Data Protection Policy of the INFORM e-Learning Platform
The INFORM Consortium values data protection, as our mission is to raise awareness on its different aspects. The INFORM e-Learning Platform implements both the Data Protection by Design and the Data Protection by Default approaches. The Platform is designed to process only the strictly necessary personal information for the provision of the services and to make it accessible only to University of Cyprus team members, who are responsible for the maintenance of the Platform. Nonetheless, the Platform enables users to provide optional personal data to their profiles.
The INFORM Consortium implements all appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the European and any relevant national legislation on data protection. Amongst other measures, login credentials are communicated and stored in an encrypted form, the secure https protocol is used instead of the plain http having all communication between the user’s browser and the platform being encrypted, user verification through an e-mail activation link is obligatory in order for someone to register and user authentication is mandatory in order for someone to use certain functionalities of the platform, for example to acquire his/ her own personal data, thus maintaining confidentiality.Users reading, writing and executing access permissions, are correctly administered in order to protect the platform as a whole.
Additionally, back-ups are being kept in order to also maintain data integrity. Furthermore,testing was conducted to confirm that the appropriate functionality according to data protection needs are being met, such as that an individual’s personal data can be edited and updated accordingly when he/she exercises his/ her right to rectification, or that all associated data will indeed be deleted when someone practices his/ her right to erasure.
A risk assessment procedure will be conducted if decided as appropriate due to the appearance of new potential threats for web environment, in order to redefine the appropriate technical and organisational measures needs.
The INFORM Consortium bears responsibility for any infringement of the data protection legislation, which is result of failure to take appropriate and proportionate to the processing protection measures.
By registering on the INFORM e-Learning Platform the User takes steps to enter into a contract with the INFORM Consortium, whose object is the provision of services free of charge (provision of access to the e-Learning Platform, its content and features).
The mandatory data requested from a person at the time of the registration is the following:
- Group according to the person’s professional interests (legal practitioner, court staff, judiciary).
These data shall be processed by the University of Cyprus until the registration is cancelled or no longer maintained by the University, since the data are necessary for the performance of a contract to which the User is a party after successful registration.
The User may decide to provide his/her first and last name on his/her account, but if he or she does not do so, this does not prevent him/her from completing the registration. The User may choose to provide more information after registration, such as Education, University, Language, Social media account(s) and others. This information will be visible to other Users on the INFORM e-Learning Platform. The basis for processing these data is the consent of the User, these fields are not mandatory, and the User can fill them or delete the data at any time. Also, the Users may share personal opinions in the INFORM forum and these opinions are also provided on the basis of consent and may be deleted at any time.
With regards to the assessment functionality on the Platform, the score of the User shall be anonymised immediately after the completion of the test. The anonymised data isused for statistical and reporting purposes. The short-answer questions of Users are accessible only to Users themselves.
Additionally, the INFORM Consortium may store data for 5 years after the last payment on the project in order to report the project’s implementation to the European Commission. This processing is based on the legitimate interest of the INFORM Consortium to fulfill its obligations under Grant Agreement No.763866 with the European Commission.
If the User chooses to delete his/her account, all data related to the account will be deleted immediately. Any content uploaded by the user on the Platform (e.g. files, images), as well as forum and blog posts, and comments, will remain as anonymised information after the user’s profile cancellation.The scores of the User may remain as parts of anonymised data/statistics on the performance of the Users.
Other personal data collected
Purposes for Processing
The purposes for which the INFORM Consortium processes the personal data are the following:
- provision of services on the INFORM e-Learning Platform;
- reporting the implementation of the project to the European Commission;
- reproducing and proving the electronic statement made by the User in the event of occurrence of a legal dispute;
- in cases where the reproduction or proving an electronic statement is necessary for fulfillment of the obligation of the Consortium in conformity with the applicable law, for meeting its obligations provided by law, for realisation and protection of its rights and interests protected by law.
The Consortium shall take the due care and ensure that the information listed above will be processed only and as long as explicitly explained purposes require so and no longer than that.
The Consortium shall be entitled to maintain for longer the stored information regarding the respective User for the purposes listed above, bearing responsibility for the protection of that information, but no longer than 5 years after the last payment on the INFORM project by the European Commission.
Rights of the Users
By accepting this Data Protection Policy, the User acknowledges that he/she is familiar with the rights granted to him/her by the European legislation and particularly by the General Data Protection Regulation along with the respective applicable national legislation, including but not only:
- his/her right of access to his/her personal data processed by the Consortium;
- the right to correct and update his/her personal data processed by the Consortium;
- the right to request deletion, correction, or blocking of his/her personal data, the processing of which does not meet the requirements of the applicable legislation;
- the right to request restriction of processing his/ her personal data processed by the Consortium;
- the right to object against the processing of his/ her personal data at any time;
- the right to request from the Consortium to notify the third parties to whom it has disclosed his/her personal data for any deletion, correction, or blocking of such data, save for the cases where this is impossible or involves excessive efforts for the Consortium;
- the right to withdraw his/her consent and delete optional data in the User profile.
Disclosure to third parties
The Consortium undertakes not to disclose any personal data of the User and not to provide any third parties – state authorities, companies, natural persons, etc. – with personal data collected hereunder, except in the event that:
- this is provisioned in the Data Protection Policy;
- the information is requested by state authorities, court bodies, or officials that according to the applicable legislation are competent and authorised to request and obtain such information in compliance with the procedures established by law;
- the data is provided to data processors acting on behalf of the Consortium. Those persons will be obliged to process the data only and solely under the strict instructions of the Consortium and will not have the right to use or process in any other way the personal data of the Registered User for other purposes, except for the purposes specified in this Policy;
- other occasions provided by law.
The INFORM Consortium does not transfer data of Users to third countries.
The User has the right at any time to receive information from the INFORM Consortium about the data processed about her/him by sending a question on the following electronic mail address: firstname.lastname@example.org.