CSMM Data Privacy Policy

This Privacy Policy explains how and why, the Cyprus School of Molecular Medicine (“we” or “CSMM”), part of the Cyprus Institute of Neurology and Genetics (“CING”), collect personal data and what we do with it. It also explains the data subject rights under the General Data Protection Regulation (“GDPR”). In legal terms, we are the data controller, as we determine the means and/or purposes of the processing of the personal data held by us. We might be the data processors in the case that we process data on behalf of another legal entity that is defining the means and/or purpose of the processing.  Whether we are the controller or the processors, the personal data stored and processed within the CSMM and CING follows the current policy.
 
The General Data Protection Regulation (GDPR) governs how we take care of the information we hold about data subjects. The first principle of the Regulation is that the data subject personal information must be processed fairly and transparently. We have an obligation to let data subjects know how we will take care of the information about them and what we will use it for.
 
Why do we collect and use personal data?
We might process personal data related to prospective, current and past students, lecturers and others. We gather the personal data to facilitate with the provision of post-graduate academic services and other associated functions.
 
We collect and use personal data under the following lawful bases:
  • where we have consent by the data subject;
  • where necessary to execute a contract with the data subject;
  • where it is necessary for compliance with a legal obligation;
  • where processing is necessary to protect the vital interests of the data subject or of another person;
  • where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • where justified by the legitimate interest of the Institute/CSMM or of the data subject’s legitimate interest or other’s
 
The information that we collect, hold and share may include:
We hold personal data about prospective, current and past students to support teaching and learning and to assess the quality of education provided by CSMM. We may also receive data about students from other organizations including but not limited to: Universities, Colleges, the Ministry of Education, National Statistics Authority. 
 
The abovementioned data may include but is not restricted to 
  • Basic details such as name, address, date of birth, phone number
  • Results of exams, presentations, assessments
  • Academic achievements
  • Data on student characteristics such as ethnic group, any special educational needs (e.g. dyslexia) any personal/familial circumstances (e.g death of a loved one) that could affect their mental state and therefore may affect their studies
  • Exclusion information
  • Details on any medical conditions that may affect the studies
  • Any information that may affect the student’s mental state and 
  • Images of the CCTV system we have installed in the broader CING premises
  • We also hold personal data about lecturers/academic staff and other CSMM employees to offer our educational services. We may also receive data about academic staff from other organizations including but not limited to: other Universities, Colleges, and the Ministry of Education.
 
The abovementioned data may include but is not restricted to 
  • Basic details such as name, address, date of birth, phone number
  • Appraisals and/or reviews of the academic staff
  • Academic and work experience
  • Financial information such as Social Security Number and bank account details
  • Images of the CCTV system we have installed in the broader CING premises
 
How long are general data retained?
We retain personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required by law.  For more information about the retention period of specific data please contact our Data Protection officer through the email: dpo@cing.ac.cy or our Education Office at 22358600.
 
 
Who do we share personal data with? 
We will not share information about students with anyone without the student’s consent, unless the law and our policies allow us to do so.
 
We are required by law to transfer certain information about students to specified external bodies which include the Ministry of Education, the Cyprus Agency of Quality Assurance and Accreditation in Higher Education, the Migration Services, the Foundation for the Management of EU Lifelong Learning programs, so that they can meet their statutory obligations.
 
We may transfer some of data subject’s personal data to financial institutions and/or auditors and/or legal representatives to execute payments or take other actions in order to execute a contract or to be in accordance with the Law.
 
We may transfer personal data to third party education providers such as external lecturers or other educational institutions for the purposes of providing to you the required educational services.
 
In any event that we should share personal data with third parties within the countries within the EU or within the countries outside the EU for which there is an “Adequacy Decision” by the European Commission, apart from the Public Authorities, we ensure that a Data Processing Agreement is in place that establishes the rules of such transfer and the security and privacy of the personal data and we will only provide the minimum amount of personal data necessary to fulfill the purpose of which we are required to share the data.
 
In the event that we should share personal data with third parties within the countries outside the EU for which there is no “Adequacy Decision”, such as in the cases that of transferring personal data to the data subjects’s country of origin following a request from the student’s home country government or authorities, we ensure that the country meets an adequate level of protection for the right and freedoms of data in relation to the processing of personal data and we will only share such data once a signed set of Standard Contractual Clauses (SCC) is in place between us and them.
 
Data subject rights:
 
Data subjects have the following rights: 
  • the right to access personal data and supplementary information
  • the right to have inaccurate personal data rectified, or completed if it is incomplete
  • the right to erasure (to be forgotten) in certain circumstances
  • the right to restrict processing in certain circumstances
  • the right to data portability, which allows the data subject to obtain and reuse your   personal data for your own purposes across different services
  • the right to object to processing in certain circumstances
 
Data subjects can exercise any one and all of their rights by submitting a Subject’s Rights Request Form to:
 
1. The Cyprus Institute of Neurology and Genetics
P.O.Box 23462 
1683 Nicosia
For the attention of the Data Protection Officer.
 
Or 
 
2. By e-mail at: dpo@cing.ac.cy
 
Or
 
3. By fax at: 22358238  (for the attention of the Data Protection Officer)
 
Rights’ Request forms can be requested through the Education Office in person, or through the e-mail dpo@cing.ac.cy
 
If you need assistance on filling the Rights Request form, or for any other relevant queries please contact the CING Education Office at 22358600.
 
If you have a concern about the way we are collecting or using your personal information, you should raise your concern with us in the first instance or directly to the office of the Commissioner for the Protection of Private Data. You can be provided the complaint forms for the Commissioner’s office at www.dataprotection.gov.cy.
 
 
 
 
Related Articles
winner