Privacy Policy
U ACADEMY IKE makes every effort to comply with the legislation relating to the protection of personal data in the sectors in which it operates. This Policy sets out the fundamental principles according to which U ACADEMY IKE processes the personal data of its customers, employees, suppliers, partners and other individuals.
This Policy applies to U ACADEMY IKE and to its directly or indirectly controlled subsidiaries based in Greece. All employees, whether employed on a permanent or fixed-term basis, as well as all subcontractors working on behalf of U ACADEMY IKE, are bound by this Policy.
The following are the key definitions of the terms used in this document, as set out in Article 4 of the General Data Protection Regulation (GDPR), in order to familiarise data subjects with the terminology used in the Regulation:
Personal Data: Any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Special Categories of Personal Data: Personal data which, by their nature, are particularly sensitive in relation to fundamental rights and freedoms and therefore require specific protection, as their processing could create significant risks to fundamental rights and freedoms. Such personal data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.
Data Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Processor: The natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.
Processing: Any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Authority: The Hellenic Data Protection Authority.
As the Data Controller, U ACADEMY IKE strictly adheres to the data protection principles set out in Article 5 of the General Data Protection Regulation.
3.1. Lawfulness, Fairness and Transparency
U ACADEMY IKE processes personal data lawfully, fairly and transparently in relation to the data subjects.
3.2. Purpose Limitation
Personal data are collected only for specified, explicit and legitimate purposes and are not further processed for any other purpose.
3.3. Data Minimisation
U ACADEMY IKE maintains accurate personal data relating to data subjects and ensures that the data retained are limited to what is necessary in relation to the purposes for which they are processed. At the same time, it implements appropriate technical measures to achieve these objectives.
3.4. Accuracy
The personal data maintained by U ACADEMY IKE are accurate and kept up to date. Measures are taken to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified within a reasonable period of time.
3.5. Storage Limitation
Personal data are retained for no longer than is necessary for the purposes for which U ACADEMY IKE processes them.
3.6. Integrity and Confidentiality
Taking into account the state of technological development and other available security measures, the cost of implementation, as well as the likelihood and severity of risks to personal data, U ACADEMY IKE applies appropriate technical and organisational measures to process Personal Data in a manner that ensures an appropriate level of security and protects personal data against accidental destruction, loss, alteration, unauthorised or unlawful processing.
3.7. Accountability
U ACADEMY IKE is responsible for, and is able to demonstrate, compliance with the General Data Protection Regulation to the competent Data Protection Authority.
4.1. Information Provided to Data Subjects
Before or at the time personal data are collected for any processing activity undertaken by U ACADEMY IKE, including but not limited to the sale of products, provision of services or marketing activities, U ACADEMY IKE is responsible for providing data subjects with appropriate information, including information regarding the types of personal data collected, the purposes of processing, the methods of processing, the rights of data subjects in relation to their personal data, the retention period, any international transfers of data, whether personal data are disclosed to third parties as part of a business relationship, and the security measures implemented by U ACADEMY IKE to protect personal data.
This information is provided through the Privacy Notice.
4.2. Consent – Right to Withdraw Consent
Where the legal basis for the collection of personal data is the consent of the data subject, U ACADEMY IKE is responsible for ensuring that data subjects provide their consent freely, through a positive action, explicitly and with full knowledge of the content to which they are consenting.
U ACADEMY IKE provides data subjects with the opportunity to withdraw their consent at any time. Where personal data relating to children under the age of 16 are collected, U ACADEMY IKE ensures that parental consent has been obtained prior to collection.
Personal data must be processed only for the purpose for which they were originally collected. If U ACADEMY IKE wishes to process collected personal data for another purpose, it must obtain the data subject’s consent through an explicit and specific written procedure. Any such request must state the original purpose for which the data were collected, as well as the new or additional purpose(s).
4.3. Collection
U ACADEMY IKE makes every effort to ensure that the amount of personal data it collects is kept to the minimum necessary. Where personal data are collected from a third party, U ACADEMY IKE ensures that such data are collected lawfully.
4.4. Relationship Between U ACADEMY IKE and Third Parties
Where U ACADEMY IKE uses a third-party supplier or business partner to process personal data on its behalf, it ensures that the Data Processor provides appropriate security and data protection measures to address any potential associated risks.
U ACADEMY IKE makes every effort to ensure that its suppliers and business partners process personal data solely for the fulfilment of their contractual obligations towards U ACADEMY IKE, always in accordance with its instructions and for no other purpose.
4.5. Data Subjects’ Right of Access
As the Data Controller, U ACADEMY IKE is responsible for providing data subjects with a mechanism for accessing their personal data, which also allows them to review, correct, erase or transfer such data.
4.6. Data Portability
Data subjects have the right, upon request, to receive a copy of the data they have provided to U ACADEMY IKE in a structured format and to transmit those data to another Data Controller.
U ACADEMY IKE is responsible for ensuring that such requests are processed within one month, provided that the requests are not manifestly unfounded. When exercising their right to data portability, data subjects may request that their personal data be transmitted directly from one Data Controller to another, where technically feasible.
4.7. Right to Erasure (“Right to be Forgotten”)
Upon request, data subjects have the right to ask U ACADEMY IKE to erase their personal data. U ACADEMY IKE will promptly take the necessary measures, including technical measures, to satisfy the request and will ensure that the same is done by any third parties that use or process personal data on its behalf.
4.8. Right to Object
Data subjects have the right to object at any time to the processing of personal data concerning them, including profiling.
4.9. Right to Restriction of Processing
Upon request, data subjects have the right to ask U ACADEMY IKE to restrict the processing of their personal data in accordance with Article 18(1)(a)–(d) of the General Data Protection Regulation (EU) 2016/679.
4.10. Exercising Data Subject Rights and Withdrawing Consent
Data subjects may exercise their rights, as well as withdraw their consent, by submitting a written request to U ACADEMY IKE. Data subjects may freely withdraw their consent without affecting the lawfulness of processing based on consent prior to its withdrawal.
Written requests/letters or emails may be sent to: info@ustudies.gr
The Data Controller responsible for the processing of personal data is U ACADEMY IKE, based in Athens, at 1 Veranzerou Street, 10677 Athens, Greece.
Data subjects may also contact the Hellenic Data Protection Authority using the following details:
Website: www.dpa.gr
Email: contact@dpa.gr
Telephone: +30 210 6475600
Address: 1–3 Kifisias Avenue, 115 23 Athens, Greece
When U ACADEMY IKE becomes aware of a suspected or actual personal data breach, it will immediately conduct an internal investigation and take appropriate remedial measures within a reasonable period of time, in accordance with its Personal Data Breach Policy.
Where there is a risk to the rights and freedoms of data subjects, U ACADEMY IKE is required to notify the Authority of the personal data breach without undue delay and, in any event, within 72 hours.
If you continue to have any questions or require clarification regarding the processing of your personal data by U ACADEMY IKE, you can contact us, and U ACADEMY IKE will be pleased to assist you promptly.
