Privacy Policy

1 Who We Are and Our Role

C.I.C. Crownhill International College (referred to throughout this policy as 'the College', 'we', 'us' or 'our') is the data controller for personal data collected through our website (cicbrazil.com), our student portal (learn.cicbrazil.com), our application form, and through direct contact by email, telephone or WhatsApp.

Our UK recruitment partner is DC EduTravel (trading name of DC Global Education Group UK), based at 450 Bath Road, Heathrow, West Drayton, UB7 0EB. Where personal data is shared with DC EduTravel for student recruitment purposes, DC EduTravel acts as a joint controller or processor depending on the processing activity.

For all data protection enquiries, contact us at: askcic@cicbrazil.com or write to the address above.

2 Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality, gender, passport number, photograph and signature.
• Contact data: email address, telephone number, WhatsApp number, home address, postal address and emergency contact details.
• Educational data: academic qualifications, institution history, English language proficiency level, assessment results, module grades, attendance records and academic progress reports.
• Immigration and visa data: visa type and expiry date, CRNM registration number, entry and exit dates in Brazil, immigration status, Federal Police registration reference and all supporting documents submitted for visa purposes.
• Financial data: tuition fee payment records, instalment plan details, scholarship status, refund requests and payment history. We do not store credit or debit card numbers or bank details directly.
• Technical and usage data: IP address, browser type and version, operating system, device identifiers, pages visited, time spent on pages, referral source and cookies.
• Communications data: records of emails, WhatsApp messages and enquiry form submissions.
• Marketing and preferences data: course interests, intake preferences, referral source, communication preferences and marketing consent records.
• Sensitive data: where relevant and with explicit consent, we may collect health or medical information solely to provide reasonable adjustments to your studies or assessments.

3 How We Use Your Personal Data

We use personal data for the following purposes:

• Processing and administering your application, offer, enrolment and student registration.
• Issuing visa support documents, including the Carta de Aceite and, where applicable, the Carta de Alojamento.
• Delivering your educational programme, tracking attendance, setting and marking assessments, and issuing qualifications and certificates.
• Supporting immigration registration with the Polícia Federal and relevant Brazilian authorities.
• Processing tuition fee payments, managing payment plans and issuing invoices and receipts.
• Communicating with you about your studies, visa, accommodation, career services, upcoming intakes and College news.
• Complying with Brazilian federal education regulations, including SINCRE student reporting requirements.
• Administering scholarships, bursaries and financial support.
• Safeguarding the welfare of students and staff.
• Maintaining the security and integrity of our IT systems and website.
• Responding to enquiries, complaints and appeals.
• Where you have given consent, sending you marketing information about our programmes and services.

4 Legal Basis for Processing

Under the LGPD, we process your personal data on the following legal bases:

• Performance of a contract: processing necessary to provide your educational programme, visa support and related services as set out in your enrolment agreement.
• Compliance with a legal obligation: processing required by Brazilian education law, immigration regulations, tax law and financial reporting obligations.
• Legitimate interests: processing for the security, safety and administration of the College, its systems and its staff, where your interests do not override ours.
• Consent: where you have given explicit, freely given, informed and unambiguous consent, including for marketing communications and the processing of sensitive data. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Protection of life: where processing is necessary to protect the vital interests of a data subject in an emergency situation.

5 How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to any legal obligation to retain it for a longer period. Our standard retention periods are:

• Student academic records, including qualifications and assessment results: seven years after the student's graduation or departure from the College, as required by Brazilian education law.
• Immigration and visa documents: five years after the student's visa expiry date.
• Financial records, including payment and invoice records: five years, as required by Brazilian tax and accounting law.
• Unsuccessful applications: twelve months from the date of the decision.
• Marketing consent records: until consent is withdrawn or three years of inactivity, whichever is earlier.
• Website analytics and technical data: twenty-four months.
• Safeguarding records: a minimum of seven years, or longer where legally required.

After the relevant retention period has expired, personal data is securely and permanently deleted or anonymised.

6 Sharing Your Personal Data

We share personal data only where necessary and in accordance with this policy. We may share your data with:

• The Polícia Federal (Brazilian Federal Police) for SINCRE immigration registration and related immigration compliance obligations.
• The Brazilian Ministry of Education (MEC) and other federal education authorities as required by law.
• Partner universities and academic institutions, as part of the university pathway application process, with your prior consent.
• Authorised education agents and DC EduTravel, our UK recruitment partner, for student recruitment and admissions purposes.
• Payment processors engaged to handle tuition fee transactions, who process data under appropriate contractual safeguards.
• IT and cloud service providers who host our website, student portal and data systems, operating under data processing agreements.
• Professional advisers including lawyers, accountants and insurers, under duties of confidentiality.
• Law enforcement agencies, courts or regulatory authorities where we are legally required or permitted to do so.

We do not sell, rent or trade personal data to any third party for their own commercial purposes.

7 International Transfers

Where personal data is transferred outside Brazil, we ensure that appropriate safeguards are in place in accordance with the LGPD. These include using standard contractual clauses approved by the Brazilian ANPD, or transferring only to countries recognised as providing an adequate level of data protection.

Students from the United Kingdom should note that their data may be transferred between Brazil and the UK as part of the recruitment and enrolment process. Such transfers are governed by both the LGPD and UK GDPR.

8 Your Rights

Under the LGPD, you have the following rights in relation to your personal data:

• Confirmation and access: the right to confirm whether we hold your personal data and to receive a copy of it.
• Correction: the right to have inaccurate or incomplete data corrected.
• Anonymisation, blocking or deletion: the right to request anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD.
• Portability: the right to receive your data in a structured, commonly used and machine-readable format and to request its transfer to another controller.
• Information about sharing: the right to know with which public and private entities we share your data.
• Objection: the right to object to processing carried out on the basis of legitimate interests where your rights and interests override ours.
• Withdrawal of consent: the right to withdraw consent at any time for processing carried out on that basis, without affecting the lawfulness of prior processing.
• Review of automated decisions: the right to request human review of any decision made solely by automated processing that significantly affects you.
• Complaint: the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

To exercise any of these rights, please contact us at askcic@cicbrazil.com. We will acknowledge your request within five working days and aim to provide a full response within fifteen working days. We may need to verify your identity before we can process your request.

9 Cookies and Website Tracking

Our website (cicbrazil.com) uses cookies and similar technologies to operate correctly, remember your preferences, analyse usage and improve user experience. We use the following types of cookies:

• Essential cookies: necessary for the website to function. These cannot be disabled.
• Analytics cookies: anonymous usage statistics collected via Google Analytics. No personally identifiable information is collected through these cookies.
• Preference cookies: remember your language preference (English or Brazilian Portuguese) and other site settings.
• Translation cookies: used by Google Translate to remember your language selection.

You may control and disable non-essential cookies through your browser settings. Disabling essential cookies may affect the functionality of the website. We do not use cookies for advertising or to track your activity across other websites.

10 Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure. These measures include encrypted HTTPS connections on all pages, restricted access controls for staff, regular security reviews, two-factor authentication on administrative systems, and staff training on data protection obligations.

Despite these measures, no system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ANPD within seventy-two hours of becoming aware, and will notify affected individuals without undue delay where required.

11 Third-Party Links

Our website may contain links to third-party websites, including partner universities, government immigration portals and social media platforms. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of any linked third-party websites and encourage you to read their privacy policies before providing personal data to them.

12 Children's Data

Our programmes are primarily designed for students aged 18 and over. Where we enrol students under the age of 18 with the consent of their parent or legal guardian, enhanced safeguarding and data protection measures apply. We do not knowingly collect personal data from children under the age of 16 without verifiable parental consent.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the services we provide. The current version is always published at cicbrazil.com/privacy-policy. The date at the top of this policy indicates when it was last updated. Where changes are material, we will notify students by email.

14 Contact and Complaints

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

• Email: askcic@cicbrazil.com
• Post: C.I.C. Crownhill International College, Level 6, Floripa Shopping, Rodovia SC-401 3116, Saco Grande, Florianópolis, SC 88032-005, Brazil
• Telephone / WhatsApp: +55 48 99205 7412

If you are not satisfied with our response, you have the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Information about the ANPD and how to submit a complaint is available at www.gov.br/anpd.