STUDENT & PARENTS PRIVACY NOTICE & CONSENT
By this Privacy Notice a Data Controller Ljubljana International School (Mednarodna šola Ljubljana, Štihova ulica 13, 1000 Ljubljana), e-mail: firstname.lastname@example.org (hereinafter: “Data Controller”) informs you about treating and processing child’s and parents’ / guardians’ personal data (hereinafter: “Data”) when your child is enrolled by the Data Controller.
Categories of personal data and Legal Basis for processing your Data:
- Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract agreement: personal name of the child and parents/guardians, address of the child and parents/guardians, date of birth of the child, nationality of the child and parents/guardians, information about possible health conditions that are important in respect of possible limitations, adjustments etc. in participating in school activities, school lunch etc., previous education of the child (schools, grades etc.); during work in class children may provide additional information necessary for preparation of certain products, their education and personal development (i.e. hobbies, interests, physical characteristics etc.); information about employer of the parent/guardian or company owned by the parent/guardian (only in case the employer or parents/guardian’s company shall pay the tuition).
- Processing is necessary for compliance with a legal obligation to which the controller is subject: personal name of the child and parents/guardians, address of the child and parents/guardians, date of birth of the child, nationality of the child and parents/guardians, information about possible health conditions that are important in respect of possible limitations, adjustments etc. in participating in school activities, school lunch etc., previous education of the child (schools, grades etc.).
- Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data: surveillance camera records and vaccination records (both for safety reasons); during work in class children may provide additional information necessary for preparation of certain products, their education and personal development (i.e. hobbies, interests, physical characteristics etc.).
- Based on your consent (you will be asked so sign a separate form regarding these): telephone number and e-mail of parents/guardians (in general for entire communication regarding enrollment of the child, in case of emergency, for sending newsletters, informing parents/guardians about important events, absence of a child etc.), photography (for use in the Outlook / Facebook / Instagram / yearbook / brochures / website / newsletters / ClassDojo / Moodle / Edmodo / Destiny / Schoology / other similar apps / presentations or other marketing material of a Data Controller), personal name of the child (for use in the Outlook / Facebook / Instagram / yearbook / brochures / website / newsletters / ClassDojo / Moodle / Edmodo / Destiny / Schoology / other similar apps / presentations or other marketing material of a Data Controller), registration number of the car (for the purpose of having the right to access the school parking).
Your consent may be withdrawn at any time by sending
Your Data will be stored and processed for as long as it: i) takes for the above stated purposes to be achieved; and/or ii) takes for possible claims/disputes to be finally resolved (expiration of statute of limitations or other relevant deadlines); and/or iii) until the permission is withdrawn (please note that this shall apply only in cases where Data Controller has no other legal basis for processing your Data); iv) and/or is determined by the law in cases when the law defines the retention period.
Categories of users and data processors
Individual personal data will be used by authorized individuals employed by the Data Controller who need certain personal data to perform their tasks.
Individual personal data may also be used by and/or transferred to and/or just insight will be possible to the following categories of users and/or data processors and/or data controllers: : i) external accounting ii) external lawyers and providers of legal services, iii) FURS (tax reporting); iv) external providers of administration services, v) court (in case of dispute), vi) hotels (when arranging staying at the hotel in case of field trips), vii) bus, airline, train carrier etc. (for transportation in case of business trips or field trips), viii) external organizers of events (sport events, cultural events, etc.), ix) external server providers; x) parents of other children (e.g. photo in a yearbook etc.); xi) some personal data will be provided during the class and children’s work will be placed on the wall, therefore those data will be seen to visitors coming to the school (it could be hobbies, height, weight, interests, photo etc.); xii) Universities (when a student or a former student request so); xiii) College board of the US(for the purpose of SAT); xiv) NWEA (for MAP testing (PSAT, AP)); xv) social security institutions; xvi) competent embassies and ministries, notary office, migration office and other competent authorities (if necessary when obtaining visa or for other purposes if stipulated by any law); xvii) GRASP grant; xviii) other online and virtual learning platforms and testing centers when and if applicable; xix) any other entity, organization, authority etc. that will prove an appropriate legal basis for obtaining certain personal data.
Transfer of data to countries which are not EU state members and/or EEC
Your Data may also be transferred (partially or entirely) to countries that are not EU state members and/or EEC and do not ensure the level of personal data protection that is common for EU and members of EEC. In such cases the Data Controller will always provide adequate protection by concluding appropriate agreements and obtaining necessary permissions and/or concluding special agreements and/or by choosing those organizations that are properly certified (e.g. Privacy Shield etc.).
You have a right: i) to request an access to your Data; ii) to request a rectification; iii) to request an erasure of personal data; iv) to request a restriction of processing; v) to object to processing; vi) to data portability; vii) to file a complaint with the supervisory authority, i.e. Republika Slovenija, Informacijski pooblaščenec, Zaloška cesta 59, 1000 Ljubljana.
You will be granted all protection and rights according to General Data Protection Regulation.