Student Privacy Policy



The American College of Greece (hereinafter referred to as “the College” or “ACG”) needs to collect and process personal data in order to provide educational services to students, manage its operations effectively (Ministry of Education, NEASC accreditation, Open University (OU) Validation, EPAS accreditation, AMBA accreditation), and meet its legal obligations and its legitimate interests. For the processing of personal data (including special categories of personal data), the College complies with the provisions of the General Data Protection Regulation (GDPR) and the applicable Greek Legislation, as in effect from time to time (herein referred to collectively as the “Data Protection Legislation”). This document sets out how we use students’ personal data.


This document is required by the General Data Protection Regulation (GDPR) and contains information on how we process students’ personal data, the legal basis for processing, how long we keep personal data for, etc.

We review this document regularly and reserve the right to make changes at any time to take into account any changes in our activities, legal requirements and how we process personal data.

This document constitutes an integral part of “the American College of Greece Personal Data Protection Policy”.


What this document covers

This document applies to students who have applied and registered to study with The American College of Greece, including both undergraduates and postgraduates.


Who we are

The American College of Greece is the data controller in relation to the processing activities described below. This means that The American College of Greece decides why and how students’ personal data is processed.

What information do we collect about students and how do we collect it

Information that students give us:

As soon as students contact us, we create a record in their name (both electronic and physical). To that record we add information that students give us when enrolling and throughout their studies until their graduation time.

Indicatively, we keep records of attendance in courses, grades in courses, disciplinary record and decisions coming from various committees and Offices (Committee on Academic Standards and Policies (CASP), Committee on Student Conduct (COSC), Committee on Disabilities and Learning Differences (CDLD), Academic Advising Office (AAO), etc.). All undergraduate students sign our honor pledge upon their admission to the College. We also keep Co-curricular transcripts (Academic enrichment, Scholarly engagement, Honors and awards, Community Service and Volunteerism, Scholarships) and record of contracts and correspondence with external employers for student internships. Moreover, we keep student’s photo for issuance of their ACG ID Cards. We also keep financial assistance records, scholarships granted and fellowships records.

We hold general biographic/demographic data about students, such as name, communication details, address, gender, age, nationality, place of birth, family status, copies of IDs and passports,  copies of VISA/residence permits, high school leaving diploma or relevant qualifications and grade lists, official transcript(s) and related documents from previous institutions attended, application form, reference letter(s), courses and qualifications studied, employment data, military information, parents/guardians and family member’s data details for reporting and statistical purposes, for meeting our legal obligations and for informing ACG affiliates on events, programs and matters concerning ACG in general.

For students participating in the Work-Study program we keep their work study application forms, CVs, ID Cards, Family Status, copy of bank account, Residence/Work Permit for foreign student employees, AFM/VAT, Social Insurance number as to serve the employment process.

We hold financial Data, for example Tax Identification Number, SSN, copies of checks, credit card receipts, and amounts owned and paid. Moreover, in case of refunds we keep Bank Account number, IBAN number, Account Beneficiary name, Account Beneficiary address. For Students that are US Citizens we collect W9 Forms in order to annually report the amount paid for “qualified tuition and fees” to both the student and the Internal Revenue Service (IRS). We also report data to Greek Tax Authorities.

Students may submit documents about “special categories” of data, including physical or mental health, disabilities and learning differences. This data might be enriched during the period of studies if a student participates in external activities and needs to submit extra medical information or nutrition preferences. Health data are also gathered for the use of Athletic Facilities (certificates from pathologist/cardiologist and or dermatologist). The Office of Athletics also keeps accident report forms. Furthermore, the College maintains copies of Health Insurance submitted directly by students going on an International Internship.

Other data we keep:

  • Data concerning Student’s Employment after graduation for reporting purposes
  • Log of Student Award recipients, Election results for academic societies, Results for governing Bodies
  • Photographs, Videos from Commencement or Various Ceremonies
  • Data on student award recipients (CV, personal statement)

Information that we automatically collect:

We will automatically collect information about students’ participation in courses through our online Student Information System (called Jenzabar, myACG portal) and all forms of assessment grades through our online grading system.

Information we receive from third parties:

We may receive some information about our candidates from third party sites or from Admissions partners/recruitment companies;

For students not currently studying with us (Alba Admissions purposes), we may enhance our records with data received from third parties, in order to ensure we have up to date student contact details, and in order to offer more relevant communications.

Data from companies that pay student’s tuition

How do we use students’ personal information?

We collect and process personal data about students in order to deliver our services and support to them, to manage our operation effectively (US NEASC accreditation, UK Open University (OU) Validation, Belgium EPAS accreditation, UK AMBA accreditation), and to meet our legal requirements (e.g. towards the Greek Ministry of Education) and serve our legitimate interests;

If students do not provide some of the information required at registration then we may not be able to effectively provide administration or support services to enable them to succeed in their academic pathway;

Information about any disabilities and special requirements students have will also be used to inform the provision of reasonable accommodations and other provisions for their study and as to protect the student’s vital interests and to provide preventive medicine and/ or first aid health services

Students may submit additional “special category” information to us, for example medical evidence, information about their religion relating to mitigating circumstances consideration through a CASP petition. We only use this information for the purpose for which it was provided and remains in the student’s file;

We are committed to the data protection principles and best practices for handling personal data. All personal data is held securely, is accessible and processed by authorized employees of ACG, who will process the personal data solely for the fulfillment of the aforementioned purposes, and by no means for their own benefit. Furthermore, some of the above personal data will be accessible and processed, within the framework of their responsibilities, by authorized external associates of ACG for the fulfillment of the aforementioned purposes.

Whom do we share information with?

We share data with external recipients/authorized external associates of the College for specific purposes, in accordance with the provisions of Data Protection Legislation.

Please see a detailed list of the external recipients below:

  • The Open University in UK (OU):For all undergraduate degree-seeking students,The American College of Greece shall undertake (where necessary) to procure the student’s consent to send to the Open University:
    • After commencement of an academic year bi-annual lists of the names of newly enrolled students on each Validated Program for registration with the Open University;
    • Progression and award boards lists signed by the external examiners;
    • Graduation student information necessary for the issuing of the Open University validated awards;
    • Copies of student academic transcripts on a yearly basis;
    • Statistical aggregate data for the Higher Education Statistics Agency (HESA) on a yearly basis;
    • Upon demand any other information or documents required by the Open University.
  • New England Association of Schools and Colleges (NEASC) in US : We share the following kinds of information:
    • Statistical aggregate data for the Commission on Institutions for Higher Education (CIHE) Annual Report;
    • Statistical aggregate data for re-accreditation purposes;
    • Student original degree, official transcript and other personal information for Apostille stamp purposes.
  • AMBA (Association of MBAs, based in London): We share the following kinds of information:
    • Names, Surnames, Gender, Age, Nationalities, Highest Academic Qualification, language proficiency and No of years of work experience.
  • EPAS (EFMD Program Accreditation System, based in Brussels)
    • No request for specific student data. They may ask for some data upon arrival for their site visit. 
  • U.S. Department of Veterans Affairs: We share the following kinds of information:
    • Student registration information for those students who receive veterans benefits only during every registration period.
  • Greek Ministry of Education:
    • Lists of students with degree and personal information for all undergraduate and graduate degree-seeking students during every registration period for army deferral reasons and because of legal obligation too;
    • Certificates of study for students seeking army deferral and visa permit.
  • Other External or Public Authorities:
    • External transfer of student data to various authorities or court order upon the student’s or his/her parent(s)’/guardian(s)’ request and consent;
    • Financial Aid data for reporting/auditing purposes, US and Greek Tax Authorities, and other external or public authorities;
    • Data of students who are employed at ACG under the Work Study program will be sent to the Ministry of Labor and the Greek Tax Authorities because of legal obligation.
  • Various Institutions (Partner Universities, Embassies, Foundations):
    • External transfer of student academic records (usually official transcripts) upon the student’s request and consent;
    • External transfer of student records to Foundations that provide scholarships for study abroad purposes.
    • External transfer of student data for Study Abroad purposes
  • Parents/Guardians
    • External release of student transcripts and academic progress to parents / guardians upon the student’s consent.
  • Printing Processor(s) and External Vendors
    • Lists of graduating students and degrees sent to the printing processor for the printing of diplomas and Commencement Ceremony program;
    • Lists of graduating students and seniors sent to the printing processor for the printing of awards and program for the Awards night;
    • External partners that provide admissions services;
    • External partners  for employment purposes and internships;
    • Companies that provide IT solutions to the College’s various offices like the Financial Aid one and the Library;
    • Career portal for employment purposes; we automatically load active Student data into the College’s Career Portal (currently US Based) for targeted communication for jobs & internship opportunities. Students submit CVs by themselves.
    • Financial data for financial aid purposes;
    • Development sites for alumni;
    • Insurance Companies for covering students’ needs;
    • Travel Agencies for study abroad purposes;
    • Advertising companies for marketing purposes;

Other ways we may share student personal information:

We may transfer students’ personal information to a third party if The American College of Greece ceases to exist and another organization offers to continue our continuing students’ study. We may also transfer personal information if we are under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our enquirers, visitors and students. However, we will always aim to secure that students’ privacy rights are safeguarded.

Do we transfer information outside the European Economic Area (EEA)?

Generally, information provided by students is stored on our secure servers located within the EEA;

However, there are times when we need to store information outside the EEA. For these purposes, we make sure that all our partners are GDPR compliant. Any transfer outside EU/EEA takes place according to the provisions of the Data Protection Legislation.

How long do we keep the students’ personal information for?

ACG will keep and process the above personal data for as long as it is required for the serving of the aforementioned purposes of processing and in order to comply with its legal obligations and to defend itself against any legal claims. After the above time period, ACG will proceed to the definite deletion of the above personal data.

Use of personal data by students

Students are not usually expected to collect or use personal data as part of their studies with The American College of Greece, but if they need to do so, they must get the written agreement of their tutor or supervisor that the processing is necessary. They must also immediately tell, in writing, our Data Protection Officer, using the contact details below.

If students need to process personal data, they then must refer to the Institutional Review Board (IRB) of the College. The American College of Greece conforms to national and international regulations for the Protection of Human Research Subjects, including the US Department of Health and Human Services (2009) Code of Federal Regulations.  Title 4, Part 46:  Protection of Human Subjects, The Belmond Report, the European Commission Ethics Review and relevant Directives, as well as relevant Greek Laws and Ministerial Decisions. Through the establishment of the Institutional Review Board to monitor the conduct of research, the College has affirmed its commitment to these principles. Use of human research participants requires approval without exception. Students’ cooperation in supplying the requested information will facilitate approval of their project. Improperly or incompletely prepared documents will be returned without evaluation.


Students (and/ or their parents /legal guardians) have a number of rights in relation to their personal data, provided by the Data Protection Legislation.

Students have the right to:

  • Access the personal information that we hold about them;
  • Correct inaccuracies in the personal information that we hold about them;
  • Request that we stop sending them direct marketing communications.

In certain circumstances, students have the right to

  • Have students’ details removed from systems that we use to process students personal data;
  • Restrict the processing of the students’ personal data in certain ways;
  • Obtain a copy of the students’ personal data in a structured electronic data file;
  • Object to certain processing of students personal data by the College.

Subject to the exceptions, conditions and limitations provided by the Personal Data Legislation, students (and/or their parents/legal guardians can exercise the aforementioned rights (right of access, rectification, restriction of processing, objection, erasure of the above personal data, as well as the right to data portability). In case they exercise one of the aforementioned rights, ACG will take any possible measure for the prompt satisfaction of their request, according to the specific provisions and conditions of the Data Protection Legislation, and shall inform them in writing regarding the satisfaction of their request, or for the reasons that prevent the exercise or the satisfaction thereof according to the Data Protection Legislation.

In addition, they may at any time withdraw their consent for the processing of their personal data, without however affecting the lawfulness of processing based on consent before its withdrawal and the processing based on other legal basis. We inform all students that in case of withdrawal of their consent, ACG may not be able to use the above personal data and they might not be able to use College’s services (or some of them).

Furthermore, students have the right to lodge a complaint with the Hellenic Data Protection Authority, in case they consider that the processing of their personal data is against the applicable legislation.

If you have any queries in relation to the protection of your personal data or you wish to exercise your legal rights, you can contact the Data Protection Officer of the American College of Greece by using the following contact details:

Address: 6 Gravias Street, Aghia Paraskevi, 15342
E-mail address: [email protected]