Personal Data Privacy Statement in accordance with the General Data Protection Regulation (GDPR) 2016/679 of the European Parliament
OUC’s Role Under the Regulation
Under the Regulation, the OUC is the Data Controller for all the personal data it maintains and processes, except in cases where the University is the Data Processor on behalf of another Data Controller. As a Data Controller, OUC is allowed to collect, maintain and process prospect or current student’s, prospect or current employee’s / collaborator’s and business associate’s, visitor’s alumnae’s personal data.
How are Personal Data Collected
Personal data is mainly collected directly from you, when you interact with us, either to fill-in an application or for other requests. Please note that throughout your employment or studies at OUC, , we may collect additional personal data from activities related to your attendance in the following ways:
- Through the use of the website or of the Portal or of the e-Learning Platform of OUC and through other online processes or other ways of contacting the University,
- By correspondence and / or by electronic mail,
- By completing any survey, that might concern the improvement of services, to which a student or an alumnus may participate
- Through participation in any kind of event organized by OUC
Types of Personal Data Collected
OUC may collect a range of personal data depending on the relationship between the University and the Data Subject.
If you are a prospect or current student the personal data collected and used by the OUC include your full name, identity card number, student ID number, course title, grades and examination results, date of birth, telephone number, email, address and province.
If you are an alumnae member of our University, we will maintain your personal email address to inform you of any news relating to the University and any upcoming events.
If you are a prospect or current employee or collaborator, we collect personal data including full name, identity card number, social status, education and training records, past employment information, financial and / or banking information, employee identification number, Curriculum Vitae, gender, title, date of birth, telephone number, email, address and province, days of sick leave and information relating to medical insurance, if applicable.
If you are a business associate (supplier, subcontractor, etc) we maintain the necessary personal data required to execute the contract or business transaction between us, such as the contact details.
If you are a visitor, we will be asking you to provide us with information including your full name, the purpose of your visit and the name of the person you are visiting. You will also be asked to sign in and out of the premises by completing your information in our logbook.
Furthermore, OUC is entitled to collect, maintain and process student’s and employee’s personal data that belong to special categories of data, also known as Sensitive Data, which include data on racial or ethnic origin, religious or philosophical beliefs, biometric data, and physical or mental health solely to provide a safe and fair environment for them to study or work.
Processing of Personal Data
Processing of your personal data, is in accordance with to the Regulation and the Cypriot legislation governing the collection and processing of Personal Data. OUC uses the personal data for a number of purposes as part of its operations, as following:
- To execute your contract of employment, if you work at OUC, or your enrollment and studies if you are a student
- For the provision of services to you throughout your employment or study
- To comply with the University’s legal obligations
- In order to protect your legitimate interests or the legitimate interests of the OUC
- Where it is necessary for reasons of public interest
- For safeguarding and protecting the personal data collected
- To safeguard your own vital interests (or the interests of another individual)
- With your consent
Processing of Sensitive Personal Data
OUC collects and processes special categories of personal data under the legal basis of the expressed consent of students, employees and alumnae. If we do not have your consent we will not process any sensitive data. The purposes of processing these data are: to facilitate student study due to social security requirements, to protect the vital interests of the student or other member of the University, for the purpose of pursuing or supporting legal claims, for reasons of substantial public interest or for reasons of public health - such as protection against cross-border health threats - for medical / healthcare purposes, for purposes of filing due to public interest, or where the information is widely disclosed by the student or alumni. Any processing will be proportional to the purpose and will be in accordance to the services provided by the University. When these data is used for monitoring and reporting purposes, the data will be anonymous where possible. It is also possible to process such information in the course of legitimate academic and University activities, with of course the appropriate safeguards.
Transfer of Personal Data
Transfer of personal data to third parties may occur if it is required by law, or requested by government authorities (e.g. the Statistical Office), or when it is necessary to manage our relationship with you, or for the purposes of OUC’s legitimate interests. A transfer or access to personal data may also occur by any natural or legal person that works or provides services to the University or acts on behalf of the University (either within or outside Cyprus) for any reasonable purpose in order to obey by OUC’s obligations or exercise the University’s rights or the needs to carry out the University's functions and services offered to its students. In any case, all reasonable technical and organizational security measures will be adhered to in order to preserve all Personal Data.
Personal data that have been or will be submitted by you to the University, are kept in electronic and hardcopy form, in one or more files, on Servers, in a secure storage space on the University’s premises in Nicosia and Limassol. The maintenance and processing of the data subject personal data starts from the date of your registration/application/visit/business contact and continuous for as long as you choose or is necessary for the fulfillment of the purposes for which they were collected, including for the fulfillment of any legal, accounting or other requirements. For more details regarding the retention period of personal data of a specific data process please contact the OUC Data Protection Officer (DPO).
OUC has implement the appropriate technical and organisational measures, such as data-protection principles, in order to safeguard all personal information from unlawful use, intervention, modification or disclosure under the requirements of the Regulation. For information regarding these measures, please contact our IT department.
Changes to the Personal Data Privacy Statement
We reserve the right to modify or amend this Policy at any time by publishing the revised policy on the University's Web site: https://www.ouc.ac.cy. It is recommended that you periodically check this Policy for any changes that may occur in order to be informed in regards to the way the University uses and safeguards your Personal Data.
Data Protection Rights within the EU
According to the Regulation, you have the following rights in regards to your personal data: (Please note, these rights are not absolute and in some cases they are subjected to conditions as defined by the law and/or the Regulation).
- Right of Access – You have the right to access your own personal data through the platform, as well as the right to request a copy of your personal data that is maintained and processed by the University.
- Right of Rectification - You have the right to request the correction of any incomplete and / or inaccurate personal data we hold for you.
- Right to Erasure - You have the right to request the deletion of personal data only if one of the following reasons is true:
- Personal data are no longer necessary in relation to the purposes for which they were collected or processed.
- If the processing is based on your consent and you have withdrawn this consent (on which processing is based) in accordance with Articles 6.1.a and 9.2.a of the Regulation and if no other legal basis, for processing, applies.
- If you object to processing in accordance with Article 21.1 of the Regulation and there are no compelling and legitimate reasons for processing.
- If personal data have been processed illegally.
- If personal data should be deleted in compliance with a legal obligation under Union law to which the University is subject to.
- If the personal data have been collected in relation to the provision of referred to in Article 8.1 of the Regulation.
- Right to Object - You have the right to oppose the processing of your personal data at any time and for reasons related to a specific situation, unless there are compelling legitimate reasons for processing that override your interests, rights and freedoms.
- Right to Restriction of Processing - You reserve the right to request the restriction of processing on your personal data so that we may no longer process the specific information until the restriction is lifted (for example, the data have been corrected).
- Right to Data Portability - You have the right to request the transfer of your personal data, that you have provided to the University. These data will be given to you in a format that is structured, widely used and machine readable and, in certain cases you may also have the right to request for us to send the information to another organization, provided that such a transfer is technically feasible.
- Right to Object and Automated Individual Decision-Making (Including Profiling) - You have the right to request that we do not make any decision, regarding you, solely on the basis of automated processing, including profiling, only in the case that this decision has legal or significant consequences on you.
- Right to Withdraw Consent - In the limited circumstances in which you may have given your consent for the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw it at any time. To be more specific, for events and / or promotions you may withdraw your consent by sending an email to firstname.lastname@example.org for the Event Office and to the email email@example.com for the Marketing section. This also applies if:
- the lawfulness of the processing, on which your consent was based on your consent, does not hold true anymore
- Any processing done, occurs under a different legal basis.
For Further Information: If you have questions in regards to our Personal Data Privacy Statement or the use your personal data, as described above, or you want to exercise any of your rights, please contact OUC’s Data Protection Officer:
Mr. Nearchos Nearchou
Giannou Kranidioti 33 Avenue
T.T. 2220, Latsia,
Call Center: +357 22 411730
Submission of a Complain: If you feel that your concerns in regard to the use of your personal data or any of your data protection rights have not been address by us, you have the right to contact OUC’s Data Protection Officer and submit a complain. You also have the right to submit a complain at the Personal Data Protection Commissioner’s Office, via the following link, http://www.dataprotection.gov.cy.