INFORMATION CIRCULAR ON PERSONAL DATA PROCESSING IN ACCORDANCE TO EU REGULATION No. 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE 27 APRIL 2016

In accordance to articles 13 and 14 of the EU Regulation No. 2016/679 of the European Parliament and the Council of the 27th April 20916 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, repealing Directive 95/46/CE (General Data Protection Regulation, hereinafter referred to as GDPR), we hereby inform that personal data which has been voluntarily submitted to Pegaso International (hereinafter also referred to as the Institution) shall be subject to processing in accordance to the data protection regulations currently in force, and in any case in full observance of the privacy and confidentiality principles which govern the Institution.

1. CATEGORIES OF PERSONAL DATA PROCESSING:

Pegaso International shall process the following personal data provided by the data subject;

• Personal data such as name, surname, and nationality as well academic degree, hereinafter also referred to as “Data”
• Sensitive data related to personal disabilities and the respective percentage of such as recognised by the certifying entity

2. AIMS OF PROCESSING

Personal data submitted to Pegaso International may be utilised for the following purposes:

• a. To allow the management of enrolments by the Institution
• b. To allow the use of specific services as may be necessary and may be indispensable and instrumental for educational purposes, and to follow the academic course on the basis of distance learning, as well as the undertaking of activities included by virtue of enrolment in the Institution which expressly, but not exhaustively, give access to the didactic platform, technological tools for e-learning, applications, interaction services with tutors and between students, monitoring services, reporting services on educational activities undertaken by the students, secretarial services, social networking services, video-conferencing and chat services.
• c. For administrative accounting purposes and for the fulfilment of related obligations as provided for by the current regulations in force
• d. For Marketing purposes in furtherance to the data subject’s specific consent, as for example the sending of informative communications of a promotional nature (including our Newsletter), publicity material and/or didactic offers by whichever means, including, but not exclusively, by mail, internet, telephone, e-mail, MMS, SMS, by the Institution, that is by didactic partners of Pegaso International
• e. For research on professional profiles further to recruitment processes undertaken directly by agencies or other appointed companies
• f. For sharing of photos and videos intended for promotional purposes and testimonials on didactic methodologies of the Institution

With regards to points a., b., and c., the submission of personal data is obligatory. Refusal to submit such data and/or the submission of incorrect or incomplete data shall impede:

• With regard to the purpose mentioned in point a., the data subject’s enrolment/registration in the Institution
• With regard to the purpose mentioned in point b., the use of services, as well as the undertaking of any activity allocated by virtue of enrolment in the Institution
• With regard to the purpose mentioned in point c., the undertaking of administrative accounting activities and the correct fulfilment of regulatory obligations

As regards to further purposes detailed under points d., e., and f., submission of personal data and the data subject’s consent for processing of such for the above-mentioned purposes, is optional and subject to explicit consent.

3. PROCESSING PROCEDURES

Processing of personal data shall be undertaken by means of suitable instruments in hard copy, or electronically, following processing criteria strictly correlated to the purposes stated above, in such way as to guarantee security and confidentiality of such data Personal data is processed legally with the help of information technology instruments, in accordance with the correct accomplishment of the above-mentioned purposes and is protected by suitable security measures which guarantee integrity, accuracy, availability and updating. The data is stored for a period not exceeding that which is necessary for the purposes for which it was compiled and subsequently processed. In case that the data subject (i) accesses or registers on the Institution’s platform by means of access credentials pertaining to a social network (for example Facebook or Twitter, hereinafter referred to as social networks) or (ii) associates one’s own account to an account held by the same user on the social network, the data subject may receive from such social network the relative data of the user, in conformity to the conditions of use and in compliance to the privacy policy of the same social network. Pegaso International may add such information to the data of the user, which data was previously compiled through the respective services. Should the data user opt to share the information on such social networks, data would be received from the latter in conformity to the option of consent as provided by the user. The personal data eventually communicated by the social network will be subject to terms and conditions of use of the social network.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Those entitled to receive information on personal data are the members, members of the Administrative Board or other administrative body, the person responsible for the protection of personal data, and persons appointed by the Institution, as well as those responsible for the processing of personal data nominated by Pegaso International in the exercise of its functions. Personal data may be communicated to eventual subjects who provide services to the Institution and which are instrumental for the purposes indicated in the preceding paragraph 2; merely by way of example, and not exclusively, control agencies or entities which may in some way be thereby involved or associated. Personal data may also be communicated to providers, contractors or subcontractors, banks and/or Insurance agencies as well as entities that render services to Pegaso International:

• for the management and/or maintenance of internet sites and of other electronic instruments and online services used by the Institution
• for the management of enrolments/registrations to the Institution
• For sending informative communications and promotional material, as well as publicity material, and/or didactic offers

Personal data may finally be transferred to agencies or companies which render recruitment services to Pegaso International. Personal data may eventually be transferred abroad, in conformity with the current legislation in force, and this also to third countries where the Institution pursues its interests and activities. The transfer of data to non-EU countries, besides in those cases where this is guaranteed by the European Commission to be duly competent, is affected in such way as to provide adequate and opportune assurance and guarantees as per articles 46,47 or 49 of the Regulation.

5. DURATION OF POROCESSING AND CRITERIA USED FOR THE STORAGE OF PERSONAL DATA

5.1 Duration

For the purposes mentioned under a., b., and c., of the preceding paragraph 2 AIMS OF PROCESSING of this information circular, personal data shall be processed for the time which is necessary

For the purposes mentioned under d., e., and f., of paragraph 2 entitled AIMS OF PROCESSING of this information circular, personal data shall be processed until such time when consent is withdrawn by the data subject.

5.2 Storage

Data shall be stored in accordance to the following criteria:

• Processed data pertaining to enrolments/registrations in the Institution as detailed in a., b., and c., of paragraph 2 entitled AIMS OF PROCESSING in this information circular shall be stored throughout the entire period of enrolment and for the successive 10-year period following the expiry of the relationship agreement, except in cases whereby the exigency for a further storage period may arise, in order to enable Pegaso International to defend its legal rights.
• Data processed for purposes detailed under d., e., and f., of paragraph 2, AIMS OF PROCESSING of this information circular shall be stored for a maximum period of 24 months.

6. RIGHTS OF THE DATA SUBJECT

In terms of the data subject’s rights, the data subject may, at any time, exercise his/her related rights as provided within the limits of articles 7 and 15-22 of the Regulation. For further elaboration on the exercise of such rights as described hereunder, the data subject is to contact the administrator responsible for data processing through the Privacy office at the email address privacy@pegasointernational.eu. Thereupon the data subject will be provided with due reply in accordance to the time limits as provided by the GDPR.

Rights of the Data Subject:

• To withdraw the previously accorded consent, without prejudice to the legitimacy of processing undertaken on the basis of the consent accorded prior to revocation
• To request access to personal data from the processing administrator, as well as the modification or cancellation (the right to oblivion), or the limitation of such and to object to its processing

7. PROCESSING ADMINISTRATOR, PERSONS RESPONSIBLE FOR PROTECTION OF PERSONAL DATA

The processing administrator of personal data is Pegaso International with registered office situated in 2, Independence Square, Valletta VLT1520, Malta.

Any request related to personal data processed by the Institution may be addressed to the registered office of the Institution or electronically on privacy@pegasointernational.eu

The updated list of nominees appointed as persons responsible for GDPR, as per article 28, is available care of the Institution, and is also made available upon request made in accordance to the above-mentioned procedures.

The Processing Administrator

Pegaso International

As indicated in the information circular issued in terms of EU Regulation 2016/679 of the European Parliament and the Council of the 27 April 2016, the undertaking of activities related to the processing of personal data as detailed in points a., b., and c. indicated in paragraph 2 of the above-mentioned information circular, does not require consent for processing.

Otherwise, consent is optional for processing of personal data as detailed in points d., e., and f., indicated in paragraph 2 of the above-mentioned information circular.

The data subject is requested to send an email to privacy@pegasointernational.eu, should he/she intend to withhold authorisation for processing of personal data for promotional aims, marketing or recruitment purposes.