Policy of the American College of Greece regarding the Processing of Personal Data of Students / Legal Guardians / and members of their family
This policy concerns the way in which the American College of Greece (hereinafter “Data Controller” or “College“) processes personal data of students in the context of their studies at Pierce as well as personal data of legal guardians or other members of their family in accordance with the provisions of Regulation (EC) 2016/679 of the European Parliament and of the Council (“General Data Protection Regulation”) and the Greek legislation on the protection of personal data, as in effect from time to time (hereinafter “the Personal Data Legislation“).
This policy forms an integral part of the “American College of Greece Personal Data Protection Policy” and may be revised on a regular basis, depending on the activities of the College, the relevant legal provisions and the way in which the College processes personal data.
Personal data processed by the College
The College collects, processes and stores, in electronic and printed form, in accordance with the provisions of the Personal Data Legislation, personal data of students, legal guardians and members of their family, and especially the following:
- Student’s Full name
- Identity / Passport data
- Date and place of birth
- School of Origin
- Siblings’ Full Name
- Parents’ / Guardians’ full name and contact details
- Parents’ / guardians’ profession
- Optionally (if stated by data subjects) Name of Employer / Business / Organization / Service as well as Specialty / Employee’s grade
- Tax Identification Number
- Full Name and Identification Number of financially responsible person
- College Affiliation with an alumnus or a staff member
- All data listed in the Primary or High school graduation certificate or in the student’s certificate of attendance or school report
- Court Decision regarding custody (if any)
- Health data contained in student’s individual health card and medical reports, information regarding learning difficulties contained in reports of diagnostic and support centers (“ΚΕΔΔΥ”) or private centers
- Any declared nutritional habits
- Photos of students used for College ID Cards and photos of parents / guardians used for Parent ID Cards
- Information regarding student participation in additional courses or afternoon groups
- Exemption from specific courses
- The manner and time of arrival and departure of the student to/ from College
- Information on grades, behavior and absences
- Information on prizes/distinctions
- Health data
- In addition, the College processes personal data provided that the data subjects give their consent to such processing. In particular, the following processing activities are involved:
- display of photos and videos taken during the student’s studies at the College or during actions and events of the College in which the student participates
- display of visual or other works created by the student
- publication of students’ data in graduates’ lists
- publication of competition results in which the student participated, on the College’s website or other material (printed material, posters, Internet videos, College’s accounts on social networks, etc.)
- printing of students’ photos for the annual commemorative albums
Processing Purposes and Legal Basis for the Processing
The AMERICAN COLLEGE OF GREECE collects, processes and stores the above personal data for the purposes of student enrolment, transfer and attendance at the College, the performance of the contract for the provision of educational services, the protection of the students’ health, the inclusion of students at the College’s alumni base after graduation, the granting of a recognized school certificate, and for purposes of promoting the activities of the College and informing students, guardians and the public at large.
The legal bases for the above processing comprise the consent given by data subjects/ or guardians during student enrollment or re-enrollment at the College, compliance of the College with its legal obligations, the fact that the processing of the above personal data is necessary for the performance of the contract for the provision of educational services, and the fulfillment of the legitimate interests of the College regarding communication with parents and guardians for reasons related to the student, providing informing on activities which take place within the school community and fulfilling the College’s duty of care for the student.
Especially as regards health data, the legal basis for the processing is, on one hand, the consent given by the data subjects or guardians and, on the other hand, the fact that the processing is necessary for the purposes of preventive medicine and for the fulfillment of the College’s obligations in the field of social protection law.
Especially as regards citizenship, the legal basis for the processing is, on one hand, the data subjects’ or guardians’ consent and, on the other hand, the fulfillment of the College’s legal obligation.
Especially as regards religion, the legal basis for processing is, on one hand, the data subjects’/guardians’ consent and, on the other hand, the compliance of the College with its legal obligations.
Access to Data and Transfers
The above personal data are accessible and processed by authorized employees of the College, who process them solely for the fulfillment of the aforementioned purposes, and by no means for their own benefit. Furthermore, some of the above personal data are accessible and processed, within the framework of their responsibilities, by authorized external associates of the College for the fulfillment of the aforementioned purposes.
The above personal data may be transferred to competent authorities (indicatively the Ministry of Education) and the International Baccalaureate Organization (for the participating students) for the purpose of the College’s compliance with its legal obligations.
Furthermore, following the data subjects’/ or guardians’ consent, personal data may be transferred to admissions departments of foreign Universities and electronic platforms which operate for that purpose. The above transfer takes place either within the EU, or on the basis of adequacy decisions in the U.S (Privacy Shield) and Canada.
Any further transfers of personal data to any third person or to a country outside the European Union, take place only in accordance with the Personal Data Legislation.
Data retention period
The College keeps and process the above personal data for as long as it is required for the serving of the aforementioned processing purposes and in order to comply with its legal obligations and to defend itself against any legal claims. After the above time period, the College, if there is no other legal basis for the processing of the data, will proceed to the deletion of the above personal data.
Rights of Data Subjects
Subject to certain exceptions, conditions and limitations provided by the Personal Data Legislation, data subjects can exercise the rights provided by Personal Data Legislation and in particular the following: the right of access, rectification, restriction of processing, objection, erasure, as well as the right to data portability. In case a data subject exercises one of the aforementioned rights, the College will take any possible measure for the prompt satisfaction of the request, according to the specific provisions and conditions of the Personal Data Legislation, and shall inform in writing the data subject concerned regarding the satisfaction of the request, or for the reasons that prevent the exercise or the satisfaction thereof according to the Personal Data Legislation.
In addition, data subjects/or legal guardians may at any time withdraw their consent for the processing of personal data, without however affecting the lawfulness of processing based on their consent before its withdrawal and the processing based on another legal basis. In case of withdrawal of the consent after the circulation of a printed commemorative album, the circulation thereof cannot be withdrawn. In case of withdrawal of consent, the College may not be able to use the relevant personal data and College enrollment and attendance by the student may not possible.
Furthermore, data subjects have the right to lodge a complaint with the Hellenic Data Protection Authority, in case they consider that the processing of their personal data is against the applicable legislation.
If the data subjects have any queries in relation to the protection of their personal data or wish to exercise their legal rights, they can contact the Data Protection Officer of the American College of Greece by using the following contact details:
Address: 6 Gravias Street, Aghia Paraskevi, 15342
E-mail address: [email protected]