American College (hereinafter the “AC”, “we”, “our”, “us”) recognizes and respects the importance of your privacy and is committed to treating your personal information with the utmost care and in compliance with the European Parliament’s and Council’s Regulation (EU) 2016/679 and Law 125(I) of 2018 regarding data protection.
The basis for processing your personal data
We collect and process personal data, in the context of our academic and/or business relationship, to enable us to provide education and support services to our students and staff, advertising and promoting the AC and the services we offer, managing our accounts and records and providing commercial activities to our clients.
Personal data may include some types of information classified as ‘sensitive’ for the purposes of the European data protection law and there are additional restrictions on how we may use and hold this information. These could be for example such as information about your ethnic origin, religious beliefs, and physical or mental health. We will always communicate to you the purposes for which we wish to use your sensitive information and in such cases, you will be able to withdraw your consent at any time.
We process personal data largely on the basis that it is necessary for the performance of our tasks carried out in the public interest or because it is necessary for our or a third party’s legitimate interests. The purpose of the AC, is to advance learning and knowledge by teaching and research to the benefit of the wider community and examples of processing on this basis include monitoring and evaluating the performance and effectiveness of the AC and improving the academic, corporate, financial and human resource management of the AC.
We may also process your personal data because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering a contract. For example, this may include interacting with individuals before they are enrolled as a student, as part of the admissions process, or dealing with any concerns a student may have.
We may also need to process personal data to comply with our legal obligations. This can include compliance and regulatory obligations, such as anti-money laundering laws, immigration obligations and safeguarding requirements, or to assist with investigations carried out by the police or other authorities. We may also process your personal data where it is necessary to protect your or another person’s vital interests, or in circumstances where we have your specific consent to do so.
Personal data we collect about you and how we use it
Information is collected in several different ways dependent on your interaction with the AC and personal data is processed for the purposes outlined below.
Website usage and enquiries
We collect personal data from visitors to our website through the use of online forms as well as when you email us with an enquiry. In addition, we collect information automatically about your visit to our website.
We may process information collected through this website, social media or other electronic networks used by the AC, for the purposes of advertising, marketing, public relations and general advice services as follows:
- the identification of recipients for AC services and administration of promotional campaigns,
- the advertising and promotion of the AC and its services including by direct marketing means,
- the advertisement and provision of general advice to members of the public about AC services,
- the advertisement and promotion of the AC through third party products and services, e.g. financial sponsorship.
Applicants and students
We collect personal data via student application forms through our own application systems. Should you subsequently enroll as a student at the AC, a student record will be created for you.
The data collected from you as a prospective student or student is used by the AC for the following:
Accounts and records
- the administration of student accounts and payments
- to maintain a central student record.
- administration of education and studies
- calculation and publication of exam results, provision of references
- provision of education and training such as the planning and control of curricula and exams, and commissioning, validating and producing educational materials
- administration of applications, e.g. receipt and processing of application forms, compilation of statistics, assessments including preliminary and confirmed offers, liaison with agents.
- preparation of statutory returns
- administration of student awards and fees
- administration of the discipline and academic misconduct processes
- administration of the academic appeals process
- administration of Erasmus+ students exchange program, with Partner Universities
Student support services
- administration and management of AC- and privately-owned property
- administration and provision of insurance services
- administration and provision of library services, loan/hire records, information and databank administration
- administration and provision of a student card
- administration and provision of a European Youth card (for non-European students)
- administration and provision of welfare and pastoral services
- careers guidance and advice
- administration and provision of computing facilities
- other commercial or information services, such as the AC newsletter, education products and services, offers, events and news which may be of interest to students
- the promotion of the relationship between the AC and its alumni
- distribution of AC mailings, e.g. newsletters
Employment applications and staff
We collect personal data via the employment application and recruitment process, and when you enter into a contract as an employee of the AC. This data is used by the AC for:
- administration of payroll
- access to IT & Telephone Facilities
- management of absence records
- administration of flexible working arrangements
- providing access to secured buildings and to parking facilities
- reviewing performance and facilitating promotion and reward
- processing expenses and administrating corporate spending accounts
- complying with our legal obligations
Educational services provider
AC needs to process your personal information for the purposes of communicating with you for anything related to the provision of your services to AC, for paying you for the provision of your services to AC and to fulfil our statutory obligations. Your information will not be shared with any third party unless AC has a legal obligation to do so.
Retention of personal data
We will keep your personal information for as long as you are a student and/or otherwise a person enjoying our services.
After you stop being a student and/or a person enjoying our services, we need to keep your personal information for a period of 7 years based on Cyprus government law. For academic purposes and in order for the AC to be able to print and certify transcripts validity and issue certificates we may keep your data for up to 50 years. We also may keep your data for more than 50 years if we cannot delete it for legal and / or regulatory and/or technical reasons. At all cases, we will ensure that your privacy is protected and the data are used only for the above-mentioned purposes.
If for any reason we keep sensitive information, we will delete it as soon as the student or employee leaves from the AC and there is no other relationship.
Disclosure and transfer of personal data
We will only disclose your personal data to a third party when we are required to by law, where we have your specific consent, or to the following:
- For compliance with legal obligations. As an academic institution, we are subject to various legal obligations
- Government departments and statutory bodies
- Accreditation and regulatory bodies in relation to confirmation of qualifications, professional conduct and the accreditation of courses
- Professional Bodies
- Research Institutions
- Insurance companies
- Hospitals & Private Clinics
- Partner Universities for Erasmus purposes
- Career Promotion Organizations
- Other private organizations offering assistance to students
From time to time, the AC may transfer limited personal data to student agents outside the European Economic Area, to support applicant students. Where this does occur, the AC will adhere to the requirements of the General Data Protection Regulation and ensure that all reasonable and practicable measures will be taken to ensure that the agent will comply with the data protection level in Europe in accordance with the GDPR.
Any transfers to parties located outside the European Union will be in line with the legal and regulatory provisions of the GDPR and applicable local legislation as amended from time to time.
Your rights including access to information and correction
You have a number of rights under the General Data Protection Regulation, and the applicable local legislation (as amended from time to time) in relation to the data protection:
- Request access to your personal data (data subject access request)
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Please note however that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. In such a case, your data will be stored but not processed until expiration of the retention obligation.
- Subject to the legal basis on which the processing activity is based, you may object to processing of your personal data. Please note that in some cases, we may have compelling legitimate grounds to process your information which we need to comply with.
- Request restriction of processing of your personal data (a) if it is not accurate; (b) where processing may be unlawful but you do not want us to erase your data; (c) where you need us to hold the data even if we no longer require it; or (d) where you may have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party.
- In case the processing of the data is performed subject to your consent, you may withdraw consent at any time where we are relying on consent to process your personal data. However, we note that this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will of course advise you if this is the case at the time you withdraw your consent.
Note that we may charge you with an administrative fee, in cases where requests are deemed manifestly unfounded or excessive, in particular because of their repetitive character.
Changes to our privacy notice
We keep our privacy notice under regular review and any updates will be placed on this webpage.
How to contact us
If you have any questions about our privacy notice or the information we hold about you, you can contact the College’s Data Protection Officer by email at firstname.lastname@example.org or you can write to Mr Vasilis Cleopa, Data Protection Officer, American College, 3 Omirou Avenue 1097 Nicosia.