Participants’ and Applicants’ Privacy Notice for Global Study and Research Programs

Emeritus (together with its relevant subsidiaries, associates, and affiliated companies as listed in Annexure-1 of this Participants’ and Applicants’ Privacy Notice for Global Study and Research Programs (“Notice”), collectively referred to as “Emeritus”, “us”, “we”, or “the Company”) is committed to protecting and securing the confidentiality of, and to lawfully handling and effectively managing the personal data we collect from and about our students, participants and applicants.

All the references to “child” or “children” in this Notice shall refer to children (minors) under a certain age (age of majority) as defined and notified under the applicable laws, including the privacy laws, of the country of residence of the child or the country of origin their personal data, as applicable.

(Global Data Protection Office at) Emeritus is committed to maintaining trust, meeting expectations, and upholding the rights of the individuals whose personal data we collect by efficiently protecting their personal data, diligently complying with the applicable privacy laws, persistently adhering to the privacy principles, and conscientiously following the privacy best practices. We understand the value of personal data and the significance of its processing in running our business, and we reinforce our pledge to remain bound to our obligations of fairness and transparency while handling personal data and related operations.

This Notice outlines and describes how personal data or information of the global study and research program (“study trip”) applicants and participants is collected, managed, and processed by Emeritus. Emeritus is committed to handling the personal data of the participants and applicants with fairness and transparency, and in a lawful manner. This Notice covers the minimum controls and obligations that Emeritus is committed towards for ensuring that the personal data is collected, used, retained, and disclosed in a secure, lawful, transparent, and compliant manner.

This Notice applies to enrolled participants or applicants to the study trips offered by Emeritus, and to their parents and legal guardians in case of child participants (collectively “you”, “your”) and is designed to inform you of the personal data that we collect, our purposes of processing that data and your rights in connection with it.

This Notice is dedicated only to the study trips that Emeritus organizes and offers and applies to all the personal data collected and processed as part of the planning, management, and execution of the study trips.

This Notice does not apply to personal data belonging to other categories of individuals like our marketing leads, faculty members, students and applicants for other programs and courses offered by Emeritus, vendors, employees, job applicants, or clients engaged with or by Emeritus. See our Privacy Notices page for more information. However, as more than one of the above notices may apply to you depending upon the context in which your personal data is collected and processed (e.g., an employee may also be a student), be sure to carefully read each applicable notice that we provide to you so that you are fully informed.

The personal data that we collect, and process may vary depending upon the study trip you select, the requirements of the university partner associated with that study trip, and obligations arising under the applicable laws. The personal data that we collect from you is stored within the electronic records/database stored on servers (including cloud servers) located in Singapore, Japan, Canada, U.S., India, P.R.China, or in another country (including third countries that are not covered by an adequacy decision of the European Commission), as well as within physical records/database.

Emeritus collects personal data only to the extent it requires it for a particular purpose(s) to organize study trips, for example, to facilitate trip registration, arrange travel and accommodations, process payments, or provide study trip-related updates, and it may collect the following types of personal data from about you and your child:

Categories of personal data	Examples of personal data attributes within each category
Identification/Identity data	Full name, alias, gender, country of residence, nationality, citizenship, location, online identifier, IP address, date of birth, age, photograph, biometric data (as part of any government-issued ID), relationship with the child participant
Contact details	Home address, personal and/or official phone number(s), personal and/or official email address(es), emergency contact details
Financial data	Billing name and address, bank account information
Electronic identification data	Login ID, password, IP data, website visit logs, browser details
User-generated data	Attendance, absence records, projects and assignments submitted, evaluation remarks, peer and faculty feedback, performance data, audio and video recordings during online/offline sessions and webinars, responses to surveys, focus groups and quizzes, feedback, and suggestions, comments and testimonials, photographs, and videos taken during study trip
Government-issued ID (including copy thereof)	Passport, any other acceptable government document
Health information	Disabilities and special accommodation needed, any other information necessary to safeguard a child participant’s health, well-being, and safety during the study trip
Other personal details	Personal references, language(s) proficiency
Logistical data	Visa status, airline ticket status, meal preference, accommodation details

Emeritus does not handle your credit or debit card number when processing payment. Such data is collected and processed by third-party payment gateway service providers on our behalf as per our agreements with them and any other rules and regulations applicable to them.

In certain situations, you may provide us with the personal data of others (for example, your friends, colleagues, family members, etc.), such as when providing emergency contact details.

In such cases, you are responsible for informing the individual(s) and/or obtaining their authorization (where legally required) towards processing their personal data for the purposes communicated to you.

Emeritus collects the personal data that we require in order to register the participant for the study trip and subsequently to enroll and onboard them to the program directly from you on the application page on our website.

We will collect your contact details, financial details, and a copy of your or your participating child’s government ID (for example, passport) during the application process. After successful payment for the study trip, we will collect other categories of personal data during the registration process.

You are responsible for ensuring that all personal data you provide is accurate, complete, and up to date at the time of application and registration form submission. Inaccurate or outdated information may impact our ability to process your child’s study trip application. Please notify us immediately of any changes to your (or the participating child’s) personal data to avoid any disruption.

During the study trip, we may collect some or all of the personal data listed under the category of “user-generated” personal data described above. There are other types of personal data that we may collect based on your or your child’s special requirements during the study trip or such personal data that you or your child may voluntarily provide. This could include personal data such as information contained in the travel documents, health and medical information, and other information necessary to organize and manage the study trip experience.

Our corporate clients (the B2B/enterprise clients who engage us for delivering one or more programs to their sponsored candidates) or individuals (like parents/guardians of our present or past participants, etc.) may also refer participants to us for enrolment in different study trips. To identify and, in some cases, register and onboard the participants referred to us, we may initially receive some personal data from the following categories from them:

• Identification/Identity data
• Contact details

If you have been referred to us, you may still be required to register through our program application page to complete the enrolment and onboarding process. You may be asked to again provide the personal data initially provided to us by your referrer, along with the additional information (personal data) required for the program (study trip) registration.

In situations where you provide us with the personal data of others, it becomes your responsibility to inform the individual(s) concerned about the processing of their personal data for the relevant purposes and to confirm to us that you have been authorized to submit such details with us for processing as necessary.

When you visit our website or use our service, we and third parties may use cookies and other tracking technologies to collect personal data from you. This may include tracking your activities across time and third-party sites or services. For more information about this processing and your choices regarding it, see our Cookie Notice.

Emeritus uses the personal data that we collect for the following purposes:

1. Creating an account to apply and register for the study trip
2. Group management and seat reservation for the study trip
3. Fulfilling orders, processing payments, and preventing transactional fraud
4. Responding to your doubts, queries, and requests
5. Verifying documentation related to identity and age
6. Trip management, which includes planning and organizing travel logistics, accommodations, and educational activities
7. Communicating important trip details and sharing related materials
8. Ensuring the safety and well-being of the participants during the study trip by managing medical needs, dietary restrictions, and emergencies
9. Ensuring compliance with applicable child protection policies of the concerned university partner
10. Monitoring and improving our services and internal operations related to study trips
11. Training our workforce/employees on different processes related to study trips
12. Conducting business analytics, marketing research, and data analysis for business planning, marketing, advertising, and sales efforts
13. Sending surveys for receiving feedback and suggestions for enhancing the overall quality of the study trip program
14. Sanction checks/screening in compliance with applicable sanction laws across geographies and similar programs of the university partners (for example, sanctions list of the Office of Foreign Assets Control)
15. Investigating and addressing complaints and issues
16. As required under the applicable law(s) to fulfill our legal or regulatory obligation
17. Any other purpose as disclosed to you at the point of collection

Where the collection and use of your personal data is based on your consent, you are entitled to withdraw that consent at any time by contacting us (please refer to the ‘Contact Us’ section of this Notice). Please note that your withdrawal of consent can have an adverse impact on our ability to engage with you and would not affect the lawfulness of processing that has already occurred based on your consent.

Emeritus is a global company, and we may share your or your child’s personal data with other companies within the Emeritus group that act as affiliate service providers to facilitate study trip services you have registered for. This Notice also applies to the data processing activities of our affiliates, who may act as controllers of your personal data in such contexts. It is provided on behalf of these affiliates, including those listed in Annexure-1 of this Notice.

Emeritus may share your or your participating child’s personal data with the following third-party service providers. These third-party service providers will require access to your and your participating child’s personal data to perform certain limited functions for Emeritus however, they may not generally use, for their own purposes, such personal data that they process:

• Technology service providers like network and IT security, internet services, video communications, customer support and communication, telecom services for running the business operation and protecting it from external and internal threats
• Travel agents and visa processing agents
• Local transportation providers like cab service providers
• Service providers for travel and accommodation arrangements, trip planning, and managing the execution of various activities tailored to the study trip
• Service providers and platforms supporting our outreach initiatives and assisting us in establishing communication (with you) through various channels like email, text (SMS), WhatsApp, voice call, etc.
• Service providers providing the following services:
  • Business analytics
  • Marketing research
  • Data collection forms (e.g., Google Forms)
  • Focus groups, surveys, and data analysis
  • Cloud services and data storage
  • Credit facilities and payment processing
  • Couriers
• Social media platforms (for example, Facebook, LinkedIn) for assisting us with our social media marketing initiatives
• Service providers conducting sanction checks and screening
• Third-party service providers for establishing and implementing whistleblower program by setting-up and independently managing hotline and web portal for collecting whistleblower reports (anonymous or identified)

We take reasonable steps, such as obtaining contractual commitments from our third-party service providers, to limit the use of and protect your and your participating child’s personal data by our service providers. We take appropriate measures to ensure that the confidentiality of your or your child’s personal data is maintained and it is used solely for authorized purposes.

Emeritus may share your personal data with the following (non-agent) third parties (list not exhaustive):

• Professional advisors and consultants including law firms, tax consultants, business/management consultants, auditors etc. for running the operations efficiently and in a compliant manner
• Regulators, government bodies, supervisory authorities, and law enforcement agencies in order to comply with applicable laws, rules and regulations including those related to audit and assessment of educational programs, licensing and approvals, and revenue and taxation
• Hotels and airlines to make arrangements during the study trip
• Prospective (and actual) sellers or buyers and their advisers in connection with any financing, merger, acquisition or sale of any of our business or assets
• Data collection forms (e.g., Google Forms) where Emeritus shall provide only your contact detail (generally only the email address) to trigger the notification and the link to the form. Personal data provided via the said form may be also available to the third-party providing the service and you are advised to read the privacy notice (policy) and terms & conditions of the third-party before entering any personal data into the form.

In addition to the above, Emeritus also shares your and your participating child’s personal data, more specifically, as stated, with the following third parties:

Recipients	Categories of personal data	Why we share (Purpose)
University partners
University partner associated with the study trip you have enrolled for. Please note that since the university partners operate independently, their privacy notice/policy shall apply to their processing of your personal data. We recommend reviewing the university partner’s privacy notice for a clear understanding of how your data is collected, used, stored, and protected by them during the study trip.	Identification/Identity data Contact details User-generated data Other personal details	Planning, collaboration, and other academic activities related to the study trip Verifying documentation related to your identity Issuing and maintaining the credential(s), if applicable Regulatory reporting Audit

We share your personal data with the (non-agent) third parties primarily for the performance of contract between you and Emeritus but may also rely upon one of the other lawful bases, listed under the section ‘Lawful (legal) basis for processing’, that may be legally available to us. Where required by the applicable privacy law(s), we will seek your consent before sharing your personal data with the parties. Third parties with whom your personal data has been shared may, in some cases, independently determine the purposes and uses of your personal data; in such cases, that third party recipient’s own privacy policy (notice) will govern their use of your personal data.

In some cases, or circumstances, we may disclose your or your participating child’s personal data to third parties without notifying you. These circumstances could include:

• Where Emeritus is required to do so as per applicable laws/rules/regulations, or by order of a court, tribunal, or any other regulatory authority, or other legal process or compulsion.
• Where Emeritus, in good faith, believes that such disclosure is reasonably necessary to comply with a legal obligation, process, order, or request.
• Where Emeritus is legally required to or believes in good faith that such disclosure is reasonably necessary to safeguard the rights, property or other interests of Emeritus, its employees, vendors, clients, customers of clients, third parties or the public as required and permitted by the applicable law(s).
• Where provision of the information would be disproportionate or would result in the impossibility or serious impairment of achieving the objectives of processing.

Due to the global nature of our business, which comprises partnerships with various universities across the globe with international enrolments to the courses and programs offered, presence of several Emeritus group companies (affiliates) worldwide, vendors/service providers (processors) that are present in and operating out of different countries and facilitate and support our services, and other third parties (esp. those listed in the earlier section) established in an overseas location, your and your participating child’s personal data may be shared, disclosed, or transferred to these parties in other countries where the privacy and data protection law(s) may differ from those in your country. These cross-border data transfers are necessary to facilitate the study trip. The cross-border transfer may include transfers to third countries (including onward transfers) that are not covered by the adequacy decision of the European Commission (Secretary of State in the case of the UK).

The cross-border transfer of your personal data shall be done in compliance with the concerned provisions and requirements of the privacy law(s) applicable to your personal data, which may include providing for appropriate safeguards in the form of Standard Contractual Clauses (SCCs) signed with the recipient of your personal data.

Emeritus will retain your and your participating child’s personal data for as long as necessary for the purpose(s) for which it has been collected, in accordance with the applicable law(s) and as set out in our retention policy and/or schedule. The duration for which we retain your and your child’s personal data may differ depending upon the purpose(s) for which it’s being processed.

We determine the appropriate retention period for personal data by considering several factors, including the amount, nature, and sensitivity of the data, the risk of harm from unauthorized use or disclosure, the purposes and means for which the data is processed, and applicable legal requirements.

We will retain and use your and your participating child’s personal data to the extent necessary to comply with our legal obligations, for example, to comply with statutory audits, resolve disputes, comply with orders or requests issued by the competent court(s), and enforce our legal agreements and policies.

In some circumstances we may anonymize your personal data so that it can no longer be associated with you or your child, in which case we may use such information without further notice to you.

Emeritus implements appropriate technical and organizational measures to ensure the security of your and your child’s personal data and to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services. These measures are designed to prevent accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed by us.

We make every reasonable effort to ensure the safety and security of your and your participating child’s personal data in accordance with the applicable law(s) and industry standards while considering the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. In addition, we limit access to your or your participating child’s personal data to those employees, agents, contractors who have a business need to access such personal data. They will only process your or your participating child’s personal data on our instructions, and they are subject to a duty of confidentiality.

In the unlikely event of a personal data breach, we will assess and investigate the event and take necessary actions, including those related to notification to the relevant supervisory authority and to the individuals impacted, in compliance with the applicable law(s) within the timelines prescribed.

Privacy laws in some jurisdictions, especially those in the European Economic Area (EEA) and the United Kingdom (UK), and in some U.S. states, provide individuals with certain rights in relation to the processing of their personal data (subject to conditions and exceptions provided in such laws). These rights are jurisdiction-specific and may not be available to all.

• Right of access: to get the inaccurate personal data corrected or rectified, and incomplete personal data completed.
• Right to erasure: to have the personal data deleted (this is not an absolute right and is subject to exemptions available under the applicable privacy law).
• Right to restriction of processing: to obtain restriction of processing.
• Right to data portability: to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have it transmitted to another controller.
• Right to object: on grounds relating to your particular situation especially where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Right to object to automated decision making and profiling: to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

We will process your request to exercise the above rights in accordance with the law(s) applicable in relation to the rights exercised by you. As permitted by applicable law, we may refuse requests that are unreasonably repetitive, require disproportionate technical effort, risk the privacy of others, may compromise an ongoing investigation, or are impractical. We do not discriminate against you for exercising any of your rights in a manner that would violate applicable law.

To exercise a data subject right or make an inquiry about your personal data, please write to us at privacy@emeritus.org. We may need to verify and confirm your identity before we process and fulfill your request. This is another appropriate security measure to protect your and your child’s personal data.

Right to complain: You may have the right to lodge a complaint with your local data protection authority about our processing of your personal data. For more information, please contact your local data protection authority. We would, however, welcome the opportunity to discuss, address, and resolve your concerns before you reach out to your local data protection authority. So, please contact us in the first instance at privacy@emeritus.org.

We are committed to protecting children’s personal data and privacy in all our study trip programs. Personal data collected from children is handled in compliance with applicable data protection laws, ensuring it is used solely for organizing and managing study trips. We take special precautions to safeguard this data, including obtaining parental or guardian consent where required and implementing strict security measures to prevent unauthorized access or misuse.

We understand that our study trip services can be availed by children (as described earlier in this Notice) and need special safeguards and privacy protection; we do not knowingly permit a child to provide us with personal data without obtaining a parent’s or guardian’s verifiable consent, except where (as applicable under the relevant laws):

• The sole purpose of collecting the name or contact information of a parent/guardian or a child is to provide a notice and obtain parental consent
• the sole purpose of collecting personal data from a child is to respond directly, on a one-time basis, to a specific request from the child and where such information is not used to re-contact the child or for any other purpose, is not disclosed, and is deleted by us promptly after responding to the child’s request during the study trip
• the purpose of collecting a child’s and a parent’s name and contact information, is to protect the safety of a child, and where such information is not used or disclosed for any purpose unrelated to the child’s safety
• otherwise permitted or required by law

We adopt stringent measures to safeguard children’s data, restricting access to authorized personnel and regularly reviewing our security protocols. Parental or guardian consent is obtained wherever required by law, and we ensure transparency regarding how the data will be used in accordance with this Notice.

For children, we obtain verifiable parental consent before collecting personal data. Parents/guardians can:

• Review the personal data collected about their child
• Request deletion of their child’s data
• Refuse to further collect or process of your child’s personal data by contacting us at privacy@emeritus.org

Any questions, concerns, or complaints about the operation of this Notice can be addressed to the Data Protection Officer at privacy@emeritus.org. In addition, you may submit your concerns or complaints about our privacy practices to our Data Protection Officer at privacy@emeritus.org or at the following address:

Emeritus Institute of Management,
78 Shenton Way,
#20-02 Singapore-079120

Whenever we receive a formal complaint, we attempt to contact the complainant individually and resolve his/her grievances and/or concerns truthfully and with utmost transparency.

In addition to contacting us, in certain countries you have the right to lodge a complaint with your local data protection authority if you so choose.

In case you are located in the European Union (EU) or United Kingdom (UK), you may contact our representative in the EU or UK:

Global Alumni (for the EU)

• by emailing: EURep@Emeritus.org
• by writing to Global Alumni at Calle Acanto, 11, 28045, Madrid, Spain

EIM Learning UK Ltd. (for UK)

• by emailing: UKRep@Emeritus.org
• by writing to EIM Learning UK Ltd. at WeWork, 10 York Road, London, England, SE1 7ND

In this Notice, the following terms (whether or not capitalized) shall have the meanings set out below and cognate terms shall be construed accordingly:

Personal data means any data related to an identified or identifiable living natural person, provided, however, that if an applicable law has a different definition of personal data (or a similar term referring to information relating to an individual), such definition shall be applied to the extent applicable.

Sensitive personal data (SPD) means personal data which is more significantly related to the notion of a reasonable expectation of privacy. However, data may be considered more or less sensitive depending on context or jurisdiction.

Process and Processing means (1) any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, accessing, consultation, interpretation, assessment, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; and (2) any other action that may be taken with respect to personal data.

(Data) Controller means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.

(Data) Processor means a natural or legal person (other than an employee of the controller), public authority, agency or other body which processes personal data on behalf of the controller.

Global study and research programs or study trips are the tailored programs organized by Emeritus which include components such as company visits, theme courses, interactive seminars with speakers, guest lectures, cultural immersions, and activity-based excursions.

Child and Children means individuals (minors) under a certain age (age of majority) as defined and notified under the applicable laws, including the privacy laws, of the country of residence of the child or the country of origin their personal data, as applicable.

Adequacy decision means a formal decision made by the European Union (EU) which recognises that another country, territory, sector or international organisation provides an equivalent level of protection for personal data as the EU does.

Onward transfer means a transfer of personal data to a fourth party or beyond. For instance, the first party is the data subject (you), the second party is the controller (Emeritus), the third party is the processor, and the fourth party is a sub-contractor of the processor.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

University partners mean the universities on whose behalf we deliver and manage the respective educational programs including the study trips.