To Whom It May Concern,

We sincerely thank you for your continued support and cooperation. It has been the

pleasure of the Student Travel Centre & STC Business referred to as STC to maintain a

friendly, cooperative relationship with you.

To comply with the General Data Protection Regulations of the European Union

(“GDPR”), effective May 25, 2018; STC internal compliance policy; and to better

protect the personal data of all of all our customers, STC hereby informs you of the main

obligations under the GDPR, upon its effective date:

1. If the data you help STC process contains personal data collected within the

territory of European Union, the GDPR is applicable to you.

2. You shall process relevant personal data strictly according to the written

instructions of STC

3. You shall ensure that any natural or legal person you authorize to process data

controlled by STC shall be subject to a strict duty of confidentiality (regardless of

whether it is a contractual or statutory duty).

4. You shall implement appropriate technical and organizational measures to protect

data from accidental or unlawful destruction, and loss, alteration,

unauthorized disclosure of/access to data.

5. You shall not subcontract any processing of data controlled by STC to a third-party

sub-processor without the prior written consent of STC

6. You shall provide all reasonable and timely assistance to enable STC to respond to

any request from data subjects when such data subjects submit claims to exercise

their rights under the GDPR.

7. If you believe or become aware that STC’s data processing is likely to result in a

risk to the data protection rights and freedoms of data subjects, you shall

promptly inform STC and provide it with all such reasonable and timely assistance

as we may require, to conduct a data protection impact assessment.

8. Upon becoming aware of a security incident, you shall inform STC without undue

delay and shall provide all such timely information and cooperation as STC may

require in order for us to fulfil its data breach reporting obligations. You shall

further take all such measures and actions as are necessary to remedy or mitigate

the effects of the Security Incident and shall keep STC informed of all

developments in connection with the Security Incident.

10- Finally your personal information is well protected for the sole use of our business with you. You own this information and its authority. You can always inform us of any changes and we will be happy to oblige.

 

Yours sincerely,

Joseph Barakat

M.D.

 

Student Travel Centre ltd & STC Business

 

May 23 rd , 2018