Privacy Policy

2 What Personal Data do we process

2.1         We are entitled to collect, and process the following Personal Data about you and any Student you are responsible for:

§  Biographical and identification information ► including first name, surname, gender, nationality, date and place of birth, information about family members, passport, and national identification card details;

·        Contact information ► including address(es), telephone number(s), email address(es), emergency contacts;

·        Student information ► including admission information (e.g. exams/tests scores), start date, year group, class information, school ID, grades, state exam transcripts, copies of assignments, classroom records, class participation information, study skills, assessments, timetables, transportation routes, photographs or videos, and communications with Parents or Guardians, teachers and other Students, login data, logs, data from educational platforms used by the Student or school equipment used by the Student, and data about warnings related to the Student or reported directly by the Student (e.g. bullying alerts, etc.).

We share some of the above data with The Ministry of Education, Research, Development and Youth of the Slovak Republic, fulfilling our obligation under the law to provide information about our Students to the Central register maintained and managed directly by the Ministry.

In rare cases, we may process the Special Categories of Personal Data and photographs and videos of Students listed below:

o   Health / Medical care information related to an injury that a Student may suffer at school or during extracurricular activities; disability data; data related to a medical condition that is educationally related; medical conditions that potentially affect the ability to learn in order to provide a safe environment for all Students; and

o   Photographs of Students and video recordings, which we process for the purposes of identifying the Student and keeping the School safe or for various marketing purposes.

For more information on the processing of the above-mentioned data, please see Use of Special Categories of Personal Data.

·        Information about Parents, legal Guardians (Guardians), parents' authorised representatives (e.g. pick-up persons), contact persons (e.g. parent's assistant) ► including identification data, login data, contact data, communication with Parents and representatives, photographs, and videos;

·        Payment information ► including bank account, credit, and debit card information, and, where applicable, the results of any relevant checks;

·        Our correspondence ► where we are contacted by you or a Student you are responsible for, we will keep a record of that correspondence;

·        Website and communication usage ► details of visits to our websites (including use of any educational tools) and information collected through cookies and other tracking technologies including, but not limited to, IP address and domain name, browser version and operating system, traffic data, location data, web logs and other internet communication data, resources that are accessed and associated telemetry data (e.g. how long you spent watching a video);

·        Information you have provided to us ► any additional information that you or a Student you are responsible for may provide to us, such as through completing enquiry or feedback forms.

Where do we collect Personal Data?

2.2         Personal Data is provided to us directly by you (or any Student for whom you are responsible) or collected by us from third parties such as through educational and sporting institutions, anti-fraud and credit checking agencies, from lists of fines/sanctions and public officials' checks, from our business partners and from public registers and records or from your employer in the case of the provision of benefits (in the form of children's education) to its employees.

3 How do we process your Personal Data and the Personal Data of the Student for whom you are responsible

3.1         We process your Personal Data and the Student Data for whom you are responsible, manually, or electronically (including through our educational tools which may use the latest technologies such as machine learning), only for specific purposes and on a specific Lawful basis. For more information and an explanation of the Lawful bases for processing Personal Data, please see the Lawful Bases section. The specific purposes and Lawful bases for processing are set out here:

A.     EDUCATIONAL PURPOSES:

(a)          To select, onboard, and enrol Students ► We use Personal Data to process application forms, tests, examination results, entrance interviews, travel arrangements and all activities relating to the Student’s enrolment in the School. This may in certain limited circumstances include Special Categories of Personal Data, photographs, and video recordings of Students for identification and security of the School premises;

Lawful bases: legal obligations, contract performance, legitimate interests (to enable us to provide our services and ensure Student identification and security of the School premises). In the limited circumstances where we need to process Special Categories of Personal Data, we rely on your consent, compliance with legal obligations and legitimate interests.

(b)          To administer the education process ► We process your Personal Data mainly for the purpose of (i) carrying out routine administration of student affairs (e.g. issuing various certificates for students and parents of students), (ii) receiving and processing various students requests regarding their studies (e.g. requests for interruption of studies, changes in the study form, etc.) and communication in various study relating affairs, (iii) provision of Personal Data from student register to the Central register of students operated by The Ministry of Education, Research, Development and Youth of the Slovak Republic, (iv) assessment and verification of the knowledge level acquired by testing students and recording the results of such assessments (electronic student book), (v) receipt and verification of payments (e.g. tuition fees payments), (vi) issuing documents of study necessary in particular for the evidence of studies within the scope of student card, statement of academic results etc.;

Lawful bases: contract performance, legal obligations, legitimate interests (which will guarantee the quality and legality of our services).

(c)          To manage timetables for academic, sport activities, ensure Students transfer, access to School information and communication systems ► We use your Personal Data to develop timetables for Students, to grant access to the School intranet and other information and communication systems and applications used by the School (including education information systems and applications), Personal Data of both Students and Parents;

Lawful bases: legal obligations, contract performance; legitimate interests (to enable us to perform our obligations and provide services under the contract(s)).

(d)          Students development and support ► We use Personal Data to assess and guide Students through dialogue, analysis, record keeping, supporting all aspects of their development (including providing information to Students about their performance, recording academic progress, helping Students understand how they learn and suggesting techniques to improve learning) and preparing them appropriately for current and future internal and external opportunities;

Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services), consent (where this information is collected through cookies or similar technologies). In exceptional cases where we need to process Special Categories of Personal Data, we rely on your consent or to defend, prove and exercise legal claims.

(e)          To provide safe and healthy environment for Students and Staff ► The foregoing may in exceptional circumstances involve processing of Special Categories of Personal Data, photographs and video recordings of Students such as:

o   Health / Medical care information related to an injury that a Student may suffer at school or during extracurricular activities (timetable), disability data, data related to a medical condition that is educationally related, medical conditions that potentially affect the ability to learn. We process health data to the extent necessary to take appropriate action and adjustments in relation to disabilities, allergies, illnesses, injuries, including disclosing the data to third parties such as insurers or healthcare providers where necessary;

o   Photographs and video recordings of Students for identification purpose on our premises.

Lawful bases: legal obligations (section 11 and 152 of the Education Act), legitimate interests in a safe and healthy environment at the School (to enable us to conduct our obligations and provide services under the contract(s)).

In exceptional cases where we need to process Special Categories of Personal Data (health data), we rely on your consent, important public interest, the defence, proof and exercise of legal claims or the protection of the vital interests of you or another person (unless you are unable to give consent for any reason).

In the exceptional cases where we need to process Students photographs or video recordings, we rely on the defence, proof and exercise of legal claims and legal obligations (section 11 and 152 of the Education Act).

(f)           Programme and extra-curricular activities ► We use Personal Data to organise, administer and operate excursions and extra-curricular activities, including processing of payments, where we may also disclose Personal Data to third parties for relevant insurance cover, medical assistance, supervision, and execution of extra-curricular activities at BISB (interest clubs, after-school clubs, etc.);

Lawful bases: contract performance, legal obligations, your consent to the processing of Personal Data (to enable us to perform our obligations and provide our services).

(g)          To keep Parents and Guardians informed about Students ►We are providing you with information and learning results on the progress, opportunities, and potential difficulties of Students, including access to the information systems used by the School (e.g. the Parent Portal). In conjunction with Students, Parents or Guardians, liaise with other bodies (educational, sporting or any other sector) in relation to Students;

Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services), consent (including where this information is collected through the use of cookies or similar technologies).

(h)          To improve our services ► We analyse Personal Data in order to better understand your requirements, or those of any Student you are responsible for. This will assist us in tailoring and developing the services we offer;

Lawful bases: legitimate interests (to allow us to improve our services).

(i)            To support, develop and improve our teaching ► We analyse your pseudonymised Personal Data in order to gather insights regarding our teaching which we use to support, develop, and improve our teaching including to help us understand and develop our curriculum and to develop and improve our educational products (including our technology tools). The resulting insights, learnings, and products (but not the underlying Personal Data) may be used for education related commercial purposes;

Lawful bases: legitimate interests (to allow us to improve our educational products and services); consent (where this information is gathered via cookies or similar technologies).

(j)            To ensure website content is relevant ► We process your Personal Data in order to provide information on our website as efficiently as possible for you and the Student for whom you are responsible;

Lawful bases: contract performance; legitimate interests (to enable us to present relevant content and services that we offer on our website).

(k)          Provision of psychological counselling services ► We process Personal Data for the purpose of providing professional services pursuant to Section 20 of Act No. 317/2009 Coll. on Educational Employees and Professional Employees, as amended. Such professional services include psychological examination and assessment, individual and group counselling, prevention and intervention for children and Students with a focus on the educational process in schools and school facilities; the School psychologist also provides psychological counselling in family and other social matters, if necessary. The School psychologist also provides psychological counselling and advice to Parents or legal Guardians;

Lawful bases: when processing Personal Data, we refer to the consent given by you and legal obligations.

(l)            Organisation of school trips (outdoor schools, ski trips, swimming courses, day camps, etc.) ► This is the processing of Personal Data that is necessary for the organisation and realisation of school trips;

Lawful bases: for the processing of Personal Data, we refer to the consent given by you.

(m)        To comply with a legal or regulatory obligation ► We may process your Personal Data or the Personal Data of a Student for whom you are responsible to the extent necessary to comply with our legal obligations or to engage in dialogue with a supervisory authority. In the course of this processing, we may disclose your Personal Data to third parties (e.g. our legal obligation is to disclose the data to the records maintained by The Ministry of Education, Research, Development and Youth of the Slovak Republic), to courts and/or supervisory authorities and/or law enforcement agencies in connection with requests for clarification/cooperation, proceedings or investigations by the aforementioned parties anywhere in the world or where compelled to do so;

Lawful bases: legal obligations, legal claims, legitimate interests (when cooperating with law enforcement authorities, supervisory authorities, and public institutions).

In exceptional cases where we have to process Special Categories of Personal Data, we invoke an important public interest.

(n)          Student Council ► This is the processing of Personal Data which is necessary in particular for the participation of Students in the organisation of their education at the School or to make suggestions for the improvement of the School's processes and to represent Students in relation to the School;

Lawful bases: legal obligations, legitimate interests (to enable us to perform the duties and activities of the School Council).

(o)          Cambridge Language Exams ► This is the processing of Personal Data which is necessary in particular for the registration and passing of Cambridge Language Exams by our Students;

Lawful bases: we are relying on your consent for the processing of Personal Data.

(p)          Parents academy ► This is the processing of Personal Data that is necessary in particular for the implementation of various workshops and other events for Parents and their children, in the form of sending invitations to Parents/Guardians of Students to these events and taking photographs and videos at these events;

Lawful bases: your consent to the processing of Personal Data.

(q)          Parent Teacher Association (PTA) ► This is the processing of Personal Data which is necessary in particular for the organisation of meetings with Parents and Students intended to improve the education of Students through social activities and initiatives focused on fundraising and assisting to the School at the discretion of the teaching staff;

Lawful bases: your consent to the processing of Personal Data.

(r)           Awarding of scholarships ► This is processing of Personal Data which is necessary in particular for (i) the assessment of a Student's application for and entitlement to a merit or talent scholarship on the basis of which the Student's BISB tuition reduction is granted, or (ii) the assessment of entitlement to and the award of other forms of scholarships as per BISB's relevant policy;

Lawful bases: legal obligations or, where applicable, your consent to the processing of Personal Data.

(s)          Final examinations ► This is processing of Personal Data which is necessary in particular to conduct final examinations as authorised by law, including IB;

Lawful bases: contract performance, legal obligations, legitimate interests in the successful completion of the Students' Final Examinations (to enable us to perform our obligations). In the exceptional cases where we need to process Special Categories of Personal Data, we rely on your consent, to defend, prove and pursue legal claims.

B             ALUMNI PURPOSES:

(t)           Establishing and maintaining relationships with former Students (Alumni) ► This is the processing of Personal Data, which includes in particular: (i) maintaining relationships, connections with Alumni in the form of organizing and inviting former Students (Alumni) to various School events and taking photographs and videos of such former Students (Alumni) at such events or, developing various other forms of Alumni cooperation or support for the School including connecting students and Alumni with other graduates via NAE Alumni platform, (ii) internal administrative activities and tasks necessary to ensure the creation and maintenance of relationships with former Students (Alumni) of the School,;

Lawful bases: your consent to the processing of your Personal Data.

C             ACADEMIC, ARTS AND LITERATURE PURPOSES:

(u)          Library management ► This is the processing of Personal Data which is necessary in particular for: (i) the use of library systems and their connection with Personal Data processed in the Student register and Student ID cards, (ii) the performance of the tasks of the academic library, (iii) the performance of the legal obligations of the library's founder;

Lawful bases: performance of legal obligations.

D             REORGANISATION OR CHANGE IN OWNERSHIP STRUCTURE:

(v)          Reorganisation or change in ownership structure; or transfer of activities to a third party ► In the event that (i) you are affected by negotiations for the transfer of our activities, reorganisation and/or change of ownership structure or part thereof to a third party; (ii) our company or part of its activities are transferred to a third party; or (iii) we undergo a reorganisation; we may be required to transfer some or all of your Personal Data and the Personal Data of the Student(s) to the relevant third party (or its consultants) as part of the due diligence process; or transferred to that reorganised entity or third party and used solely for the same purposes as set out in this PICS or for the purpose of analysing any proposed transfer (transaction) or reorganisation;

Lawful basis: legitimate interests in order to allow us to change and develop School´s activities or to arrange for reorganisation and/or changes in the ownership structure.

E             PROMOTION, ADVERTISING AND MARKETING PURPOSES:

(w)         Newsletters and marketing materials ► If you have expressed your willingness to receive newsletters and promotional materials, we will keep you and the Students for whom you are responsible informed about news and offers of our services. If the law requires consent for such processing, we will ask for your consent to carry out the aforementioned advertising activities. We will provide an option to unsubscribe or opt-out of further communication in any electronic marketing communication sent to you or you may opt out by contacting us using the details set out in Annex 3;

Lawful bases: legitimate interests in the promotion of our services; consent.

(x)          Print and online advertising, promotion of the School and information about the School's activities ► This involves the processing of Personal Data (i) in and around the School in places that can be seen by visitors to the School, such as billboards, posters or notice boards in classrooms, in the corridor of the School, etc.; (ii) on the School's website, group website and other School digital platforms as part of our newsletters and updates about events and activities at the School, such as sending newsletters about sports games, parents' days or open days, fairs, concerts, performances, etc; (iii) on our social networking sites such as Facebook/Instagram/LinkedIn, etc.; (iv) in our other marketing materials, including yearbooks, handbooks, prospectuses, entrance exam/interview materials, promotional videos, print advertising and outdoor advertising; the processing of Personal Data for this purpose also includes the recordings (visual, audio, audio-visual) of the School’s activities, their editing and processing, as well as sharing within defined groups of recipients (e.g. within classroom, among the School’s legal representatives, etc.) through various means or platforms;

Lawful bases: legitimate interests in promoting our services and activities; consent.

(y)          School events ► This is the processing of Personal Data which is necessary in particular for: (i) the organisation of events of a different nature (e.g. sporting events, arts events, seminars, workshops, cultural and social events, lectures, charity events); (ii) sending invitations to events to the persons concerned who have been registered for the same or similar events in the past; (iii) registering new participants who wish to attend a specific event, if registration is necessary for their participation;

Lawful bases: legitimate interests in promoting our services and activities; consent.

(z)          Administration of our website ► Our website uses cookies. For more information on how we use cookies, please see our Cookie Policy.

Sharing Personal Data with other organisations

3.2             In order to provide our education and schooling services (including extra-curricular activities) effectively, we sometimes need to share information with other organisations. We share information with the following entities:

(a)          NAE and our Regional Office Teams which undertake management functions;

(b)          Our suppliers, who assist us in providing educational and extra-curricular services, including after-school programmes (interest clubs, after-school clubs, camps etc.), catering, transportation (bus company, travel agency, etc.), our programme partners Julliard, MIT and UNICEF, and IT contractors who help us develop our products and services or suppliers of platforms and applications for learning (for example for practicing mathematics, coding, etc.) A list of our suppliers can be provided upon request by contacting us using details set out in Annex 3;

(c)          The Ministry of Education, Research, Development and Youth of the Slovak Republic, when fulfilling our obligation under the law to provide information about our Students to the Central register maintained by the Ministry.

3.3             Where these entities are outside of the EU/EEA, we ensure that there are adequate safeguards in place to ensure the security of your Personal Data. See Export of data outside of the EU/EEA for more information.

4             Use of Special Categories of Personal Data, photographs and video recordings

2            

4.1             As a general rule, we do not process Special Categories of Personal Data. In order to provide educational and schooling services (including extra-curricular activities) effectively to you or a Student for whom you are responsible, we are required in very exceptional circumstances to collect, process, and disclose Special Categories of Personal Data and photographs of Students including, but not limited to:

(a)          Health / Medical care information related to an injury that a Student may sustain at school or during extracurricular activities; disability data; data related to a medical condition that is educationally related; medical conditions that potentially affect the ability to learn in order to provide a safe environment for all Students; and

(b)          Photographs of Students and video recordings for the purposes of identifying and maintaining safety at the School, enhancing the School premises or for marketing purposes.

4.2             In addition to the usual appropriate technical and organisational measures we implement to ensure the security and integrity of the Personal Data processed by us, we may implement additional measures in relation to Special Categories of Personal Data, as appropriate. These may include segregation, pseudonymisation (data can no longer be directly identified to the Data Subject) or restriction of access to the data.

4.3             Where we need to process Special Categories of Personal Data, photographs and video recordings we will usually do so based on the following Lawful bases (see Lawful Bases):

Consent

4.4             If the Student is a minor (under 18 years of age), we will ask for your explicit consent as the Parent/Guardian who is responsible for the Student, on behalf of the Student. Consent is valid until withdrawal by the consenting Parent/Guardian or the Student, provided that the Student has the legal capacity to withdraw consent (see Legal capacity).

4.5             Withdrawal of consent does not adversely affect the interests of the Student.

4.6             In all circumstances, if a minor Student under the age of 18 who we have deemed competent to consent later withdraws consent against the best interests of the Student, we may approach a Parent/Guardian to consent on the Student's behalf.

4.7             We will seek consent directly from adult Students (over the age of 18).

5             Legal capacity of Students to decide on the processing of their Personal Data

5.1             Legal capacity will be assessed as follows:

5.2             Students under the age of 16. If a Student is under the age of 16, they are not considered mature enough to make decisions about the processing of Personal Data. We will provide these Students with a simplified and age-appropriate version of this PICS and refer to the consent provided by a Parent or other legal representative (Guardian) where necessary.

5.3             16 - 18-year-old Students. Where a Student is over 16 and under 18 years old, they are deemed to be sufficiently mature to make decisions about the processing of their own Personal Data, and their competence and understanding in the matter in question will be independently assessed where necessary. We will provide these Students with a copy of this PICS.

5.4             Students over the age of 18. Where a Student has reached the age of 18, they are deemed to be sufficiently mature to make decisions about the processing of their own Personal Data. We will provide these Students with a copy of this PICS and, if necessary, ask them directly to provide consent again.

6             Transfer, storage, and security of Personal Data

Security over the Internet

6.1             No data transmission over the Internet or through websites can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic, and procedural safeguards to protect your Personal Data, and that of any Student you are responsible for, in accordance with data protection legislative requirements.

6.2             All information you, or any Student you are responsible for, provide to us is stored on our secure servers or our suppliers’ secure servers and accessed and used subject to our security policies and standards. We ask that you, or any Student you are responsible for:

(a)          Refrain from sharing any password providing access to certain parts of our websites, applications, or systems with any other person; and

(b)          Comply with any other security procedures that we may notify you of from time to time.

Personal Data export outside the EU/EEA

6.3             We are a global network of schools, and your Personal Data, or that of any Student you are responsible for, may be transferred to, stored in, or accessed by staff or suppliers in a destination outside the European Union (EU) / European Economic Area (EEA). Regardless of location, we will impose the same data protection safeguards that we apply inside the EU/EEA.

6.4             Certain countries outside the EU/EEA, have been approved by the European Commission as providing essentially equivalent protections to EU/EEA data protection laws and therefore no additional safeguards are required to export Personal Data to these jurisdictions (see the full list here: Adequacy decisions (europa.eu)). In countries which have not had these approvals, we will transfer data subject to European Commission approved contractual terms (as appropriate) that impose equivalent data protection obligations directly on the recipient, unless we are permitted under applicable data protection law to make such transfers without such formalities.

Please contact us using details set out in Annex 3 if you would like to understand more about where your Personal Data is located, or to see a copy of the specific safeguards applied to the export of Personal Data relating to you or any Student you are responsible for.

Retention period

6.6             Your Personal Data will only be processed for as long as is necessary for the purpose for which they were collected and any other permitted linked purposes. So, if Personal Data is used for two purposes, we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose with a shorter period once that period expires. We restrict access to Personal Data to those persons who need to use it for the relevant purpose(s).

6.7             Our retention periods are based on our needs and the relevant legislation. We process your Personal Data obtained on the basis of consent for the period of validity of the consent or until the consent is withdrawn.

6.8             This means that the Controller shall ensure that the Personal Data is deleted without undue delay after:

a)     all the purposes of the processing set out in the legislation have been fulfilled;

b)     the period for which consent was given has expired or the data subject has withdrawn their consent;

c)      the Data Subject's request for erasure of the Personal Data has been complied with and one of the grounds justifying compliance with that request has been fulfilled;

d)     all rights and obligations between the Data Subject and the Controller have been settled;

and, at the same time, all obligations of the Controller laid down by generally binding legal regulations which require the retention of Personal Data (in particular for archiving purposes in the public interest, tax inspection, etc.), or which could not be fulfilled without their retention, have expired.

6.9             Records that are no longer needed are either irreversibly anonymised (cannot be linked to a specific person and may be retained) or securely destroyed.

6.10             In any case, we do not systematically further process any Personal Data collected accidentally for any purpose defined by our company. Where possible, we shall inform the Sata Subject to whom the accidentally collected Personal Data belongs of its accidental collection and, depending on the nature of the case, we shall provide them with the necessary cooperation leading to the restoration of control over their Personal Data. Immediately following these necessary actions to resolve the situation, we will promptly dispose of all accidentally obtained Personal Data in a secure manner.

6.11             Please contact us if you would like more detailed information about the specific retention period using the contact details set out in Annex 3.

7             What are you Rights relating to Personal Data

Be aware of the rights that Data Subjects have in relation to their Personal Data

7.1             Data Subjects have a number of rights relating to how their Personal Data is used. Please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise them in all situations. In addition, these will vary slightly between EU member states. If you wish to exercise any of these rights, we will verify your entitlement and respond within a reasonable time period.

7.2             Students may be able to exercise these rights independently, provided that they have Legal capacity.

7.3             You have, to the extent applicable, the following rights relating to your Personal Data or Personal Data of the Student you are responsible for:

·          Access to Personal Data: ► You have the right to access any Personal Data held by BISB about you or the Student for whom you are responsible. We will provide you with this information within 1 month of confirming your identity and understanding the scope of your request;

·          Rectification: ► You have the right to request the rectification of incorrect Personal Data or the completion of incomplete Personal Data;

·          Erasure: ► You have the right to request that we delete Personal Data in certain circumstances. Where Personal Data has been disclosed, we will take reasonable steps to inform other controllers that are processing the data that you have requested the erasure of any links to, copies or replication of it;

·          Withdrawal of consent: ► You have the right to withdraw any consent to the processing of data that you have given to us or on your behalf and to prevent further processing, unless there is another Lawful basis that allows us to process your Personal Data;

·          Restriction: ► You have the right to request that certain Personal Data be designated as Restricted Data in certain circumstances, whilst we resolve complaints that have been submitted. Restriction means that while we archive the data, we do not process it until the restriction is lifted;

·          Data Portability: ► You have the right to have us provide you with a copy of any Personal Data that you have provided to us or have transferred to another data controller in a commonly used machine-readable format;

·          Right to object: ► On the basis of legitimate interests, you have the right to request that we stop processing your data unless the legitimate interests we have in processing your data outweigh any prejudice to your right to protection of Personal Data;

·          Marketing: ► You have the right to ask us to stop processing your Personal Data for direct marketing purposes;

·          Lodge a complaint: ► You have the right to lodge a complaint with the local Data Protection Authority regarding the processing of your Personal Data. Details of relevant Data Protection Authority can be found at Annex 3.

7.4             If you would like to exercise any of your rights or have any queries relating to your rights or exercise of your rights, please contact us using the details set out in Annex 3.

8             Profiling and automated decision-making

8.1             The Controller does not conduct processing operations which would result in a decision having legal effect or other substantial impact on your person based solely on the fully automated processing of your Personal Data.

9 Obligation to provide Personal Data

9.1             If the Lawful bases for processing your Personal Data is to comply with our legal obligation under Article 6(1)(c) of the GDPR and you refuse to provide us with your Personal Data, this may lead to damages which we may claim against you (e.g. if we are sanctioned as a result of our failure to comply with our obligation).

If the Lawful bases for the processing of your Personal Data is the conclusion or performance of a contractual relationship, processing under Article 6(1)(b) GDPR, and you refuse to provide us with your Personal Data, this may result in us being prevented from entering into a mutually binding contractual legal relationship.

9.3             Where the Lawful basis for processing your Personal Data is consent, processing under Article 6(1)(a) GDPR, you may withdraw consent at any time, and you are entitled to use the same method as you used to give us the consent. We never make the granting of consent to process Personal Data for the purposes requested conditional on your ability to enter into a contractual relationship with us.

9.4             If the Lawful bases for the processing of your Personal Data is the prevalence of our legitimate interests and we use the Lawful bases under Article 6(1)(f) GDPR to process your Personal Data, you are obliged to tolerate this processing, but you have the right to object to it.

9.4            

10                Changes to the PICS and/or Cookie Policy

10.1             The contents of our PICS and Cookie Policy are subject to potential future changes. We therefore recommend that you visit our website regularly to keep updated on how we manage Personal Data.

10.2             This PICS was last updated on 1st May 2024.

Annex 1: Lawful bases

Use of Personal Data under EU data protection laws must be justified under one of a number of Lawful bases and we are required to set out the Lawful bases in respect of each use of the data in this PICS. We define the Lawful bases that justify how your Personal Data is used in the section How do we process your Personal Data and the Personal Data of the Student for whom you are responsible.

The principal Lawful bases that justify our use of your Personal Data:

The principal Lawful bases that justify our use of Special Categories of your Personal Data when

the data is used:

Annex 2: Definitions

The following terms are used in this PICS:

Data Controller: This is the person who alone or jointly with others determines the purposes and means of the Personal Data processing. For the purposes of these PICS the Controller is BISB or, as the case may be, the other entities referred to in Annex 3 of this PICS.

Data Subject: For the purpose of this PICS this includes all living individuals about whom we hold Personal Data, including, Students, Parents or Guardians, employees, suppliers, and business partners. A Data Subject does not have to be a national or a permanent resident of the country where we carry out the relevant company activities. Within the EU, all Data Subjects have legal rights in relation to their Personal Data.

Data Processor: This is the person processing Personal Data on behalf of the Data Controller (not including employees of the Data Controller). These are suppliers and agencies that process Personal Data on our behalf, they are considered to be our Processors.

Personal Data: This is defined as any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified (either directly or indirectly) by reference to an identifier. These include names, ID numbers, location data, online identifiers or one or more factors specific to the physical, psychological, genetic, mental, economic, cultural, or social identity of that person.

Special Categories of Personal Data: This type of data is, in the EU and some other countries, subject to more stringent processing conditions than other Personal Data and in the EU includes Personal Data which reveals racial or ethnic origin, political opinion, religious or philosophical beliefs, trade-union membership, and the processing of genetic data, biometric data in order to uniquely identify a natural person or data concerning health, sex life and sexual orientation. Data concerning health covers Personal Data relating to the physical or mental health of an individual which reveals information about the individual's health status. In the EU, the processing of Personal Data relating to criminal convictions or related security measures is only permitted under Member State law or EU legislation. In other countries, the concept of Special Categories of Personal Data may include other categories of data, such as financial and password data. If in doubt, please contact the Data protection officer.

NAE: Nord Anglia Education Group (including companies and schools listed in the contact details set out in Annex 3).

NAE: Our UK based Headquarters, Nord Anglia Education, Nova South, 160 Victoria Street, Westminster, London, SW1E 5LB, United Kingdom.

School(s): This means mainly BISB or any school within the Nord Anglia Education Group.

Parents / Guardians: This means any Parents or Guardians responsible for a Student.

Legal capacity: See Legal capacity.

Student: This means any prospective, past, or present Student of a School.

Education Act: Act No. 596/2003 Coll. on state administration in education and school self-government and on amendment and supplementation of certain acts and Act No. 245/2008 Coll. on education and training (Education Act) and on amendment and supplementation of certain acts.

Annex 3: Nord Anglia Education and the School Contact details

Information on the processing of the personal data on the BISB premises and CCTV system