Data Processing Notice for Trainers and Trainees of the

Centre for Training & Lifelong Learning

of the University of Piraeus

 

Controller

The Centre for Training and Lifelong Learning (KEDIVIM) of the University of Piraeus (hereinafter the «Organisation»), based in Piraeus (80 M. Karaoli & A. Dimitriou St.), telephone (+30) 210 4142481 and email kedivim@unipi.gr, as Controller, informs you about the processing it carries out. In particular, KEDIVIM carries out processing in the context of its mission to offer Training and Lifelong Learning Programmes in the wider range of subject areas covered by the Departments of the University of Piraeus. The Organisation attaches particular importance to the protection of your personal data. For this reason, it has drawn up this Data Protection Policy in order to inform you about how your personal data are collected, used and disclosed. Please read this text to be informed in detail about the terms of the processing of your data, as provided for in the General Data Protection Regulation (EU) 2016/679 (hereinafter the «GDPR»). To participate in these Programmes and to be awarded certificates, you must submit personal data to KEDIVIM. In addition, to express interest in KEDIVIM Programmes, you must submit your personal email address.

Collection and Processing of personal data

To fulfil our obligations as a provider of Training and Lifelong Learning Programmes, we process the personal data of trainers, prospective trainers, trainees and prospective trainees, which are either collected directly from you or drawn from the Organisation’s Trainers’ Register. In addition, within the scope of the above responsibilities, the Organisation will integrate the Integrated Distance Training Information System (OSTK), which will be the central point for submitting applications and participating in distance training programmes. Through this system, each user will be continuously informed of all the educational activities, certifications and training offered by the Organisation. The table below sets out in detail the categories of personal data we process for each processing purpose, the legal basis of the processing, the recipients of the personal data and their retention period:

Data categories	Purpose	Legal Basis	Recipients *please note that processing is carried out by the competent Department of KEDIVIM Specifically, it is carried out for the following categories of recipients	Retention Periods
Data of trainers and prospective trainers: Expression of interest data (full name, email)	Informing you in the future about the same or a related subject area	Art. 6(1)(a) GDPR[1]	1. Microsoft Corporation INC (Outlook) 2. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 3. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	Until consent is withdrawn and in any case for up to 20 years from subscription to newsletter services
Trainer data: 1. Basic personal details (full name, telephone, email) 2. Employment data (e.g. role/position) 3. Programme-related data 4. CV data (CVs of teaching staff) 5. Financial data (fees, where a natural person can be identified)	Development of new training programmes	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Board 2. Third parties (e.g. expert for an opinion) 3. Ministry of Education 4. Senate 5. Governing Board of the Institution 6. Research Committee / University of Piraeus Research Centre (UPRC) 7. Principal Investigator 8. Academic Coordinator 9. Microsoft Corporation INC (Outlook) 10. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 11. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 12. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years
Trainer and trainee data: 1. Basic personal details (full name, telephone, email) 2. Employment data (e.g. role/position) 3. Programme-related data (programme title, duration, certification, type of learning: in-person, distance or blended) 4. Assessment data 5. Financial data (participation fee)	Implementation of a Training Programme	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Board 2. Research Committee / University of Piraeus Research Centre (UPRC) 3. Microsoft Corporation INC (Outlook) 4. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 5. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 6. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years. In particular, the Training Programme Certificate, the Training Certificate Annex, the Certificate of Successful Completion and the Certificate of Attendance issued upon completion of a training programme are kept indefinitely, for reasons of public interest
Trainer data: 1. Basic personal details (full name, date of birth, gender, address details, telephone, email, father’s name) 2. Unique identifiers (ID card number, Tax ID (AFM), Social Security Number (AMKA), trainer register number) 3. CV data (certified trainer registered in the EOPPEP adult trainer registers, certified trainer registered in the LAEK (OAED) trainer registers, certified trainer registered in another trainer register, teaching experience, work experience) 4. Financial data (trainer fees) 5. Assessment data 6. Education data (e.g. degree, year awarded, institution, master’s degree, doctorate, foreign language, computer skills, training (from public and/or private bodies)/hours/body, publications)	Management and Monitoring of the KEDIVIM Trainers’ Register	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Director of Training and Lifelong Learning of KEDIVIM 2. Microsoft Corporation INC (Outlook) 3. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 4. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 5. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years
Data of trainees and prospective trainees: 1. Basic personal details (full name, date of birth, gender, address details, telephone, email, father’s name, tax office) 2. Unique identifiers (Tax ID (AFM)) 3. Education data (e.g. level of education, training programme) 4. Financial data (training programme participation fee/payments) 5. Assessment data 6. Employment data (occupation)	Enrolment of trainees in KEDIVIM training programmes	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Principal Investigator of the Training Programme 2. Academic Coordinator of the Training Programme 3. Training Programme Secretariat 4. Research Committee / University of Piraeus Research Centre (UPRC) 5. Director of Training and Lifelong Learning of KEDIVIM 6. Microsoft Corporation INC (Outlook) 7. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 8. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 9. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years
Trainee data: 1. Basic personal details (full name, father’s name) 2. Education data (title of the programme or teaching/thematic unit, duration, type of certificate or attestation awarded, certificate number)	Issue of Certificates	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Principal Investigator of the Training Programme 2. ELKE of the University of Piraeus 3. Microsoft Corporation INC (Outlook) 4. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 5. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 6. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	Indefinitely
Trainee data: 1. Basic personal details (full name, telephone, address, email) 2. Data related to the request/complaint	Monitoring and handling of trainee requests/complaints and objections	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Secretariat of the training programme attended 2. KEDIVIM Secretariat 2. KEDIVIM Quality Management Office 3. Principal Investigator 4. Chair of KEDIVIM 5. Board 6. Trainers 7. Microsoft Corporation INC (Outlook) 8. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 9. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 10. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years
Trainee data: 1. Basic personal details (email, gender, age range) 2. Data related to trainee satisfaction/evaluation 3. Education data (level of education)	Monitoring and management of training programme satisfaction/evaluation questionnaires	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. KEDIVIM Quality Management Office 2. Chair of KEDIVIM 3. Board 4. Google LLC 5. Microsoft Corporation INC (Outlook) 6. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 7. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 8. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years
Trainer and trainee data: 1. Basic personal details (full name, email, telephone, date of birth, gender, address details, telephone, father’s name) 2. Unique identifiers (trainer register number, ID card number, Tax ID (AFM), Social Security Number (AMKA)) 3. Employment data (trainer status, statement of whether the person is a certified trainer registered in the EOPPEP adult trainer registers, the LAEK (OAED) trainer registers or another trainer register, teaching experience, work experience, occupation) 4. System usage data (user identification data, actions per user, data related to access rights, data related to the period each user is logged in, action approvals) 5. Education data (Training Programme Certificate, Training Certificate Annex, Certificate of Successful Completion, Certificate of Attendance, degrees – e.g. degree, year awarded, institution, master’s degree, doctorate, foreign language, computer skills, training (from public and/or private bodies)/hours/body, publications, learning performance) 6. Financial data (training programme attendance cost, training programme participation fee, method of fee payment, payments, etc.)	Processing of personal data in the Integrated Distance Training Information System (OSTK)	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. The data subjects themselves 2. Trainers 3. Trainees 4. Register of Lifelong Learning Centres (KDBM) of the General Secretariat for Vocational Education, Training, Lifelong Learning and Youth 5. Internal Quality Assurance System (IQAS) of the University of Piraeus 6. Hellenic Authority for Higher Education (HAHE) 7. ELKE of the University of Piraeus 8. Ministry of Education and Religious Affairs 9. Communication & Information Technologies Experts S.A. Consulting and Development Services (trading as CITE) (provider of the OSTK). 10. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 11. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years. In particular, the Training Programme Certificate, the Training Certificate Annex, the Certificate of Successful Completion and the Certificate of Attendance issued upon completion of a training programme are kept indefinitely, for reasons of public interest
Data of trainers, prospective trainers, trainees and prospective trainees: 1. Basic personal details (e.g. full name, role of the person who made the report) 2. Details of the nature of the breach (e.g. date and time the incident was reported, breach category, extent of impact, notification to the Hellenic DPA, cause of and corrective measures for the breach)	Management of Data Breach Incidents	Art. 6(1)(c) GDPR: compliance with a legal obligation where the incident constitutes a personal data breach. Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority for the investigation of the incident	1. Competent Directorates of the Organisation 2. Data Protection Officer 3. Information Security Officer 4. Natural person 5. Suppliers/Partners (Processors, depending on the processing to which the breach relates) 6. Supervisory Authorities (e.g. Hellenic DPA) 7. Third parties (e.g. Legal Advisors) 8. Microsoft Corporation INC (Office 365, Azure) 9. Compliance Officer 10. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 11. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	The retention period set for the category of data concerned by the incident applies. In addition, the data resulting from the investigation of the incident are kept by the Organisation for a period of 5 years.
Data of trainers, prospective trainers, trainees and prospective trainees: 1. Basic personal details (e.g. full name, email, telephone, address) 2. Unique identifiers (e.g. ID card number, passport number) 3. Data related to the request (e.g. date received, channel of receipt, type of request & supporting documentation, validity/lawfulness check, date of fulfilment, method of reply to the natural person, reason for rejection of the request)	Management of Requests from Natural Persons	Art. 6(1)(c) GDPR: compliance with a legal obligation	1. Competent Directorates of the Organisation 2. Data Protection Officer 3. Natural person 4. Third party authorised by the natural person 5. Suppliers/Partners (Processors, depending on the processing to which the request relates) 6. Microsoft Corporation INC (Office 365, Azure) 7. Compliance Officer 8. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 9. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	The retention period set for the category of data concerned applies. In addition, the data resulting from the handling of the request are kept by the Organisation for a period of 5 years.
Data of trainers, prospective trainers, trainees and prospective trainees: 1. Basic personal details (e.g. full name) 2. Employment data (role/position) 3. Audit-related data (e.g. access to procedure documentation) 4. Evaluation data (e.g. satisfaction surveys)	Monitoring the implementation of procedures for the quality management system	Art. 6(1)(e) GDPR: performance of a task carried out in the public interest or in the exercise of official authority	1. Audit bodies/Certification Body 2. Board 3. Director of KEDIVIM 4. Microsoft Corporation INC (Outlook) 5. Supervisory, audit, independent, judicial, public and/or other authorities and bodies within the scope of their statutory competences, duties and powers, where transfer to them is required or provided for by law. 6. Lawyers, law firms, court bailiffs, experts and assessors, in any case of legal action to safeguard our rights and interests.	20 years

 

Processors

 

In the context of the above processing operations, the recipients of your personal data are legal persons to whom the Organisation assigns the performance of specific tasks on its behalf, such as providers of IT application services and their maintenance (e.g. Microsoft Corporation, CITE). These partners, acting as Processors of Personal Data, have been informed and have undertaken in advance to maintain the confidentiality of your Data, know and follow our instructions regarding the processing of Personal Data and take all appropriate measures to protect them.

 In particular, Processors have agreed and are contractually bound with the Organisation:

• to process your Personal Data exclusively in accordance with our instructions and orders,
• to maintain confidentiality,
• not to send Data to third parties without the Organisation’s permission,
• to take appropriate security measures

 

Transfer of Data outside the EU/EEA

 In certain cases, your Data may be transferred outside the European Economic Area due to the use of services and tools of «Microsoft Corporation». The transfer of your Data outside the EEA (specifically to the USA) for the above purposes is carried out on the legal basis of an adequacy decision (Article 45 GDPR). Where, in the course of using the services of «Microsoft Corporation», Data are transferred to third countries outside the EEA and outside the USA for which no adequacy decision has been issued, the security of the transfer is ensured through standard contractual clauses.

 Security of Personal Data

The Organisation is committed to safeguarding your personal data. It has taken appropriate organisational and technical measures to secure and protect your data against any form of accidental or unlawful processing. These measures are reviewed and amended when deemed necessary.

Rights of Data Subjects

• You have the right of access to your Personal Data.

This means that you have the right to be informed by us whether we process your Data. If we process your Data, you may request information on the purpose of the processing, the type of your Data we hold, to whom we disclose them, how long we store them, whether automated decision-making takes place, as well as on your other rights, such as rectification, erasure of data, restriction of processing and lodging a complaint with the Hellenic Data Protection Authority.

• You have the right to rectification of inaccurate personal data.

If you find that there is an error in your Data, you may submit a request to us to correct it (e.g. correction of your name or an update of a change of telephone number).

• You have the right to erasure/right to be forgotten.

You may ask us to delete your Data if they are no longer necessary for the processing purposes mentioned above, or if you wish to withdraw your consent where it is used as the legal basis for the processing.

• You have the right to portability of your Data.

You may ask to receive the Data you have provided in a readable format, or ask us to transfer them to another controller, where the processing is based on your consent or is necessary for the performance of a contract between us.

• You have the right to restriction of processing.

You may ask us to restrict the processing of your Data while your objections to the processing are being examined, or if part of the processing is no longer required to fulfil the purposes for which your data were collected.

• You have the right to object to the processing of your Data.

You may object to the processing of your Data where it is carried out in pursuit of our legitimate interests, and we will stop processing your Data unless there are other compelling legitimate grounds that override your right.

• Right to withdraw your consent

Where the processing of your Data for a specific purpose is based on your prior consent to the processing, you have the right to withdraw your consent, with the result that the processing will not continue in the future. Please note that we do not make decisions or carry out profiling based on the automated processing of your Data.

How to exercise your rights

 

To exercise your rights, you may send us a Request either to the Organisation’s postal address (80 Karaoli & Dimitriou St., Piraeus 18534), or to the email address (dpo@unipi.gr) with the subject «Exercise of the right of access/rectification/erasure/portability/restriction/objection», or through the online contact form (Contact – Centre for Training and Lifelong Learning (unipi.gr)) with a description of your Request, and we will examine it and reply to you as soon as possible.

Fulfilment of your requests

 

The Organisation has procedures in place that allow you to exercise your rights easily, so that all the required actions are initiated immediately. We respond to your Requests free of charge and without delay, and in any case within one (1) month of receiving your request. However, if your Request is complex or there is a large number of Requests, we will inform you within the month if we need an extension of a further two (2) months, within which we will reply to you. If your Requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Organisation may charge a reasonable fee, taking into account the administrative costs of providing the information or taking the requested action, or may refuse to act on the Request. Please note that the Organisation may be unable to satisfy the above rights to the extent that the statutory conditions for doing so are not met or one of the exceptions provided for by the GDPR applies.

Right to lodge a complaint

 

If you consider that: a) a request of yours has not been satisfied adequately and lawfully, or b) your right to the protection of your personal data is infringed by any processing we carry out, you have the right to lodge a complaint with the Hellenic Data Protection Authority (postal address: 1-3 Kifisias Ave., 115 23 Athens, https://www.dpa.gr/, tel. +30 210 6475600, email: contact@dpa.gr).

Information on any changes to this Notice

We will update this Notice whenever necessary. If there are significant changes to it or to the way in which we use your Personal Data, we will notify you either by posting a notice in a prominent place before the changes take effect or by any other appropriate means. We encourage you to read this Notice periodically to be aware of how your Data are protected.