Online Privacy Policy

CEPRES International University provides the following information relating to your privacy when using websites in the ciu.edu.lr domain. This privacy policy covers all ciu.edu.lr websites unless otherwise indicated on a specific website.

Online Privacy Notice

This Online Privacy Notice (“Notice”) applies to the Personal Information that CEPRES International University (“CEPRES”, “we”, “us”, “our”) – as data controller – collects when you visit CEPRES’s main website (www.ciu.edu.lr) and other websites that we own or control and link or refer to in this Notice (together, the “Sites”), including mobile applications and through communications such as subscription to newsletters and email updates.

This Notice describes the types of Personal Information we collect, purposes for which we collect it, other parties with whom we may share it, measures taken to protect your personal information and your rights, and choices that are available to you regarding the use of the Personal Information and how you can contact us about our privacy practices.

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. This Notice does not apply to information collected from or about current or former employees, contractors, volunteers, postdoctoral fellows, and other workers of CEPRES International University (“Workers”) as part of or in the context of their employment or working relationship with CEPRES, unless otherwise indicated on the Sites. This Notice also does not apply to and we are not responsible for the privacy practices or information of any third parties, including any third-party operating websites to which our Sites contain a link.

Contents

Personal Information we collect and process
Marketing
Legal Basis for Processing
Sharing your Personal Information
International Transfer of Personal Information
Individual Privacy Rights
Access and Choice
Document Retention
Information Security
Third-Party Links
Contact Information
Updates to Notice
Effective Date

1. Personal Information we collect and process

When you access or use the Sites, we may collect and process the following types of information from you:

Personal Information:

“Personal Information” is any information that we can reasonably use to directly or indirectly identify you. If you are located in the European Economic Area (EEA) or the United Kingdom (UK), Personal Information includes all Personal Data as defined under EEA and UK data protection laws.

We collect the following Personal Information from you when you provide it to us:

Identification information, such as your first name, last name, demographic information, other relevant biographic information, postal address, email address, phone number, any other relevant contact details, CEPRES unique ID, user account(s) on our Sites (including login), and passport number.
Information related to your application, such as information related to your application for admission (including your educational history, personal statements, reference letters, any other relevant information provided in your application), and information related to your visa application.
Information related to your student life, such as your courses, programs and training (including online/hybrid courses, programs and training), housing and/or dining status, travels through CEPRES’s programs, and alumni status.
Financial and banking information, such as your salary history, tax forms, any relevant financial information to evaluate and determine your eligibility for financial aid opportunities, and payment information.
Information related to your donation, such as the amount of your donation, affiliation to CEPRES, giving history, and legal documentation related to your donation.
Information related to your exchanges with CEPRES, such as date, hour, and subject of your request, exchanges with CEPRES’s services, and preferred means of communication.

Information Received from Third Parties:

We collect your Personal Information from third parties, including other schools, references, family members, and education partners where authorized by the data protection laws.

In compliance with the data protection laws, we may collect information about you from other companies and organizations, including public databases, social media platforms, our third-party marketing partners, or various independent organizations. For example, we may collect public information about you when you interact with us through social media.

Automatically Collected Personal Information:

Whenever you visit or interact with our Sites, we may use a variety of technologies that automatically or passively collect information about your online activity. This information may be collected in the following ways:

Through your browser: Certain information is collected by most browsers, such as your IP address and Internet browser type and version. Your “IP address” is a number that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP Address is identified and logged automatically whenever a user visits the Sites, along with the time of the visit and the page(s) that were visited. We use IP addresses for purposes such as calculating Site’s usage levels, helping diagnose server problems, administering the Sites, and presenting content that is tailored to your country.
Through Cookies: Cookies allow a web server to transfer data to a computer for recordkeeping and other purposes. We use cookies and other similar technologies to, among other things, better serve you with more tailored information and to facilitate your ongoing access to and use of the Sites. If you do not want your information collected by cookies and other similar technologies, please refer to our Cookies Policy. Some features of the Sites may not work properly if you decline the use of cookies and other similar technologies. To learn more about cookies, please visit http://www.allaboutcookies.org/.
Through pixel tags, web beacons, clear GIFs, or other similar technologies: These may be used in connection with some Sites pages and HTML-formatted email messages to, among other things, track the actions of Site users and email recipients, and compile statistics about Sites usage and response rates.
From you: Information such as your location, as well as other information, such as your preferred means of communication, is collected when you voluntarily provide this information.

Sensitive Personal Information:

“Sensitive Personal Information” includes special categories of Personal Information (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation) for which the applicable data protection laws provide enhanced protections.

In compliance with the applicable data protection laws, we may collect Sensitive Personal Information such as race/ethnicity, and certain financial information when you provide it to us for purposes described above, including as part of your application package for graduate or undergraduate admissions or financial aid opportunities. We do not sell or use your Sensitive Personal Information for targeted marketing purposes, and only use your Sensitive Personal Information as permitted by the applicable data protection laws.

Refusing or Withdrawing Consent:

Data protection laws that apply to you may let you refuse to consent to our proposed collection, use, or disclosure of your Personal Information.

When we need to process your Personal Information as part of your relationship with us, we usually do not process it based on your consent. But if we have asked for consent, you have the right to withdraw consent at any time. If you withdraw consent, this doesn’t affect the lawfulness of the processing before you withdrew consent. To withdraw consent, please contact us in writing using the information in the “Contact Us” section below. However, if you withdraw your consent, we may not be able to adequately provide you the assistance or services you requested.

Anonymity:

If you are located in Australia, you have the option to remain anonymous, where practicable. However, if you do not provide us with the Personal Information we require for processing, we may not be able to adequately provide you the assistance or services you requested.

Failure to Provide Personal Information:

If you fail to provide certain Personal Information when requested or if you withdraw consent to processing, we may not be able to perform the contract we have entered with you (where applicable), we may not be able to process your request, or we may not be able to properly comply with legal obligations (i.e., tax reporting). If this is the case, we may have to stop providing you any services or assistance. If we need to process requested Personal Information to provide you a service or fulfill our obligations to you, we will tell you that in the event you do not provide your consent for us to process that Personal Information where authorized by the data protection laws that apply to you.

2. Marketing

Personal Information you submit through our Sites, such as your name, address, and other contact information, may be collected by CEPRES for internal marketing and development purposes as well as to respond to your inquiry, complete a transaction for you, or fulfill other forms of customer service. Where required by applicable data protection laws, we will obtain your consent prior to sending you marketing communications. You can choose not to receive marketing emails from us by “unsubscribing” using the instructions in any marketing email you receive from us.

3. Legal Basis for Processing

All processing and use of your Personal Information is justified by a “legal basis” for processing. In most cases, processing will rely on one of the following legal bases:

Take steps prior to entering into a contract or contract performance: The processing is necessary to perform a contract with you or take steps prior to entering into a contract at your request, such as to fulfill a specific request, or to provide information about our services you have requested;
Legal obligation: The processing is necessary for us to comply with legal and jurisdictional obligations (i.e. EEA, UK, Australia, Brazil or China) to which we are subject such as keeping accounting records;
Legitimate interests: The processing is in our legitimate interests or the legitimate interests of a third party, which are not overridden by your interests and fundamental rights and freedoms; or
Consent: You have consented to the processing.

We use the Personal Information we collect for the purposes we described above relying on the following legal bases:

Contract performance – to create and manage your account(s) on our Sites; to manage your admission if your application is successful; to manage your student record and your education at CEPRES; to provide you with the services offered by CEPRES (e.g. housing and dining services, wellness program, IT or helpdesk services, events organized by CEPRES or its partners, etc.) and to manage any payment related to such services; and to manage the donations.
Legal obligation – to process your visa application where required for employment or travel; to comply with legal, regulatory and jurisdictional obligations to which CEPRES is subject; and to process your request when you exercise your rights in accordance with the data protection laws that apply to you.
Legitimate interests – to evaluate your candidacy for admissions and visa (where relevant); conduct internal analyses and collect statistics (with your consent where required); evaluate financial aid eligibility; facilitate provisioning, administration, instruction and quality improvement of educational platform use, courses, learning and teaching; inform registrants about research opportunities; inform the current CEPRES student about wellness programs, courses, activities and facilitating enrollment to such programs; provide information and processing applications for employment opportunities; if you are a current CEPRES student, to distribute brochures, newsletters and other requested communications; manage the alumni network; personalize your user experience on our Sites (with your consent when required), to improve our Sites, their services and your user experience; ensure the security of our Sites; and manage any pre-litigation and litigation.
Consent – to send you CEPRES’s newsletters and any other electronic communications that might interest you where your consent is required for such communication; and process your personal information if the data protection laws that apply to you expressly require your consent for such processing, including the processing of the Sensitive Personal Information.

4. Sharing your Personal Information

We share your information internally at CEPRES to facilitate and manage the purposes listed above. This includes third parties whom CEPRES engages to process your Personal Information on our behalf for the purposes stated above, such as vendors who help CEPRES with our marketing, application processing, IT services, and web hosting.

CEPRES may also share your Personal Information with government and law enforcement agencies, regulators or other relevant authorities to 1) comply with a legal process, subpoena, order or other legal or regulatory requirement applicable to us; 2) enforce our terms of use or other policies; or 3) pursue available legal remedies or defend against legal claims.

CEPRES may also share your Personal Information with lawyers and all interested parties, but exclusively in the case of the management of possible disputes and other legal matters where appropriate.

CEPRES may share your Personal Information following or during a restructuring, reconstitution, acquisition, debt financing, merger, sale of assets of CEPRES or a similar transaction, as well as in case of insolvency, bankruptcy or receivership where personal information is transferred to one or more third parties as assets of CEPRES.

Other third parties as you may so request as permitted by this and other CEPRES policies and applicable laws and regulations.

CEPRES does not sell any Personal Information, including Personal Information of minors, to third parties for their use in direct marketing, advertising, or promotion of their products or services.

5. International Transfer of Personal Information

Personal information that you provide to us may be transferred and stored in countries other than your home country such as the United States (U.S.), where applicable data protection laws may differ from those of your home country. By providing us with your information you acknowledge that your information will be transferred to the U.S. and processed and stored on servers in the U.S. Your Personal Information may also be processed by employees or by other third parties who work for us, or by the representatives and employees or Workers of CEPRES located outside your home country.

If we transfer your Personal Information to third parties located in other countries, we will only do so if the third party offers an adequate level of protection under the data protection laws that apply to you and by implementing the appropriate safeguards where required.

In addition, we take all reasonable steps to protect your privacy in accordance with the applicable data protection laws.

We only share your Personal Information with third parties who adequately implement appropriate technical and organizational measures and who guarantee the protection of your rights as required under the laws that apply to you.

If you live in the EEA, UK, Australia, Brazil or China, if we transfer your Personal Information out of your respective area, and that area has not been deemed to provide an adequate level of protection for Personal Information, we will ensure the appropriate safeguards are implemented such as using standard contractual clauses or contracts approved by the data protection laws or the relevant authorities which gives Personal Information the same protection it has in your home country or ensure there is some other protections in place which has been approved by the law giving Personal Information the same protection it has in your home country.

6. Individual Privacy Rights

Under certain circumstances, you have rights under the data protection laws that apply to you in relation to your Personal Information. You have the right to:

a. Know What Personal Information We Have: You may have the right to know what Personal Information is being collected about you, whether it is disclosed, and to whom (as provided in this Notice). If you are located in China and if you have questions, you have the right to ask that we explain Personal Information handling rules and policies to you.
b. Access Your Personal Information: You can request access to your Personal Information. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the Personal Information we have about you. Your right to access the Personal Information that we hold about you is not absolute. There are instances where the applicable laws or regulatory requirements allow or require us to refuse to provide some or all the Personal Information we hold about you. If we cannot provide you with access to your Personal Information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
c. Modify or Update Your Personal Information: We aim to ensure that Personal Information in our possession is accurate, current, and complete. If you believe that the Personal Information about you is incorrect, incomplete, or outdated, you may request the correction or update of that information. We will use reasonable efforts to revise it and, if required by the data protection laws that apply to you, to use reasonable efforts to inform other third parties if applicable, so records in their possession may also be corrected or updated. However, we reserve the right not to change any Personal Information we consider accurate or if it is necessary for our records.
d. Erasure of Your Personal Information: You may ask us to delete or remove Personal Information where there is no legal reason for us to continue using it. You also have the right to ask us to delete or remove your Personal Information where:
- You object to the processing of your Personal Information, and there are no overriding legitimate reasons justifying to maintain the processing of your Personal Information (e.g., legal obligation);
- You object to marketing activities;
- You decide to withdraw your consent on which the processing is based;
- Your Personal Information is no longer useful for the original purposes for which it was collected or for any other type of processing;
- The use that is made of your Personal Information does not comply with the applicable legal or regulatory obligations.
Please note that we may not always be able to comply with your request of erasure for specific legal reasons including complying with legal obligations, pursuit of legal action, detection and monitoring of fraud or for the performance of a task in the public interest. We will notify you, if applicable, at the time of your request. To the extent possible and where required by the data protection laws that apply to you, we will inform any third parties we might have shared your Personal Information with of your deletion request. If you are in Brazil and believe we are processing unnecessary or excessive Personal Information, you may ask us to anonymize, block, or delete your personal information.
e. Object to Processing of Your Personal Information: You may have the right to object to us processing your Personal Information in certain circumstances. This right applies when we are processing your Personal Information based on a legitimate interest (or those of a third party), which you may challenge if you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. However, in some cases, we may demonstrate that we have compelling legitimate grounds to process your Personal Information or legal obligations which override your rights and freedoms.
f. Restrict Processing of Your Personal Information: You may have the right to request restricted processing of your Personal Information which if applicable, we will limit the processing if you dispute the accuracy of the Personal Information, your Personal Information was processed unlawfully and you request a limitation on processing, rather than the deletion of your Personal Information, we no longer need to process your Personal Information, but you require your Personal Information in connection with a legal claim, or you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists. You may also have the right to ask us to limit our processing of your Sensitive Personal Information to what is necessary to our relationship with you. While CEPRES’s practices are to restrict processing of your Sensitive Personal Information to what is strictly necessary at all times, you are welcome to make a request by contacting us.
g. Data Portability: You may request that we transfer your Personal Information to you or a third party where technically feasible. We will provide to you, or a third party you have chosen, your information in a structured, commonly used, machine-readable format. Please note this right only where the processing of your Personal Information is based on your consent or required for the performance of a contract and the processing is carried out by automated means (paper files are therefore not included). Your request will only relate to your Personal Information (excluding anonymous or third-party Personal Information) and your request must not adversely affect the rights or freedoms of others, in particular those of CEPRES (e.g., trade secret) or any third party (e.g., intellectual property, recommendation letters that you previously agreed would remain confidential).
h. Opt Out of Marketing: You may opt out of receiving future electronic marketing messages from CEPRES and request that we not share your Personal Information with unaffiliated third parties. If you are in India or China, you may opt out of the collection of your Personal Information by contacting us. However, we may not be able to adequately provide you assistance or services you requested.
i. Automated Decision Making: In Brazil, China, UK or the EEA, you have the right to not be subject to decisions based solely on automated processing and not be subject to decisions with a legal or similarly significant effect (including profiling) that are based solely on the automated processing of your Personal Information, unless you have given us your explicit consent or where they are necessary for a contract with us. You can request to have a human review an automated decision made by automated means (if applicable) and ask us to explain the automated decision-making process.
j. Withdraw Consent: You have the right to withdraw any consent you may have previously given us at any time. If you withdraw your consent, this will not affect the lawfulness of our collecting, using and sharing of your Personal Information up to the point in time that you withdraw your consent. Even if you withdraw your consent, we may still use your information that has been fully anonymized and does not personally identify you.
k. Right to Make a Complaint: If needed, you have a right to file a complaint related to our Personal Information practices or file a complaint to your country’s supervisory authority (e.g., Canada’s Office of the Privacy Commissioner, Australian Privacy Commissioner, Brazil’s National Data Protection Authority, the United Kingdom’s Information Commissioner’s Office, an EEA specific country supervisory authority, or China’s Cyberspace Administration) if you believe we have not processed your Personal Information in compliance with the data protection laws and principles that apply in your home country.
l. Non-Discrimination: We do not discriminate against people who exercise their privacy rights.

Making a Request:

If you wish to contact us in connection with the exercise of your rights listed above, please email us at privacy@ciu.edu.lr. Please include your name, address, email, phone number, and the specific type of request you would like to make (a request to know, erase, opt out, etc.). Current CEPRES students should open a case at https://privacyrequest.ciu.edu.lr/.

We will respond to your written request without unreasonable delay and in accordance with any deadlines imposed by the data protection laws that apply to you and without making our other data less secure or changing our data.

Unless specific circumstances, we will not charge you any fee in connection with the exercise of your rights. If we are not able to honor any part of your request, we will notify you in our response as well as the reason we cannot do so.

To protect you and your information, we may ask you to confirm certain information before we honor your request. For example, where permitted by the data protection laws, we will ask you to confirm your name, email address, and phone number to verify your identity, so that we can help protect your information.

7. Access and Choice

CEPRES students can manage privacy settings for their directory information in Axess. Faculty, staff and other CEPRES affiliates can manage their privacy settings in CEPRESYou.

You can choose not to receive emails from us by “unsubscribing” using the instructions in any email you receive from us. This will not stop us from sending emails about your account or your transactions with us.

8. Document Retention

To the extent permitted by applicable law, we keep your Personal Information for as long as needed to fulfill the particular purpose for which it was collected and in accordance with this Notice. We may also retain your Personal Information if legally required or to fulfill a legitimate interest or another lawful basis for retaining the information beyond the period which is necessary, including a legal action. If the legal basis is based solely on consent, we will delete the Personal Information once consent is withdrawn.

9. Information Security

CEPRES takes the security of your personal information seriously. We protect your information using security measures including physical, administrative and technical safeguards to reduce the risk of loss, misuse, unauthorized access, disclosure or modification of your information. Our minimum security standards can be found at: https://uit.ciu.edu.lr/guide/securitystandards.

10. Third-Party Links

Our Sites may include links to third-party websites and services that we do not operate. If you visit a third-party website or service via a link on our Sites, you are subject to that third party’s privacy practices and policies. This Notice does not apply to any Personal Information that you provide to third-party websites or services. A link to a third-party website or service does not mean that we endorse that third party or the quality or accuracy of the information presented on its website or service.

11. Contact Information

For more information on how we collect and process your Personal Information, or if you have any complaints please contact privacy@ciu.edu.lr. Current CEPRES faculty, staff and students should open a case at https://privacyrequest.ciu.edu.lr/.

12. Updates to Notice

CEPRES reserves the right to modify this Notice at any time. If we make any material changes to this Notice, we will provide you notice on our Site and make it available at privacy.ciu.edu.lr. Where we are required by the applicable data protection laws, we will also seek your consent to any material changes that affect how we use your personal information.

13. Effective Date

The effective date of this Notice is May 15, 2024.