This Privacy Statement governs the way Cinnamon Hotel Management Limited (“Company”) [company registration number PB 7] of No. 117, Sir Chittampalam A. Gardiner Mawatha, Colombo 02, Sri Lanka and the hotels it operates under the Cinnamon Brand (jointly “Cinnamon Hotels & Resorts”) collects, uses, maintains and discloses information collected from students or potential students (“students”, “you”) of the Cinnamon Hospitality Academy (CHA), established by Cinnamon Hotels & Resorts in collaboration with the Swiss Hotel Management Academy Pvt. Ltd (SHMA). This Privacy Statement also forms part of your contract with us to provide educational services. This Privacy Statement may also be referred to as the “Student Privacy Policy”.
 

1. WHAT PERSONAL DATA DO WE COLLECT?

The following are examples of the type of information that we collect from you when you make an application to us

• Personal Information: You and your guardian/parents name, address, email address, age, gender, citizenship, National Identification Card, Passport Number, occupation, and contact information.
• Educational and Employment Information: Details about your education and employment history and any information provided through form submissions or student registrations.  
• Photos, CCTV, Audio and Video Recordings
• IT information such as website usage and user logs.
• Health Information: Health information you may provide, such as information related to accessibility requirements or medical conditions.
• Financial information such as bank details.
• Other Information: Any other information you voluntarily provide, such as survey responses or competition entries.

2. WHEN DO WE COLLECT YOUR PERSONAL DATA?

We collect your personal data when you directly interact with us, such as sending us an email, filling a form or when you use any of our systems or applications. We also may collect your information from other John Keells Group Companies and third-party sources like the internet, social media, private agencies or government authorities.

3. HOW DO WE USE YOUR PERSONAL DATA?

We always process your personal information based on one or more of the following legal grounds: your consent, contractual necessity, legitimate interests, legal obligation, vital interests, or public interest. Some of these instances are detailed below. 

• Assessing your suitability for enrollment as a student.
• Handling administrative tasks such as student pass applications, scholarship applications, fee payments, academic performance tracking, and internship placements.
• Organizing and facilitating student activities like orientations, festivals, celebrations, and excursions.
• Assisting with providing services from our educational partners

4. WHOM DO WE DISCLOSE YOUR PERSONAL DATA TO?

• Educational partners
• Potential Employers
• To any other third-party organizations that are contracted with us to provide services
• To other John Keells Group Companies
• To public authorities
• If another company acquires, or plans to acquire part of our business, we will also share information with that company.

5. TRANSFERS OF PERSONAL DATA

We may transfer your personal data outside of Sri Lanka. The transfer of your personal data is carried out under organisational, technical and contractual protection.

6. HOW DO WE PROTECT YOUR PERSONAL DATA?

We implement industry accepted security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. However, please be aware that no system is completely secure. In the event of a data security breach that could potentially impact your personal information, we will take appropriate steps to investigate the incident and notify you as required by applicable laws and regulations.

7. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

We will retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Statement or as required by applicable laws and regulations.  Once the retention period expires, we will securely anonymize your personal information to prevent unauthorized access or disclosure.

8. WHAT ARE YOUR RIGHTS?

You have the right to access, correct, or request anonymisation of your personal information. To exercise these rights, please contact the Data Protection officer at [email protected]. We will respond to your request within a reasonable timeframe. However, we reserve the right to deny these requests at our discretion within the legal framework.

9. CONSEQUENCES OF NOT PROVIDING YOUR PERSONAL DATA

• Failure to provide such information may:
• Limit or prevent access to features on our website or digital platforms.
• affect our ability to communicate with you.
• Hinder our degree to enter into a contract with you
• Be in violation of any applicable law or regulation

10. BY SUBMITTING PERSONAL DATA TO US, YOU ACKNOWLEDGE THAT:

• You have read and understood this Privacy Statement and agree and consent to the use, processing, disclosure and transfer of personal data as set out herein.
• All information and representations provided by you are true and correct to the best of your knowledge, and you have not knowingly omitted any relevant information.
• If you are providing information on behalf of another person, you guarantee you have the authority to do so and they are aware of this privacy statement.
• For children younger than 18 years old, the use of any of our services is only allowed with the valid consent of a parent or a guardian. If we become aware that we process information of a child under 18 years old without the valid consent of a parent or guardian, we reserve the right to delete it and stop services.

11. WHOM CAN YOU CONTACT FOR MORE INFORMATION?

If you have any questions or complaints about this statement or about our privacy practices, kindly reach out to the Data Protection Officer (DPO) at [email protected]

12. UPDATES TO THE PRIVACY STATEMENT

We reserve the right to amend, modify, vary or update this Privacy Statement, at our discretion from time to time, as and when the need arises. The most recently published Privacy Statement shall prevail over any of its previous versions. We have no obligation to directly inform you of any changes and you have a responsibility to periodically review https://www.cinnamonhotels.com/privacy-statement for any updates.