PRIVACY POLICY FOR BUSINESS DIGITAL ACADEMY
INTRODUCTION
This document (the “Privacy Policy”) is a legal document aiming to inform the Visitors/ Customers/ Participants/ Instructors (hereinafter the “Data Subject”) about their rights regarding the processing and protection of general and Personal Data, which come to the control of BDA, pursuant to the provisions of the Terms of Use or any other agreement between BDA and a Customer/ Participant/ Instructor.
This Privacy Policy explains the type of data which will be processed by the BDA, the type of processing and, it aims to inform the Data Subject about their rights and the available tools to control the processing of their Personal Data.
Please read carefully. By visiting the Website and/or subscribing and/or contacting BDA and/or purchasing a Product and/or accepting the delivery of a Product and/or submitting a Product, you agree with the terms of this Privacy Policy.
DEFINITIONS
“Access” means access to an Account and and/or a Learning Platform, by using login credentials and/ or by following a link and/or by using a code;
“Account” means an active account whereby a subscriber may peruse the available Products, place an order and/or purchase a Product, cancel a transaction, access the history of their transactions and update their profile information and/or submit a Product as an Instructor;
“Agreement” means the Terms of Use, the entire content of the Website and/or any terms embodied in a quotation provided by BDA at the Customer’s request;
“Cancellation Date” means the business day upon which a Party receives a cancellation notice by the other Party;
“Consent” means freely given, specific, informed and unambiguous consent given by the Data Subject, by which they authorise BDA to process their Personal Data in the course and during the use of the Website, the subscription to the Website, the purchase and/or the delivery of a Product and/or during any other communication or interaction between the Parties;
“Controller” means the natural or legal person, public authority, agency or other body, which, alone or jointly with others, determines the purposes and/or the means of the processing of Personal Data;
“Cross-border processing” means:
(A).processing of Personal Data which takes place in the context of the activities of establishments, in more than one Member State of a controller or processor in the Union, where the controller or processor is established in more than one Member State; or
(B).processing of Personal Data which takes place in the context of the activities of a single establishment of a controller or processor, in the Union but which substantially affects or is likely to substantially affect Data Subjects, in more than one Member State.
“Customer” means the legal entity or natural person, who subscribes to the Website and/ or purchases a Product in accordance with the Terms of Use and/or the terms of a quotation provided by BDA, at the Customer’s request;
“Data Subject” means the person who can be identified by the Personal Data disclosed to BDA. This term includes subscribers to the Website, purchasers of a Product and/or Participants and/or Instructors;
“Fee” means the remuneration paid by the Customer for the purchase of Product, pursuant to the Terms of Use and/ or the terms of a quotation provided by BDA at the Customer’s request;
“Intellectual Property Rights” means all Intellectual Property Rights, wherever in the world, whether registrable or unregistrable, registered or unregistered, including any application or right of application of such rights (including copyright and related rights, database rights, confidential information, trade secrets, know-how, business names, trade names, trade marks, service marks, passing off rights, unfair competition rights, patents and rights in designs);
“Learning Platform” means the learning platform zoom.us and other LMS Platforms used by BDA to deliver a Product;
“Online Order Form” means an electronic form, whereby the Customer declares their intention to purchase a Product, by filling in the mandatory fields and submitting the form to BDA;
“Parties” means BDA and the Customer/ Participant/ Instructor and, “Party” means either one of them;
“Participant” means the natural person to whom the Product is delivered, whenever the purchaser of a Product and the recipient of a Product are different persons ;
Pseudonymisation” is the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an identifiable person;
“Personal data” means any data relating directly or indirectly to a person, by which the person may be identified and which are disclosed by a Customer/ Participant/ Instructor to BDA, in the course of subscribing to the Website and/or submitting an Online Order Form and/or purchasing a Product and/or accepting delivery of a Product and/or submitting a Product as an Instructor ; Personal Data does not include any data that is anonymized, aggregated, de-identified or compiled on a generic basis and which does not name or identify a specific individual directly or indirectly;
“Personal Data Breach” means a breach of security, leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed;
“Processor” means the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller;
“Processing” means the collecting, recording, using, storing, amending, adapting, disclosing, transferring, transmitting, structuring, using, combining, deleting, destroying of any Personal Data disclosed to BDA by a Customer/ Participant/ Instructor, pursuant to the Terms of Use and/or the terms of a quotation provided by BDA at the Customer’s request;
“Profiling” means any form of automated processing of Personal Data, regarding the evaluation of certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, interests, reliability, behaviour, location or movements;
“BDA” means the company Thomas Poutas International Associates Ltd and/or any natural or legal person to whom BDA’s rights and obligations are assigned ;
“Product” means an online training course/program and/or a recorded seminar/webinar and/or a resource which is available for purchase on the Website and/or it is submitted by an Instructor to BDA;
“Recipient” means the person or legal entity, public authority, agency or another body, other than BDA, to whom the Personal Data are disclosed;
“Restriction of Processing” means the marking of stored Personal Data, with the aim of limiting their processing in the future;
“Subscription” means the submission of an electronic form through the Website, whereby the Customer/ Participant/ Instructor requests the creation of an Account;
“Instructor ” means a natural person who delivers a live training course/program and/or submits through their Account a recorded seminar/webinar and/or a resource to be delivered to Customers or Participants ;
“Terms of Use” means the document under the respective title, which is published on the Website, including the modifications made to this document, from time to time;
“Third Party” means the person or legal entity, public authority, agency or body other than the Data Subject, controller, processor and persons authorised by the processor or the controller and who processes Personal Data;
“Visitor’s Personal Data” means the Personal Data of Visitors;
“Visitor” means the natural person who navigates through the Website but has not yet subscribed to the Website;
“Website” means the website www.businessdigitalacademy.com;
GENERAL PRINCIPLES
(1) Each Party shall comply with the Data Protection Laws in respect to the processing of Personal Data of the Data Subject.
(2) The Customer warrants to BDA that they have the legal right and/or are duly authorized by the Data Subject to disclose all Personal Data they in fact disclose to BDA, pursuant to the Terms of Use or the terms of a quotation provided by BDA at the Customer’s request.
(3) Any Personal Data disclosed by the Customer and processed by BDA must be necessary for or related to the Parties Agreement.
(4) BDA shall only process the Personal Data of a Customer/Participant/ Instructor only for a period necessary to achieve the purpose of the processing or as far this is allowed by the European Legislation, to which BDA is subject to.
(5) If the Customer directs BDA to process Personal Data in a way that infringes the Personal Data laws, BDA shall inform the Customer promptly and decline to follow the instructions.
(6) BDA is hereby authorized by the Customer to assign the processing of Personal Data to Third Parties, who act as sub-processors on behalf of BDA.
(7) BDA shall assign the processing of Personal Data only to authorized persons, who have committed themselves to confidentiality.
(8) Whenever BDA employs independent contractors, vendors, suppliers (collectively as “Independent Contractors), BDA is obliged to:
(a) Protect the Personal Data which BDA processes under the Agreement in accordance with the Privacy Policy;
(b) Not use or disclose Personal Data, for purposes other than the purposes for which the Personal Data were disclosed to BDA;
(c) BDA shall ensure that the Independent Contractors operate .in compliance with GDPR.
(9) BDA shall use standard, industry-wide, commercially reasonable security practices, for the protection of Personal Data.
(10) BDA shall make available to a Data Subject the necessary information to demonstrate their compliance with Data Protection Laws.
(11) BDA will block and/or erase routinely any Personal Data for which the purpose of processing is not applicable and /or shortly after the expiration of the processing period.
(12) BDA is obliged, where possible, to apply Pseudonymisation of Personal Data, processed pursuant to the provisions of the Agreement.
(13) BDA shall confine the processing of Personal Data provided during the payment of a Fee, to the required processing for the completion of a transaction. BDA shall ensure that such Personal Data are erased immediately after the completion of the transaction.
(14) BDA shall not rent or sell Personal Data to Third Parties.
(15) BDA shall not disclose any Personal Data to any Third Parties, unless is so required by law or subpoena or if BDA reasonable believes that such action is necessary to:
(a).conform to the law or comply with legal processes served on BDA or affiliates or to investigate;
(b).prevent or take action regarding illegal activities;
(c).to enforce the Terms of Use or the terms of any quotation provided by BDA at the Customer’s request;
(d).take precautions against liability, to investigate and defend BDA against Third-Party claims or allegations, to assist government enforcement agencies;
(e).protect the security or integrity of the Website;
(f).exercise and protect the rights, property or personal safety of BDA or any other person, including but not limited to Visitors/ Customers/ Participants/ Instructors;
(16) In case of Personal Data Breach, because of security breach, BDA shall promptly notify the affected Data Subject, as required by law.
(17) In as much the content of the Website and the Products are not directed towards children, if BDA discovers that they collected Personal Data from a child under the age of 16 without parental consent, BDA shall delete the minor’s Personal Data, within and not later than 30 days from the date of discovery.
RIGHTS OF THE DATA SUBJECT
RIGHT OF CONFIRMATION
The Data Subject has the right to obtain from the Controller a confirmation, as to whether or not the Data Subject’s Personal Data are being processed by the Controller.
RIGHT OF ACCESS
(1) The Data Subject has the right to know which Personal Data are being processed by the Controller and to be informed in writing by the Controller.
(2) Additionally, the Data Subject may request to be informed about:
(a) The purpose of the processing;
(b) The categories of Personal Data that are being processed;
(c) The Recipients or categories of Recipients to whom the Personal Data have been or will be disclosed;
(d) The envisaged period for which the Personal Data will be processed and, if the period cannot be determined, the Controller shall inform the Data Subject as to the criteria applied to determine the period;
(e) The existence of the right to request from the Controller rectification or erasure of Personal Data or restriction of processing of Personal Data concerning the Data Subject;
(f) The right to lodge a complaint with a supervisory authority;
(g) Where the Personal Data are not collected from the Data Subject, any available information as to their source;
(h) The existence of automated decision-making, such as profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences for the
Data Subject.(3) In case that Personal Data are transferred to a third country or to an international organisation, the Data Subject has the right to be informed about the appropriate safeguards in relation to the transfer.
(4) The Controller shall provide a copy of all Personal Data undergoing processing. For any further copy the Controller may request reasonable fee based on administrative cost. If the Data Subject’s request is submitted electronically, the information shall be provided in commonly used electronic form.
RIGHT TO RECTIFICATION
The Data Subject may request the rectification of inaccurate, incomplete or false Personal Data.
RIGHT TO BE FORGOTTEN
The Data Subject may request and obtain by the Controller the erasure of their Personal Data and, the Controller shall erase such Personal Data, provided that at least one of the following grounds applies and that the processing is no longer necessary:
(a) The Personal Data are no longer necessary for the purposes or activities for which they were collected or otherwise processed;
(b) The Data Subject withdraws their consent under the provisions of GDPR and there is no other legal ground for the processing;
(c) The Data Subject objects to the processing pursuant to the provisions of GDPR and there are no overriding legitimate grounds for the processing;
(d) The Personal Data has been unlawfully processed;
(e) The Personal Data must be erased for compliance with a legal obligation of the Controller to which the latter is subject.
RIGHT OF RESTRICTION OF PROCESSING
The Data Subject may obtain restriction of processing by the Controller, provided that one of the following grounds apply:
(a) The accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data;
(b) The processing is unlawful and the Data Subject opposes to the erasure of the Personal Data and requests the restriction of their use instead.
(c) The Controller no longer needs the Personal Data for the purposes of the processing but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
(d) The Data Subject has objected to the processing pursuant to Article 21(1) of the GDPR, while the verification of the Controller’s legitimate grounds overriding those of the Data Subject, is pending.
RIGHT TO DATA PORTABILITY
(1) The Data Subject has the right to receive their Personal Data which are being processed by the Controller in a structured, commonly used and machine-readable format.
(2) The Data Subject has the right to transmit those Personal Data to another controller without hindrance from the Controller, provided that:
(a) the processing is based on consent or a contract;
(b) the processing is carried out by automated means
(c) the processing is not necessary for the performance of a task carried out in the public interest or in exercise of official authority vested in the Controller.
(3) Furthermore, the Data Subject has the right to have their Personal Data transmitted from one controller to another, provided that this is technically feasible and that such action does not affect adversely the rights and freedoms of others.
RIGHT TO OBJECT
(1) The Data Subject shall have the right to object at any time to the processing of their Personal Data and/or profiling, on grounds relating to their situation.(2) Whenever a Data Subject objects to the processing of their Personal Data and/ or to profiling, BDA shall no longer process their Personal Data, unless BDA demonstrates compelling legitimate grounds for the processing. Such grounds must override the interests, rights and freedoms of the Data Subject and/or the processing must be necessary for the establishment, exercise or defence of legal claims for/against BDA.
(3) Whenever BDA processes Personal Data for direct marketing purposes, the Data Subject has the right to object, at any time, to the processing for such purposes. This includes profiling to the extent that it is related to such direct marketing. If the Data Subject exercise their right, BDA shall cease the processing for such purposes.
(4) Furthermore, the Data Subject shall have the right to object to the processing of their Personal Data, when such processing relates to scientific or historical research purposes or statistical purposes, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
AUTOMATED INDIVIDUAL DECISION-MAKING, INCLUDING PROFILING
(1) The Data Subject shall have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning the Data Subject or similarly affects them, provided that:
(a) The decision is not necessary for entering into, or for the performance of a contract between the Parties;
(b) The decision is not authorised by the European Union or Member State law to which the Controller is subject, and which also lays down suitable measures to safeguard the Data Subjects rights and freedoms and legitimate interests;
(c) The decision is not based on the Data Subject’s explicit consent.
(2) If the decision is necessary for entering, or for the performance of a contract between the Parties or it is based on the Data Subject’s explicit consent, BDA shall implement suitable measures to safeguard the Data Subject’s rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express their point of view and contest the decision.
RIGHT TO WITHDRAW DATA PROCESSING CONSENT
The Data Subject shall have the right to withdraw their consent to processing its Personal Data at any time.
PERSONAL DATA PROCESSING BY BDA
TYPE OF PERSONAL DATA PROCESSED
1. BDA processes Personal Data which are necessary for the following actions:
(a) use of the Website;
(b) subscription and access to an Account;
(c) purchase/delivery of a Product;
(d) billing;
(e) communication between BDA and the Data Subject;
(f) termination of a contract;
(g) cancellation of a purchase;
(h) to issue a refund.
2. BDA processes information such as name, surname, telephone number, addresses and e-mail address, job position of the Data Subject. Any correspondence between BDA and the Data Subject may be retained by BDA, only for purposes stipulated in the Data Protection Laws.
PROCESSING OF PERSONAL DATA
1. When a Customer/ Instructor successfully subscribes to the Website, their Personal Data are collected through the online forms provided by BDA. Invariably, the subscriber is required to consent to the processing of their Personal Data, before the subscription is completed. Consent is a pre-requisite for a successful subscription and for the creation of an Account. Thereafter, BDA creates an Account, through which the subscriber may access, update and/or rectify the Personal Data which are processed by BDA. Additionally, BDA may collect Personal Data of Participants through disclosure by the Customer. The Customer warrants that they have obtained the Participant’s consent for such disclosure. Afterwards, BDA transmits the Personal Data to the Controller.
2. Personal Data are collected and stored by BDA for internal use, exclusively. Any further transfer by the Controller to one or more processors must be for purposes attributable to BDA.
3. BDA processes Personal Data of a subscriber and/or Participant for as long as the Account of the Data Subject is active, irrespective of any purchases, delivery of Products and/ or interactions of the Data Subject with BDA. The Data Subject may request the deletion of their Account, by sending a written notice to BDA’s Designated Address, whereby they explicitly declare their request. Provided that any outstanding obligations between the Parties are settled, BDA shall cease the processing of the Data Subject’s Personal Data and delete the Account promptly and not later than 30 calendar days from the date of the request.
4. Regarding the processing of Participant’s Personal Data, an explicit consent of the Participant is requested at the first log in to the Participant’s Account. In case of refusal, BDA shall cease the processing of the Participant’s Personal Data and, delete the Account promptly and not later than 30 calendar days from the date of refusal.
5. BDA may use the email address of the Data Subject to send Product related notices, newsletters, special offers, provided that the Data Subject ticks the opt-in checkbox when subscribing or at the first log in to the Account (in case of a Participant). The Customer may withdraw their consent for such processing of their Personal Data, at any time, by clicking the relevant link contained in each notice given by BDA.
6. Any processing of Personal Data obtained and processed by BDA as stipulated herein, must be necessary to identify the person or legal entity subscribing, purchasing a Product, receiving delivery of a Product or acting as an instructor. The Data Subject is free to change their Personal Data, at any time, or to have them completely deleted, provided that any outstanding obligations between the Parties are settled.
7. BDA may process Personal Data of a Data Subject, despite the expiration of the 30-day period mentioned above, provided that the Data Subject has explicitly consented to such processing by BDA for promotional and/or advertising purposes. The Data Subject may withdraw their consent to such processing, by clicking the relevant link attached on any notification sent by BDA, for promotional and/or advertising purposes.
PROCESSING OF GENERAL DATA AND INFORMATION
1. The general data and information collected by BDA are necessary to deliver the content of the Website, to optimize the content of the Website, to ensure the viability of the information technology system and the Websites technology and to assist law enforcement authorities with necessary information for criminal prosecution, in case of cybercrimes.
2. BDA uses “cookies”, every time a Visitor visits the Website and/or a Customer/ Participant/ Instructor logs in to their Account and/or purchases a Product and/or receives delivery of a Product and/or submits a Product (applicable to Instructors). Additionally, BDA provides custom, personalized content and information, monitor the effectiveness of the Website and/or the aggregate metrics such as total number of Visitors and traffic, diagnoses or fixes technology problems reported by Visitors/ Customers/Participants/ Instructors and help the Data Subject efficiently access their information.
3. Visitor/ Customers/ Participants/ Instructors may opt to disable or control the “cookies”, by setting a preference within their browser.
4. The Website may collect general data such as browser types and versions used, operating system used by the accessing system, the websites from which an accessing system reaches the Website, the sub-websites, the date and time of access to the Website, the IP address of a Visitor/ Customer/ Participant/ Instructor and/or any other similar data and information that may be used in the event of attacks on the information technology systems of BDA.
5. The Visitor/ Customer/ Participant/ Instructor hereby grants BDA a non-exclusive licence to collect, store, copy, reproduce, distribute, publish export, adapt, edit and translate their general data, to the extent reasonably required for the performance of BDA’s obligations and for the exercise of BDA’s rights. The Visitor/ Customer/ Participant/ Instructor also grants BDA the right to sub-license these rights to their hosting, connectivity and telecommunication service providers, to the extent reasonably required for the performance of BDA’s obligations and the exercise of BDA’s rights, subject to the national and European Legislation, regulating the protection of Personal Data and, subject to any express restrictions provided in the Privacy Policy and /or the Terms of Use and/or the terms of a quotation provided by BDA at the Customer’s request. The Visitor/ Customer/ Participant/ Instructor agrees and consents to cross-border processing of such General data and information.
6. The general data analysis is conducted anonymously and statistically and, it aims to increase the data security and data protection of the Website.
DISCLAIMER
BDA shall not be responsible and does not undertake any duty to protect any Personal Data voluntarily disclosed by the Data Subject in public areas and/or public bulletin boards and/or in public classified advertisement within the Website and/or the Learning Platforms. Additionally, BDA will not be responsible and/or liable for any processing of Personal Data of the Data Subject which the Data Subject has voluntarily disclosed in their Messages, Groups or in the Profile Page within the Website and/or the Learning Platforms.
BDA shall not be responsible for the protection and processing of Personal Data of the Customer/ Participant/ Instructor on the Learning Platform, where the Product will be delivered. Data Subject is advised to read carefully the Privacy Policy of each Learning Platform they access
DENIAL OF DISCLOSURE
The Visitor/ Customer/ Participant/Instructor may object to the processing of their Personal Data, in which case BDA may not be able to perform their obligations stipulated in the Terms of Use and/or the terms of a quotation provided by BDA at the Data Subject’s request.
CONTACT IN CASE OF QUESTIONS OR REQUESTS REGARDING PRIVACY POLICY
If the Data Subject wishes to exercise any of the above rights, they may contact directly the BDA’s Protection Officer or another employee of the Controller at info@businessdigitalacademy.com, at any time.
