Legal
Privacy and cookie policy.
1Who we are
Elephant & Cross Limited, 148/12 Tower Road, Sliema, Malta. Company number C 98899.
We decide how your information is used, which makes us the "controller" under data protection law.
Email us about anything in this policy: info@elephantcross.org
We don't have a data protection officer. We're not required to have one.
2What this covers
This policy covers information we collect through www.elephantcross.org, when you enquire about a course, when we help you enrol, and when we stay in touch afterwards.
It does not cover what your course provider does with your information. Once you enrol, they hold your data in their own right and their privacy notice applies to that. We can tell you which provider and point you to their notice.
3What we collect
What you give us: your name, email, phone number, where you live, your previous qualifications and work experience, what you want to study, how you'd like to pay, and whatever you write to us.
What we collect automatically: your IP address, roughly where you are, your device and browser, which pages you looked at and for how long, and the cookies described further down.
What we get from others: if you replied to one of our ads, the platform sends us the contact details you filled in. If a provider or partner referred you, they send us enough to get in touch.
We don't ask for sensitive information, health, religion, and so on. If you tell us something like that yourself, for example a disability that affects how you'd study, we only use it to help you, and only with your say-so.
4Why we use it, and what allows us to
| What we're doing | Why we're allowed to |
|---|---|
| Answering your enquiry and advising on courses | You asked us to, steps before a contract |
| Referring you to a provider and helping you enrol | Same |
| Supporting you while you study | Same, plus our legitimate interest in running the service |
| Sending you marketing about courses | Your consent, or, if you're already a student, our legitimate interest, and you can opt out at any time |
| Measuring our ads and improving the site | Your consent, through cookies |
| Keeping accounts and commission records | We're required to by law |
| Dealing with a legal claim | Our legitimate interest in defending ourselves |
"Legitimate interests" means we've weighed what we want to do against your privacy and concluded it's fair. You can object, see Your rights.
Consent can be withdrawn whenever you like. That doesn't undo anything we did before you withdrew it.
You don't have to give us anything. But without your contact details and what you want to study, we can't advise you or arrange an enrolment.
5Who else sees it
Course providers: so they can assess your application and enrol you. They then hold it in their own right.
Companies that run things for us: the providers of our customer database and email system, our website hosting, and our website analytics and advertising tools. They can only use your data to do the job we've given them, under a written contract. Ask us and we'll tell you who they are.
Our accountants and lawyers, when needed.
Authorities, if the law requires it.
We don't sell your data, and we don't hand it to anyone for their own marketing.
6Sending data outside Europe
Some of the companies above are in the UK or the US.
For the UK, the European Commission has decided its protection is equivalent to ours, so transfers are straightforward.
For the US, we rely on the EU–US Data Privacy Framework where the company is certified under it, and on the European Commission's standard contractual clauses where it isn't.
Ask us and we'll send you the safeguards that apply to any particular transfer.
7How long we keep it
| You enquired but didn't enrol | 24 months after we last heard from you |
| You enrolled | Your course, plus 6 years, the period in which a contract claim can be brought |
| Marketing | Until you opt out, and in any case 24 months after you last engaged |
| Accounting records | 10 years, as Maltese tax and company law requires |
| Website and analytics data | As set out in the cookie table below |
After that we delete it, or strip it of anything that identifies you.
8Your rights
You can ask us to:
- tell you what we hold and give you a copy
- correct anything wrong or incomplete
- delete it
- restrict what we do with it
- send it to you or another company in a portable format
- stop using it where we've relied on legitimate interests, and for marketing, you can stop us at any time, no reason needed
- withdraw consent where you gave it
Email info@elephantcross.org. We'll reply within a month. If it's complicated we may need up to two months more, and we'll tell you within the first month if so.
It's free. We'd only charge, or refuse, if a request were plainly excessive or repetitive. We may need to check you are who you say you are.
If you think we've got it wrong, you can complain to the Information and Data Protection Commissioner, Floor 2, Airways House, High Street, Sliema SLM 1549, idpc.org.mt. You can also complain to the authority where you live or work.
9Cookies
A cookie is a small file a website puts on your device. Pixels, tags and local storage do much the same thing. We call all of it "cookies" here.
Three kinds:
Essential: needed for the site to work at all, like keeping you logged in and keeping the site secure. These don't need your permission.
Analytics: tell us how people use the site so we can improve it.
Advertising: tell us whether our ads are working.
What's on our site:
| Kind | What it does | How long it lasts |
|---|---|---|
| Essential | Keeps your session going and the site secure | Until you close the browser |
| Analytics | Tells us how visitors use the site, so we can improve it | Up to 24 months |
| Advertising | Measures how our ads perform | Up to 3 months |
Analytics and advertising cookies aren't needed to run the site. Under EU and Maltese law they can only be placed with your permission first.
You can block or delete cookies in your browser settings, every major browser explains how. Blocking the essential ones will break parts of the site.
Cookies set by other companies are covered by their own privacy policies, not this one.
10Keeping it safe
We protect your information with encryption in transit, access limited to people who need it, and by choosing suppliers who can demonstrate proper security.
Nothing sent over the internet is completely secure, so we can't promise absolute safety.
11Children
Our service is for people aged 16 and over. We don't knowingly collect data from anyone younger, and we delete it if we find we have.
12Automated decisions
We don't make decisions about you by computer alone, and we don't profile you for that purpose.
13Changes
We may update this policy. The version here is the current one, and the date at the top tells you when it last changed. If we change something important and we're in touch with you, we'll email you.