Legal
My OTI Group Privacy Notice
This Notice explains how OTI Group uses personal data when you create and use a My OTI Group account and when the portal connects you to OTI services, records and workspaces.
1. Controller and contact
The controller for My OTI Group is One Terrene International Group (OTI Group), Cyprus company HE 435117, 107 Giannou Kranidioti, Office 311, Latsia 2231, Nicosia, Cyprus. Privacy enquiries and data-protection requests may be sent to privacy@otigroup.org or made by telephone on +357 22322771.
2. What this Notice covers
This Notice covers personal data processed through My OTI Group and the connected OTI operational services exposed through the portal. It does not replace a more specific privacy notice or declaration presented for a particular project, course, form, funding process or external service.
3. Account, identity and security data
When you create an account we process your name, verified email address, password credential, preferred language, authentication settings and policy-acceptance history. We also process security and audit information needed to protect the account, investigate misuse and demonstrate important actions.
Your verified email may be used to link your account to an existing authoritative OTI person record. Names and shared telephone numbers are not treated as sufficient automatic identity keys. If no existing person can be safely linked, OTI may establish a new authoritative person record when required for a service you request.
4. Profile and relationship data
Depending on the services you use, OTI may process contact details, address information, employment, education, languages, training history, professional details and profile interests. The portal may also expose relationships recorded by OTI, such as participant, trainer, examiner, organisation contact, legal representative, project partner, project team member or referral relationship.
5. Courses, examinations and certificates
For course discovery, registration and participation we may process programme choices, registration state, eligibility and funding information, HRDA-related details where applicable, attendance, required evidence, payments and course communications. Examination and certification services may process candidate records, assessment or examination information, results and certificate records where relevant to you.
6. Organisations and EU or other projects
If you act for an organisation or participate in an EU-funded or other project, we may process your role, authority, organisation relationship, professional contact details, project participation, team information, declarations, documents, work-package information and other records required for delivery, reporting, audit or funding compliance.
7. Forms, documents and evidence
Forms and document workflows may collect information specifically required for the service concerned, including declarations and uploaded evidence. We do not require every possible profile field for every service; the information requested depends on the operational, legal, funding or contractual requirement concerned.
8. Payments and accounting
When a service involves payment, OTI processes financial-obligation, invoice, receipt, payment-status and accounting records. Card payment details are handled by the payment provider and are not intended to be stored in My OTI Group. OTI may receive transaction identifiers and payment status needed to reconcile your account.
9. Training-room bookings
Room-booking services may process booking dates and times, room and layout choices, contact information, organisation details where relevant, rental-term acceptance, payment status, add-ons and date-change requests. Separate rental terms may require additional declarations.
10. Referrals and OTI Educational Subsidy
Referral functions may process the relationship between a referrer, a prospective participant and resulting OTI activity where permitted. Subsidy applications may process employment, funding eligibility and other information needed to assess the application.
OTI may use AI-assisted analysis to help score or recommend an OTI Educational Subsidy outcome. The AI output is decision support, not an uncontrolled final legal decision. OTI retains the approved outcome, audit trail and human/operational responsibility for the subsidy process. OTI currently uses OpenAI as the AI service provider for this assessment function.
11. Notifications, browser push and PWA
My OTI Group sends operational notifications needed to keep you informed about services and actions connected to your account. If you enable browser push notifications, the portal stores a browser/device push subscription endpoint and cryptographic keys required to deliver those notifications. The relevant browser or operating-system push service also participates in delivery.
The PWA may cache limited application assets and an offline fallback on your device so the portal can load more reliably. Installing the PWA does not create a separate identity or marketing subscription.
12. Newsletter is separate
Operational My OTI Group communications are separate from OTI newsletters and marketing. A portal account does not subscribe you to marketing. Newsletter subscriptions are managed separately and, where consent is used, you can withdraw that consent or unsubscribe without losing your My OTI Group account.
13. Why we process personal data
Depending on the activity, OTI processes personal data because it is necessary to provide or take steps toward a service or contract, comply with legal or funding obligations, carry out tasks connected with accredited training or funded projects, protect legitimate interests such as account and system security, establish or defend legal claims, or because you have given consent for a specific optional purpose such as marketing where consent is the appropriate legal basis.
Acknowledging this Privacy Notice is not consent to every processing activity described in it. Where consent is required for a specific purpose, OTI asks for that consent separately.
14. Who may receive or process data
Access within OTI is limited according to role and operational need. Where relevant, information may also be processed by contracted technology and hosting providers, email delivery providers, payment processors such as Stripe, browser push-service providers, the AI provider supporting the subsidy assessment, professional advisers, auditors, project partners, funding bodies, HRDA/ERMIS or other competent public authorities where the service or law requires it.
OTI does not give advertisers access to your My OTI Group account data merely because you use the portal.
15. International transfers
Some technology providers may process data outside Cyprus or the European Economic Area. Where a transfer requires a safeguard under data-protection law, OTI uses an applicable mechanism such as an adequacy decision or approved contractual safeguards and applies appropriate security measures.
16. Retention
OTI keeps personal data for as long as needed for the service and for the legal, contractual, funding, accounting, accreditation, audit, security and limitation periods that apply to the record concerned. Different records therefore have different retention periods.
Account and relationship records may be retained while the relationship remains active and for an appropriate period afterward. Financial and statutory records are retained for the periods required by applicable law. Project and funding records may need to remain available for the audit period set by the relevant programme, which can continue for several years after project completion. Security records are kept according to operational security needs and may be retained longer when connected to an incident or legal claim.
17. Your rights
Subject to the conditions and exceptions in applicable data-protection law, you may have rights to obtain information and access, correct inaccurate data, request erasure or restriction, object to certain processing, receive portable data where applicable, withdraw consent for consent-based processing, and complain to the competent supervisory authority.
A request to erase data does not automatically require OTI to erase records that must be retained for legal, funding, accounting, accreditation, security or legal-claims purposes. OTI will explain the applicable position when responding to a request.
18. Security
OTI uses technical and organisational measures designed to protect personal data, including verified-email access, authentication controls, role/context-based access, audit logging and encrypted connections. No internet service can guarantee absolute security, so users must also protect their credentials and devices.
19. Changes to this Notice
OTI may update this Privacy Notice when processing changes or clarification is needed. Material versions may require a new acknowledgement in My OTI Group. Editorial or non-material changes may be published without forcing a new acknowledgement. Historic acknowledgements are retained rather than overwritten.
20. Questions and complaints
For privacy questions or to exercise a data-protection right, contact privacy@otigroup.org, OTI Group, 107 Giannou Kranidioti, Office 311, Latsia 2231, Nicosia, Cyprus, telephone +357 22322771. You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority where applicable.