List of active policies
- OUC’s role under the Regulation
- How are Personal Data Collected
- Types of Personal Data Collected
- Processing of Personal Data
- Processing of Sensitive Personal Data
- Transfer of Personal Data
- Retention period
- Changes to the Personal Data Privacy Statement
- Data Protection Rights within the EU
- Contact info
Under the Regulation, the Open University of Cyprus is the Data Controller for all the personal data it maintains and processes, except in cases where the University is the Data Processor on behalf of another Data Controller. As a Data Controller, OUC is allowed to collect, maintain and process students’ and alumnae’s personal data.
Personal data are collected directly from you, when you interact with us, either to fill-in an application or for other requests. Please note that throughout your studies at OUC, if you are studying at OUC, we may collect additional personal data from activities related to your attendance in the following ways:
- Through the use of the website or of the Portal or of the e-Learning Platform of OUC and through other online processes or other ways of contacting the University,
- By correspondence and / or by electronic mail,
- By completing any survey, that might concern the improvement of services, to which a student or an alumnus may participate
- Through participation in any kind of event organized by the University.
OUC may collect a range of personal data such as personal information (name, surname, identity card number, date of birth, telephone number, email, address and province), family and social status, education and training records, employment information, financial and / or banking information, in addition to information provided through services. Furthermore, OUC is entitled to collect, maintain and process student’s personal data that belong to special categories of data, also known as Sensitive Data, which include data on racial or ethnic origin, religious or philosophical beliefs, biometric data, and physical or mental health.
Processing of students and alumnae personal data, is in accordance with to the Regulation and the Cypriot legislation governing the collection and processing of Personal Data. OUC uses the personal data for a number of purposes as part of its operations, as following:
- For the provision of services to you.
- To comply with the University’s legal obligation.
- To execute a contract of which you are a party or to take action upon your request, before finalizing a contract.
- In order to protect your legitimate interests or the legitimate interests of the University.
- Where it is necessary for reasons of public interest.
- To safeguard your own vital interests (or the interests of another individual).
- With your consent
OUC collects and processes special categories of personal data under the legal basis of the expressed consent of students and alumnae. If we do not have your consent we will not process any sensitive data. The purposes of processing these data are: to facilitate student study due to social security requirements, to protect the vital interests of the student or other member of the University, for the purpose of pursuing or supporting legal claims, for reasons of substantial public interest or for reasons of public health - such as protection against cross-border health threats - for medical / healthcare purposes, for purposes of filing due to public interest, for purposes of scientific or historical research or for statistical purposes, or where the information is widely disclosed by the student or alumni. Any processing will be proportional to the purpose and will be in accordance to the services provided by the University. When these data are used for monitoring and reporting purposes, the data will be anonymous where possible. It is also possible to process such information in the course of legitimate academic and University activities, with of course the appropriate safeguards.
Transfer of personal data to third parties may occur if it is required by law, or requested by government authorities (e.g. the Statistical Office), or when it is necessary to manage our academic relationship with you, or for the purposes of OUC’s legitimate interests. A transfer or access to personal data may also occur by any natural or legal person that works or provides services to the University or acts on behalf of the University (either within or outside Cyprus) for any reasonable purpose in order to obey by OUC’s obligations or exercise the University’s rights or the needs to carry out the University's functions and services offered to its students. In any case, all reasonable technical and organizational security measures will be adhered to in order to preserve all Personal Data.
Personal data that have been or will be submitted by you to the University, are kept in electronic and hardcopy form, in one or more files, on Servers, in a secure storage space on the University’s premises in Nicosia and Limassol. The maintenance and processing of the students’ and alumnae' s personal data starts from the date of your registration and continuous for as long as you choose or is necessary for the fulfillment of the purposes for which they were collected, including for the fulfillment of any legal, accounting or other requirements.
OUC has implement the appropriate technical and organisational measures, such as data-protection principles, in order to safeguard all personal information from unlawful use, intervention, modification or disclosure under the requirements of the Regulation.
We reserve the right to modify or amend this Policy at any time by publishing the revised policy on the University's Web site: https://www.ouc.ac.cy/web/guest/policy.
It is recommended that you periodically check this Policy and any
changes that may occur in order to be informed in regards to the way the
University uses and safeguards your Personal Data.
According to the Regulation, you have the following rights in regards to your personal data: (Please note, these rights are not absolute and in some cases they are subjected to conditions as defined by law)
- Right of Access – You have the right to access your own personal data through the platform, as well as the right to request a copy of your personal data that is maintained and processed by the University.
- Right of Rectification – You have the right to request the correction of any incomplete and / or inaccurate personal data we hold for you.
Right to Erasure - You have the right to request the deletion of personal data only if one of the following reasons is true:
- Personal data are no longer necessary in relation to the purposes for which they were collected or processed.
- If the processing is based on your consent and you have withdrawn this consent (on which processing is based) in accordance with Articles 6.1.a and 9.2.a of the Regulation and if no other legal basis, for processing, applies.
- If you object to processing in accordance with Article 21.1 of the Regulation and there are no compelling and legitimate reasons for processing
- If personal data have been processed illegally.
- If personal data should be deleted in compliance with a legal obligation under Union law to which the University is subject to.
- If the personal data have been collected in relation to the provision of referred to in Article 8.1 of the Regulation.
- Right to Object – You have the right to oppose the processing of your personal data at any time and for reasons related to a specific situation, unless there are compelling legitimate reasons for processing that override your interests, rights and freedoms.
- Right to Restriction of Processing – You reserve the right to request the restriction of processing on your personal data so that we may no longer process the specific information until the restriction is lifted (for example, the data have been corrected).
- Right to Data Portability – You have the right to request the transfer of your personal data, that you have provided to the University. These data will be given to you in a format that is structured, widely used and machine readable and, in certain cases you may also have the right to request for us to send the information to another organization, provided that such a transfer is technically feasible.
- Right to Object and Automated Individual Decision-Making (Including Profiling) – You have the right to request that we do not make any decision, regarding you, solely on the basis of automated processing, including profiling, only in the case that this decision has legal or significant consequences on you.
Right to Withdraw Consent – In the limited circumstances in which
you may have given your consent for the collection, processing and
transfer of your personal information for a specific purpose, you have
the right to withdraw it at any time. To be more specific, for events
and / or promotions you may withdraw your consent by sending an email to
email@example.com for the Event Office and to the email firstname.lastname@example.org for the Marketing section. This also applies if:
- the lawfulness of the processing, on which your consent was based on your consent, does not hold true anymore
- Any processing done, occurs under a different legal basis.
For Further Information: If you have questions in regards to our Personal Data Privacy Statement or the use of students’ and alumnae’s personal data, as described above, or you want to exercise any of your rights, please contact OUC’s Data Protection Officer:
Mr. Nearchos Nearchou
Giannou Kranidioti 33 Avenue
Τ.Τ 2220, Latsia,
Call Center: +357 22 411730
Submission of a Complain: If you feel that your concerns in regard to the use of your personal data or any of your data protection rights have not been address by us, you have the right to contact OUC’s Data Protection Officer and submit a complain. You also have the right to submit a complaint with the Personal Data Protection Commissioner’s Office, http://www.dataprotection.gov.cy.