GENERAL DATA PROTECTION REGULATION (GDPR) POLICY

Last revised on 12-04-2018

About this document

This Privacy Notice explains how School of Cybersecurity and CCE® Program (“we,” and “our”) collect, use and share your personal data and your personal data rights. This Privacy Notice relates to our processing of personal data from past, present and prospective School of Cybersecurity Cyber-U students or CCE® Program certification holders (“you”). School of Cybersecurity is your personal data controller and is subject to the 1998 Data Protection Act (DPA) and the General Data Protection Regulation (GDPR). Any questions or concerns regarding the privacy and data protection practices of School of Cybersecurity can be directed to [email protected].

Whose data is protected by the GDPR?

The GDPR covers personal information about all natural persons in the EU (“EU data subjects”), i.e. persons, but not legal entities such as companies or non-profits. The GDPR makes no distinction based on permanent residence or nationality of individuals. The GDPR applies to all personal data of such persons.

Protection of your personal data
We take reasonable and appropriate measures to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Data.

• Own Cookies are cookies that we are placed on your web browser by us when you visit our website.
• Third Party Cookies refers to cookies that are placed on your web browser by another party when you visit or use our website.

How we collect your information

We may collect your personal information in a number of ways, for example:

• From the information you provide to us when you interact with us before you join us, for example when you express your interest in courses or certifications from the School of Cybersecurity Cyber-U and CCE® Program;

• When you apply for courses or certifications at the School of Cybersecurity Cyber-U and CCE® Program and complete registration forms and when you complete other admission processes and procedures;

• When you communicate with us by telephone, e-mail, forms or through our website, for example, to ask questions or raise concerns;

• In a variety of other ways when you interact with us as a School of Cybersecurity Cyber-U student or the CCE® Program

Types of Data Collected

We may collect the following types of personal data about you:

• Your name, and contact information such as address, email address and telephone number, as well as your date of birth, social security number (or other tax identification number) and your passport number or national identity card details, country of residence and your nationality. We will also allocate you a unique student number
• Information relating to your education and employment history, the school(s) and other colleges or universities you have attended, certifications you have and places where you have worked, the courses you have completed, dates of study and examination results. We will also keep records relating to assessments of your work, details of examinations taken, actual examination grades and other information in your student record
• Payment data necessary to process your payment if you make purchases, such as your payment instrument number (credit card number).
• Records related to your use of our facilities and services
• Photographs from course involvement
• Information about your involvement, activities, and awards

The basis for your information processing and how it is used

We may process your personal data as it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

• To interact with you before you are enrolled as a student, as part of the admissions process (e.g. to send you a prospectus or answer enquiries about our courses)
• To address any concerns or feedback you may have
• For any other purpose for which you provide us with your personal data.

We also may process your Personal Information because it is necessary for our legitimate interests. In this respect, we may use your Personal Information for any of the following:

• To monitor and evaluate the performance and effectiveness of School of Cybersecurity Cyber-U and CCE® Program including by training our staff or monitoring their performance
• To maintain and improve the course material and certifications for School of Cybersecurity Cyber-U and CCE® Program
• To promote equality and diversity throughout our programs
• To seek advice on our rights and obligations, such as where SCS requires legal advice
• To recover funds owed to School of Cybersecurity Cyber-U and CCE® Program

We may also process your personal information in order to comply with our legal obligations. We may use your personal information in this regard for the following:

• To meet our compliance and regulatory obligations
• For the prevention and detection of crime
• In order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

We may also process your personal data where:

• It is necessary for medical purposes (e.g. medical diagnosis, provision of health or social care or treatment, or a contract with a health professional)
• It is necessary for emergency medical purposes
• It is necessary to protect your or another person’s vital interests or
• We have your specific or, where necessary, explicit consent to do so.

How SCS and CCE® Program use information about current and prospective students

We may use Personal Information (including Sensitive Personal Data) we collect from and about you during your association with us for the following purposes:

• Admit you as a student at School of Cybersecurity Cyber-U and CCE® Program
• Facilitate academic matters, including for:
• The provision of our core teaching, learning, and research services (e.g. registration, assessment, attendance, managing progress, academic misconduct investigations and certification)
• Maintaining student records
• Provide IT, media, and other information services
• Provide support of our core services in non-academic matters, including:
• Monitoring of equal opportunities
• Safeguarding and promotion of students’ welfare
• Ensuring students’ safety and security
• Managing the use of social media
• Managing facilities on-site, including parking
• Provide other administrative functions, such as:
• Carrying out research and statistical analysis
• Carrying out audits to ensure compliance with our regulatory and legal obligations
• Providing operational information
• Promoting our services
• Preventing and detecting crime
• Dealing with grievances and disciplinary actions
• Dealing with complaints and inquiries
• Provide for archiving and statistical purposes

Data Retention Timeframe

We will retain your personal information for as long as necessary to comply with legal document retention requirements. Even if you have exercised one or more of the rights (hereinafter) with regard to your Personal Information, we shall be entitled to retain your Personal Information for the purpose of complying with legal obligations, carrying out a task carried out in the public interest, for archiving purposes in the public interest, for scientific or historical research purposes, for statistical purposes or for the establishment, exercise, or defense of legal claims.

Your Rights with Respect to Your Personal Information

Under the General Data Protection Regulations (GDPR), you have the following rights:

• To obtain access to the Personal Information that we hold about you
• To object on grounds relating to your particular situation to our processing activities where you feel they have a disproportionate impact on your interests, rights, and freedoms
• If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge
• To restrict the processing activities related to your Personal Information (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• To request that we erase your Personal Information erased
• To have Personal Information, which you have voluntarily provided to us, produced in a structured, commonly used, and machine-readable format, including for the purpose of transmitting it to another party; and
• To require us not to send you marketing communication.

Please note that the above individual rights are not absolute and that we may refuse applications where there are certain exceptions. If you consent and wish to withdraw your consent, please contact us by email at [email protected]. Please note that if your consent is based on the processing of your personal data and you withdraw your consent, we may not be able to provide you with all or some aspects of our services and/or it may affect the provision of those services.

Privacy and Children

The Privacy Notice is not directed to “children”, and we do not seek, nor do we knowingly process, Personal Information from children. Where a prospective or current student is classified as a child, we will make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child, where Personal Information of the child is to be processed.

Revisions to this Privacy Notice

School of Cybersecurity reserves the right, at our sole discretion, to change, modify, add, remove, or otherwise revise portions of our policies and this Privacy Notice at any time, consistent with the requirements of applicable law. When we do, we will post the revision(s) to this page. If this policy is changed in a material way, we will provide appropriate notice.