1. Data Controller
- Company: I.O. Holistic Wellness and Coaching Training Ltd
- Trading as: Mediterranean Academy of Wellness Sciences (MAWS)
- Registration Number: HE463051 (Republic of Cyprus)
- Registered Address: 7 Etnas Street, Sphera Block B, Office 203, Limassol 3118, Agia Fyla, Cyprus
- Contact Email: info@maws-academy.com
- Contact Phone: +357 99 719224
2. Personal Data We Collect
We collect the following categories of personal data:
- Identity data: full name, date of birth, nationality, ID/passport number
- Contact data: address, phone number, email address
- Emergency contact data: name, relationship, phone number
- Financial data: payment method, payment plan details
- Educational data: course enrollment, attendance, assessment results, certificates
- Health data (special category): medical conditions, allergies, medications, pregnancy status — collected only with your explicit consent
- Media data: photographs and video recordings (only with your consent, as described in Section 13 of the Student Agreement)
- Communication data: correspondence with the Academy
- Website data: information submitted through contact or inquiry forms on maws-academy.com (name, email, phone, message); cookie and analytics data (see our Cookie Policy for details)
- Online enrollment data: information submitted through our enrollment platform (Teach & Go), including registration form responses and uploaded documents
3. Purposes and Legal Basis of Processing
| Purpose | Legal Basis |
|---|
| Course administration, delivery, and student support | Performance of contract (GDPR Art. 6(1)(b)) |
| Certification, accreditation, and IICT reporting | Legitimate interest and legal obligation (Art. 6(1)(c)(f)) |
| Communication about courses and Academy activities | Legitimate interest (Art. 6(1)(f)) |
| Health and safety during practical sessions | Explicit consent for special category data (Art. 9(2)(a)) |
| Legal and regulatory compliance | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) — separate, voluntary |
| Photos/video for educational and promotional use | Consent (Art. 6(1)(a)) — as per Section 13 of the Student Agreement |
| Storage and processing through third-party platforms (LMS, CRM, payment providers) | Performance of contract / legitimate interest (Art. 6(1)(b)(f)) — as per Section 14.5 of the Student Agreement |
| Website analytics and advertising measurement | Consent (Art. 6(1)(a)) — see Cookie Policy |
4. Health Data (Special Category)
Health-related information provided by you is classified as special category data under GDPR Article 9 and Cyprus Law 125(I)/2018. This data:
- Is collected only with your explicit, informed consent
- Is processed solely for ensuring your safety and the safety of others during training
- Is stored with additional security measures
- Is accessible only to relevant Academy staff and instructors on a need-to-know basis
- Will not be shared with third parties except where required by law
You may withdraw your consent to health data processing at any time by written notice to info@maws-academy.com. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. Please note that withdrawing health data consent may affect your ability to participate in practical training sessions (see Section 14.6 of the Student Agreement).
5. Data Retention
The Academy will retain your personal data as follows:
- Student records (enrollment, attendance, certificates): minimum 7 years after the last course completion, for accreditation and legal purposes (consistent with Section 14.4 of the Student Agreement)
- Financial records: as required by Cyprus tax and accounting legislation
- Health data: duration of your studies plus 1 year, or longer if required by law
- Marketing consent records: until consent is withdrawn
- Media (photos/video): until consent is withdrawn (see Section 13 of the Student Agreement)
- Complaints and appeals records: minimum 5 years (consistent with the Complaints and Appeals Policy)
After the retention period expires, your data will be securely deleted or anonymised.
6. Your Rights Under GDPR
Under the GDPR and Cyprus Law 125(I)/2018, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations
- Right to restriction of processing — request that we limit how we use your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — at any time, without affecting the lawfulness of processing based on consent before its withdrawal
- Right to lodge a complaint — with the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy)
To exercise any of these rights, contact us at: info@maws-academy.com. We will respond to your request within 30 days.
If you are dissatisfied with how we handle your data protection request, you may also raise a complaint through the Academy’s Complaints and Appeals Policy.
7. Data Sharing and International Transfers
We may share your personal data with:
- IICT (International Institute for Complementary Therapists) — for certification and accreditation purposes
- Cyprus tax and regulatory authorities — as required by law
- Professional service providers (accountants, legal advisors) — under strict confidentiality obligations
The Academy also uses the following categories of third-party data processors, as described in Section 14.7 of the Student Agreement:
- Online learning management system (LMS) — for course content delivery and student progress tracking
- Customer relationship management system (CRM) — for communication and enrollment management
- Online enrollment platform (Teach & Go) — for student registration, document signing, and enrollment management
- Payment service providers — for processing course fee payments
- Certification and accreditation bodies (including IICT) — for professional qualification registration
All data processors are bound by Data Processing Agreements (DPAs) that require them to protect personal data in accordance with GDPR. The Academy maintains an up-to-date register of processors, which is available to Students upon written request.
We will NOT sell, rent, or otherwise commercially distribute your personal data.
International transfers: Your personal data will not be transferred outside the European Economic Area (EEA) without appropriate safeguards in place, as required by GDPR Chapter V. Where a processor stores or processes data outside the EEA, the Academy ensures that EU Standard Contractual Clauses (SCCs) or other approved mechanisms are in place (see Section 14.5 of the Student Agreement).
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Secure storage of physical documents in locked facilities
- Password-protected electronic systems with restricted access
- Additional security measures for health data (special category)
- Regular review of data protection practices
- Staff training on data protection obligations
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Cyprus Commissioner for Personal Data Protection within 72 hours, as required by GDPR Article 33.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any significant changes will be communicated to you via email or through a notice at the Academy. The latest version will always be available upon request.
Last updated: April 2026
Approved by: Iryna Olic
Date: 12/04/2026
