Privacy Policy Addendum

FOR EUROPEAN WEBSITE VISITORS AND PARTICIPANTS TRAVELING WITHIN THE EUROPEAN ECONOMIC AREA

ACIS Educational Tours is a trading name of the American Institute for Foreign Study, Inc (“AIFS US”). European travel and accommodation and other European elements of our tours are booked and managed through American Institute for Foreign Studies (UK) Limited (“AIFS UK”). AIFS UK also gives assistance to tour participants while they are in Europe. Contact details for AIFS UK (including details of its registration with the UK Information Commissioner’s Office) are at the end of this Policy (see HOW TO CONTACT ACIS below).

AIFS US and AIFS UK (collectively “AIFS”/“we”/“our”/“us”) take your privacy very seriously and are committed to protecting and respecting your privacy.

This Policy, together with a) our Website Terms of Use, b) our Cookie Policy, and c) our Terms and Conditions (each as described in OTHER TERMS WHICH MAY APPLY TO YOU below), applies to personal information that we and the Tour Managers we engage hold and process about you.

Where we refer to the “ACIS Website” in this Policy, we mean the website which can be accessed at https://www.acis.com/ and any other “ACIS” website operated by us (including any updates or supplements to them).

Please read this Policy carefully to understand our views and practices regarding your personal information and how we will treat it.

Topics Covered

• WHO THIS POLICY APPLIES TO
• OTHER TERMS WHICH MAY APPLY TO YOU
• INFORMATION WE COLLECT (INCLUDING WHEN AND HOW WE COLLECT IT)
• HOW WE USE YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO
• SHARING YOUR INFORMATION
• RETAINING YOUR INFORMATION
• TRANSFERRING YOUR INFORMATION OVERSEAS
• CHILDREN’S INFORMATION
• KEEPING YOUR INFORMATION SECURE
• UPDATING AND ACCESSING YOUR INFORMATION
• YOUR RIGHTS
• OTHER WEBSITES
• CHANGES TO THIS POLICY
• HOW TO CONTACT ACIS

WHO THIS POLICY APPLIES TO

 This Policy applies to:

• “Participants”, i.e. a student, teacher or other client who books a tour with ACIS involving travel within the European Economic Area (“EEA”, i.e., the member states of the European Union, the United Kingdom, Norway, Iceland and Liechtenstein); and
• “Visitors” to the ACIS Website who are in the EEA.

OTHER TERMS WHICH MAY APPLY TO YOU

This Policy refers to the following additional terms, which also apply to your use of the ACIS Website and, if applicable, your participation in a tour:

WEBSITE TERMS OF USE 
Our “Website Terms of Use” govern your use of the ACIS Website.

COOKIE POLICY
Our “Cookie Policy” sets out information about the cookies we use on the ACIS Website.

TERMS AND CONDITIONS
The “Terms and Conditions” that you accept when booking your tour.

INFORMATION WE COLLECT (INCLUDING WHEN AND HOW WE COLLECT IT)

We collect the following personal information from and about you:

1. Information you give us
2. Information we collect when you visit the ACIS Website
3. Information provided by third parties

1. Information you give us. You may give us information about you:

• when you register your interest in or book a tour;
• when you use the ACIS Website, for example, if you fill in a website enquiry or registration form;
• if you complete a survey or provide feedback on the ACIS Website;
• if you report a problem with the ACIS Website;
• if you contact or correspond with us (for example, by phone, e-mail or otherwise) for any other reason.

When booking a tour, you:

• must provide us with your name, address, telephone number, email address, date of birth, gender, emergency contact information, nationality, passport and visa details (including your town and country of birth)
• must provide us with details of any medical conditions which are relevant to your ability to take part in the tour, which may include details of your medical history and any medical or health conditions (including any disabilities) and
• must provide us with information to enable us to provide you with insurance.

when taking part or after taking part in a tour, you:

• may provide us with information about you, for example, in any feedback, comments, blog articles or complaints you make or provide about a tour or your involvement in it; and
• may provide us with your then-current contact details to enable us to keep in touch with you.

2. Information we collect when you visit the ACIS Website. Each time you visit the ACIS Website, we will automatically collect the following:

• certain technical information, for example, the type of device (and its unique device identifier) you use to access the ACIS Website, the internet protocol (IP) address used to connect your device to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, mobile network information and platform;
• information about your visit to the ACIS Website, including the full Uniform Resource Locators (URL), clickstream to, through and from the ACIS Website (including date and time), pages you viewed, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page; and
• certain cookies that are capable of identifying your device (see our Cookie Policy to understand which cookies the ACIS Website uses).

3. Information provided by third parties. 
When taking part or after taking part in a tour:

• The Tour Manager, Group Leader or others taking part in the tour may provide feedback or may give us other information concerning you (for example if you wish to end your tour early and return home).

HOW WE USE YOUR INFORMATION AND OUR LEGAL BASIS FOR DOING SO

We collect personal information so that we can operate effectively and provide you with the best possible service. The information we process depends on the context of your interactions with us, with our Tour Managers and with the ACIS Website, and your involvement in a tour. It also depends on the choices you make, for example the consents you provide, the functions you use and the privacy settings you select. You may choose not to provide or allow us to collect certain information, but we may then not be able to consider you for a tour or enable you to participate in a tour (where that information is necessary for us to do so).

Learn more below about how we use your information and what our legal basis is for using it:

Participants
Type(s) of personal information we process	Why we process this personal information	Our legal basis for processing this personal information
Name Telephone number(s) Email address Address Date of birth Password	To help us to identify you and any account you hold with us.	To allow us to perform our obligations under our agreement with you, and/or to take steps at your request prior to entering into our agreement with you.
Name Telephone number(s) Email address Address Date of birth Gender Preferred city of departure Passport and visa details Information required for insurance purposes Personal information you provide to our Tour Managers	To allow us to book your tour/itinerary, to provide you with information and services that you request from us, and to ensure that you are insured while on your tour. AIFS US may share information with AIFS UK to enable it to book elements of your tour.	To allow us to perform our obligations under our agreement with you, and/or to take steps at your request prior to entering into our agreement with you.
Name Telephone number Email address Address Date of birth Passport and visa details Information required for insurance purposes	To support you with your participation in a tour, e.g. with: your visa application; your repatriation (if necessary); and/or your travel, accommodation and insurance. AIFS US may share information with AIFS UK to enable it to provide assistance during your tour. To verify your visa eligibility and/or comply with visa regulations.	To allow us to perform our obligations under our agreement with you, and/or to take steps at your request prior to entering into our agreement with you.
Name Telephone number Email address Address Information in any feedback, comments or complaints you make or provide about the Program or your involvement in the Program Any other relevant personal information	To deal with any enquiries, correspondence, concerns or complaints.	To allow us to perform our obligations under our agreement with you, and/or to take steps at your request prior to entering into our agreement with you.
Name Telephone number Email address Other contact details	To enable us to keep in touch with you after you have participated in a tour.	To enable us to pursue our legitimate interests to: understand your experience of a tour; and improve and/or promote our tours.
Name Telephone number Email address Other contact details Your interest in travel generally	To enable us to send you information about other tours we offer, and/or other opportunities or services of ours and other companies in our group which may be of interest to you.	Your consent.
Certain medical and health details	To enable us or your Tour Managers to provide information to the emergency services if an emergency arises.	To protect your vital interests
Certain medical and health details	To enable us or your Tour Managers to provide information to organisations associated with your tour who reasonably need this information.	Your consent.
Details of your emergency contact(s)	To enable us or your Tour Managers to get in touch with your emergency contact(s) if an emergency arises.	Your consent.
Information we collect when you visit the ACIS Website	Please see “Why we process this personal information” in the table for Visitors below.	Please see “Our legal basis for processing this personal information” in the table for Visitors below.

Visitors
Type(s) of personal information we process	Why we process this personal information	Our legal basis for processing this personal information
Information we collect when you visit the ACIS Website as described above	To conduct internal operations, including data analysis, testing, research, statistical purposes and troubleshooting. To ensure that content on the ACIS Website is presented in the most effective manner for you and for your device. To analyse traffic to the ACIS Website. As part of our efforts to keep the ACIS Website secure and to prevent fraud.	To enable us to pursue our legitimate interests to: understand how the ACIS Website is used; improve the ACIS Website; keep the ACIS Website secure; and prevent fraud.

More about the information we use and why

Where we have a legal basis to use your personal information without consent (as we have described above), this Policy fulfils our duty to process personal information transparently and helps us to do so fairly and lawfully and in a manner that you would expect given the nature of our relationship with you, by giving you appropriate notice and explanation of the way in which your personal information will be used.

Where consent is required for our use of your personal information, we will ask you to positively opt-in by ticking the appropriate consent box or otherwise communicating your consent.
Where you provide us with personal information relating to other individuals (for example, if you give us your emergency contact’s details), you must obtain the consent of those individuals before doing so.

If you have any questions or require any further information regarding our use of personal information, please contact our data protection officer (see HOW TO CONTACT ACIS).

SHARING YOUR INFORMATION

We may share your personal information with your consent or as is necessary with selected third party service providers, and other companies within our group that support us in the performance of the activities set out in the tables above. See below for more details.

We expect all our third party service providers and all other companies within our group to take appropriate security measures to protect your personal information in line with our policies.

We may also need to share your personal information with a regulator or otherwise to comply with the law or to respond to valid legal process, including from law enforcement or other government agencies.

Why might you share my personal information with third parties?

We may share your personal information with third parties where it is necessary in connection with arranging your tour, where required by law (as above), or where we have another legitimate interest in doing so that is not overridden by your interests and fundamental rights (for example, to protect Tour Managers or other Participants, or to operate and maintain the security of our computer systems.)

Who will you share my personal information with?

We will share certain information about you as follows:

• we use Google to track your usage of the ACIS Website. We do so to improve our users’ experience of the ACIS Website.
• we may share certain information (including your name, gender, passport information, date of birth and address) with third party suppliers such as travel and accommodation providers (including airlines and hotels); insurance providers; embassies; and border control agencies. We do so to facilitate your participation in a tour;
• we will ask you to share your financial and/or payment details with our third party payment processors, PayPal and CyberSource, (although we ourselves will never access that information). We do so to collect payment for initial program fees and any upgrades you may later select.

RETAINING YOUR INFORMATION

We will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements. To decide the appropriate retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of it, the purposes for which we process your information, and the applicable law.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Even if you request that we erase your information, we may still need to keep it (see YOUR RIGHTS) or may keep it in a form that does not identify you.

The following retention periods will apply, unless we inform you otherwise (or you request that we erase your information):

• if you register your interest in or apply to take part in a tour but do not go on to book a tour, we may retain some of your personal information (including your name, email address and date of birth) for a period of 5 years following the date when you first express your interest; or
• if you are a Participant, we may retain some of your information for a period of 7 years from the end of your tour, for example, to keep in touch with you and/or for legal reasons.
• if you are a Visitor and you do not use the ACIS Website for one year, then we will erase your information.

We may keep certain information for longer periods than those stated above if you have agreed to us using it, for example, for promotional purposes.

Please contact our data protection officer if you would like further details on how long we retain your information (see HOW TO CONTACT ACIS).

TRANSFERRING YOUR INFORMATION OVERSEAS

If you are a Participant, AIFS UK may transfer, process and store the information it collects from or about you to AIFS US and other relevant third parties based in the U.S. (i.e. outside of the EEA). AIFS UK does so as it is necessary for it to communicate with AIFS US in relation to your tour, and so that you can take part in your tour (i.e. necessary for the performance of our obligations under our agreement with you).

If you are a Visitor based in the EEA, we will transfer the information we collect from you to AIFS US and other relevant third parties based in the U.S. We do so because the ACIS Website is operated out of, and accessed in, the U.S. and it is necessary for us to understand how it is used, so that we can improve it.

In each case, we will take all steps reasonably necessary to ensure that your personal information receives an adequate level of protection and is treated in a way consistent with EU laws on data protection.

CHILDREN’S INFORMATION

We do not knowingly collect information from anyone under the age of 13 and you should not register your interest in or apply to take part in a tour if you are under the age of 13. If you are under 21 and wish to register your interest in a tour, then you must obtain the consent of your parent or legal guardian. If you become aware that your child or any child under your care has provided us with information without your consent, please contact our data protection officer (see HOW TO CONTACT ACIS).

KEEPING YOUR INFORMATION SECURE

All personal information that you provide to us is stored on secure servers. We have put in place (and require anyone who processes data on our before to put in place) appropriate measures to protect the security of your information.

In addition, we limit access to your information to those of our employees, agents, contractors and other third parties who have a business need to know.

You should be aware that the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of the information transmitted to the ACIS Website or by email; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.

UPDATING AND ACCESSING YOUR INFORMATION

You have the right under data protection laws to access personal information held about you, subject to certain conditions, and to request its rectification or deletion.

If you would like to access or amend the personal information which we hold about you or if you would like us to stop using your personal information, please contact our data protection officer (see HOW TO CONTACT ACIS).

To learn more about the rights you may have in relation to your personal information see YOUR RIGHTS.

YOUR RIGHTS

By law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will need you to prove your identity before we release any personal information to you.
• Request correction or erasure of your personal information (unless we have the legal right to retain it). You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of personal information that you have provided to us to another party.
• Change your information processing preferences at any time.

You should be aware that if you ask us to stop processing your personal information in a certain way or to erase your personal information, and this type of processing is necessary in order for you to participate in a tour, then we may not be able to continue to provide our tour services to you and you may need to leave the tour. This does not include your right to object to direct marketing, which can be exercised at any time without restriction.

If you want to exercise any of the rights listed above, please contact our data protection officer (see HOW TO CONTACT ACIS).

No fee usually required to access your personal information

You will not normally have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to confirm your identity and verify your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

Where you have consented to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our data protection officer (see HOW TO CONTACT ACIS). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

OTHER WEBSITES

The ACIS Website contains links to other websites, including Facebook, Twitter and Instagram. This Policy only applies to the ACIS Website so when you link to other websites you should read their own privacy policies.

CHANGES TO THIS POLICY

We keep this Policy under regular review and will post any updates on this webpage. This Policy was last updated in May 2018.

HOW TO CONTACT ACIS

In the UK, AIFS UK is the data controller in respect of your personal information and is registered with the UK Information Commissioner’s Office with registration number Z6393161. AIFS UK’s address is 37 Queen’s Gate, London, SW7 5HR.

We have appointed Richard Howell as our data protection officer to oversee compliance with this Policy. If you have any questions about this Policy or how we handle your personal information please contact him at dpo@aifs.co.uk, +44 20 7581 7300, 37 Queens Gate, London SW7 5HR, United Kingdom.

Complaints
If for any reason you are not happy with the way that we have handled your personal information please contact us at dpo@aifs.co.uk, +44 20 7581 7300, 37 Queens Gate, London SW7 5HR, United Kingdom. If you are still not happy, you have the right to make a make a complaint to the Information Commissioner’s Office see: https://ico.org.uk/global/contact-us/.