Personal Information Protection Policy
At Bermuda College, we are committed to providing our students, employees, clients, customers and alumni with exceptional service. As providing this service involves the collection, use and disclosure of some personal information about our students, employees, clients, customers and alumni, protecting their personal information is one of our highest priorities.
While we have always respected our constituent groups’ privacy and safeguarded their personal information, we have strengthened our commitment to protecting personal information as a result of Bermuda’s Personal Information Protection Act (PIPA). PIPA, which came into effect on 1st January 2025, sets out the ground rules for how Bermuda businesses and not-for-profit organizations may collect, use and disclose personal information.
Bermuda College will inform our constituents of why and how we collect, use and disclose their personal information, obtain their consent where required, and only handle their personal information in a manner that a reasonable person would consider appropriate in the circumstances.
This Personal Information Protection Policy, in compliance with PIPA, outlines the principles and practices we will follow in protecting students, employees, clients, customers and alumni’ personal information. Our privacy commitment includes ensuring the accuracy, confidentiality, and security of all our constituents’ personal information and allowing them to request access to, and correction of, their personal information.
Scope of this Policy
This Personal Information Protection Policy applies to Bermuda College and to any service providers collecting, using or disclosing personal information on behalf of Bermuda College.
Definitions
- Personal Information - means information about an identifiable individual. For example, name, age, home address and phone numbers, social insurance number, marital status, religion, income, credit history, medical information, education, employment information etc. Personal information does not include contact information as described below
- Contact Information - means information that would enable an individual to be contacted at a place of business and includes name, position name or title, business telephone number, business address, business email or business fax number.
- Contact information is not covered by this policy or PIPA.
- Privacy Officer - means individuals designated responsibility for ensuring that Bermuda College complies with this policy and PIPA.
1.0 Collecting Personal Information
1.1 Unless the purposes for collecting personal information are obvious and students, clients and customers voluntarily provide their personal information for those purposes, we will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection.
1.2 Bermuda College will only collect students, clients and customers’ information that is necessary to fulfil the following purposes:
- To verify identity, we may collect name, home address, home telephone number and birth date;
- To verify creditworthiness;
- To identify student, client and customer preferences;
- To understand the financial, banking, insurance and employment needs of our students, employees, clients and customers;
- To open and manage student, employee, and vendor banking accounts;
- To admit and enroll students in courses and programmes;
- To collect and send out association and charity membership information;
- To contact our students, employees, clients, customers and alumni for fundraising;
- To ensure a high standard of service to our students, employees, clients and customers;
- To meet local and accrediting bodies’ regulatory requirements;
- To assess suitability for tenancy and rental agreements;
- To collect and process rental fees and related payments.
2.0 Consent
2.1 Bermuda College will obtain students, employees, clients and customers consent to collect, use or disclose personal information (except where, as noted below, we are authorized to do so without consent).
2.2 Consent can be provided orally, in writing, electronically, and through an authorized representative or it can be implied where the purpose for collecting using or disclosing the personal information would be considered obvious and students, employees, clients and customers voluntarily provide personal information for that purpose.
2.3 Consent may also be implied where students, employees, clients and customers have been given notice and a reasonable opportunity to opt-out of his or her personal information being used for mail-outs, the marketing of new services, or programmes, or fundraising and the student, employee, client and customer does not opt-out.
2.4 Subject to certain exceptions (e.g., the personal information is necessary to provide the service or product, or the withdrawal of consent would frustrate the performance of a legal obligation), students, employees, clients and customers can withhold or withdraw their consent for Bermuda College to use their personal information in certain ways. A student, employee, client and customer’s decision to withhold or withdraw their consent to certain uses of personal information may restrict our ability to provide a particular service or product. If so, we will explain the situation to assist the constituent group in making the decision.
2.5 Bermuda College may collect, use or disclose personal information without students, employees, clients and customers’ knowledge or consent in the following limited circumstances:
- When the collection, use or disclosure of personal information is permitted or required by law;
- In an emergency that threatens an individual's life, health, or personal security;
- When the personal information is available from a public source (e.g., a telephone directory);
- When we require legal advice from a lawyer;
- For the purposes of collecting a debt;
- To protect ourselves from fraud;
- To investigate an anticipated breach of an agreement or a contravention of law.
3.0 Using and Disclosing Personal Information
3.1 Bermuda College will only use or disclose students, employees, clients, customers and alumni’ personal information where necessary to fulfil the purposes identified at the time of collection or for a purpose reasonably related to those purposes such as:
- To conduct student, employee, client, customer, or alumni surveys in order to enhance the provision of our services, academic offerings, employment conditions and customer services;
- To contact our students, employees, clients, customers and alumni directly about events and services that may be of interest.
3.2 Bermuda College will not use or disclose students, employees, clients, customers and alumni personal information for any additional purpose unless we obtain consent to do so
4.0 Retaining Personal Information
4.1 If Bermuda College uses students, employees, clients, customers or alumni’ personal information to make a decision that directly affects any of the constituent members, we will retain that personal information for at least one year so that any member will have a reasonable opportunity to request access to it.
4.2 Subject to 4.1, Bermuda College will retain said personal information only as long as necessary to fulfil the identified purposes or a legal or business purpose.
5.0 Ensuring Accuracy of Personal Information
5.1 Bermuda College will make reasonable efforts to ensure that students, employees, clients, customers and alumni’ personal information is accurate and complete where it may be used to make a decision about any member of the constituent group or be disclosed to another organization.
5.2 Students, employees, clients, customers and alumni may request correction to their personal information in order to ensure its accuracy and completeness. A request to correct personal information must be made in writing and provide sufficient detail to identify the personal information and the correction being sought.
5.3 If the personal information is demonstrated to be inaccurate or incomplete, Bermuda College will correct the information as required and send the corrected information to any organization to which the personal information was disclosed in the previous year.
5.4 If the correction is not made, Bermuda College will note the constituent member’s correction request in the file.
5.5 A request to correct personal and general business information should be forwarded to the Chief Privacy Officer, the Director of Human Resources. Requests for corrections to student and alumni information should be forwarded to the Registrar (Privacy Officer).
5.6 The designees of either Privacy Officer will proceed with the making the corrections.
6.0 Securing Personal Information
6.1 Bermuda College is committed to ensuring the security of students, employees, clients, customers and alumni’ personal information in order to protect it from unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.
6.2 The following security measures will be followed to ensure that students, employees, clients, customers and alumni’ personal information is appropriately protected:
- The use of locked filing cabinets;
- Physically securing offices where personal information is held;
- Requiring the use of user IDs, passwords, encryption, firewalls; and restricting employee access to personal information as appropriate (i.e., only those that need to know will have access;
- Contractually require Information Technology Consultants and Service Providers to provide comparable security measures.
6.3 Bermuda College will use appropriate security measures when destroying students’, employees’, clients’, customers’ and alumni’ personal information such as shredding documents, and deleting electronically stored information.
6.4 Bermuda College will continually review and update our security policies and controls as technology changes to ensure ongoing personal information security.
7.0 Providing Students, Employees, Clients, Customers and Alumni with Access to Personal Information
7.1 Students, employees, clients, customers and alumni have a right to access their personal information, subject to the following exceptions:
- The personal information is protected by any legal privilege;
- The disclosure of the personal information would reveal confidential information of Bermuda College or of a third party that is of a commercial nature and it is not unreasonable to withhold that information;
- The personal information is being used for a current disciplinary or criminal investigation or legal proceedings, and refusal does not prejudice the right of the individual to receive a fair hearing;
- The personal information was used by a mediator or arbitrator, or was created in the conduct of a mediation or arbitration for which the mediator or arbitrator was appointed to act under an agreement or by a court;
- The disclosure of the personal information would reveal the intentions of Bermuda College in relation to any negotiations with the individual to the extent that the provision of access would be likely to prejudice those negotiations;
- Bermuda College shall not provide access to personal information if the disclosure of the personal information could reasonably be expected to threaten the life or security of an individual;
- The personal information would reveal personal information about another individual; or the personal information would reveal the identity of an individual who has in confidence provided an opinion about another individual and the individual providing the opinion does not consent to disclosure of his identity, unless it is reasonable in all the circumstances to provide access;
- If Bermuda College is reasonably able to redact the information or redact the personal information about the individual who requested it.
7.2 A request to access personal information must be made in writing and provide sufficient detail to identify the personal information being sought.
7.3 Upon request, Bermuda College will also tell students, employees, clients, customers and alumni how we use their personal information and to whom it has been disclosed if applicable.
7.4 Bermuda College will make the requested information available within 30 business days, or provide written notice of an extension where additional time is required to fulfil the request.
7.5 If a request is refused in full or in part, Bermuda College will notify the student, employee, client, customer or alumni in writing, providing the reasons for refusal and the recourse available for redress.
8.0 Questions and Complaints: The Role of the Privacy Officer and other Designated Individuals
8.1 Bermuda College Privacy Officers and other designated individuals are responsible for ensuring the College’s compliance with this policy and the Personal Information Protection Act.
8.2 Students, employees, clients, customers and alumni should direct any complaints, concerns or questions regarding Bermuda College’s compliance in writing to the Chief Privacy Officer. If the Chief Privacy Officer is unable to resolve the concern, the concerned constituent member may also write to the Information and Privacy Commissioner of Bermuda.
Contact information for Bermuda College’s Privacy Officers:
Constance Smith, Interim, Director Human Resources and Development, External Programmes, Articulation Agreements & Training:
Erica Russell, Registrar, Privacy Officer:
Karmeta Hendrickson, Interim Director of Information Technology: