Ref code: SWMD6413 | 2023 | FLEX Application Informed Consent

Informed Consent
Country of Participation
Romania
American Councils for International Education: ACTR/ACCELS, Inc., (“American Councils”, “we”, “us”, or “our”) based at
1828 L Street NW, Suite 1200, Washington, DC 20036-5136, United States of America, would like to inform you and your parents/
legal guardians about the Future Leaders Exchange Program (“FLEX”).
To participate in FLEX, American Councils requires certain data about yourself and/or your parents/legal guardians. We kindly
request that you and your parents/legal guardians read this document and contact us if you have any questions (see American
Councils' contact information below.) Your written consent is required to participate. If you are under the legal age of consent in your
home country, your parent's/legal guardian's signature is also required.
American Councils respects your privacy and adheres to the Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and the free
movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”).

What Is FLEX?
FLEX offers high school students the chance to participate in an academic year exchange program in the United States of America
followed by FLEX alumni programming in their home countries. FLEX finalists attend American high schools, live with volunteer host
families, and take part in American community life. Upon return to their home country, FLEX alumni join an international network with
life-long benefits. American Councils manages FLEX on behalf of the Bureau of Educational and Cultural Affairs at the U.S.
Department of State.

What Data Will Be Collected, Used, and Stored?

For this program, your personal data will be collected, used, and stored. Different data is collected at the applicant, semi-finalist,
finalist, and alumni stages.
At the applicant stage, you and/or your legal guardian may be asked to share:
▪ Demographic data, such as name, email address, telephone, address, and birth date
▪ Educational data, such as school enrollment details
▪ Photographs
▪ Other data of your choice, such as disclosure of disability

At the semi-finalist stage, you and/or your legal guardian may be asked to share:
▪ Demographic data, such as citizenship and family composition
▪ Educational data, such as transcripts and teacher recommendations
▪ Photographs
▪ Mental and physical health data, such as height, weight, health history, and vaccination records
▪ Other data of your choice, such as disclosure of disability

At the finalist stage, you and/or your legal guardian may be asked to share:
▪ Educational data, such as updated grade transcripts
▪ Mental and physical health data, such as updates on changes in health conditions
▪ Other data of your choice, such as on-program success stories

At the alumni stage, you and/or your legal guardian may be asked to share:
▪ Demographic data, such as place of residence
▪ Educational data, such as university enrollment
▪ Occupational data, such as employment information
▪ Other data of your choice, such as awards and accomplishments

What Is the Legal Basis for this Data Collection, Use, and Storage?
American Councils uses explicit consent [art. 6(1)(a) and art. 9(2)(a) GDPR] to process applicant and participant data.

Why Is this Data Required?

Your personal data is required for the following purposes:
At the applicant stage:

Page 1 of 4 FLEX 2023-24 Pre-Application Informed Consent

Ref code: SWMD6413 | 2023 | FLEX Application Informed Consent

▪ Initiating participation in the application process

At the semi-finalist stage:

▪ Continuing participation in the selection process
▪ Conducting the health clearance process

At the finalist stage:

▪ Securing health insurance for the finalist
▪ Placing the finalist in the host family and school
▪ Providing on-program support to the finalist
▪ Offering additional on-program opportunities to the finalist

At the alumni stage:

▪ Engaging the alumni in alumni programming

Who Will Have Access to the Data?

We may share your personal data with various American Councils' offices, affiliated organizations, and third-party business partners.
Our third-party business partners may include program funders, service providers, and others located outside of the European
Economic Area (the “EEA” consists of all EU Member States, plus Iceland, Liechtenstein, and Norway.) in the United States of
America and throughout the world, that work with us to process your application or request and to deliver our program and other
services to you. All third-party business partners that we share your personal data with are expected to comply with applicable
regulations and privacy requirements. We strive to ensure that such third parties will only share this information with other
organizations or individuals that are working with them to deliver American Councils-related program and other services.
Some examples of why we may provide your personal data to such third parties are:
▪ Sending you program preparation materials
▪ Arranging a home, work, and educational placements for you while on program
▪ Arranging transportation, such as airline and train, to and from your program location
▪ Arranging your participation in conferences, seminars, and other similar activities
▪ Evaluating any health and medical information that you provide to us
▪ Providing support to you while you are on program
▪ Contacting you about post-program alumni activities
▪ Generating aggregated and anonymized statistical reports that may be shared with program funders

What Risks May I Have if My Personal Data Is Sent Outside the EEA?
Different laws and legislation exist on personal data protection and information security outside the EEA. There is a chance that your
personal data will be requested by government authorities. This may have consequences for the protection of your personal data. The
U.S. Government may, for example, invoke laws and legislation to oblige American Councils, to provide access to the personal data
of the program.
Some U.S. Government Laws and Legislation Related to Personal Data Protection and Information Security
Legislation Risks
CLOUD Act Despite being American legislation, the CLOUD Act may affect European citizens. Under this law, companies may be obliged to
(in force since provide information about non-U.S. citizens directly to the U.S. Government. In order to increase your privacy, only coded data
23-Mar-2018) will be sent and all data is encrypted in transit and at rest.
PRISM PRISM is a digital program that can collect personal data from large U.S. Internet companies. It is a tool that analyses data to
(in force since find irregularities about a certain person. It is also used to collect data about people outside the U.S. In order to increase your
2007) privacy, only coded data will be sent and all data is encrypted in transit and at rest.
USA Freedom Act Under certain circumstances, U.S. authorities have access to personal data stored outside the U.S. This must concern a U.S
(in force since organization. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at rest.
2015)
Foreign Under certain circumstances, U.S authorities have access to information concerning the conduct of the foreign affairs of the U.S.
Intelligence Under this law, U.S authorities may require electronic communication service providers to give information, facilities, or
Surveillance Act assistance, as required. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at
(“FISA”) Section rest.
702

How Long Will the Data Be Stored?

Your personal data will be retained by American Councils as referenced in our Data Retention Policy. Unidentifiable statistical data
regarding you may be retained indefinitely.

Page 2 of 4 FLEX 2023-24 Pre-Application Informed Consent

Ref code: SWMD6413 | 2023 | FLEX Application Informed Consent

American Councils' Retention Policies for Program Applicants and Participants

Student Records Type Must Keep For Must Delete After
Applicant Data (Statistical) Forever Never
Applicant Data Six (6) Months One (1) Year After Application Deadline
Participant Records (Statistical Data and Forever Never
Grades)
Participant Records Six (6) Months After the Completion of the One (1) Year After the Completion of the
Program Program

Your Rights Under the General Data Protection Regulation (“GDPR”)

Under the GDPR, you have various rights regarding the use of your personal data in this program. These include:

Your Right to Withdraw Consent for the Use of Your Personal Data
You can always withdraw your consent for the use of your personal data. This applies to this program and also to the storage and use
of these personal data for future use, such as for alumni purposes. Apart from the personal data we are obliged to store in compliance
with legal obligations, your personal data will be deleted or anonymized after you have withdrawn your consent for the use of your
personal data.

Your Right to Access Your Personal Data

You have the right to access the personal data we, or parties using personal data about you on our behalf, have about you. You will
then, within one (1) month, receive an overview of all the personal data we have about you, together with an explanation of why we
keep those.

Your Right to Have Personal Data Amended

If personal data used by us, or by parties using personal data on our behalf, are incorrect or incomplete, you can submit a request to
have these personal data updated.

Your Right to Have Personal Data Deleted

In some cases, you can ask to have personal data deleted. For example, this can be done if personal data is no longer needed for the
program, if you withdraw your consent, if your personal data is being wrongly used or if your personal data needs to be deleted
because of a legal obligation we need to comply with.

Your Right to Stop the Use of Personal Data

You have the right to stop the use of your personal data. You may, for example, make a request to have your personal data amended
if your personal data is being wrongly used, but you do not (yet) want your personal data to be deleted, or for defense of your legal
rights.

Your Right to Have Your Personal Data Transferred

You have the right to request transfer of your personal data to another organization.

Your Right to Object to the Use of Your Personal Data

In some cases, you have the right to object to the use of personal data.

Making a Request or Asking a Question

If you want to exercise any of the rights above, you need to submit a request. You can do this by contacting American Councils. You
may also ask questions related to your GDPR rights. You will receive a response within 30 days.
By Postal Mail:
ATTN: Chief Information Officer
American Councils for International Education:
1828 L St NW Ste 1200
Washington DC 20036-5136
United States of America
By Email:
[email protected]

Contacting the Relevant Data Protection Authority

If you have contacted American Councils and are not satisfied with how your complaint has been handled, then you can also contact
the Data Protection Authority in your country.

Page 3 of 4 FLEX 2023-24 Pre-Application Informed Consent

Ref code: SWMD6413 | 2023 | FLEX Application Informed Consent

Consent Signatures and Dates

I. Consent for the collection, use, and storage of personal data:
▪ I consent to the collection, use, and storage of my personal data in the way and for the purposes described in this
Informed Consent for the European Economic Area.

Indicate your decision:

Yes, I consent No, I do not consent

Applicant's Signature
Titeiu David

Date of Consent
Oct 10, 2022

Parent's/Legal Guardian's Signature

Florentina Tarcuta

Date of Consent
Oct 10, 2022

II. Consent for the transfer of personal data outside the EEA:
▪ I consent that that my personal data be transferred to the United States of America (USA) and, on a limited basis, to
other countries outside of the EEA.
▪ I understand that the standard protections afforded to those in the EU under GDPR may not fully apply to data that I
voluntarily consent to be transferred to the United States or other countries outside of the EEA.

Indicate your decision:

Yes, I consent No, I do not consent

Applicant's Signature
Titeiu David

Date of Consent
Oct 10, 2022

Parent's/Legal Guardian's Signature

Florentina Tarcuta

Date of Consent
Oct 10, 2022

I certify that I meet all the eligibility requirements listed above for student applicants from Romania for the 2023-24 FLEX
program:
Yes No

Page 4 of 4 FLEX 2023-24 Pre-Application Informed Consent