Emeritus Privacy Notice

Who are we (Introduction)?

Emeritus (together with its relevant subsidiaries, associates, and affiliated companies as listed in Annexure-1 of this Notice, collectively referred to as "Emeritus", "us", "we", or “the Company”) is committed to protecting and securing the confidentiality of, and to lawfully handling and effectively managing the personal data we collect from external individuals that inter-alia includes the representatives of our former, present, or future vendors, clients, or university partners; former, present, or future business associates; guests and visitors to our physical facilities, locations, campuses, and regional offices; attendees, speakers, participants at our academic and non-academic conferences, webinars, seminars, open houses and networking events; visitors to our websites and other digital platforms; individuals interacting with us via various inquiry channels; or any other third party individuals we generally engage, interact with, and collect personal data from (collectively “Other External Individuals”).

Our Vision and Mission Statement

(Global Data Protection Office at) Emeritus is committed to maintaining trust, meeting expectations, and upholding the rights of the individuals whose personal data we collect by efficiently protecting their personal data, diligently complying with applicable privacy laws, persistently adhering to privacy principles, and conscientiously following privacy best practices. We understand the value of personal data and the significance of its processing in running our business, and we reaffirm our pledge to remain bound to our obligations of fairness and transparency while handling personal data and related operations.

What is the purpose of this notice?

This Emeritus Privacy Notice (“Notice”) outlines and describes how Emeritus collects, manages, and processes personal data or information of Other External Individuals. Emeritus is committed to handling the personal data it controls and processes with fairness and transparency, and in a lawful manner. This Notice sets out the minimum controls and obligations to which Emeritus is committed to ensure that the personal data of individuals in the Other External Individuals category is collected, used, retained, and disclosed in a secure, lawful, transparent, and compliant manner.

To whom is this notice directed (Scope)?

This Notice applies to individuals covered under the category of Other External Individuals that inter alia includes the representatives of our former, present, or future vendors, clients, or university partners; former, present, or future business associates; guests and visitors to our physical facilities, locations, campuses, and regional offices; attendees, speakers, participants at our academic and non academic conferences, webinars, seminars, open houses and networking events; visitors to our websites and other digital platforms; individuals interacting with us via various inquiry channels; or any other third party individuals we generally engage, interact with, and collect personal data from (collectively “you”, “your”) and is designed to inform you of the personal data that we collect, our purposes of processing that data and your rights in connection with it.

This Notice applies to all your interactions with Emeritus in your capacity as an individual covered under Other External Individuals for the activities associated with your role and purpose of interaction. Please note, however, that there may be cases from time to time when we need to update this Notice, for example, to reflect changing legal requirements or processing activities, and if we make any material changes to this Notice, we will let you know.

This Notice applies when you interact with us in a general capacity and when your interaction is not governed by another, more specific privacy notice issued by us. This Notice does not apply to personal data belonging to other categories of individuals, like our students, program applicants, marketing leads, faculty members, employees, job applicants, consultants, or contractors engaged with or by Emeritus. See our Privacy Notices page for more information. However, as more than one of the above notices may apply to you depending upon the context in which your personal data is collected and processed (e.g., an employee may also be a student), be sure to carefully read each applicable notice that we provide to you so that you are fully informed.

What other rules or notices apply?

In some cases, local laws and regulations that apply to the processing of your personal data may be more restrictive than this Notice. Those more restrictive requirements will apply in that case. Emeritus will provide you with additional privacy notices or information where applicable law(s) so require. In addition, this Notice may be supplemented from time to time with more specific privacy information or notices, for example, when you use a particular Emeritus app or portal.

What are the categories/types of personal data we collect about you?

The personal data that we collect and process may vary depending on the purpose of your interaction with us and the obligations arising under applicable laws. The personal data that we collect from you is stored within the electronic records/database stored on servers (including cloud servers) located in Singapore, Japan, Canada, the U.S., India, or in another country (including third countries that are not covered by an adequacy decision of the European Commission), as well as within physical records/databases.

Emeritus collects the personal data only to the extent it requires it for a particular purpose(s), and it may collect the following types of personal data from you:

Sensitive personal data

Sensitive personal data or special categories of personal data (“SPD”) are personal data that are particularly sensitive in nature and merit specific protection, as the context of their processing could create greater risks to the fundamental rights and freedoms of individuals. SPD, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. The examples of SPD may vary depending upon the context and the laws of the respective countries from where the SPD originates, and may include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, sex life or sexual orientation, or data concerning health.

Emeritus does not require the collection or processing of any sensitive personal data or special categories of personal data. Should we require SPD for any purpose(s), we will obtain your explicit consent towards such collection and processing in terms of this Notice at the point where the SPD will be collected from you.

Where the applicable law(s) provide other legal bases for processing SPD (as an exception to obtaining explicit consent), we may rely upon such legal basis as may be available to us in a particular situation. In the event you voluntarily disclose/share/upload/post/make public your SPD on our website, or any other public forum owned or controlled by us, you understand that the said SPD may be processed by us in accordance with the applicable law(s) and this Notice.

Personal data of others provided by you

In certain situations, you may provide us with the personal data of others (for example, your colleagues and other business associates, etc.), such as in the context of managing the business relationship between us and your organization.

How do we collect your personal data (Source)?

Personal data collected directly from you (through our website or offline)

Emeritus collects your personal data directly from you on different occasions and via various mediums, depending upon your relationship with Emeritus. E.g., when you browse our website, when you communicate with us during your business dealings as our client, vendor, or university partner, when you enter your details in the visitors’ logbook while visiting our business locations, when you inquire from us and provide your necessary information on the forms available on our website or via offline mediums, when you register for and interact with us during business events, academic conferences, webinars, and open houses, when you subscribe to our newsletters, etc.

You need not register to use our websites. However, you may be required to share your personal data, where necessary, to engage with us, interact, communicate, receive specific information or details, or attend events and webinars, using the provided forms for these purposes.

It is your responsibility and obligation to ensure that all personal data submitted to us is accurate, correct, complete, and up to date at the time of submission. Failure to do so may result in our inability to engage with you effectively. Please keep us informed of any changes to your personal data.

Personal data provided by others

Your employers, who could be our B2B/enterprise clients, university partners, vendors, or other business associates, may share your personal data with us. Other sources, like business networking agencies, may also provide us with your personal data.

Personal data that others provide about you may also include data provided by third-party platforms like Google, Facebook, or LinkedIn, which have been authorized by you to share such data available with them with us.

Personal data of others provided by you

In certain situations, you may provide us with the personal data of others (for example, your colleagues and other business associates, etc.), such as in the context of managing the business relationship between us and your organization. In such a situation, it becomes your responsibility to inform the individual concerned about the processing of their personal data for the relevant purposes and to confirm to us that you have been authorized to submit such details to us for processing for such purposes.

Personal data collected via tracking technologies

When you visit our website, mobile applications, or use our digital services, authorized third parties, and we may use cookies and other similar tracking technologies to automatically collect certain technical and behavioural personal data from you. This may include tracking your activities across time and third-party sites or services. For more information about this processing and your choices regarding it, see our Cookie Notice.

Why do we collect your personal data?

Purpose(s) of processing

Emeritus may use your personal data for various purposes depending upon your or your organization’s business relationship with Emeritus.

Lawful (legal) basis for processing

Privacy law of certain jurisdictions requires that one of the available lawful bases of processing, as prescribed by such privacy law, must be relied upon (satisfied) by Emeritus before processing your personal data for a given purpose. The lawful basis that Emeritus relies upon for a particular processing activity may differ from that relied upon for another, i.e., different lawful bases may be relied upon to lawfully perform different processing activities associated with the purpose of processing.

All or some of the following lawful bases of processing may be available under the privacy law of a particular jurisdiction (country):

1. Consent: You have given consent (explicit/express or deemed/implied, depending upon the privacy law applicable) to the processing of your personal data for one or more specific purposes.
2. Performance of a contract: Processing of your personal data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
3. Compliance with legal obligation: Processing is necessary for compliance with a legal obligation to which Emeritus is subject.
4. Protection of vital interests: Processing is necessary in order to protect your vital interests or those of another natural person.
5. Public interest: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
6. Legitimate interest: Processing is necessary for the legitimate interests pursued by Emeritus or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms under applicable privacy laws.

Processing of sensitive personal data or special categories of personal data (‘SPD’) has been covered earlier under the section ‘What are the categories/types of personal data we collect about you?’.

The most common processing activities that we use (process) your personal data for are listed below:

• Managing the business relationship with your employer (our client, vendor, or university partner), including invoicing.
• Delivering services, effectively handling projects, and soliciting business.
• Verifying your identity and related documentation, where necessary, for formal interactions or facility access.
• Conducting sanction checks and/or background screening in compliance with applicable sanction laws across geographies.
• Responding to your queries, questions, or requests and providing the information you need from us.
• Facilitating your participation in various events and webinars.
• Facilitating public engagement initiatives, including public lectures, exhibitions, open days, campus tours and community outreach activities.
• Managing your subscription to newsletters, publications, blogs or similar informational communications.
• Conducting surveys to improve our website, public engagement activities and visitor experience.
• Providing updates about the business transactions.
• Receiving feedback and suggestions.
• Verifying your contact information, like phone number and email ID, using OTP or other mechanisms.
• Verifying your identity for resetting your login credentials in case of lost/forgotten particulars, including your username and password.
• Maintaining formal records of consent that we have obtained from you.
• Investigating and addressing your complaints and issues.
• Providing access to our facilities.
• Securing our facilities and common areas (including parking lots and cafeterias) using surveillance systems like CCTV (where required, signage will identify the areas under CCTV monitoring).
• Complying with applicable laws, rules, regulations, codes of practice or guidelines and associated administrative activities.
• Responding to requests by government or law enforcement authorities conducting any investigation.
• Complying with directions, orders, including subpoenas or other legal process(es) of competent courts, legal or regulatory bodies (including but not limited to disclosures to such regulatory bodies).
• Monitoring and ensuring network and information security, including preventing unauthorized access to our systems and preventing attacks through viruses, malicious software, etc., and ensuring business continuity.
• Processing personal data for audit checks and other regulatory purposes, including but not limited to Emeritus re-certification and accreditation purposes.
• Implementing a whistleblower program (or other complaint mechanism) and setting up a hotline and a web portal for collecting whistleblower reports (anonymous or identified).
• Ensuring compliance with applicable terms and conditions and/or applicable policies and procedures.
• Administering and improving our websites.
• Internal reporting and/or accounting purposes.
• Successors in the event of a merger, acquisition, or reorganization.
• Reaching out to you for corporate and individual referrals.
• Training our workforce/employees on different processes that may involve the processing of your personal data.
• Conducting business analytics, marketing research, and data analysis.
• Business planning purposes, marketing, advertising, and sales efforts.
• Inviting, registering, and onboarding you for general seminars, webinars, and events.
• Making appropriate arrangements in the event of an emergency.
• For any other purpose as disclosed to you at the point of collection or pursuant to your consent.

Emeritus may process your personal data primarily for the performance and administration of a contract, for its legitimate business interest, or to comply with its legal obligations.

Where Emeritus wishes to use your personal data for a new purpose that has not been included in the table above, Emeritus will process your personal data for such new purpose, as per the provisions of the applicable privacy law(s). Where required, Emeritus will notify you of the new purpose in accordance with the applicable law(s) and obtain your consent (or rely on any other lawful basis available to us) before processing your personal data for the new purpose.

Legitimate interest as the lawful (legal) basis for processing – additional information

You have the right to object at any time, on grounds relating to your situation, to the processing of your personal data carried out for our legitimate interests or of a third party.

Please refer to the section ‘What are your rights with respect to your personal data?’ for more details.

Performance of a contract as the lawful (legal) basis for processing – additional information

Please note that if you fail to provide certain information when requested, we may be unable to enter into a contract with you at your request, or to perform our contractual obligations under an existing agreement with you.

Consent as the lawful (legal) basis for processing – additional information

Where the collection and use of your personal data is based on your consent, you are entitled to withdraw that consent at any time by contacting us (please refer to the ‘Contact Us’ section of this Notice). Please note that your withdrawal of consent could adversely affect our ability to engage with you and would not affect the lawfulness of processing that has already occurred based on your consent.

With whom do we share your personal data (Disclosure)?

Disclosure within the Emeritus group of companies (affiliates)

Emeritus is a global organization, and we may share your personal data or provide such access to other companies within the Emeritus group, including as affiliate service providers or data controllers, to effectively manage our relationship with you or your employer. This Notice also applies to the processing activities of our affiliates on your personal data in such contexts and is provided for and on behalf of those affiliates where they also act as controllers of your personal data, including those listed under Annexure 1 of this Notice.

Disclosure to third-party service providers

Emeritus may share your personal data with the following third-party service providers. These third party service providers will require access to your personal data to perform certain limited functions for Emeritus; however, they may not generally use, for their own purposes, your personal data that they process:

• Service providers like network and IT security, internet services, video communications, customer support and communication, and telecom services to run business operations and protect it from external and internal threats.
• AI systems and service providers that deliver advanced generative AI models, conversational AI solutions, marketing technology services, developer APIs, platforms, and enterprise applications that enable AI-powered functionality within our products, services and business operations.
• Service providers for business continuity management and contingency planning in the event of business disruptions.
• Platforms (service providers) for hosting interactive webinars and events.
• Service providers and platforms assisting us in establishing communication (with you) through various channels like email, text (SMS), WhatsApp, voice call, etc.
• Service providers providing the following services:
  • Business analytics
  • Marketing research
  • Data collection forms (e.g., Google Forms)
  • Focus groups, surveys, and data analysis
  • Cloud services and data storage
  • Credit facilities and payment processing
  • Couriers
  • Security services
  • Vendors providing verification services towards your contact information, such as email ID and phone number
• Service providers conducting sanction checks and screening.
• Third-party service providers for establishing and implementing a whistleblower program by setting up and independently managing a hotline and a web portal for collecting whistleblower reports (anonymous or identified).

We take reasonable steps, such as obtaining contractual commitments from our third-party service providers, to limit and protect the use of your personal data.

Disclosure to other third parties

Emeritus may share your personal data with the following (non-agent) third parties (list not exhaustive):

• Our university partners, i.e., the universities on whose behalf we deliver and manage the respective educational courses.
• Professional advisors and consultants, including law firms, tax consultants, business/management consultants, auditors, etc., for running the operations efficiently and in compliance.
• Regulators, government bodies, supervisory authorities, and law enforcement agencies in order to comply with applicable laws, rules and regulations, including those related to audit and assessment of educational programs, licensing and approvals, and revenue and taxation.
• Prospective (and actual) sellers or buyers and their advisers in connection with any financing, merger, acquisition or sale of any of our business or assets.
• Data collection forms (e.g., Google Forms) where Emeritus shall provide only your contact details (generally only the email address) to trigger the notification and the link to the form. Personal data provided via the said form may also be available to the third-party providing the service, and you are advised to read the privacy notice (policy) and terms & conditions of the third-party before entering any personal data into the form.

We share your personal data with the (non-agent) third parties primarily to be able to perform our contract with you or for our legitimate interests, but may also rely upon one of the other lawful bases, listed under the section ‘Lawful (legal) basis for processing’, that may be legally available to us. Where required by the applicable privacy law(s), we will seek your consent before sharing your personal data with third parties. Third parties with whom your personal data has been shared may, in some cases, independently determine the purposes and uses of your personal data; in such cases, that third party recipient’s own privacy policy (notice) will govern their use of your personal data.

Disclosure without notification

In certain circumstances, we may disclose your personal information to third parties without notifying you. These circumstances could include:

• Where Emeritus is required to do so as per applicable laws/rules/regulations, or by order of a court, tribunal, or any other regulatory authority, or other legal process or compulsion.
• Where Emeritus, in good faith, believes that such disclosure is reasonably necessary to comply with a legal obligation, process, order, or request.
• Where Emeritus is legally required to or believes in good faith that such disclosure is reasonably necessary to safeguard the rights, property, or other interests of Emeritus, its employees, vendors, clients, customers of clients, third parties or the public as required and permitted by the applicable law(s).
• Where the provision of the information would be disproportionate or would result in the impossibility or serious impairment of achieving the objectives of processing.

International (cross-border) transfer of personal data

Due to the global nature of our business which comprises of partnership with various universities across the globe with international student enrolments to the courses and programs offered, presence of several Emeritus group companies (affiliates) worldwide, vendors/service providers (processors) that are present in and operating out of different countries and facilitate and support our services, and other third parties (esp. those listed in the earlier section) established in an overseas location, your personal data may be shared, disclosed, or transferred to these parties in other countries where the privacy and data protection law(s) may differ from those in your country. The cross-border transfer may include transfers to third countries (including onward transfers) that are not covered by the European Commission’s adequacy decision (in the case of the UK, the Secretary of State).

The cross-border transfer of your personal data shall be done in compliance with the concerned provisions and requirements of the privacy law(s) applicable on your personal data that may inter-alia include tranfer to a country or a territory that is covered by an adequacy decision issued by the concerned regulator, or appropriate safeguards in the form of Standard Contractual Clauses (SCCs) have been executed/implemented, or we have obtained explicit consent from you after informing you of any possible risks of transfer to a third country for you as an individual.

How long do we retain your personal data?

Emeritus will retain your personal data for as long as necessary for the purpose(s) for which it has been collected, in accordance with the applicable law(s), and as set out in our retention policy and/or schedule. The duration for which we retain your personal data may differ depending upon the purpose(s) it’s being processed for.

We will retain and use your personal data to the extent necessary to comply with our legal obligations, for example, to meet statutory audit requirements, resolve disputes, comply with orders or requests issued by competent court(s), and enforce our legal agreements and policies.

In some circumstances, we may anonymize your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

How do we protect your personal data (Data Security)?

Emeritus implements appropriate technical and organizational measures to ensure the security of your personal data and to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. These measures are designed to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed by us.

We make every reasonable effort to ensure the safety and security of your personal data in accordance with the applicable law(s) and industry standards while considering the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Despite all our efforts, the risk of personal data breach persists as no method of internet transmission or storage guarantees complete security. In the unlikely event of a personal data breach, we will assess and investigate the breach and take necessary actions, including notifying the relevant supervisory authority and the individuals impacted, in compliance with applicable law(s) within prescribed timelines.

What are your rights with respect to your personal data?

You may check and update certain personal data in our systems either by logging in to your password-protected account (in certain cases) or by contacting us at privacy@emeritus.org. It is your responsibility to ensure that your personal data, which you have shared with us, is accurate, correct, complete, and up to date in our records.

Privacy laws in some jurisdictions, especially those in the European Economic Area (EEA) and the United Kingdom (UK), and in some U.S. states, provide individuals with certain rights regarding the processing of their personal data (subject to conditions and exceptions set out in such laws). These rights are jurisdiction-specific and may not be available to all. Some or all these rights (and even some additional rights) may be available to you under the privacy law(s) of other jurisdictions as well, but that depends upon the scope of privacy law(s) applicable to your personal data.

• Right of access: to obtain from us a confirmation as to whether or not personal data concerning you is being processed.
• Right to rectification: to get your inaccurate personal data corrected or rectified, and incomplete personal data completed.
• Right to erasure: to have your data deleted (this is not an absolute right and is subject to exemptions available under the applicable privacy law).
• Right to restriction of processing: to obtain restriction of processing.
• Right to data portability: to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have it transmitted to another controller.
• Right to object on grounds relating to your particular situation, especially where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation which makes you want to object to processing on this ground.
• Right to object to automated decision making and profiling: to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
• Right to nomination in case of death or incapacity: to nominate another individual to exercise your rights, in the event of death or incapacity.

We will process your request to exercise the above rights in accordance with the law(s) applicable in relation to the rights exercised by you. As permitted by applicable law, we may refuse requests that are unreasonably repetitive, require disproportionate technical effort, risk the privacy of others, may compromise an ongoing investigation, or are impractical. We do not discriminate against you for exercising any of your rights in a manner that would violate applicable law.

As a policy, Emeritus allows you to access your personal data, verify and challenge the accuracy and completeness of your personal data, and have it corrected, amended, or deleted if inaccurate and, in limited circumstances, object to processing of your personal data even if the law in your jurisdiction does not accord you those rights, but we will apply our discretion in how we process such requests except as otherwise required by applicable law. We may require you to establish your identity and provide evidence to justify any amendment to the personal data we hold about you. You can exercise these rights by contacting us per the ‘Contact Us’ section below.

In addition, we enable you to exercise certain choices regarding cookies and certain other tracking technologies, as explained in our Cookie Notice.

To exercise a data subject right or make an inquiry about your personal data, please write to us at privacy@emeritus.org. We may need to verify your identity before we process and fulfil your request. This is another appropriate security measure to protect your personal data.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights) unless, and subject to applicable law, your request for access is clearly unfounded, excessive, or repetitive. Alternatively, we may refuse to comply with the request in such circumstances in accordance with applicable law.

Right to complain: You may have the right to lodge a complaint with your local data protection authority about our processing of your personal data. For more information, please contact your local data protection authority. We would, however, welcome the opportunity to discuss, address, and resolve your concerns before you contact your local data protection authority. So, please contact us in the first instance at privacy@emeritus.org.

Contact us.

Any questions, concerns, or complaints about the operation of this Notice can be addressed to the Data Protection Officer at privacy@emeritus.org. In addition, you may submit your concerns or complaints about our privacy practices to our Data Protection Officer at privacy@emeritus.org or at the following address:

Emeritus Institute of Management
78 Shenton Way,
#20-02 Singapore-079120

Whenever we receive a formal complaint, we attempt to contact the complainant individually and resolve their grievances and/or concerns truthfully and with utmost transparency.

In addition to contacting us, you have the right in certain countries to lodge a complaint with your local data protection authority if you so choose.

In case you are in the European Union (EU) or the United Kingdom (UK), you may contact our representative in the EU or the UK:

Global Alumni (for the EU)

• by emailing: EURep@Emeritus.org
• by writing to Global Alumni at Calle Tubo 6, Pozuelo de Alarcon, 28223, Madrid, Spain

EIM Learning UK Ltd. (for the UK)

• by emailing: UKRep@Emeritus.org
• by writing to EIM Learning UK Ltd. at 86-90 Paul Street, London, England, EC2A 4NE

Definitions.

In this Notice, the following terms (whether or not capitalized) shall have the meanings set out below, and cognate terms shall be construed accordingly. If an applicable law or data protection law has a different definition or incorporates a different term for the definition/meaning given hereunder, such definition or term shall be applied to the extent applicable:

AI system means any system that uses automated reasoning, machine learning, or similar computational methods to generate outputs such as predictions, recommendations, or decisions that influence processing or outcomes related to personal data.

Personal data means any data related to an identified or identifiable living natural person.

Sensitive personal data (SPD) means Personal Data that is more significantly related to the notion of a reasonable expectation of privacy. However, data may be considered sensitive depending on context or jurisdiction.

Process and Processing means (1) any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, accessing, consultation, interpretation, assessment, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; and (2) any other action that may be taken with respect to Personal Data.

(Data) Controller or Fiduciary means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.

(Data) Processor means a natural or legal person (other than an employee of the controller), public authority, agency or other body which processes personal data on behalf of the controller.

Adequacy decision means a formal decision made by the European Union (EU) that recognises that another country, territory, sector, or international organisation provides an equivalent level of protection for personal data to that of the EU.

Onward transfer means the subsequent transfer of personal data by a recipient in one country to another recipient in a different country or to an international organization, after the data has already been initially transferred from its original location (country of origin) to the first recipient making the transfer.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

University partners mean the universities on whose behalf we deliver and manage the respective educational courses.