Notification regarding the processing of personal data the Hellenic American Education Center alumni
In light of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Hellenic American Education Center (22 Massalias Street, 10680 Athens) (“HAEC”) would like to inform you of the following:
1. In addition to personal data of HAEC’s graduates (the “data subjects” and/ or “graduates” / “alumni”) that HAEC collected during their participation in its educational programs and retains for a period of time as required or as HAEC is entitled to store, HAEC, in its capacity as data controller, may process the following data for the purposes below:
a) personal information, such as full name, father’s name, gender, date of birth, email address, faculty, field of study, graduation date etc.,
b) image and voice data (voice) of the data subjects, collected when an event is photographed, video-recorded or audio-recorded to creating direct marketing material or / and provided by the data subject o HAEC and
c) professional information, i.e., information that relate to the data subject’s profession that may be disclosed by the data subject.
2. The source of the data is the data subject himself / herself disclosing his/ her data.
3. Depending on the case, HAEC may process personal data for the following purposes:
(a) To manage in general HAEC’s graduates (e.g. to respond to questions / inquiries that the data subject address to HAEC or issue certificates of attendance for its training programs). The legal basis for this data processing is the data subject’s consent given by the disclosure of the relevant personal data to HAEC, to execute the relevant contract concluded with HAEC, and to comply with a legal obligation HAEC has.
(b) To conduct surveys of HAEC alumni (e.g., concerning their professional development). Where HAEC needs to communicate with the alumni to notify them about the survey, the legal basis for such data processing is that processing is necessary to serve the prevailing legitimate interests of HAEC (i.e., the legitimate interests relating to the evaluation of its services), which override the interest, fundamental rights and freedoms of the data subject which require the protection of personal data, while in the case of alumni participating in these surveys, the legal basis for this data processing (including data derived from the data subjects’ answers to the survey) is the data subjects’ consent, which is expressed by the clear affirmative action of participating in the survey.
(c) To safeguard the interests of HAEC. The legal basis for such data processing is that processing is necessary for the purposes of the legitimate interests pursued by HAEC which override the interest, fundamental rights and freedoms of the data subject which require the protection of personal data (e.g. for the establishment, exercise or support of legal claims).
(d) To send marketing material via electronic mail. Note that HAEC is entitled to use the data subjects’ email address, as it has been lawfully obtained as part of the services or transactions it has provided or to promote similar services or pursue similar purposes, even when data subjects have not given their prior consent, provided that they are given, when these contact details are collected, as well with every subsequent message, a clear, transparent, cost-free, and easy-to-use option to object to the collection and use of their electronic data. The legal basis for such data processing is that processing is necessary to serve the prevailing legitimate interests of HAEC (i.e. the legitimate interests relating to the promotion of its services, dispatching of newsletters that relate to upcoming events, scholarships, sponsorships or / and subsidies of training programs),which override the interest, fundamental rights and freedoms of the data subject which require the protection of personal data. Finally, once the data subjects’ consent has been obtained, HAEC may process the data subjects’ image or/ and voice (voice), when an event is photographed, video-recorded or audio-recorded and/or their photograph or any other material that includes data that the data subjects may disclose, as part of HAEC’s newsletters or / and for the purpose of creating direct marketing material that HAEC may use in its brochures, website, promotional videos or elsewhere. In none of the above cases does HAEC use automated decision-making, including profiling of the data subjects.
4. As the case may be and depending on the purpose of processing, personal data may be transmitted to authorized employees of HAEC or, once the data subject’s consent has been obtained, personal data may form part of HAEC’s newsletters, be uploaded to HAEC’s websites or websites of third parties, be incorporated into promotional brochures for its training programs which will be distributed in paper form or electronically or may be part of other direct marketing activities to promote its training programs (e.g. promotional messages via electronic communication). Personal data may also be transmitted to companies associated with HAEC with which HAEC has a concluded a contract and which process the data on HAEC’s behalf (e.g. IT companies, IT service providers, etc.), within their competencies and subject to the obligation of confidentiality, secrecy and compliance with the data protection legislation. In addition, HAEC may transmit personal data to third parties where so required by law, or for the purposes of, or in connection with, legal proceedings in which it is involved, or otherwise for the purposes of supporting, exercising or defending its rights, or to law enforcement authorities that have submitted a lawful transmission request, or where it considers that transmission is necessary in connection with an investigation into the suspicion or existence of illegal activity. Personal data shall not be transmitted outside the European Economic Area.
5. The above data will be retained for a period time as required or allowed by the legislation/regulatory framework in force each time, taking into account the applicable prescription period, which may extend to 20 years. Specifically:
(a) where processing is carried out under a relevant contract, the personal data will be stored for as long as necessary for the performance of the contract and for the establishment, exercise and/or support of any legal claims of HAEC arising from that contract; and
(b) where the processing is imposed as an obligation by provisions stemming from the applicable legal framework, personal data will be stored for as long as the relevant provisions require
6. The data subject shall have the following rights under the GDPR:
(a) to receive a copy of the personal data held by HAEC, together with other information on how data is processed;
(b) to request that personal data concerning him or her be rectified and, under conditions, to request the deletion or restriction of processing, or to object to the processing of personal data;