Contact

     

    Privacy Policy

    1. At a Glance

    Topic Information
    Data Controller Foundation AMERICAN EUROPEAN EDUCATION, trading as American Hotel Academy (AHA)
    Registered Office 16 Vlad Tepes Street, Brașov, Romania
    Registration Registered with the Brașov Court in the National Register of Associations and Foundations
    Tax Registration Number 29911760
    Data Protection Officer (DPO) Mihaela Varsan
    DPO Contact mihaela.varsan@americanhotelacademy.ro
    General Contact contact@americanhotelacademy.ro
    Telephone +40 268 455 401
    Website aharomania.ro
    Applicable Law Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Romanian data protection legislation
    Data Subjects Website visitors, applicants, students, alumni, partners, suppliers, and other individuals interacting with AHA

     

    2. Introduction

    American Hotel Academy (“AHA”, “we”, “our”, or “us”) is committed to protecting your privacy and processing your personal data responsibly, transparently, and securely.

    This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you interact with AHA, including when you:

    • visit our website;
    • request information about our programmes;
    • apply for admission;
    • enrol as a student;
    • participate in internships or professional placements;
    • attend events;
    • subscribe to newsletters;
    • collaborate with us as a partner, supplier, or service provider;
    • communicate with us through any channel.

    We process personal data in accordance with the principles of the GDPR, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

    3. Who We Are

    American Hotel Academy (AHA) is operated by:

    Foundation AMERICAN EUROPEAN EDUCATION
    Registered with the Brașov Court in the National Register of Associations and Foundations
    Tax Registration Number: 29911760

    Registered Office:
    16 Vlad Tepes Street
    Brașov
    Romania

    Contact:
    Telephone: +40 268 455 401
    Email: contact@americanhotelacademy.ro
    Website: aharomania.ro

     

    AHA is a transnational education provider. We are licensed by several professional awarding bodies and international partner universities to deliver on our campus in Brasov or in virtual format professional further and higher education study programmes, ranging from certificates and diplomas to undergraduate and postgraduate (advanced) degrees.

    As a non-traditional institution, AHA merges western career-oriented academic programmes and work experience opportunities with the aspirations of eastern students to become global graduates. Notably, AHA is the first institution in Romania to establish a Transnational Education (TNE) partnership with a British university.

     

    4. Our Commitment to Privacy

    We recognise that the delivery of education requires the processing of personal data. We are committed to ensuring that all personal data is:

    • processed lawfully, fairly, and transparently;
    • collected for specified, explicit, and legitimate purposes;
    • adequate, relevant, and limited to what is necessary;
    • accurate and kept up to date;
    • retained only for as long as necessary;
    • protected against unauthorised access, alteration, disclosure, or destruction;
    • handled in a manner that respects individual rights and freedoms.

    Privacy and information security are integrated into our operational procedures, systems, and contractual arrangements with third-party service providers.

     

    5. Scope of this Privacy Policy

    This Privacy Policy applies whenever AHA processes personal data, including through:

    • our websites and online platforms;
    • application and admissions systems;
    • student administration systems;
    • learning management systems (LMS);
    • virtual learning environments (VLE);
    • internship and placement activities;
    • alumni relations;
    • marketing communications;
    • events and surveys;
    • email, telephone, and written communications;
    • social media interactions (where applicable);
    • contracts with suppliers and partners.

    This Policy should be read together with our Cookie Policy and any specific privacy notices issued for particular services or activities.

     

    6. Data Controller

    For the purposes of GDPR, the Data Controller is:

    Foundation AMERICAN EUROPEAN EDUCATION
    trading as American Hotel Academy (AHA)

    16 Vlad Tepes Street
    Brașov
    Romania

    Email: contact@americanhotelacademy.ro
    Telephone: +40 268 455 401

    As Data Controller, AHA determines the purposes and means of personal data processing and is responsible for ensuring compliance with applicable data protection laws.

     

    7. Data Protection Officer (DPO)

    AHA has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with data protection obligations.

    DPO Contact
    Mihaela Varsan mihaela.varsan@americanhotelacademy.ro

    You may contact the DPO regarding:

    • this Privacy Policy;
    • how your personal data is processed;
    • exercising your GDPR rights;
    • data protection concerns or complaints;
    • data security matters.

     

    8. Definitions

    Term Meaning
    Personal Data Any information relating to an identified or identifiable natural person
    Processing Any operation performed on personal data (e.g. collection, storage, use, disclosure, deletion)
    Data Subject The individual whose personal data is processed
    Controller The entity determining the purposes and means of processing personal data
    Processor A third-party processing data on behalf of the Controller
    GDPR Regulation (EU) 2016/679 (General Data Protection Regulation)
    TNE Transnational Education programmes delivered through international partnerships

     

    9. Who This Privacy Policy Applies To

    This Privacy Policy applies to:

    • prospective students;
    • applicants;
    • enrolled students;
    • graduates and alumni;
    • internship participants;
    • parents or sponsors (where applicable);
    • website visitors;
    • newsletter subscribers;
    • event participants;
    • business partners and suppliers;
    • contractors and consultants;
    • external trainers;
    • representatives of partner organisations.

    Additional privacy notices may apply in specific contexts where required.

     

    10. Categories of Personal Data We Collect

    Depending on your relationship with AHA, we may process the following categories of personal data:

    Category Examples
    Identity Data Name, date of birth, nationality, passport/ID details, student ID
    Contact Data Address, email, telephone number, emergency contacts
    Academic Data Qualifications, transcripts, attendance, grades, academic progress
    Admission Data Applications, supporting documents, references, interview notes
    Financial Data Tuition fees, invoices, payments, scholarships, sponsorships
    Internship Data Placement records, employer evaluations, internship outcomes
    Professional Data CV, employment history, qualifications
    Technical Data IP address, browser type, device identifiers, log data
    Usage Data Website activity, LMS usage, communication preferences
    Marketing Data Consent records, newsletter subscriptions, preferences
    Visual & Audio Data Photos, video, and recordings from events or activities
    Communication Data Emails, enquiries, and correspondence

    We only collect data that is necessary for specific, defined purposes.

     

    11. How We Collect Personal Data

    We collect personal data from the following sources:

    11.1 Directly from you

    When you provide information through:

    • application forms;
    • enrolment documents;
    • scholarship or internship applications;
    • email or telephone communications;
    • surveys and feedback forms;
    • event registrations;
    • online platforms and LMS systems.

    11.2 Automatically

    When you use our website or digital systems, we may collect:

    • IP address;
    • browser and device information;
    • operating system;
    • pages visited;
    • duration of visits;
    • referral sources;
    • usage patterns.

    This is done through cookies and similar technologies (see Cookie Policy).

    11.3 From third parties

    We may receive data from:

    • partner institutions and TNE partners;
    • awarding bodies;
    • internship providers and employers;
    • scholarship organisations;
    • payment providers;
    • public authorities or regulators;
    • individuals authorised by you.

    We only collect such data where legally permitted and relevant.

     

    12. How We Use Your Personal Data

    We process personal data for the following purposes:

    12.1 Academic and admissions purposes

    • managing applications and admissions;
    • assessing eligibility and qualifications;
    • delivering education and training programmes;
    • monitoring academic performance and attendance;
    • administering assessments and examinations.

    12.2 Student administration and support

    • maintaining student records;
    • providing access to academic systems and services;
    • offering student support and wellbeing services (where the case);
    • managing academic or disciplinary processes.

    12.3 Internships and placements

    • organising internships and placements;
    • sharing necessary information with placement providers;
    • monitoring internship progress and evaluations.

    12.4 Financial administration

    • processing payments and invoices;
    • managing scholarships and sponsorships;
    • preventing fraud and ensuring compliance.

    12.5 Communication and operations

    • responding to enquiries;
    • sending administrative updates;
    • managing institutional communications.

    12.6 Marketing and events (where permitted)

    • sending newsletters and updates (based on consent or legal basis);
    • promoting events, programmes, and opportunities;
    • managing event participation.

    12.7 Legal and security purposes

    • complying with legal obligations;
    • responding to lawful requests from authorities;
    • ensuring IT and network security;
    • preventing fraud and misuse.

    13. Legal Basis for Processing

    We process personal data under one or more of the following legal bases:

    1. Contractual necessity – to provide educational services or fulfil obligations;
    2. Legal obligation – to comply with applicable laws and regulations;
    3. Legitimate interests – to operate and improve institutional services;
    4. Consent – where explicitly provided (e.g. marketing communications);
    5. Public interest / official authority – where required under applicable law.

    14. Data Sharing and Disclosure

    We may share personal data with:

    14.1 Educational partners

    • partner universities;
    • TNE partners;
    • accreditation and awarding bodies.

    14.2 Service providers

    • IT and cloud providers;
    • LMS and educational platforms;
    • payment processors;
    • communication and event tools.

    All processors are contractually required to ensure data protection compliance.

    14.3 Internship and employment partners

    • hospitality employers;
    • internship providers;
    • recruitment organisations.

    14.4 Legal authorities

    • courts;
    • regulators;
    • law enforcement bodies;
    • government authorities.

    14.5 Institutional changes

    In the event of restructuring or transfer of activities, data may be transferred in compliance with GDPR safeguards.

    We do not sell or rent personal data.

     

    15. International Data Transfers

    Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards, including:

    1. European Commission adequacy decisions;
    2. Standard Contractual Clauses (SCCs);
    3. other legally recognised transfer mechanisms.

    These safeguards ensure an adequate level of data protection.

     

    16. Data Retention

    Personal data is retained only for as long as necessary for the purposes collected.

    Retention periods depend on:

    • legal and regulatory requirements;
    • academic obligations;
    • contractual needs;
    • administrative and operational requirements.

    When no longer required, data is securely deleted, anonymised, or archived in accordance with applicable law and internal policies.

     

    17. Data Security

    We implement appropriate technical and organisational measures to protect personal data, including:

    • access controls and authentication systems;
    • encryption technologies;
    • secure servers and networks;
    • staff confidentiality obligations and training;
    • monitoring and security audits.

    While we take strong precautions, no system can guarantee absolute security.

     

    18. Your Rights as a Data Subject

    Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

    18.1 Right of access

    You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to request access to that data.

    18.2 Right to rectification

    You have the right to request correction of inaccurate or incomplete personal data.

    18.3 Right to erasure (“right to be forgotten”)

    You may request deletion of your personal data where there is no lawful reason for us to continue processing it.

    18.4 Right to restriction of processing

    You may request that we limit the processing of your personal data in certain circumstances, such as while accuracy is being verified.

    18.5 Right to data portability

    Where processing is based on consent or contract and carried out by automated means, you may request to receive your data in a structured, commonly used format and transfer it to another controller.

    18.6 Right to object

    You may object to processing based on legitimate interests or for direct marketing purposes.

    18.7 Right to withdraw consent

    Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

    18.8 Right not to be subject to automated decision-making

    You have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions have legal or similarly significant effects.

    How to exercise your rights

    You may exercise any of the above rights by contacting:

    Data Protection Officer (DPO)
    Mihaela Varsan
    Email: mihaela.varsan@americanhotelacademy.ro

    We may request proof of identity before responding to your request to ensure data security.

    19. Cookies and Similar Technologies

    Our website uses cookies and similar technologies to ensure proper functionality and improve user experience.

    19.1 What are cookies

    Cookies are small text files stored on your device when you visit a website. They help websites function efficiently and provide analytical and functional insights.

    19.2 Types of cookies we use

    We may use the following categories:

    1. Strictly necessary cookies – required for website operation and security;
    2. Functional cookies – enable enhanced functionality and preferences;
    3. Analytics cookies – help us understand how users interact with our website;
    4. Marketing cookies – used to deliver relevant communications (only where consent is provided).

    19.3 Managing cookies

    You can control or disable cookies through your browser settings. However, disabling some cookies may affect website functionality.

    For more detailed information, please refer to our separate Cookie Policy.

    20. Complaints Procedure

    We are committed to handling personal data responsibly and transparently.

    If you have concerns about how your personal data is processed, we encourage you to contact us first so we can resolve the issue:

    Data Protection Officer (DPO)
    Mihaela Varsan
    mihaela.varsan@americanhotelacademy.ro

    We will investigate and respond to your complaint in a timely and appropriate manner.

    21. Right to Lodge a Complaint with a Supervisory Authority

    If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority.

    In Romania, the supervisory authority is:

    National Supervisory Authority for Personal Data Processing (ANSPDCP)
    Website: https://dataprotection.ro/

    You also have the right to contact a supervisory authority in the EU Member State where you reside, work, or where the alleged infringement occurred.

    22. Data Breach Notification

    In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

    • take immediate steps to mitigate the breach;
    • notify the relevant supervisory authority within 72 hours where required;
    • inform affected individuals without undue delay when there is a high risk to their rights and freedoms.

    23. Third-Party Links

    Our website may contain links to external websites operated by third parties.

    We are not responsible for the content, privacy practices, or security of such external websites. We encourage you to review their privacy policies before providing any personal data.

    24. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes.

    When changes are made, we will:

    • update the “last updated” version date;
    • publish the revised version on our website;
    • where appropriate, notify individuals of significant changes.

    We encourage you to review this Privacy Policy periodically.

    25. Contact Information

    If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us:

    American Hotel Academy (AHA)
    Foundation AMERICAN EUROPEAN EDUCATION

    16 Vlad Tepes Street
    Brașov, Romania

    Email: contact@americanhotelacademy.ro
    Telephone: +40 268 455 401

    Data Protection Officer:
    Mihaela Varsan
    mihaela.varsan@americanhotelacademy.ro

    26. Final Statement

    This Privacy Policy is designed to ensure transparency regarding how we process personal data and to uphold the rights and freedoms of individuals in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable Romanian legislation.