Our Privacy Policy
The British School Warsaw and The British School Sp. Z.o.o.
(“we” or “us”) is committed to safeguarding Personal Data. This PICS is
addressed to Parents that are responsible for one or more Students of any
School managed by the School and situated in Poland and concerns the processing
of:
- Parents
personal data for the purpose of: interaction with the School with regard
to the educational process of the Student
- Students
personal data in the course of educational process
It explains how we collect and use your Personal Data and
the Personal Data of Students in the educational process of Students you
are responsible for.
If you are the Parent of a Student who is, or becomes,
competent to make their own decisions relating to the processing of their
personal data, i.e reaches age 18, then you must provide a copy of this PICS to
them. More information about provision and withdrawal of consent is set out
at Consent.
This PICS is intended to explain our privacy practices and
covers the following areas:
By providing your information, or the
information of any Students you are responsible for (whether via our website,
in person, in writing or over the phone) to us, you acknowledge the processing
set out in this PICS. Further notices highlighting certain uses we wish to make
of your Personal Data together with the ability to opt in or out of selected
uses may also be provided to you when we collect Personal Data from you.
This PICS only relates to processing undertaken by or on
behalf of the School. Whilst our websites may contain links to other third
party websites, please note that we do not accept any responsibility
or liability for their policies in relation to any Personal Data or their
collecting processing of any Personal Data.
1. What Personal Data do we process?
We may collect and process the following Personal Data about
you and any Student you are responsible for :
Parents personal data
i. Contact information ► including name, surname,
address(es), telephone number(s), email address(es), and
ii. Our correspondence ► where we are contacted by you
or a Student you are responsible for, we will keep a record of that
correspondence;
iii. Website and
communication usage ►
details of visits to our websites and information collected through cookies and
other tracking technologies including, but not limited to, IP address and
domain name, browser version and operating system, traffic data, location data,
web logs and other communication data, and the resources that are accessed;
iv. Information you have
provided to us ►
any additional information that you may provide to us, such as through
completing enquiry or feedback forms;
v. Security purposes – CCTV use ► Image.
Students personal data
(a) Biographical and identification
information ►
including name, gender, nationality, date and place of birth, passport and
national identity information;
(b) Student information ► this includes admission
information (e.g. tests scores), start date, year group, class information,
school ID, grades, notes, timetables, transport routes, photographs and
communications with Parents or Guardians, teachers and other Students and
information relating to reports made by/concerning Student (e.g. bullying
reports etc).
(c) To manage the Student’s academic, sporting and
boarding timetable and to provide access to the School’s communication networks ► to schedule the
Student’s activities and provide access to the School’s intranet and other
information storage communication tools;
Lawful
Bases: contract performance; legitimate interests (to
enable us to perform our obligations and provide our services)
(d)To develop and support Students ► To assess and coach
Students through dialogue and record keeping and suitability for current and
future internal and external opportunities. This may in certain limited
circumstances include Special Categories of Personal Data, in the form of
religious beliefs (where required), so that Students can observe
religious/cultural practices, customs and/or celebrations.
Lawful
Bases: contract performance; legitimate interests (to
enable us to perform our obligations and provide our services). In the limited
circumstances where we need to process Special Categories of Personal Data we
will rely on explicit consent
(e) To provide a safe and healthy environment for
Students and staff ► this may in certain limited circumstances include
Special Categories of Personal Data such as:
* Health data, comprising information relating to any injury
a Student may sustain at School or whilst undertaking an extra-curricular
activity; any disability; health conditions relevant to education; and any
health problems that could affect the ability to learn. We use this data to
make suitable provision and adjustments relating to the management of
disabilities, allergies, illnesses and injuries, including the provision of
such information to third parties such as insurers or medical professionals
where appropriate;
Lawful
Bases: contract performance;
(f) To conduct extra-curricular programs ► to
organise, administer and operate extra-curricular expeditions and activities,
including processing payment, which may include passing Personal Data to third
parties for relevant insurance cover, medical assistance, supervision and
execution of activities;
Lawful
Bases: contract performance; legitimate interests (to
enable us to perform our obligations and provide our services)
(g) To report back to Parents and Guardians on
Students ► To
provide reports and note correspondence on Students’ progress, opportunities
and any issues. In conjunction with Students, Parents or Guardians, liaise with
other bodies (educational, sporting or any other sector) in relation to Students;
Lawful
Bases: contract performance; legitimate interests (to
enable us to perform our obligations and provide our services)
(h) To provide newsletters and marketing
materials ► to
provide you and any Students you are responsible for with updates and offers
relating to our products and services, where you have chosen to receive these.
Where required by law, we obtain consent to conduct this marketing activity. We
will provide an option to unsubscribe or opt-out of further communication on
any electronic marketing communication sent to you or you may opt out by
contacting us;
Lawful
Bases: legitimate interests (to promote our services);
consent
(i)To provide data to Educational System (SIO) ►to public authority
Lawful
Bases: legal obligation (Prawo oświatowe).
(j) To ensure that we are paid ► where required, to
recover any payments due to us and where necessary to enforce such recovery
through the engagement of third party debt collection agencies or taking legal
action (including the commencement and carrying out of legal and court
proceedings);
Lawful
Bases: contract performance; legal claims; legitimate
interests (to ensure that we are paid for our services)
(j) To improve our services ► to analyse Personal Data in
order to better understand your requirements, or those of any Student you are
responsible for. This will assist us in tailoring and developing the services
we offer;
Lawful
Bases: legitimate interests (to allow us to improve our
services)
(k) To monitor certain activities ► to monitor communications to ensure
compliance with our internal procedures and any legal requirements;
Lawful
Bases: legal obligations; legal claims; legitimate interests
(to ensure that the quality and legality of our services)
(l) To ensure website content is relevant ► to ensure that content from our
websites are presented in the most effective manner for you and any Student you
are responsible for;
Lawful
Bases: contract performance; legitimate interests (to allow
us to provide the content and services on the websites)
(m) To reorganise or make changes to our
business ► In
the event that we are (i) subject to negotiations for the sale of our business
or part thereof to a third party, (ii) is sold to a third party or (iii)
undergo a re-organisation, we may need to transfer some or all of your and your
Student(s)’Personal Data to the relevant third party (or its advisors) as part
of any due diligence process or transferred to that re-organised entity or
third party and used for the same purposes as set out in this PICS or for the
purpose of analysing any proposed sale or re-organisation;
Lawful
Bases: legitimate interests (in order to allow us to change
and develop our business)
(n) In connection with legal or regulatory
obligations ► We
may process your personal Data or that of any Student you are responsible for
to comply with our regulatory requirements or to engage in dialogue with our
regulators. This may include disclosing that Personal Data to third parties,
the court service and/or regulators or law enforcement agencies in connection
with enquiries, proceedings or investigations by such parties anywhere in the
world or where compelled to do so. This could include processing of Criminal
Conduct Data;
Lawful
Bases: legal obligations; legal claims; legitimate
interests (to cooperate
(o) Information you have provided to us ► any additional information that
a Student may provide to us, such as through completing enquiry or feedback
forms.
In certain very limited circumstances, it may also include
the following Special Categories of Personal Data:
o Health/medical information
comprising information relating to any injury a Student may sustain at School
or whilst undertaking an extra-curricular activity; any disability; health
conditions relevant to education; and any health problems that could affect the
ability to learn, so that we can maintain a safe environment for all Students;
o Religious beliefs, ethnicity and
race, so that Students can observe religious/cultural practices, customs and/or
celebrations; and
o Photographs of Students, so that
we can identify them for security purposes. We do not use these photos
for any other purpose. Sometimes we can offer the option to include
photographs on marketing materials or social media, but we will not do this
without first obtaining consent for the specific use.
You can find out more about this processing here: Use
of Special Categories of Personal Data
Where we collect Personal Data from
We may obtain Personal Data from you as a Parent
directly and about the Candidate for Student
directly (in cases where they are aged 18) and from you
2. How we use your Personal Data?
Your Personal Data (and that of any Student you are
responsible for) will only be processed where we have a specific purpose, and a
lawful basis, for doing so. These purposes and bases are listed below. An
explanation of the scope of the grounds available can be found here Lawful
Bases.
(a) Purpose of processing
Data stated in point 2.1.2 i-v In connection with legal
or regulatory obligations ►
We may process your personal Data or that of any Student you are
responsible for to comply with our regulatory requirements or to engage in
dialogue with our regulators. This may include disclosing that Personal Data to
third parties, the court service and/or regulators or law enforcement agencies
in connection with enquiries, proceedings or investigations by such parties
anywhere in the world or where compelled to do so.
Lawful bases: legal obligations;
legitimate interests (to cooperate with law enforcement and regulatory and
public authorities).
Data stated in point 2.1.2 i-v in connection with
processing possible legal claims
Lawful bases: legal obligations, and
in case of special categories of personal data based for the establishment,
exercise or defence of legal claims
Data stated in point 2.1.2.v in connection with
CCTV camera use for security purposes.
Lawful bases: legitimate
interests.
(b) Purpose of processing of
Parents Data stated in point 2.1.1 i – vi to:
Data stated in point 2.1.1 i and ii To ensure that we are
paid ► where
required, to recover any payments due to us and where necessary to enforce such
recovery through the engagement of third party debt collection agencies or
taking legal action (including the commencement and carrying out of legal and
court proceedings);
Lawful bases: contract performance;
legitimate interests (to ensure that we are paid for our services)
(c) Data stated in point 2.1.1 i –
for contact with the School ►
for the purpose of getting know the results of a child, for emergency contact,
for inviting for events
Lawful bases: legitimate interests
(d) Data stated in point 2.1.1 iv
To improve our services ►
to analyse Personal Data in order to better understand your requirements, or
those of any Student you are responsible for. This will assist us in tailoring
and developing the services we offer;
Lawful bases: legitimate interests (to
allow us to improve our services)
(e) Data stated in point
2.1.1 iii, iv To monitor certain activities ► to monitor communications to ensure compliance
with our internal procedures and any legal requirements;
Lawful bases: legitimate interests (to
ensure that the quality and legality of our services)
(f) Data stated in point
2.1.1. iii, iv. v To ensure website content is relevant ► to ensure that content from our
websites are presented in the most effective manner for you and any Student you
are responsible for;
Lawful bases: legitimate interests (to
allow us to provide the content and services on the websites)
(g) Data stated in point 2.1.1 i,
ii To reorganise or make changes to our business ► In the event that
we are (i) subject to negotiations for the sale of our business or part thereof
to a third party, (ii) is sold to a third party or (iii) undergo a
re-organisation, we may need to transfer some or all of your and your
Student(s)’Personal Data to the relevant third party (or its advisors) as
part of any due diligence process or transferred to that re-organised entity or
third party and used for the same purposes as set out in this PICS or for the
purpose of analysing any proposed sale or re-organisation;
Lawful bases: legitimate interests (in
order to allow us to change and develop our business)
(h) Data stated in point 2.1.1 i-v
In connection with legal or regulatory obligations ► We may process your personal
Data to comply with our regulatory requirements or to engage in dialogue with
our regulators. This may include disclosing that Personal Data to third parties,
the court service and/or regulators or law enforcement agencies in connection
with enquiries, proceedings or investigations by such parties anywhere in the
world or where compelled to do so.
Lawful bases: legal obligations;
legitimate interests (to cooperate with law enforcement and regulatory and
public authorities).
(i) Data stated in
point 2.1.1 iv To manage our websites ►
We use cookies on our websites. To find out more about how we use cookies,
please see our Cookies Policy.
(j) Data stated in
point 2.1.1 i-iv in connection with processing possible legal claims.
Lawful bases: legal obligations;
legitimate interests
(k) Data stated in point
2.1.1.vi in connection with CCTV camera use for security purposes.
Lawful bases: legitimate
interests.
Sharing Personal Data with other organisations
In order to provide our education and schooling services
(including extra-curricular activities) effectively, we sometimes need to share
information with other organisations. We share information with the following
entities:
(a) School
(b) Headquarter
and our Regional Office Teams (identified at Contacting
us) which undertake management functions; and
(c) Our
suppliers, who assist us in providing educational and extra-curricular
services. A list of our suppliers can be provided upon request by Contacting
us.
(d) Authorities based
on the provision of law
(e) Where these
entities are outside of the EEA, we ensure that there are adequate safeguards
in place to ensure the security of your Personal Data. See Export
of data outside of the EEA for more information.
Where these entities are outside of the EEA, we ensure that
there are adequate safeguards in place to ensure the security of your Personal
Data. See Export of data outside of the EEA for
more information.
Provision of data
Provision of data of those who submit them directly, i.e. as
the case may be with Parents or Students age 18, is a statutory/contractual
requirement or a requirement necessary to enter into contract. Provision of
data is needed to ensure the purpose of the processing – participation of
a Student in the recruitment process to the School and Parents data in
order to enable such process for the admission to School or in order to perform
agreements with School for those who has
been admitted to School. Lack of provision of data will make impossible to
perform the aim of the processing.
3. Use of Special Categories of Personal Data?
As a general rule, we do not process Special Categories of
Personal Data However, in order to assess the ability to learn in the enrolment
process – recruitment process to School in certain very limited circumstances,
required to collect, process and disclose Special Categories of Personal Data
of Students:
Health/medical information comprising information relating
to any injury of a Student may sustain at School or whilst undertaking an
extra-curricular activity; any disability; health conditions relevant to
education; and any health problems that could affect the ability to learn, so
that we can maintain a safe environment for all Students;
In addition to the usual appropriate technical and
organisational measures we implement to ensure the security and integrity of
the personal data processed by us, we may implement additional measures in
relation to Special Categories of Personal Data, as appropriate. These may
include segregation, pseudonymisation or restriction of access to the data.
Where we must process Special Categories of Personal Data,
we will do so on the following lawful bases (see Lawful Bases for
more information):
|
Special Category
|
Lawful bases / condition for processing
|
|
Health/medical information
|
Explicit Consent
|
|
Religious beliefs, ethnicity and race
|
Explicit Consents
|
Consent
Where a Student is under the age of 18, we will obtain
explicit consent from a Parent/ responsible for a Student, on his/her behalf.
This consent will remain valid until it is withdrawn by the Parent/ who
provided it, or the Student, provided that:
(a) A
Student is age 18 to withdraw consent and
(b) Withdrawal
of consent does not have a prejudicial impact on the interests Student.
In any instance where a Student under the age of 18 who was
deemed to be capable of providing consent later withdraws that consent against
his/her own best interests, we may revert to a
Parent/Guardian to obtain consent on his/her behalf.
We will obtain consent directly from any Student who is age
of 18.
4. Transmission, storage and security of Personal Data
Security over the internet
No data transmission over the Internet or through a website
can be guaranteed to be secure from intrusion. However, we maintain
commercially reasonable physical, electronic and procedural safeguards to
protect your Personal Data, and that of any Student you are responsible for, in
accordance with data protection legislative requirements.
All information you, or any Student you are
responsible for, provide to us is stored on our or our suppliers’ secure
servers and accessed and used subject to our security policies and standards.
We ask that you, or any Student you are responsible for:
(a) Refrain from sharing any password providing
access to certain parts of our websites, applications or systems with any other
person; and
(b) Comply with any other security procedures
that we may notify you of from time to time.
Export outside the EEA
Your Personal Data, or that of any Student you are
responsible for, may be transferred to, stored in or accessed by staff or
suppliers in, a destination outside the European Economic Area (EEA).
Regardless of location, we will impose the same data protection safeguards that
we deploy inside the EEA.
Certain countries outside the EEA have been approved by the
European Commission as providing essentially equivalent protections to EEA data
protection laws and therefore no additional safeguards are required to export
Personal Data to these jurisdictions. In countries which have not had these
approvals, (see the full list here http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm)
we will transfer it subject to European Commission approved contractual terms
that impose equivalent data protection obligations directly on the recipient
unless we are permitted under applicable data protection law to make such
transfers without such formalities.
Please contact
us if you would like to see a copy of the specific safeguards applied
to the export of Personal Data relating to you or any Student you are
responsible for or you would like to receive a copy of data or information on
the place of making data available.
Storage limits
We will Personal Data for as long as is necessary for the
processing purpose(s) for which they were collected – educational process,
archiving purposes and any other permitted linked purpose until the time limit
for claims. So if Personal Data is used for two purposes we will retain it
until the purpose with the latest period expires; but we will stop using it for
the purpose with a shorter period one that period expires. We restrict access
to Personal Data to those persons who need to use it for the relevant
purpose(s).
Our retention periods are based on business needs and
relevant laws, especially as regards the specific retention periods that may
apply for School. Records that are no longer needed are either
irreversibly anonymised (and the anonymised information may be retained) or
securely destroyed.
5. Rights relating to Personal Data
Be aware of the rights that Data Subjects have in
relation to their Personal Data
Data Subjects have a number of rights relating to how their
personal data is used. Please be aware that certain exceptions apply to the
exercise of these rights and so you will not be able to exercise them in all
situations. In addition, these will vary slightly between EU member states. If
you wish to exercise any of these rights we will check your entitlement and
respond within a reasonable timescale.
Students at the age of 18 may be able to exercise these
rights independently,
Where applicable, you, Parents will have the following
rights relating to your Personal Data or the Personal Data of a Student you are
responsible for :
Subject Access: ►
Be provided access to any Personal Data held about you/a a Student you are
responsible for, by TBS. This information will generally be provided within one
month of us confirming your identity and understanding the scope of your
request
Erasure: ►
Require us to erase Personal Data in certain circumstances. If the Personal
Data has been made public, reasonable steps will be taken to inform other
controllers that are processing the data that you have requested the erasure of
any links to, copies or replication of it.
Withdrawal of consent: ►
Withdraw any consents to processing that you have given us or that have been
given on your behalf and prevent further processing, if there is no other
ground under which we can rely to process your Personal Data. The withdrawal of
consent shall not affect the lawfulness of processing based on consent before
its withdrawal.
Restriction: ►
Require certain Personal Data to be marked as restricted in some circumstances,
for example, whilst we resolve any complaint we may have received. Restriction
means that whilst we still store the data, we will not process it until such
time as the restriction may be lifted.
Portability: ►
In case the processing is based on a consent or performance of an agreement,
have a copy of any Personal Data you have provided to us returned to you, or
transmitted to another controller in a commonly used, machine readable format.
Prevent processing: ►
Require TBS to stop any processing based on the legitimate interests ground
unless TBS’s reasons for undertaking that
processing outweigh any prejudice to your data protection rights.
Marketing: ►
Require TBS to prevent processing of your Personal Data for direct marketing
purposes. For marketing please see a separate PICS.
Raise a complaint: ►
Complain to your local Data Protection Authority about our processing of your
Personal Data.
If you have any queries relating to your
rights or exercis of your rights, please contact the Data Protection Officer
at: DPO@thebritishschool.pl
6. Changes to our PICS and/or Cookies
Policy
Our PICS and our Cookie Policy may change from time to time
in the future. We therefore encourage you to review them when you
visit the website from time to time to stay informed of how we are using Personal Data.
This PICS was last updated on updated on 24th May
2018.
7. Lawful Bases
Use of Personal Data under EU data protection laws must be
justified under one of a number of Lawful bases and we are required to set out
the Lawful bases in respect of each use in this policy. We note the Lawful
bases we use to justify each use of your information here: How we
use your Personal Data.
These are the principal Lawful bases that justify our use
of your Personal Data:
|
Consent: You have given your consent to
the processing of those personal data for one or more specified purposes. You
are free to withdraw your consent by contacting
us. Where you do so, we may be unable to provide a service that requires
the use of such data.
|
|
Contract performance: where your
information is necessary to enter into or perform our contract with you.
|
|
Legal obligation: where we need to use
your information to comply with our legal obligations.
|
|
Legitimate interests: where we use your
information to achieve a legitimate interest and our reasons for using it
outweigh any prejudice to your data protection rights.
|
|
Legal claims: where your information is
necessary for us to defend, prosecute or make a claim against you, us or a
third party.
|
These are the principal Lawful bases that justify our use of
Special Categories of your Personal Data, in the limited circumstances where it
is necessary to do so:
|
Explicit consent: You have given
your explicit consent to the processing of those personal data for one or
more specified purposes. You are free to withdraw your consent by contacting
us. Where you do so, we may be unable to provide a service that requires
the use of such data.
|
|
Protection of vital interests of you or another
person, where you are unable to consent: Processing is
necessary to protect the vital interests of you or of another natural person
where you are physically ore legally incapable of giving consent.
|
|
For legal claims: Processing is
necessary for the establishment, exercise or defence of legal claims or
whenever courts are acting in their judicial capacity.
|
|
In the substantial public interest: Processing
is necessary for reasons of substantial public interest,
on the basis of EU or local law.
|
8. Definitions
The following terms are used in this PICS:
Data Controller: this is the person which alone
or jointly with others determines the purpose and means of the processing of
Personal Data. The School is the Data Controller of all employment details used
in its business.
Data Subject: for the purpose of this policy
this includes all living individuals about whom we hold Personal Data,
including employees, Students, Parents or Guardians, suppliers and business
partners. A Data Subject need not be a national or resident of the country the
concerned the School business is based in. Within the EU, all Data Subjects
have legal rights in relation to their Personal Data.
Data Processor: this is the person which
processes Personal Data on behalf of the Data Controller (not including
employees of the Data Controller). the School’s suppliers and agencies that
handle Personal Data on our behalf will be Data Processors.
Parents: this means any parents or guardians
responsible for a Student.
The School, Our, Us, We, School: Brytyjskie
Liceum Ogólnokształcące The British School (IB Diploma
School)and Brytyjska Szkoła Podstawowa The British School No 91 (Primary
School with the Pre-School division) listed on the contact page of our
website).
Personal Data: this is defined as any information
relating to an identified or identifiable natural person. An identifiable
person is one who can be identified (either directly or indirectly) by
reference to an 'identifier'. These include names, ID numbers, location data,
online identifiers or one or more factors specific to the physical,
psychological, genetic, mental, economic, cultural or social identity of that
person.
Regional Office Teams: Nord Anglia International
School LLC, a company established in Dubai, the United Arab Emirates with its
registered address at Office No. 001, Level 100, Arenco Tower, Media City,
Dubai; Collège Champittet SA a company incorporated in Switzerland with its
registered address at Chemin de Champittet, c/o Collège Champittet; and Nord
Anglia Education Limited, a company established in England and Wales with its
registered address at 6th Floor, 18 King William Street, London, United
Kingdom, EC4N 78P.
Special Categories of Personal Data: this type
of data is, in the EU and some other countries, subject to more stringent
processing conditions than other Personal Data and in the EU includes Personal
Data which reveals racial or ethnic origin, political opinion, religious or
philosophical beliefs, trade-union membership, and the processing of genetic
data, biometric data in order to uniquely identify a person or data concerning
health, sex life and sexual orientation. Data concerning health covers Personal
Data relating to the physical or mental health of an individual which reveals
information about the individual's health status. In the EU, Personal
Data relating to criminal convictions or offences or related
security measures may only be processed when
authorised by Member State or EU law. If in doubt, please contact the Data
Protection.
9. Contact Us
Please contact the Data Protection Officer at: Jeremy Buss,
Ul. Limanowskiego 15, 02-790 Warsaw, Poland
DPO@thebritishschool.pl
