Personal Information Protection Notice


Bermuda College (“the College”) is committed to protecting the personal information of its students, employees, clients, customers, alumni, and other stakeholders in accordance with the Personal Information Protection Act 2016 (PIPA). This Notice outlines how the College collects, uses, discloses, retains, and safeguards personal information while ensuring transparency, accountability, and respect for individual rights.


Scope


This Notice applies to:


  • All personal information handled by Bermuda College
  • All employees, contractors, and service providers acting on behalf of the College
  • All systems, records, and processes involving personal information

Definitions


  • Personal Information - Information about an identifiable individual.
  • Sensitive Personal Information - Includes data such as health information, race, religion, biometrics, or criminal history, requiring heightened protection.
  • Contact Information - Business contact details (not governed by PIPA).
  • Processing - Any operation involving personal information (collection, use, disclosure, storage, deletion).
  • Privacy Officer - Individual responsible for PIPA compliance.


Principles Governing Personal Information


The College adheres to the following principles:

  • Accountability
  • Fair and lawful processing
  • Purpose limitation
  • Data minimization
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality
  • Transparency

Accountability


The College will:


  • Appoint a Chief Privacy Officer responsible for compliance
  • Implement policies, procedures, and training programs
  • Require third-party providers to meet equivalent privacy standards

Collection of Personal Information


Personal information will be collected:


  • Lawfully and fairly
  • Directly from individuals where possible
  • Only where necessary for specified purposes

Purposes include:


  • Identity verification
  • Student admission and enrolment
  • Employment administration
  • Financial and payment processing
  • Regulatory compliance
  • Service delivery and improvement
  • Fundraising and communications

The College will limit collection to the minimum amount necessary.


Consent


The College will obtain consent unless legally exempt.


Consent may be:


  • Express (written/oral/electronic)
  • Implied (where purposes are obvious)

Individuals may:


  • Withdraw consent (subject to legal/contractual limits)
  • Opt out of marketing or non-essential communications

Use and Disclosure


Personal information will be used or disclosed:


  • Only for identified or reasonably related purposes
  • With consent unless otherwise permitted by law

Permitted uses without consent include:


  • Legal compliance
  • Emergencies involving life or safety
  • Fraud prevention or investigation
  • Debt collection

Cross-Border Transfers


Where personal information is transferred outside Bermuda, the College will:


  • Ensure the receiving party provides comparable protection
  • Use contractual safeguards to maintain compliance with PIPA

Sensitive Personal Information


The College will apply enhanced protections for sensitive personal data, including:


  • Limiting access strictly to authorized personnel
  • Applying stronger security controls
  • Obtaining explicit consent where required

Data Minimization and Retention


  • Only necessary personal information will be collected and retained
  • Information will be retained only as long as required for:
    • Identified purposes
    • Legal or regulatory obligations
  • Information used for decisions will be retained for at least one year

Accuracy


The college will:


  • Maintain accurate and complete records
  • Allow individuals to request corrections
  • Notify third parties of corrections where applicable

Safeguards


The College will implement:


Physical Safeguards


  • Secure offices and locked storage

Technical Safeguards


  • Encryption, firewalls, password controls

Administrative Safeguards


  • Access controls
  • Staff training
  • Confidentiality agreements

Secure disposal methods (e.g., shredding, secure deletion) will be used.


Breach Management


The College will:


  • Detect, investigate, and respond to breaches
  • Assess risk to individuals
  • Notify affected individuals and authorities where required
  • Maintain breach incident records
  • Implement corrective measures to prevent recurrence

Individual Rights


Individuals have the right to:

  • Access their personal information
  • Request correction
  • Withdraw consent
  • Object to certain processing
  • Request deletion where legally permissible

Requests must be submitted in writing.


Access Requests


The College will:


  • Respond within 30 business days
  • Provide access unless exemptions apply

Access may be refused if:


  • It reveals third-party confidential information
  • It is legally privileged
  • It impacts investigations or legal proceedings
  • It poses a security risk

Reasons for refusal will be provided in writing.


Transparency


The College will inform individuals about:


  • What data is collected
  • Why it is collected
  • How it is used
  • Who it is shared with

Training and Awareness


The College will:


  • Provide regular privacy training to staff
  • Promote awareness of data protection responsibilities

Privacy by Design


Privacy safeguards will be built into:


  • Systems
  • Programs
  • Processes

by default, and throughout the lifecycle of data.


Complaints and Inquiries


Questions, concerns, or complaints should be directed to:


Scott Wade
Privacy Officer
Bermuda College
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.


If unresolved, individuals may contact the Information and Privacy Commissioner of Bermuda.


Notice Review


This Notice will be:


  • Reviewed regularly
  • Updated to reflect legal, regulatory, or operational changes