You and your parents/legal guardians should read this policy carefully.
American Councils for International Education: ACTR/ACCELS, Inc., (American Councils, we, us, or our) based at 1828 L Street NW, Suite 1200, Washington, DC 20036-5136, United States of America, would like to inform you and your parents/legal guardians about the Future Leaders Exchange Program (FLEX).
To participate in FLEX, American Councils requires certain data about yourself and/or your parents/legal guardians. We kindly request that you and your parents/legal guardians read this document and contact us if you have any questions (see American Councils’ contact information below.)
American Councils respects your privacy and adheres to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR).
What Is FLEX?
FLEX offers high school students the chance to participate in an academic year exchange program in the United States of America followed by FLEX alumni programming in their home countries. FLEX finalists attend American high schools, live with volunteer host families, and take part in American community life. Upon return to their home country, FLEX alumni join an international network with life-long benefits. American Councils manages FLEX on behalf of the Bureau of Educational and Cultural Affairs at the U.S. Department of State.
What Data Will Be Collected, Used, and Stored?
For this program, your personal data will be collected, used, and stored. Different data is collected at the applicant, semi-finalist, finalist, and alumni stages.
At the applicant stage, you and/or your legal guardian may be asked to share:
- Demographic data, such as name, email address, telephone, address, and birth date
- Educational data, such as school enrollment details
- Photographs
- Other data of your choice, such as disclosure of disability
At the semi-finalist stage, you and/or your legal guardian may be asked to share:
- Demographic data, such as citizenship and family composition
- Educational data, such as transcripts and teacher recommendations
- Photographs
- Mental and physical health data, such as height, weight, health history, and vaccination records
- Other data of your choice, such as disclosure of disability
At the finalist stage, you and/or your legal guardian may be asked to share:
- Educational data, such as updated grade transcripts
- Mental and physical health data, such as updates on changes in health conditions
- Other data of your choice, such as on-program success stories
At the alumni stage, you and/or your legal guardian may be asked to share:
- Demographic data, such as place of residence
- Educational data, such as university enrollment
- Occupational data, such as employment information
- Other data of your choice, such as awards and accomplishments
What Is the Legal Basis for this Data Collection, Use, and Storage?
American Councils uses explicit consent [art. 6(1)(a) and art. 9(2)(a) GDPR] to process applicant and participant data.
Why Is this Data Required?
Your personal data is required for the following purposes:
At the applicant stage:
- Initiating participation in the application process
At the semi-finalist stage:
- Continuing participation in the selection process
- Conducting the health clearance process
At the finalist stage:
- Securing health insurance for the finalist
- Placing the finalist in the host family and school
- Providing on-program support to the finalist
- Offering additional on-program opportunities to the finalist
At the alumni stage:
- Engaging the alumni in alumni programming
Who Will Have Access to the Data?
We may share your personal data with various American Councils’ offices, affiliated organizations, and third-party business partners. Our third-party business partners may include program funders, service providers, and others located outside of the European Economic Area (the EEA consists of all EU Member States, plus Iceland, Liechtenstein, and Norway.) in the United States of America and throughout the world, that work with us to process your application or request and to deliver our program and other services to you. All third-party business partners that we share your personal data with are expected to comply with applicable regulations and privacy requirements. We strive to ensure that such third parties will only share this information with other organizations or individuals that are working with them to deliver American Councils-related program and other services.
Some examples of why we may provide your personal data to such third parties are:
- Sending you program preparation materials
- Arranging a home, work, and educational placements for you while on program
- Arranging transportation, such as airline and train, to and from your program location
- Arranging your participation in conferences, seminars, and other similar activities
- Evaluating any health and medical information that you provide to us
- Providing support to you while you are on program
- Contacting you about post-program alumni activities
- Generating aggregated and anonymized statistical reports that may be shared with program funders
What Risks May I Have if My Personal Data Is Sent Outside the EEA?
Different laws and legislation exist on personal data protection and information security outside the EEA. There is a chance that your personal data will be requested by government authorities. This may have consequences for the protection of your personal data. The U.S. Government may, for example, invoke laws and legislation to oblige American Councils, to provide access to the personal data of the program.
Some U.S. Government Laws and Legislation Related to Personal Data Protection and Information Security
| Legislation | Risks |
| CLOUD Act (in force since 23-Mar-2018) | Despite being American legislation, the CLOUD Act may affect European citizens. Under this law, companies may be obliged to provide information about non-U.S. citizens directly to the U.S. Government. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at rest. |
| PRISM (in force since 2007) | PRISM is a digital program that can collect personal data from large U.S. Internet companies. It is a tool that analyses data to find irregularities about a certain person. It is also used to collect data about people outside the U.S. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at rest. |
| USA Freedom Act (in force since 2015) | Under certain circumstances, U.S. authorities have access to personal data stored outside the U.S. This must concern a U.S organization. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at rest. |
| Foreign Intelligence Surveillance Act (FISA) Section 702 | Under certain circumstances, U.S authorities have access to information concerning the conduct of the foreign affairs of the U.S. Under this law, U.S authorities may require electronic communication service providers to give information, facilities, or assistance, as required. In order to increase your privacy, only coded data will be sent and all data is encrypted in transit and at rest. |
How Long Will the Data Be Stored?
Your personal data will be retained by American Councils as referenced in our Data Retention Policy. Unidentifiable statistical data regarding you may be retained indefinitely.
American Councils’ Retention Policies for Program Applicants and Participants
| Student Records Type | Must Keep For | Must Delete After |
| Applicant Data (Statistical) | Forever | Never |
| Applicant Data | Six (6) Months | One (1) Year After Application Deadline |
| Participant Records (Statistical Data and Grades) | Forever | Never |
| Participant Records | Six (6) Months After the Completion of the Program | One (1) Year After the Completion of the Program |
Your Rights Under the General Data Protection Regulation (GDPR)
Under the GDPR, you have various rights regarding the use of your personal data in this program. These include:
Your Right to Withdraw Consent for the Use of Your Personal Data
You can always withdraw your consent for the use of your personal data. This applies to this program and also to the storage and use of these personal data for future use, such as for alumni purposes. Apart from the personal data we are obliged to store in compliance with legal obligations, your personal data will be deleted or anonymized after you have withdrawn your consent for the use of your personal data.
Your Right to Access Your Personal Data
You have the right to access the personal data we, or parties using personal data about you on our behalf, have about you. You will then, within one (1) month, receive an overview of all the personal data we have about you, together with an explanation of why we keep those.
Your Right to Have Personal Data Amended
If personal data used by us, or by parties using personal data on our behalf, are incorrect or incomplete, you can submit a request to have these personal data updated.
Your Right to Have Personal Data Deleted
In some cases, you can ask to have personal data deleted. For example, this can be done if personal data is no longer needed for the program, if you withdraw your consent, if your personal data is being wrongly used or if your personal data needs to be deleted because of a legal obligation we need to comply with.
Your Right to Stop the Use of Personal Data
You have the right to stop the use of your personal data. You may, for example, make a request to have your personal data amended if your personal data is being wrongly used, but you do not (yet) want your personal data to be deleted, or for defense of your legal rights.
Your Right to Have Your Personal Data Transferred
You have the right to request transfer of your personal data to another organization.
Your Right to Object to the Use of Your Personal Data
In some cases, you have the right to object to the use of personal data.
Making a Request or Asking a Question
If you want to exercise any of the rights above, you need to submit a request. You can do this by contacting American Councils. You may also ask questions related to your GDPR rights. You will receive a response within 30 days.
By Postal Mail:
ATTN: Chief Information Officer
American Councils for International Education:
1828 L St NW Ste 1200
Washington DC 20036-5136
United States of America
By Email:
Contacting the Relevant Data Protection Authority
If you have contacted American Councils and are not satisfied with how your complaint has been handled, then you can also contact the Data Protection Authority in your country.