Legal Affairs

• Privacy Policy C07.0
• Policy on Freedom of Speech and Expression C11.0
• Records Management Policy C22.0
• Foreign Corrupt Practices Act (FCPA) Policy
• Use of Demographic Information 

• Privacy Policy Procedures
• FCPA Procedure
• Confidentiality Note - RIT Business Emails

• Alphabetical Listing
• Listing By Division
• Listing By Official Repository

The Office of Legal Affairs has drafted several standard RIT contracts that should always be used. These standard contracts contain all terms required by RIT. We will only review the other party's contract if RIT's contract has been presented and they refuse to negotiate. Some examples are:

Non-Disclosure Agreements

Independent Contractor Agreement

Live Performance Agreement

Entertainment Services Agreement

Speaker Agreement

If you need to purchase goods or services, start with the Procurement Services Office (PSO). 

If you don't know where to start, PSO has compiled a list of suppliers by commodity on their website: https://www.rit.edu/fa/procurement/list-of-supply-categories. The vendors that appear on this list have been "approved" to the extent that they meet RIT's minimum requirements and payment terms. Their contract still must go through the RIT contract review process. 

If the vendor sends you a contract, email it to: purchase@rit.edu.

RIT, One Lomb Memorial Drive, Rochester, New York 14623, will be the primary controller for your personal data. In addition, other RIT global entities may control or process your personal data to the extent we are required or permitted by law to share your personal data with them for the purposes described below.

Personal data and other details about you that you supply as part of the student application or registration process, as an RIT student or alumni, or that are collected by us when you use the RIT network and its affiliated websites (collectively, “Services”) are used to provide you with Services and information. You have chosen to provide us with this information in connection with receiving Services and we will use that information to provide you with any such Services.

Furthermore, we will process your personal data as required in connection with your interactions with RIT, for the following purposes:

Applicants and Inquiries:

• Informing you about studies at RIT, student life, enrollment process, brochures and other promotional materials by using telephone, post and electronically, including but not limited to email, text messaging and social media posts;
• Advising you about scholarship and financial aid opportunities;
• Administering your application to RIT and assigning you your RIT University ID number;
• Assessing your eligibility to apply for studies with RIT and complying with relevant laws and regulations set by federal and state entities and other accrediting and regulatory bodies as applicable (e.g., NCAA);
• Security purposes, including ensuring integrity and security of and controlling access to our premises, secured websites and applications websites; and
• Monitoring and assessing compliance with RIT policies and standards.

Students:

• General student administration, including monitoring enrollment, facilities/classroom planning, course schedules, course assignment, grade processing and other education related activities;
• Advising you about Scholarship and Financial Aid opportunities;
• Advising you about Study Abroad and Erasmus opportunities;
• Contacting you about your billing and financial aid, including outstanding dues or overpayments;
• Career planning and development, cooperative education employment opportunities, guidance for employment opportunities, communication with your employers to ensure proper cooperative education grading;
• Academic advising to ensure proper academic guidance during your studies at RIT;
• Supporting your engagement with the RIT Community, including but not limited to your engagement with clubs and other RIT organizations;
• To evaluate and improve programs offered at RIT;
• Advising you and your families about upcoming college events, student life, Study Abroad/Erasmus opportunities (direct communication, email, social media, and via printed newsletter);
• Providing notice and information relating to any potential academic or disciplinary actions which may be commenced against you;
• Providing health services through RIT’s Student Health Center;
• Security purposes, including ensuring integrity and security of and controlling access to our premises, IT and communication systems, platforms and secured websites and applications websites and other systems or facilities (including monitoring by camera or other means of surveillance), investigating, preventing and detecting security threats, fraud, theft or other criminal or malicious activities;
• Legal and other regulatory or compliance purposes, such as state and federal recordkeeping and other record retention obligations, NCAA compliance, etc.; and
• Monitoring and assessing compliance with RIT policies and standards.

Alumni:

• General alumni networking database administration, including gathering your contact information, workplace data and additional education information;
• Advising you about further education opportunities at RIT;
• Advising you about career opportunities, career planning and development;
• Advising you about scholarship and financial aid opportunities;
• Contacting you about outstanding financial obligations;
• Advising you about benefits programs and other activities that are essential for Alumni Association functioning;
• Security purposes, including ensuring integrity and security of and controlling access to RIT premises, information technology and communication systems, platforms and secured websites and applications websites and other systems or facilities (including monitoring by camera or other means of surveillance), investigating, preventing and detecting security threats, fraud, theft or other criminal or malicious activities;
• Legal and other regulatory or compliance purposes, such as archive and record keeping obligations; and
• Monitoring and assessing compliance with RIT policies and standards.

Employees, applicants for employment, and former employees (including retirees):

• Informing you about employment opportunities at RIT;
• Administering your employment application;
• Assessing your employment eligibility and complying with relevant laws and regulations set by federal and state entities and other accrediting and regulatory bodies as applicable.
• Administering payroll and other benefits related to your current or past employment at RIT;
• Administering your employment;
• Security purposes, including ensuring integrity and security of and controlling access to RIT premises, secured websites and applications websites; and
• Monitoring and assessing compliance with applicable laws, regulations, and RIT policies and standards.

Processing is either necessary for RIT’s performance of RIT’s obligation for the Services, or necessary for purposes of RIT’s legitimate interest. RIT’s legitimate interests, however, do not override your interests or fundamental rights and freedoms. In addition, use of your personal data may be based on your express consent given to RIT.

Subject to applicable law, RIT reserves the right to send you certain communications, such as service announcements, administrative messages, and other communications relating to the Services.

Where you have provided your explicit consent or as otherwise required in pursuit of a legitimate business interest of RIT, your name, email address, and contact number may be used to provide you, or permit selected third parties to provide you, with information about services we feel may interest you. You may unsubscribe from the receipt of this information.

Unless otherwise agreed to by you, we will collect only personal data which is required in connection with our relationship with you for the above-stated purposes. For applicants, students, and alumni such personal data collection typically includes the following categories:

• Personal details, such as name, address, date of birth, emergency contact details, gender, country of residence, citizenship, and tax related details if necessary;
• Information about your high school studies and previous college records including grades and information regarding any disciplinary processes;
• Degree continuation related information processed in connection with your enrollment or voluntarily provided by you, such as alternate email addresses, information about your personal and professional life, etc.;
• Identification documentation, such as copies of your passport, driving license, national or work ID card, or other documentation required by law (which may include photographs of your face);
• Professional details where applicable or necessary to assist in your career development;
• Data relating to access to and use of our systems, facilities and premises including, but not limited to, data generated through monitoring by camera or other means of surveillance;
• Data relating to any travel for RIT purposes;
• Data relating to your Student Life activities (e.g., RIT club participation);
• Data relating to your academic studies and activities at RIT (e.g., information provided during classes and courses, academic support center and related services, etc.); and
• Other data that RIT may be required to collect pursuant to applicable laws and regulations.

Categories of data collected for employees, applicants for employment, and former employees (including retirees) typically include the following categories of data:

• Name, address and contact details, including email address and telephone number, date of birth and gender;
• Details of your qualifications, skills, experience and employment history, your nationality, eligibility to work in the US (such as copies of your passport, driving license, tax information, or other documentation required by law (which may include photographs of your face) and criminal background information;
• The terms and conditions of your employment, including but not limited to:
  • Wage or salary information, including details about your bank account;
  • information about your benefits such as eligibility, periods of leave taken by you, including vacation, sick/personal leave, other forms of leave (e.g., paid family leave);
  • assessments of your performance, including appraisals, performance reviews, performance improvement plans and any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
  • information which RIT may need to make a reasonable accommodation (e.g., religious or disability); and
  • data relating to any travel for RIT purposes that is considered business travel.
• Information about your marital status, next of kin, dependents and emergency contacts;
• Data relating to access to and use of our systems, facilities and premises including data generated through monitoring by camera or other means of surveillance;
• Demographic information related to RIT’s obligations under applicable law; and
• Any other data that RIT may be required to collect pursuant to applicable laws and regulations.

We will collect your personal data primarily directly from you through direct communication. However, some personal data may also be collected from your application(s) through online portals and social media (e.g., Facebook, Instagram, LinkedIn, etc.) or from other third-parties with whom RIT contracts for services.

For further information on cookie data set or collected by RIT websites, please refer to RIT’s Cookie Statement.

RIT will maintain physical, electronic and procedural safeguards in accordance with data protection requirements to protect your personal data from unauthorized access or intrusion. These safeguards include implementing specific technologies and procedures designed to protect your privacy, such as secure filing cabinets, servers, firewalls and SSL encryption.

We may share your personal data with:

• RIT subsidiaries and affiliates if and to the extent required for legally permitted purposes. In such cases, RIT subsidiaries and affiliates will use the personal data for the same purposes and under the same conditions as outlined in this Privacy Statement;
• Third parties who process your personal data on their own behalf but in connection with a service provided to us;
• Service providers and data processors, domestically or abroad (e.g. webmasters, human resources providers, finance database providers, student database providers, workplace safety advisors, cloud providers, etc.) instructed to process personal data for legally permitted purposes on RIT’s behalf and in accordance with RIT instructions. RIT will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers and data processors;
• Public or governmental bodies, enforcement authorities, attorneys or courts when required to do so by applicable law, regulation or request in compliance with a legal obligation or for the establishment, exercise or defense of legal claims; and
• Third parties to whom you direct or give us permission, when we are required by applicable law, regulations or judicial or official request to do so, or when we suspect fraudulent or criminal activities.

If you are a European Union resident, you may request access to, rectification, erasure or restriction of processing of your personal data, subject to applicable European Union law. You may also have the right to object to processing or request data portability and request a copy of the personal data that we hold about you.

For any of the above requests, please send a description of your personal data stating your name, your date of birth and your place of birth as proof of identity to the contact details below. We may require additional proof of identity to protect your personal data against unauthorized access. We will carefully consider your request and may discuss with you how it can best be fulfilled.

If you have given us your consent for the processing of your personal data you can withdraw the consent at any time with future effect, i.e. the withdrawal of the consent does not affect the lawfulness of processing based on the consent before its withdrawal. However, if you withdraw such consent, RIT may no longer be able to offer you all of the Services. In case consent is withdrawn by you, we may only further process the personal data where there is another legal ground for the processing.

If you have any concerns about how your personal data is handled by us or wish to raise a complaint, you can contact us at the contact details below to have the matter investigated. If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the competent data protection supervisory authority in your country.

As a general principle, you voluntarily provide us with your personal data. However, in certain circumstances we are required to collect certain personal data for legal purposes, for example because this personal data is required to be able to complete a contractual relationship, including your education or for other Services. In these cases, if you do not provide us with your personal information, we may be unable to provide you Services such as, but no limited to, administering your application/enrollment, assign certain tasks to you or permit you to participate in certain activities or services offered in connection with your studies or other interactions with RIT.

If you are a European Union resident, RIT will delete your personal data when it is no longer reasonably required for business purposes or you withdraw your consent (where applicable), provided that we are not legally required or otherwise permitted to continue storing such data. RIT will not delete your personal data where it may be retained for the public interest, scientific or historical research purposes or statistical purposes. Please refer to our data retention policies for further details.

RIT’s web systems contain links to external sites run by third parties. RIT makes no warranty, expressed or implied, regarding the content or information collection practices of such external sites. This Privacy Statement only applies to RIT.

While all attempts are made to provide accurate, current, and reliable information, RIT recognizes the possibility of human and/or mechanical error. Therefore, RIT and its officers and employees make no representations as to the accuracy, completeness, or suitability of the information provided by this website, and deny any expressed or implied warranty as to the same.

This Privacy Statement was last updated in April 2026. We reserve the right to update and change this Privacy Statement from time to time in order to reflect changes in the way in which we use your personal data or for changing legal requirements. Any amended Privacy Statement will apply from the date it is posted on RIT website or otherwise made available to you.

If you have any questions regarding your rights or if you have any specific requests relating to your personal data please contact us at:

RIT’s Privacy Contact: dataprivacy@rit.edu

• Recommend RIT Privacy Policy revisions or advance new policies as may be deemed appropriate.
• Monitor changing issues of privacy in higher education.
• Review privacy issues related to RIT operations including:
  • Regulatory compliance
  • Individual privacy
  • Management of RIT resources
• Meet at least annually, or more frequently as needed.
• Provide a report annually to the Administrative Council on the status of privacy issues at RIT.

Chairperson

• Valerie Curry Bradley – Privacy Officer and Senior Counsel

Committee Members

• Information Security - Aldwin Maloto
• Registrar - Joe Loffredo
• Human Resources - *
• Student Affairs - Jessica Bowen
• Academic Affairs - Sue Provenzano
• NTID - Bernie Hurwitz
• Academic Senate - *
• University News - Bob Finnerty
• Student Government - *
• Alumni Relations - Megan Cheever
• Campus Safety - Rod Lezette
• ITS - Ben Wolke
• Enrollment Management - *
• Staff Council - *
• University Advancement - *

A raffle is where you sell tickets at an established price in order for participants to be entered into a drawing for the chance to win an item of value.  This is only open to those who have purchased raffle tickets.  An admission fee may be charged for the event where the raffle tickets are being sold, but you cannot give away a “free” raffle ticket with the payment of the admission fee. 

RIT requires that every raffle be approved by the RIT Office of Legal Affairs before any tickets are sold. The Raffle Approval Form must be submitted for approval no less than ten (10) business day before the first date of ticket sales.

50/50 raffles are allowed, however, no other split is allowed (i.e. 60/40, etc.).  Additionally, Gene Polisseni Center does not allow 50/50 raffles; they will only allow raffles of a physical item (i.e. hockey stick, jersey, gift card, etc.)

A free prize drawing is where tickets are given, free of charge, to anyone and everyone attending the event for entry into a drawing for a chance to win an item of value.  You must ensure that there is absolutely no purchase necessary to enter the event or to obtain a prize drawing ticket.  You cannot require the exchange of anything of value in order to obtain a ticket into the drawing for the item of value (e.g. donate a canned good to receive a ticket).  DO NOT refer to this as a raffle.

Awarding prizes based on a contest using a skill based or timed activity to determine a winner?

-Chance cannot be injected in the process - in the event of a tie, winners CANNOT be selected by chance (e.g. put two names in a hat and select one as the winner)

-Must ensure a definitive tie breaker based on some talent-based assessment

-Judging must be objective and clearly disclosed

-Judges must be qualified to apply the judging criteria

-All entrants must be competing on the same playing field (i.e. all entries must be judged)

-Must post official rules

Contest Official Rules must contain:

-Complete name and address of the sponsor and promoter of the contest

-The exact criteria that all entries will be judged by

-The maximum cost to the participant, if any

-The identity or description of judges and their qualifications

-How winners will be determined and when

-Number of prizes, the accurate description of each prize, the retail value of each prize

-Geographic area of the contest

-Opening date and scheduled termination date of the contest

-Where and when a list of winners can be obtained

-Special eligibility requirements and other requirements/prohibitions

Once posted, cannot be changed

Consult with Office of Legal Affairs for an Official Rules Template

Offering a prize/prizes as an incentive to do something where there is no purchase necessary but there is a random drawing to determine a winner?

The issue with giving away a prize as an incentive to do something, in many cases this is used to fill out a survey, is that it can create an illegal lottery if not structured properly.  A lottery is a promotion that has three elements: prize, consideration, winner chosen by chance. With a sweepstakes drawing there needs to be absolutely no purchase necessary (consideration) to enter in order to avoid creating an issue. Obviously with filling out a survey there isn’t any purchase, but there is case law to suggest that the time someone invests into doing certain tasks can actually satisfy the “consideration” element which is why the official rules requires the alternate method of entry. Filling out a survey is one of those tasks that would constitute “consideration”.  Therefore, you have to offer the option for participants to enter the drawing without participating in the survey at all to avoid the risk of creating the illegal lottery.

Official rules must be posed.

Official Rules must contain:

1) No purchase is necessary to enter and will not improve the chances of winning.

2) Opening date and scheduled termination date of the sweepstakes.

3) Eligibility requirements - geographic area of the sweepstakes and/or who is eligible to participate in the sweepstakes (age, residency, etc. also specify exclusions).

4) Method to enter – be sure to also include an alternative method of free participation - a “no purchase” method of entry.

5) Limitations on the number of entries by a signal person or household.

6) Odds of winning.  (In many cases the odds will depend on the number of eligible entries received, however, if a particular number of entry forms, direct mail pieces, or similar items will be distributed, the odds should be stated according to that number.)

7) Accurate description and retail value of the prize(s).  State whether all prizes offered will be awarded.

8) Manner of selection of winner(s), when the winner(s) will be selected and how the winner(s) will be notified.

9) Where and when a list of winners can be obtained.

10) Restrictions on receiving the prize (if applicable)

11) Complete name and address of the sponsor and promoter of the contest.

Once posted, they cannot be changed

Consult with Office of Legal Affairs for an Official Rules Template

Awarding prizes based on games of skill?

- Must be a bona fide skill - some method that the entrant is in control of their ability to win the prize based on their ability

- Chance cannot be injected in the process - in the event of a tie, winners CANNOT be selected by chance (e.g. put two names in a hat and select one as the winner)

- Must ensure a definitive, skill-based, tie breaker

- Judging must be objective and clearly disclosed

- Judges must be qualified to apply the judging criteria

- All entrants must be competing on the same playing field (i.e. all entries must be judged)

- Must post official rules

Games of Skill Official Rules must contain:

-Complete name and address of the sponsor and promoter of the contest

-The number of rounds or levels (if applicable, that subsequent rounds are more difficult)

-The maximum cost to the participant, if any

-The identity or description of judges and their qualifications

-How winners will be determined and when

-Number of prizes, the accurate description of each prize, the retail value of each prize

-Geographic area of the contest

-Opening date and scheduled termination date of the contest

-Where and when a list of winners can be obtained

-Special eligibility requirements and other requirements/prohibitions

Once posted, cannot be changed

Bingo is HIGHLY regulated and has extremely specific rules and restrictions.  Bingo games can only be played for fun, no money (or other item of value) can be exchanged in order to play Bingo and there cannot be any charge to enter the event where the Bingo game is being held.

The value of a single prize in any Bingo game cannot exceed $10 and the total value of all prizes awarded on any calendar day cannot exceed $150.  This means that you need to make sure that the total value of all prizes awarded for each Bingo game does not exceed $10.  If two or more people call Bingo in the same game, you will need to find another way to determine prize winner(s) that do not exceed a total value of $10 per game - you cannot award two $10 items, or two items with a total dollar value exceeding $10. 

RIT is not allowed to conduct Bingo games more than a total of fifteen (15) days during any calendar year.

If you intend to host a Bingo game, you must fill out the Bingo Approval Form and submit it to the Office of Legal Affairs no less than 10 business days prior to the date of the Bingo game.