We wish to inform you that on 25.05.2018 the Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 has begun taking effect on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and repealing Directive 95/46 / EC, published in the Official Journal of the European Union L 119 (4.5.2016).
As a European regulation, it applies directly and uniformly in all E.U. Member States in order to strengthen and unify the security policies in the online environment, but also for the betterment of personal data protection for all European citizens and its residents.
OLGA GUDYNN INTERNATIONAL SCHOOL S.R.L. (OGIS) has taken all necessary measures to strictly comply with the legal dispositions and provisions on the protection of natural persons with regard to the processing of personal data and the free movement of such data.
Respect for privacy and personal data protection are fundamental principles to which our institution gives great importance and attention, for the reason that without their understanding, awareness and implementation, OGIS’ current activity cannot conform to the previously mentioned European Regulation.
OGIS processes personal data of its prospective students, former and current students and parents or their legal representatives, throughout its daily operations to provide educational services and education, in accordance with Regulation (EU) 2016/679 – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
For these purposes, OGIS acts as an operator with respect to personal data (Personal Data), which means that OGIS establishes the purposes and the means of processing personal data.
Pertaining to this Notice of Information, please note that the term “processing” represents any operation performed on data of personal nature, whether or not it is made by automatic means, such as collection, recording, storage, adaptation or alteration, consultation, use, disclosure by any means, deletion or destruction.
OGIS wishes complete transparency with regard to the processing of data personal in nature and as such we present you with all the necessary information pertaining to this topic.
We hereby request that you read through this Notice of Information for a complete understanding of the OGIS data processing operations.
- The purposes for which OGIS processes your personal data
OGIS processes data relating to you or your child as a student within OGIS for the following purposes:
- Providing educational services: starts with the application and admission process, preparing pupils, assigning pupils to classes, elaborating the calendar with activities and artistic and educational events, activities related to the instructive-educational process, administration of internal and public examinations;
- Providing auxiliary educational services: personal guidance, focus on areas of interest and personal counseling, library services, extracurricular activities, school tours, publications and projects belonging to OGIS;
- Ensure the security of educational establishments, monitor access to these locations and video surveillance;
- Provide medical care that students may need and advice in this regard;
- School administration: document manipulation, student records and other forms, administration of school fees and accounts, internal audits and controls, reporting and statistics, creation, implementation of school policies, collaboration with other schools, archiving, OGIS quality assessment, facilitating development and research activities;
- Ensuring communication: transmission of different messages relating to students and OGIS activities by any means of communication;
- Organizing of fundraising and other school events (e.g. concerts, theater plays, talent shows, charitable and environmental activities), including marketing communications related to fundraising activities organized by OGIS;
- Dispute settlement and management.
2. The categories of personal data that OGIS processes include but are not limited to the following
- Identification and contact information (name, surname, nationality, address, information included in I.D. / passport, telephone number, e-mail address, etc.); bank details;
- Health related data: medical history, allergies, immunization records, psycho-motor disorders, medical exam results and other student medical data;
- Educational background data and data related to the pupil’s personal progress and school performance: academic, disciplinary or other related results on record, academic references, special needs, hobbies, evaluation test results, etc.;
- Behavior data as well as data on student preferences/interests;
- Family information: the spoken language at home, the profession and work place of the parents, their civil status, the names, surnames and telephone numbers of relatives or persons of contact designated by the student’s parents, etc.;
- Photos and video recordings.
Personal data retained by OGIS was provided directly by parents or have resulted from the direct interaction of parents and students with OGIS institutions.
3. The legal basis for OGIS personal data processing operations collects and further processes personal data on the basis of one of the following legal bases expressly provided by GDPR:
- The consent you have
agreed to grant us prior to processing any personal data for:
- use of photos and videos of students in various school publications, on the OGIS website and its social media pages;
- use of contact information to provide information via e-mail, SMS, telephone, Facebook social media platforms, Instagram, website, YouTube, brochures, magazines, flyers, posters, promotional materials or other forms advertising on school, extracurricular, fundraising and other artistic, ecological and humanitarian events (e.g. concerts, theater plays, excursions, camps, exhibitions, talent shows, charitable and environmental events, etc.);
- Other types of consent granted for other occasional varied processing activities.
- Initiating proceedings for evaluating the admission and enrollment procedures of the commencement of the schooling contract or for the cessation and termination of the schooling contract. Please note that there are some compulsory personal data categories required for OGIS to adhere to in order to complete the admission and enrollment procedure and to provide students with high-quality educational services in their interest. Mandatory categories of personal data are included in the enrollment form and in the enrollment documents (enrollment form, internal regulation policy, tuition agreement). Please note that all mandatory data categories are required for OGIS to be able to evaluate your application and ultimately to register your child. Failure to provide all mandatory information will result in OGIS being unable to process your application and to enter into a contract with you;
- OGIS legal obligation to process personal data (for example video surveillance in certain situations such as examinations);
- Fulfillment of a task of public interest, given that OGIS provides educational services, considered as a service of public interest, in accordance with the applicable Romanian legislation on education, many of the processing operations carried out by OGIS, which are strictly related to educational purposes will be based on this legal basis for processing. Here we mainly refer to: issuing and storing academic records, assessing student performance, etc.;
e) Legitimate interest pursued by OGIS.
OGIS functions according to this legal basis in order to provide educational services that it has undertaken to provide together with additional services related to this field of application, at high quality standards, always for the benefit of students and without affecting the rights and freedoms of students and parents.
OGIS may invoke judicial motive of legitimate interest in the following cases:
- monitoring and ensuring the security of individuals, premises and private property;
- performing fundraising activities, including advertising such activities, and marketing of certain products strictly related to these events;
- execution of legal claims, complaints and by third party quality controls;
- management quality control, reporting and performance of OGIS activity statistics;
- ensuring security;
- maintaining close relationships with graduates and the OGIS community;
- collaboration with other schools and educational institutions in the country and abroad in order to develop educational partnerships and exchanges of experience;
- agreements with OGIS suppliers and collaborators;
- access to grants and other sources of funding.
With regard to the processing of special categories of personal data under the GDPR regulation or health data, please note that OGIS processes health-related data on the following legal grounds:
- The need for such data to be processed by health professionals at OGIS for the purpose of exercising preventive medicine, medical diagnosis and providing health, medical care or treatment services under the EU or national legislation;
- Processing is necessary for reasons of the greater public interest, based on European Union or national legislation. Such a legal basis is especially used in those situations where OGIS needs to assess a student’s learning abilities and adapt teaching activities to their own pace and special needs;
- Your explicit consent granted to keep the student’s personal data regarding allergies, intolerance or other medical conditions from which they suffer from on record.
4. Disclosure of personal data
OGIS discloses your personal data or that of your child only to those OGIS members, staff and collaborators who need access to personal data, primarily to ensure the provision of educational and auxiliary services. In this regard, please note that only medical professionals and directors at OGIS headquarters have access to student medical data. Other departments of OGIS units have access to specific health data based on the consent you have expressed (e.g. for allergies) or to protect a substantial public interest under European Union or national legislation (e.g. miscellaneous medical conditions triggering special learning needs).
With regards to the disclosure of personal data to third parties outside OGIS, please note that such disclosure is only made in the day-to-day business of OGIS. The categories of recipients include the following:
- IT and hosting vendor server suppliers;
- other educational institutions or organizations, not limited to other schools;
- travel agencies, catering and transportation providers;
- OGIS photographer and video crew;
- courier service providers;
- public, national or foreign authorities and institutions, foreign courts and embassies;
- Tax, legal and accounting consultants, lawyers;
5. Transfers to / from third party countries
OGIS transfers personal data to third party countries as follows:
- EU Member States or the United Kingdom of Great Britain and Northern Ireland, where international experiences, camps, competitions and international projects (eg ERASMUS) are organized.
6. Retention of personal data
OGIS retains all personal data for as long as you are in a contractual relationship with us and afterwards for a standard 5-year period, for which OGIS may justify a need in the storage of such personal data. OGIS keeps the student file and all data related to student interaction with OGIS, mainly for the scope of school activity evaluation and the quality of services provided, as well as for requesting students’ progress report in OGIS, which usually appear after the students have graduated.
Without prejudice to the retention period mentioned above, we inform you that all records of academic results and other school documents and related documents are kept for an indefinite period of time in accordance with OGIS’s legal obligations to do so. Where a legal provision imposes a minimum retention period, OGIS will retain personal data for at least that mandatory period of time.
7. Your rights regarding the nature of personal data processing by OGIS
GDPR provides for certain rights related to the processing of personal data that both you and your children, as students, have. In this regard, we inform you that students who have an adequate level of understanding could exercise the rights listed in this section individually.
OGIS respects all the rights set out in the GDPR and undertakes to provide you with the appropriate means necessary to exercise these rights in accordance with the information below:
- The right of access, which entails the possibility to obtain confirmation from OGIS if your personal data is processed by OGIS or not, and if applicable you may have access to this data as well as additional information pertaining to personal data, such as: the purposes of the processing, the categories of recipients. Personal data and the expected retention period disclosed. Should you consider to exercise your right of access, please consider contacting OGIS and request confirmation by e-mail at email@example.com. Please note that there may be specific situations that are exempted from the right of access, such as information that identifies other persons or are subject to confidentiality obligations.
- The right to data rectification, which allows you to request OGIS to rectify, inaccurate, incomplete or to be updated personal data in OGIS possession.
- The right to deletion of the data, which means that in situations governed by law, you may request the deletion of your personal data. Please note that the current law provides you with the possibility delete personal data in situations where processing is illegal or where processing is based on a previous consensual agreement you have withdrawn.
- The right to restrict processing, which means the right to obtain a restriction on the processing of personal data by OGIS. Please note that this right may only be exercised in specific situations established by the GDPR, such as when the accuracy of personal data is being challenged. During the necessary time frame in which OGIS rectifies data, you may request OGIS to restrict the processing of personal data.
- The right to data portability involving the right to receive personal data in a structured, commonly used and automated format that can be read further to transmit this data to another operator. This data portability right applies only to personal data you have provided us with and when processing is complete by automated means based on your consent or the execution of the contract you have entered into with OGIS.
- The right to object to the processing of personal data by OGIS for reasons related to a special situation. The right of opposition applies in situations where OGIS relies on consent as the legal basis for processing (for example, using the email address for the transmission of fundraising messages)
- The right to lodge a complaint designates the right to challenge how OGIS carries out the processing of your personal data by the competent data protection authority.
- The right to withdraw the consent granted for various processing operations, in cases where the agreement is the legal basis for processing. If you withdraw your consent to the processing of your personal data, please note that the processing will terminate when the withdrawal takes place without any effect on the processing that took place prior to such prior withdrawal.
8. Creating Profiles
OGIS does not create profiles by automatic means based on personal data that relates to students.
9. Video Surveillance
OGIS has implemented a video surveillance system on its premises to ensure the security of students, staff and all other people entering the premises. The security and well-being of our students is our primary concern, and these video surveillance systems offer and allow real-time protection.
All areas covered by a video surveillance system are labeled in OGIS headquarters via specific posters, informing you about OGIS video surveillance.
10. Point of Contact
In the event that you may wish to exercise any of the rights listed in paragraph 7 of this notice, comments, obtain further information or clarification on the subject matter of your personal data processing, please contact OGIS via its Designated Data Protection Officer for ensuring that OGIS complies with all GDPR requirements.
Contact details of the OGIS Data Protection Officer:
E-mail address: firstname.lastname@example.org