Data Privacy Notice

Privacy Policy 

Last updated: 31/03/2026 

  1. Who We Are

We are Eluma Education, a training institution established under Maltese law and authorised by the Malta Further and Higher Education Authority (MFHEA).

Registered address: Level G, Office 1/1115, Quantum House 75, Abate Rigord Street, Ta’ Xbiex, XBX 1120, Malta.

Email: dataprivacy@elumaeducation.com 

For the purposes of the EU General Data Protection Regulation (GDPR), we act as the Data Controller for all personal data collected through this website and during the course of our training activities.

We take your privacy seriously and aim to give you easy control over your Personal Data. You have the right to ask us to correct, update, delete, or restrict how we use your information. If you’d like to know what Personal Data we hold about you, or if you want us to remove it from our systems, simply get in touch with us and we’ll be happy to help.

  1. What Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Data Provided by Applicants and Students

  • Full name, date of birth, nationality
  • Contact details (email, phone number, address)
  • Identification documents (ID card, passport, residence permit)
  • Education and qualification records
  • Employment history (if relevant to course entry)
  • Police Conduct Certificate,
  • POMA clearance,
  • Medical fitness declarations (only where necessary for training or placement)
  • Visa or immigration documentation (for Third-Country Nationals)
  • Payment information (invoices, receipts)

2.2 Data Collected Automatically via the Website

  • IP address and device information
  • Cookies and usage data
  • Website analytics (pages visited, time spent, browser type)

2.3 Data Collected During Training

  • Attendance records
  • Assessment results and coursework
  • Practical placement evaluations
  • Communications with trainers or administrative staff

Please note that our service is not intended for individuals under the age of 18 (“Children”). We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and become aware that your child has provided us with Personal Data, please contact us.  Should we discover that we have collected Personal Data from a child without verified parental consent, we will take immediate steps to delete that information from our systems.

  1. Why We Collect Your Data 

We process personal data only when permitted by GDPR. The main legal bases are:

  • Contractual necessity — to process applications, enrol students, deliver training, issue certificates.
  • Legal obligation — compliance with MFHEA, Jobsplus, Identity Malta, tax, and accounting requirements.
  • Legitimate interests — ensuring quality of training, maintaining security, improving services.
  • Consent — for optional activities such as marketing communications or photo/video use.
  • Vital interests — in rare cases where health or safety requires it.
  1. How We Use Your Data

Your data may be used for:

  • Processing course applications and verifying eligibility
  • Registering students for MFHEA-accredited programmes
  • Delivering training, assessments, and practical placements
  • Issuing certificates, transcripts, and attendance records
  • Communicating important course updates
  • Managing payments and financial records
  • Ensuring compliance with Maltese and EU regulations
  • Quality assurance and internal reporting
  • Providing support services to students
  1. Who We Share Your Data With

We only share personal data when necessary and lawful.

Possible recipients include:

  • MFHEA (for accreditation and quality assurance)
  • Jobsplus (for work placement or employment-related requirements)
  • Placement partners (elderly care homes, childcare centres)
  • External trainers or assessors
  • IT service providers (secure hosting, email, LMS platforms)
  • Accountants or auditors (for financial compliance)
  • Law enforcement (when legally required) There may be times when we may need to share your Personal Data to meet important legal or safety obligations. We may do this in good faith when it is necessary to: comply with a legal requirement, protect our rights or property, prevent or investigate potential misuse of our Service, safeguard the safety of our users or the public, defend ourselves against legal claims.
  • Third parties’ suppliers which are related to the educational services, which we may engage, for the services we provide. 

We sometimes work with trusted third-party companies and professionals to help us deliver our Service. These “Service Providers” may support us with tasks such as operating the Service, providing features on our behalf, or helping us understand how the Service is used. These partners only receive the Personal Data they need to carry out their work for us, and they are strictly required to keep it confidential and not use it for anything else. Please rest assure that we will have in place sufficient organizational and technical measures to protect your personal data.

We do not sell or trade personal data.

  1. International Transfers

If data is stored or processed outside the EU/EEA, we ensure appropriate safeguards such as:

  • EU Commission adequacy decisions
  • Standard Contractual Clauses (SCCs)
  • GDPR-compliant data processing agreements
  1. Data Security and Confidentiality

At Eluma Education, keeping your Personal Data safe is a top priority. We use a range of security measures—technical, physical, and organizational—to protect your information from unauthorized access, accidental loss, or misuse. These measures follow all relevant laws and industry standards.

We handle your Personal Data in a way that keeps it confidential and secure. When choosing how to protect your data, we consider factors like new technologies, the cost of implementing them, the type of data we process, and any potential risks to your rights and freedoms.

Only authorised members of the Eluma Education team can access your Personal Data, and they are all bound by strict confidentiality obligations

  1. Data Retention

Eluma Education keeps your Personal Data only for as long as it’s needed for the purposes described in this Privacy Policy, in alignment with the ‘Data Minimisation and Storage Limitation’ principles as defined in Article 5 of the GDPR. We may also keep certain information if required to meet our legal obligations, resolve disputes, or enforce our agreements and policies.

We also store Usage Data to help us understand how our Service is used and to improve its performance. This type of data is usually kept for a shorter period, unless it’s needed to enhance security, improve functionality, or we are legally required to keep it for longer.

After the retention period ends, we securely delete your Personal Data from our systems, as long as we no longer need it for the purposes described above.

If you would like more details about how long we keep specific types of Personal Data, feel free to contact us at dataprivacy@eluma.edu.mt.

  1. Your Rights Under GDPR

You have the right to:

  • Access your personal data
  • Request correction/ rectification of inaccurate or missing data
  • Request deletion 
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent at any time (for consent-based processing)
  • Object to a decision taken solely on the basis of automated processing.

In order to execute any of these rights kindly contact us via our email dataprivacy@elumaeducation.com 

Eluma Education will get back to you within one (1) month of receiving your request. If your request is complex or if we are handling several requests at the same time, we may need a little more time. In that case, we may extend the response period by up to two (2) additional months, and we will let you know in advance.

If we are unable to fulfil your request, we will explain why. To protect your privacy, we may also ask for extra information if we need to confirm your identity before processing your request.

If you believe your data protection rights have been violated, you have the right to file a complaint with the Office of the Information and Data Protection Commissioner. You can do so through their website.

You can also lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) – Malta. Data Protection Commissioner details are: 

Information and Data Protection Commissioner

Address: Level 2, Airways House, High Street, Sliema SLM 1549, Malta

Telephone: (+356) 2328 7100

Email: idpc.info@idpc.org.mt

  1. Security Measures

We implement technical and organisational measures to protect your data, including:

  • Encrypted storage and secure servers
  • Access controls and authentication
  • Staff confidentiality agreements
  • Regular security monitoring
  • GDPR-compliant data processing agreements with third parties
  1. Cookies and Website Tracking

Our website uses cookies to make your experience smoother and more enjoyable. 

Eluma uses cookies and similar technologies to understand which parts of our website are most helpful, how visitors move around the site, and how long they stay. This helps us improve our pages, make our communication more effective, and create a better experience for you each time you visit.

Cookies also allow us to remember things like your preferred language or other basic settings, so you don’t have to re-enter them every time. They can also help us provide support and register your interactions with our content.

The cookies we use are session cookies, which means they only stay active while you are browsing our website and disappear once you close your browser.

We only use cookies that are essential for the basic functioning of our website. These cookies do not collect Personal Data, in line with GDPR standards.

  1. Updates to This Policy

We may revise this Privacy Policy from time to time. Any updates will be published on this page.

Before any changes take effect, we will inform you by email and/or by displaying a prominent notice on our Service, and we will update the “effective date” at the top of this Privacy Policy.

You are encouraged to review this Privacy Policy periodically to stay informed about any updates. All changes become effective once they are posted on this page.

For any clarification or question kindly contact our DPO at dataprivacy@elumaeducation.com

  1. Jurisdiction

Any dispute that may arise in relation to the subject matter of the Privacy Policy shall be governed and construed in accordance with Maltese law and subjected to the exclusive jurisdiction of the competent courts of Malta.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email:  dataprivacy@elumaeducation.com 

Registered Address: Level G, Office 1/1115, Quantum House 75, Abate Rigord Street, Ta’ Xbiex, XBX 1120, Malta.