How this portal handles your information
EUt+ Coordination Center staff portal · version 1.1, in force 2026-09-07
This is the staff portal of the EUt+ Coordination Center at the Cyprus University of Technology. It handles leave, weekly reports, and the record of what each of us works on. It is used by the people who work at the Center and by nobody else.
The University is responsible for the information in it. This page tells you what is held, why we are allowed to hold it, how long it stays, and what you can ask us to do about it.
What the portal holds about you
- Your name, your University email address, your position and who supervises you.
- Your engagement — dates, hours a month, category and scale point, and what an hour of your time costs a project. Cost is visible to administrators only, never to colleagues.
- Your leave: the dates, whether it was a whole day, and which kind. Including sick leave — the dates only. The portal has no field for a diagnosis and no way to attach a certificate, deliberately.
- Your weekly reports, the tasks in them, and what you are allocated to.
- Technical records: when you signed in, failed sign-in attempts, and a log of changes made to records. Your IP address is shortened before it is stored, so it identifies a network rather than a device.
- Only if you ask for it — your birthday (day and month), and your birth details for Το Κοσμικό Δελτίο, with the birth chart derived from them. Both are optional and both are off unless you turn them on.
Why we are allowed to hold it
Mostly because the University employs you, not because you agreed to it — and that distinction is deliberate rather than evasive. If we asked you to consent to your own leave records, you could withdraw that consent on a Tuesday and the University would still be legally required to keep them. Calling it consent would be pretending you have a choice you do not have.
| What | On what basis |
|---|---|
| Your employment details, leave, reports | Necessary for your employment contract, and required by Cyprus employment lawArt. 6(1)(b) and 6(1)(c) |
| Sick-leave dates | Employment-law obligations, under the specific permission the law gives for health-related data in employmentArt. 9(2)(b) |
| Timesheets, allocations, cost | The funding agreements oblige the University to evidence effort and costArt. 6(1)(c) and 6(1)(e) |
| Sign-in records and the change log | Keeping everyone’s information secure is itself a legal obligationArt. 6(1)(c), Art. 32 |
| Birthdays and Το Κοσμικό Δελτίο | Your consent — the only two things here that are. Optional, refusable with no consequence at all, and switched off in one clickArt. 6(1)(a) |
Who else sees it
Inside the Center: your supervisor sees the leave they approve and the reports they review. Administrators see everything, including cost. Your colleagues see only that you are away, never why.
Outside: the companies that host the portal and deliver its email — and, only for Το Κοσμικό Δελτίο and only if you joined it, the service that casts a birth chart from a date, time and place, and the AI service that writes the card’s text from that chart as star signs and houses, never from your name or your date of birth. They are listed, by name and by country, on the sub-processors page. Nobody else. Your information is not sent to any other University system automatically, and is never sold, shared or used for advertising — there is no advertising here and no analytics of any kind.
How long it stays
| What | How long | Then |
|---|---|---|
| Failed sign-in attempts | 90 days | Deleted |
| Expired sessions | 30 days | Deleted |
| Used or expired invitation, sign-in and reset tokens | 7 days | Deleted |
| Email delivery records | 1 year | Deleted |
| The change log | 5 years | Deleted |
| Accounts, leave, reports and timesheets of people who have left | 5 years | Your name is removed from the records rather than the records being deleted, so the history still adds up |
| Records that somebody was shown the privacy notice | 5 years | Deleted |
| Subject rights requests and their answers | 5 years | Deleted |
| Birthday and Κοσμικό Δελτίο details | Until you switch them off | Deleted in that moment |
These are not intentions. Each row is a scheduled deletion the portal performs, and this table is generated from the same schedule the jobs read.
What you can ask for
Some of these are a button on your data page and happen immediately. Others are a request that reaches an administrator, because they need a person to answer them honestly.
- See everything held about you — a button. Download it now, as a readable page or as data.
- Correct your name or position — a button, on your profile.
- Correct something you do not control — a contract date, a leave entry: a request.
- Stop the Κοσμικό Δελτίο or the birthday — a button. Immediate, no reason asked, nobody notified.
- Have your information deleted — a request, and read the next paragraph first.
- Object to something, or ask us to pause it — a request.
About deletion, plainly
If you are not happy with how this is handled
Tell an administrator, or write to the University’s Data Protection Officer, Cyprus University of Technology at gdpr.dpo@cut.ac.cy. You can also complain directly to the Office of the Commissioner for Personal Data Protection in Cyprus, without going through us first, and nothing bad happens to you for doing so.
One thing this page cannot tell you
This portal is not the only place the University holds information about you. Payroll, HR and the University’s central systems are separate, with their own records and the same Data Protection Officer. This page covers this portal only.