STUDENT PRIVACY NOTICE

Last updated: September 2026

Athens International College (“AIC”, “the College”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal data of applicants, prospective students, current students and, where applicable, former students.

This Student Privacy Notice explains how AIC collects, uses, stores, shares and protects personal data in connection with applications, enrolment, studies and participation in College activities.

Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), Greek Law 4624/2019, as amended, and other applicable data protection legislation.

1. Data Controller

For the purposes of applicable data protection legislation, the data controller is:

Athens International College
Rethymnou 3
10682 Athens
Greece

Website: www.aic.edu.gr

For privacy-related enquiries and requests, you may contact:

Privacy Contact
Email: [email protected]

2. Who does this Notice apply to?

This Notice applies primarily to:

• prospective students;
• applicants;
• current students;
• former students and graduates, where relevant to the processing described in this Notice.

We may also process limited personal data relating to other individuals connected with a student, such as parents, guardians, emergency contacts, sponsors or persons responsible for tuition fees, where such processing is necessary and lawful.

3. What personal data do we collect?

The personal data we process will depend on your relationship with AIC and the programme or service concerned.

Identification and Contact Information

This may include:

• full name;
• date of birth;
• postal address;
• email address;
• telephone number;
• identification or passport information, where required;
• tax identification information where required for billing or other legal purposes;
• nationality or residency-related information where relevant;
• emergency contact information; and
• details of parents, guardians, sponsors or other contacts where necessary.

Application and Academic Information

This may include:

• application forms;
• previous educational qualifications;
• transcripts and certificates;
• academic history;
• admission information;
• programme and module registrations;
• attendance records;
• academic progress;
• examination and assessment results;
• assignments and other academic work;
• academic decisions;
• correspondence relating to your studies;
• awards, qualifications and transcripts; and
• other information necessary for the administration of your studies.

Financial and Administrative Information

This may include:

• tuition fee information;
• invoices and receipts;
• payment records;
• scholarships, discounts or financial arrangements;
• outstanding balances; and
• information required for accounting, tax or regulatory purposes.

Health, Disability and Accessibility Information

In certain circumstances, we may process information concerning your physical or mental health, disability, accessibility requirements or other circumstances relevant to your participation in your programme.

Such information may include medical certificates or documentation provided in support of requests for reasonable adjustments, mitigating circumstances, accessibility arrangements or other appropriate student support.

Health information constitutes a special category of personal data and is subject to additional protection under applicable data protection legislation.

AIC will only process such information where necessary and where an appropriate condition under Article 9 GDPR and applicable national legislation applies.

Career Services Information

Where you choose to use career or employability services, we may process information such as:

• your CV;
• professional interests;
• skills and qualifications;
• employment preferences; and
• information relevant to internships, placements or employment opportunities.

Photographs, Video and Other Media

AIC may create photographs, video recordings or other audiovisual material during educational activities, ceremonies, events, conferences, seminars and other College activities.

Photographs and video recordings are personal data where an individual can be identified.

They are not treated as biometric data merely because they contain an individual's image. They would constitute biometric data under the GDPR where they are subject to specific technical processing for the purpose of uniquely identifying an individual.

The use of identifiable photographs or video for promotional, marketing or public communication purposes is separate from the delivery of your academic programme.

Where AIC relies on your consent for such use, participation will be voluntary, consent will be specific and you may withdraw it at any time.

Choosing not to consent to promotional use of your image will not affect your academic relationship with AIC.

Where photographs or recordings are taken during an event on another lawful basis, appropriate information will be provided to participants and reasonable measures will be taken to respect individuals who do not wish to be prominently photographed or recorded.

4. How do we collect your personal data?

We generally collect personal data directly from you, including when you:

• request information about a programme;
• submit an application;
• enrol as a student;
• communicate with AIC;
• access or use academic platforms and services;
• submit assessments or other academic work;
• participate in classes, examinations or activities;
• request student support or reasonable adjustments;
• use career services; or
• participate in College events and activities.

We may also receive relevant personal data from third parties, including, where appropriate:

• partner universities or awarding institutions;
• previous educational institutions;
• professional or accreditation bodies;
• authorised representatives;
• sponsors or organisations funding your studies;
• public authorities; or
• other organisations involved in the delivery or administration of your programme.

Where personal data is obtained from another source, AIC will comply with the applicable information requirements under data protection legislation.

5. Why do we process your personal data?

We may process student personal data for purposes including:

Admissions and Enrolment

To:

• assess applications;
• determine eligibility for a programme;
• communicate with applicants;
• process admissions;
• complete enrolment; and
• establish and administer the contractual relationship between you and AIC.

Academic Administration

To:

• administer your programme;
• maintain your student record;
• register modules;
• manage attendance;
• organise teaching and academic activities;
• administer assessments and examinations;
• record academic progress;
• issue academic documentation;
• manage academic decisions and procedures; and
• support the effective delivery of your studies.

Partner University and Award Administration

Where your programme is delivered in collaboration with, validated by, awarded by or otherwise connected with a partner university, awarding institution or professional body, relevant personal data may be processed and shared as necessary for:

• registration;
• academic administration;
• assessment;
• quality assurance;
• progression;
• award administration;
• certification; and
• verification of qualifications.

Student Support and Welfare

Where necessary, we may process relevant personal data in order to:

• provide academic or administrative support;
• make reasonable adjustments;
• consider mitigating or exceptional circumstances;
• provide accessibility arrangements; and
• appropriately respond to circumstances affecting a student's participation in their programme.

Where this involves health information or another special category of personal data, the additional requirements of Article 9 GDPR will apply.

Financial Administration

We process relevant information to:

• issue invoices and receipts;
• administer tuition fees;
• manage scholarships or discounts;
• monitor payments and outstanding balances;
• maintain accounting records; and
• comply with tax, accounting and other legal obligations.

Communication with Students

We use contact information to communicate with students regarding matters connected with their studies, including:

• programme commencement and scheduling;
• teaching and academic activities;
• assessments;
• academic progress;
• administrative requirements;
• tuition fees and financial matters;
• student services;
• changes affecting the programme; and
• other information necessary for the administration of the student relationship.

These communications are part of the educational and contractual relationship and are not considered marketing communications.

Events, Additional Programmes and Marketing Communications

We may also wish to inform you about:

• additional educational programmes;
• seminars;
• conferences;
• events;
• professional development opportunities; and
• other activities organised or promoted by AIC.

Where consent is required for electronic marketing communications, such communications will only be sent in accordance with applicable law and your communication preferences.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Career and Employability Services

Where you choose to use these services, we may process relevant personal data to provide career support and, where appropriate and authorised, facilitate contact with potential employers or professional opportunities.

AIC will not normally disclose your CV or other identifiable career information to a potential employer without an appropriate legal basis and, where relevant, your knowledge or authorisation.

Security and Legal Compliance

We may process personal data where necessary to:

• protect students, staff and College property;
• maintain the security of our systems and facilities;
• prevent or investigate misconduct, fraud or security incidents;
• comply with legal or regulatory obligations; and
• establish, exercise or defend legal claims.

Statistical, Reporting and Quality Assurance Purposes

We may process information for:

• internal reporting;
• quality assurance;
• programme evaluation;
• institutional planning;
• statistical analysis; and
• improvement of our academic and administrative services.

Where possible and appropriate, information used for statistical and analytical purposes will be aggregated or anonymised.

6. Legal Bases for Processing

AIC does not rely on a single legal basis for all processing of student personal data.

Depending on the purpose and circumstances, processing may be based on:

Performance of a Contract

Processing may be necessary in order to take steps at your request before entering into a contract or to perform the educational agreement between you and AIC.

This applies to many activities connected with admissions, enrolment, academic administration and provision of educational services.

Compliance with Legal Obligations

Certain information must be processed in order for AIC to comply with tax, accounting, regulatory, educational or other applicable legal requirements.

Legitimate Interests

Where appropriate, AIC may process personal data where necessary for legitimate interests such as:

• effective academic and administrative management;
• maintaining appropriate academic records;
• ensuring the security of systems and facilities;
• improving services;
• quality assurance; and
• establishing, exercising or defending legal claims.

Where legitimate interests are relied upon, AIC considers the impact on the rights and freedoms of the individuals concerned.

Consent

Consent may be relied upon where appropriate, particularly where the processing is genuinely optional and is not necessary for the provision of the educational service.

This may include certain:

• marketing communications;
• promotional uses of identifiable photographs or video; or
• other optional activities.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Special Categories of Personal Data

AIC may occasionally need to process special categories of personal data, particularly health or disability information.

Such information will only be processed where:

• it is necessary for a legitimate and specified purpose;
• an appropriate legal basis under Article 6 GDPR applies;
• an appropriate condition under Article 9 GDPR applies; and
• suitable organisational and technical safeguards are in place.

Depending on the circumstances, the applicable Article 9 condition may include your explicit consent or another condition permitted by applicable law.

AIC seeks to collect only the minimum health or other sensitive information necessary for the relevant purpose.

8. Who may receive your personal data?

AIC does not sell or rent student personal data.

Personal data may, however, be shared where necessary and lawful with appropriate recipients, including:

• authorised AIC employees and academic staff;
• partner universities and awarding institutions;
• professional, accreditation or certification bodies;
• educational service providers;
• information technology, learning management and cloud service providers;
• accounting, financial and payment service providers;
• professional advisers;
• government departments and competent public authorities;
• tax or regulatory authorities;
• organisations sponsoring or funding a student's studies, where applicable;
• potential employers or career partners where appropriate and authorised; and
• parents, guardians or other third parties where the student has authorised the disclosure or another lawful basis exists.

Access is limited to the information reasonably necessary for the relevant purpose.

Where an external organisation processes personal data on behalf of AIC, appropriate contractual and organisational safeguards will be applied as required by the GDPR.

9. Information About Parents and Other Third Parties

Where a student is an adult, AIC will not normally disclose information concerning their studies, academic progress, financial position or other personal matters to parents, relatives or other third parties solely because of their relationship with the student.

Such information may be disclosed where:

• the student has authorised the disclosure;
• the relevant person is legitimately acting on behalf of the student;
• the disclosure is necessary under an applicable contractual arrangement;
• there is another lawful basis for the disclosure; or
• disclosure is required or permitted by law.

10. International Transfers

The delivery of certain programmes or services may involve partner universities, educational organisations, technology providers or other recipients located outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, AIC will ensure that the transfer complies with Chapter V GDPR.

Depending on the circumstances, this may involve:

• a European Commission adequacy decision;
• Standard Contractual Clauses;
• other appropriate safeguards permitted by Article 46 GDPR; or
• an applicable derogation under Article 49 GDPR.

Further information concerning applicable safeguards may be requested through our Privacy Contact.

11. How Long Do We Retain Your Personal Data?

AIC does not apply a single retention period to all student information.

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected and taking into account applicable legal, regulatory, contractual and institutional requirements.

Student Administration Records

General administrative information is normally retained for the duration of your studies and thereafter for the period necessary to:

• complete administrative procedures;
• comply with legal and contractual obligations;
• resolve outstanding financial or academic matters; and
• establish, exercise or defend legal claims.

Core Academic Records

Certain core academic records may need to be retained for a substantially longer period and, where justified, indefinitely.

These may include information necessary to:

• confirm that you studied at AIC;
• verify academic results;
• verify qualifications or awards;
• issue or reproduce transcripts or other academic documentation; and
• maintain the integrity of the College's academic records.

Long-term retention of these records does not mean that all personal data associated with your studies will be retained indefinitely.

Financial and Accounting Records

Financial, invoicing and payment-related information will be retained for the periods required under applicable tax, accounting and other legal requirements.

Health and Accessibility Information

Health, disability, medical and accessibility information will not be retained indefinitely merely because an individual was a student.

Such information will be retained only for as long as necessary for the purpose for which it was collected and for any additional period justified by applicable legal or claims-related requirements.

Photographs and Video

Photographs and audiovisual material will be retained for as long as necessary for the purpose for which they were created or published.

Where processing is based on consent, withdrawal of consent will be respected in accordance with applicable law, although withdrawal will not affect processing that lawfully occurred before withdrawal and may not always enable the removal of material already lawfully distributed or published.

Marketing Information

Information processed for direct marketing purposes will be retained until you withdraw consent, object to the relevant processing or the information is no longer necessary, subject to limited retention where necessary to maintain suppression or opt-out records.

When the applicable retention period expires, personal data will be securely deleted, anonymised or otherwise disposed of in accordance with our data retention procedures.

12. Security and Confidentiality

AIC implements appropriate technical and organisational measures designed to protect personal data against:

• accidental or unlawful destruction;
• loss;
• misuse;
• unauthorised alteration;
• unauthorised disclosure; and
• unauthorised access.

Access to student personal data is restricted according to operational and academic requirements.

Individuals with authorised access to personal data are required to respect its confidentiality and process it only for legitimate purposes.

13. Your Rights

Subject to the conditions and limitations provided by applicable data protection legislation, you may have the following rights:

Right of Access

You may request confirmation as to whether AIC processes personal data concerning you and obtain access to that data and information concerning its processing.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete information.

Right to Erasure

You may request deletion of your personal data where the requirements of the GDPR are satisfied.

The right to erasure is not absolute. For example, AIC may be required or entitled to retain particular records in order to comply with legal obligations or maintain necessary academic records.

Right to Restriction of Processing

You may request restriction of processing in the circumstances provided by the GDPR.

Right to Data Portability

Where the relevant legal requirements are satisfied, you may have the right to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to Object

Where processing is based on legitimate interests, you may have the right to object on grounds relating to your particular situation.

You have the right to object at any time to processing of your personal data for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

Rights Relating to Automated Decision-Making

Where applicable, you have rights relating to decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.

14. Exercising Your Rights

You may exercise your data protection rights or submit a privacy-related enquiry by contacting:

Privacy Contact
Athens International College
Rethymnou 3
10682 Athens
Greece

Email: [email protected]

We may request information reasonably necessary to verify your identity before acting on a request.

AIC will respond without undue delay and normally within one month of receiving the request.

Where permitted by the GDPR, this period may be extended by up to a further two months taking into account the complexity and number of requests. Where an extension is required, you will be informed within one month of receipt of your request.

Requests are normally handled free of charge. However, where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, AIC may charge a reasonable fee or refuse to act on the request, as permitted by the GDPR.

15. Complaints

If you have concerns regarding the manner in which AIC processes your personal data, you may contact us at:

[email protected]

You also have the right to lodge a complaint directly with the competent supervisory authority:

Hellenic Data Protection Authority
1–3 Kifisias Avenue
115 23 Athens
Greece

Telephone: +30 210 6475600
Email: [email protected]
Website: www.dpa.gr

You are not required to contact AIC before exercising your right to lodge a complaint with the supervisory authority.

16. Changes to this Notice

AIC may update this Student Privacy Notice from time to time to reflect changes in legislation, regulatory guidance, its programmes, services, systems or processing activities.

The latest version will be made available through the AIC website and will indicate the date of its most recent update.