and use, including the following:

  • Right of Access. You have the right to be informed about what personal information we hold about you and to a copy of this personal information.
  • Right to Rectification. You have the right to have any inaccurate personal information which we hold about you updated or corrected.
  • Right to Erasure. In certain circumstances you may request that we delete the personal information that we hold about you.
  • Right to Complain. You have the right to lodge a complaint regarding the processing of your personal information to an applicable governmental or supervisory authority in your country.
  • Right to Withdraw Consent. Where processing of personal information is based on your consent, you have the right to withdraw such consent at any time.
  • Right to Object. Where we rely on our legitimate interests to process your personal information, you have the right to object to such use and we are required to discontinue such processing unless we can demonstrate an overriding legitimate interest in such processing.
  • Right to Restriction. You have the right to request that we stop using your personal information in certain circumstances including if you believe that the personal information we hold about you is inaccurate or that our use of your personal information is unlawful. If you validly exercise this right, we will store your personal information and will not carry out any other processing until the issue is resolved.

You may exercise any of the above requests in writing to us via email or regular mail by using the contact information under “Contact details” below.

Contact details

You may contact us by mail, email or phone as follows:

Woods Hole Oceanographic Institution
266 Woods Hole Road, Woods Hole, MA 02543-1050
United States
Website: https://www.whoi.edu
Email: GeneralCounsel@whoi.edu
Phone number: (508) 548-1400