Personal Information Collection Statement ("PICS")
The British International School Bratislava, ("BISB") is committed to safeguarding Personal Data. This PICS is addressed to Parents or Guardians that are responsible for one or more prospective, past or present Students of any School managed or owned by Nord Anglia Education Hong Kong ("NAE") and situated in Slovakia. It explains how we collect and use your Personal Data and the Personal Data of each Student you are responsible for during the course of our provision of educational and related services to them.
If you are the Parent or Guardian of a Student who is, or becomes, competent to make their own decisions relating to the processing of their personal data, then you must provide a copy of this PICS to them. More information about provision and withdrawal of consent is set out at Consent.
This PICS is intended to explain our privacy practices and covers the following areas:
By providing your information, or the information of any Student you are responsible for (whether via our website, in person, in writing or over the phone) to us, you acknowledge the processing set out in this PICS. Further notices highlighting certain uses we wish to make of your Personal Data together with the ability to opt in or out of selected uses may also be provided to you when we collect Personal Data from you.
Some of the processing activities set out in this PICS are undertaken by our Schools. Other processing activities are undertaken by NAE HK itself, as the ultimate owner of the Schools, or by our Regional Offices as identified at Contact Us. The exact split differs between Schools, Students and over time. We can confirm which processing activities are undertaken by which entity on request.
This PICS only relates to processing undertaken by or on behalf of NAE. Whilst our websites may contain links to other third party websites, please note that we do not accept any responsibility or liability for their policies in relation to any Personal Data or their collecting and processing of any Personal Data.
What Personal Data do we process?
We may collect and process the following Personal Data about you and any Student you are responsible for:
- Biographical and identification information: including name, surname, gender, nationality, date and place of birth, details of family members, passport and national identity card information;
- Contact information: including address(es), telephone number(s), email address(es), emergency contacts;
- Student information: this includes admission information (e.g. tests scores), start date, year group, class information, school ID, grades, notes, timetables, transport routes, photographs and communications with Parents or Guardians, teachers and other Students and information relating to reports made by/concerning Student (e.g. bullying reports etc).
A subset of this information will be shared with the Ministry of Education of the Slovak Republic, to meet our statutory obligation to provide information relating to our Students to the central register administered by it.
In certain very limited circumstances, we may also process Criminal Conduct Data (so that we can deal with serious behavioural issues and authorities appropriately) and the following Special Categories of Personal Data and Photographs of Students:
- Health/medical information comprising information relating to any injury a Student may sustain at School or whilst undertaking an extra-curricular activity; any disability; health conditions relevant to education; and any health problems that could affect the ability to learn, we may process the Personal Data only in necessary extent so that we can maintain a safe environment for all Students;
- Religious beliefs, so that Students can observe religious/cultural practices, customs and/or celebrations; and
- Photographs of Students, so that we can identify them for security purposes.
You can find out more about this processing here: Use of Special Categories of Personal Data and Criminal Conduct Data.
- Payment information: including bank account and credit/debit card information;
- Our correspondence: where we are contacted by you or a Student you are responsible for, we will keep a record of that correspondence;
- Website and communication usage: details of visits to our websites and information collected through cookies and other tracking technologies including, but not limited to, IP address and domain name, browser version and operating system, traffic data, location data, web logs and other communication data, and the resources that are accessed;
- Information you have provided to us: any additional information that you or a Student you are responsible for may provide to us, such as through completing enquiry or feedback forms.
Where we collect Personal Data from
We may obtain Personal Data from you (or any Student you are responsible for) directly, or from third parties such as other educational or sporting institutions, credit reference and anti-fraud agencies, sanctions and politically exposed persons screening lists, our business partners and public registers.
How we use your Personal Data
Your Personal Data (and that of any Student you are responsible for) will only be processed where we have a specific purpose, and a lawful basis, for doing so. An explanation of the scope of the grounds available can be found in section Lawful Bases. These purposes and lawful bases are listed below.
- To select, onboard and enrol Students: We use the Personal Data in order to process application forms, tests, interviews, travel arrangements and all activities relating to the Student’s enrolment in a School. This may, in certain limited circumstances, include Special Categories of Personal Data, photographs of Students for identification and security purposes; or Criminal Conduct Data, for understanding the background and needs of potential Students;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services). In the limited circumstances where we need to process Special Categories of Personal Data or Criminal Conduct Data, we may also rely on explicit consent, legal claims or (in the case of Criminal Conduct Data only) substantial public interest.
- To manage the Student’s academic, sporting and boarding timetable and to provide access to the School’s communication networks: We use the Personal Data in order to schedule the Student’s activities and provide access to the School’s intranet and other information storage communication tools;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services).
- To develop and support Students: We use the Personal Data in order to assess and coach Students through dialogue and record keeping and suitability for current and future internal and external opportunities. This may in certain limited circumstances include Special Categories of Personal Data, such as religious beliefs, so that Students can observe religious/cultural practices, customs and/or celebrations.
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services). In the limited circumstances where we need to process Special Categories of Personal Data we may also rely on explicit consent or legal claims
- To provide a safe and healthy environment for Students and staff: this may in certain limited circumstances include Special Categories of Personal Data and Photographs of Students:
- Health data, comprising information relating to any injury a Student may sustain at School or whilst undertaking an extra-curricular activity; any disability; health conditions relevant to education; and any health problems that could affect the ability to learn. We use this data to make suitable provision and adjustments relating to the management of disabilities, allergies, illnesses and injuries, including the provision of such information to third parties such as insurers or medical professionals where appropriate;
- Criminal Conduct Data, so that we can deal with serious behavioural issues and inform authorities if appropriate; or
- Photographs of Students, so that we can identify them onsite.
Lawful bases: contract performance; legal obligations; legitimate interests (to enable us to perform our obligations and provide our services).
In the limited circumstances where we need to process Special Categories of Personal Data (health data) we will rely on explicit consent or protection of the vital interests of you or another person (where you are unable to consent).
In the limited circumstances where we need to process Criminal Conduct Data or photographs of Students, we will on explicit consent.
- To conduct extra-curricular programs: to organise, administer and operate extra-curricular expeditions and activities, including processing payment, which may include passing Personal Data to third parties for relevant insurance cover, medical assistance, supervision and execution of activities;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services)
- To report back to Parents and Guardians on Students: To provide reports and note correspondence on Students’ progress, opportunities and any issues. In conjunction with Students, Parents or Guardians, liaise with other bodies (educational, sporting or any other sector) in relation to Students;
Lawful bases: contract performance; legitimate interests (to enable us to perform our obligations and provide our services)
- To provide newsletters and marketing materials: to provide you and any Students you are responsible for with updates and offers relating to our products and services, where you have chosen to receive these. Where required by law, we obtain consent to conduct this marketing activity. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by Contacting us;
Lawful bases: legitimate interests (to promote our services); consent
- To ensure that we are paid: where required, to recover any payments due to us and where necessary to enforce such recovery through the engagement of third party debt collection agencies or taking legal action (including the commencement and carrying out of court proceedings);
Lawful bases: contract performance; legal claims; legitimate interests (to ensure that we are paid for our services)
- To improve our services: to analyse Personal Data in order to better understand your requirements, or those of any Student you are responsible for. This will assist us in tailoring and developing the services we offer;
Lawful bases: legitimate interests (to allow us to improve our services)
- To monitor certain activities: to monitor communications to ensure compliance with our internal procedures and any legal requirements;
Lawful bases: legal obligations; legal claims; legitimate interests (to ensure that the quality and legality of our services)
- To ensure website content is relevant: to ensure that content from our websites are presented in the most effective manner for you and any Student you are responsible for;
Lawful bases: contract performance; legitimate interests (to allow us to provide the content and services on the websites)
- To reorganise or make changes to our business: In the event that we are (i) subject to negotiations for the sale of our business or part thereof to a third party, (ii) is sold to a third party or (iii) undergo a re-organisation, we may need to transfer some or all of your and your Student(s)’ Personal Data to the relevant third party (or its advisors) as part of any due diligence process or transferred to that re-organised entity or third party and used for the same purposes as set out in this PICS or for the purpose of analysing any proposed sale or re-organisation;
Lawful bases: legitimate interests (in order to allow us to change and develop our business)
- In connection with legal or regulatory obligations: We may process your personal Data or that of any Student you are responsible for to comply with our regulatory requirements or to engage in dialogue with our regulators. This may include disclosing that Personal Data to third parties (for example, our statutory duty to provide data for entry on the register administered by the Ministry of Education of the Slovak Republic), the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so. This could include processing of Criminal Conduct Data;
Lawful bases: legal obligations or legitimate interests (to cooperate with law enforcement and regulatory and public authorities).
In the limited circumstances where we need to process Special Categories of Personal Data or Criminal Conduct Data we may also rely on explicit consent, substantial public interest or legal claims.
We may also process personal data (including Special Categories of Personal Data or Criminal Conduct Data) where necessary in relation to the establishment, exercise or defence of legal claims.
Sharing Personal Data with other organisations
In order to provide our education and schooling services (including extra-curricular activities) effectively, we sometimes need to share information with other organisations. We share information with the following entities:
- NAE HK and our Regional Office Teams, which undertake management functions; and
- Our suppliers, who assist us in providing educational and extra-curricular services. A list of our suppliers can be provided upon request by Contacting us; and
- The Ministry of Education of the Slovak Republic, to meet our statutory obligation to provide information relating to our Students to the central register administered by it.
Where these entities are outside of the EU/EEA, we ensure that there are adequate safeguards in place to ensure the security of your Personal Data. See Export of data outside of the EU/EEA for more information.
Use of Special Categories of Personal Data and Criminal Conduct Data and Photographs
As a general rule, we do not process Special Categories of Personal Data or Criminal Conduct Data of Students, Parents or Guardians. However, in order to provide our education and schooling services (including extra-curricular activities) effectively to you and any Student you are responsible for, we are, in certain very limited circumstances, required to collect, process and disclose Special Categories of Personal Data and Photographs of Students, including but not limited to:
- Health/medical information comprising information relating to any injury a Student may sustain at School or whilst undertaking an extra-curricular activity; any disability; health conditions relevant to education; and any health problems that could affect the ability to learn, so that we can maintain a safe environment for all Students;
- Religious beliefs, so that Students can observe religious/cultural practices, customs and/or celebrations;
- Photographs of Students, so that we can identify them for security purposes.
Where necessary, we may also process Criminal Conduct Data, so that we can deal with serious behavioural issues and report to authorities appropriately. The exact purposes for which we process this Personal Data is set out at How we use your Personal Data.
In addition to the usual appropriate technical and organisational measures we implement to ensure the security and integrity of the personal data processed by us, we may implement additional measures in relation to Special Categories of Personal Data, as appropriate. These may include segregation, pseudonymisation or restriction of access to the data.
Where we must process Special Categories of Personal Data or Criminal Conduct Data or Photographs, we will do so on the following lawful bases (see Lawful Basesfor more information):
|Special Category / Criminal Conduct Data / Photographs
||Lawful bases / condition for processing
||Explicit consent, substantial public interest, to protect the vital interests of a person, or in relation to legal claims.
|Photographs of Students
|Criminal Conduct Data
||Explicit consent, substantial public interest or the data is processed in relation to legal claims.
Where a Student is under the age of 18, we will obtain explicit consent from a Parent/Guardian responsible for the Student, on his/her behalf. This consent will remain valid until it is withdrawn by the Parent/Guardian who provided it, or the Student, provided that:
- The Student has legal capacity to withdraw consent (see Legal Capacity); and
- Withdrawal of consent does not have a prejudicial impact on the interests of the Student.
In any instance where a Student under the age of 18 who was deemed to be capable of providing consent later withdraws that consent against his/her own best interests, we may revert to a Parent/Guardian to obtain consent on his/her behalf.
We will obtain consent directly from any Student over the age of 18.
Legal capacity of Students to make decisions about the processing of their Personal Data
Legal capacity will be assessed as follows:
- Students under 16 years of age Where a Student is below the age of 16, they will not be considered sufficiently mature to make decisions about the processing of their personal data. We will provide these Students with a simplified, age-appropriate version of this PICS and rely on the consent provided by a Parent/Guardian, as required.
- Students between 16-18 years of age Where a Student is above the age of 16 but below the age of 18, they will be presumed to be sufficiently mature to make decisions about the processing of their personal data, subject to an individual evaluation of their maturity and understanding, if deemed necessary. We will provide these Students with a copy of this PICS but continue to rely on the consent provided by a Parent/Guardian, as required, as described in section Consent.
- Students over 18 years of age Where a Student has reached the age of 18, they will be considered to be sufficiently mature to make decisions about the processing of their personal data. We will provide these Students with a copy of this PICS and re-obtain consent from them directly, as required.
Transmission, storage and security of Personal Data
Security over the internet
No data transmission over the Internet or through a website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your Personal Data, and that of any Student you are responsible for, in accordance with data protection legislative requirements.
All information you, or any Student you are responsible for, provide to us is stored on our and our suppliers’ secure servers and accessed and used subject to our security policies and standards. We ask that you, or any Student you are responsible for:
- Refrain from sharing any password providing access to certain parts of our websites, applications or systems with any other person; and
- Comply with any other security procedures that we may notify you of from time to time.
Export outside the EU / EEA
Your Personal Data, or that of any Student you are responsible for, may be transferred to, stored in or accessed by staff or suppliers in, a destination outside the European Union (EU) / European Economic Area (EEA). Regardless of location, we will impose the same data protection safeguards that we deploy inside the EU/EEA.
Certain countries outside the EU/EEA have been approved by the European Commission as providing essentially equivalent protections to EEA data protection laws and therefore no additional safeguards are required to export Personal Data to these jurisdictions. In countries which have not had these approvals, (see the full list here http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm) we will transfer it subject to European Commission approved contractual terms that impose equivalent data protection obligations directly on the recipient unless we are permitted under applicable data protection law to make such transfers without such formalities.
Please contact us if you would like to see a copy of the specific safeguards applied to the export of Personal Data relating to you or any Student you are responsible for.
We will Personal Data for as long as is necessary for the processing purpose(s) for which they were collected and any other permitted linked purpose (for example certain transaction details and correspondence may be retained until the time limit for claims in respect of the transaction has expired or in order to comply with regulatory requirements regarding the retention of such data). So if Personal Data is used for two purposes we will retain it until the purpose with the latest period expires; but we will stop using it for the purpose with a shorter period one that period expires. We restrict access to Personal Data to those persons who need to use it for the relevant purpose(s).
Our retention periods are based on business needs and relevant laws. Records that are no longer needed are either irreversibly anonymised (and the anonymised information may be retained) or securely destroyed.
Your Personal Data obtained on the basis of the above consent will be processed during the term of the contractual relationship between you / Student and NAE and three years after its termination, or until revocation of the given consent.
Rights relating to Personal Data
Be aware of the rights that Data Subjects have in relation to their Personal Data
Data Subjects have a number of rights relating to how their personal data is used. Please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise them in all situations. In addition, these will vary slightly between EU member states. If you wish to exercise any of these rights we will check your entitlement and respond within a reasonable timescale.
Students may be able to exercise these rights independently, provided that they have Legal Capacity.
Where applicable, you will have the following rights relating to your Personal Data or the Personal Data of a Student you are responsible for:
- Subject Access: Be provided access to any Personal Data held about you/a Student you are responsible for, by NAE. This information will generally be provided within one month of us confirming your identity and understanding the scope of your request.
- Rectification: Require to have inaccurate Personal Data amended.
- Erasure: Require us to erase Personal Data in certain circumstances. If the Personal Data has been made public, reasonable steps will be taken to inform other controllers that are processing the data that you have requested the erasure of any links to, copies or replication of it.
- Withdrawal of consent: Withdraw any consents to processing that you have given us or that have been given on your behalf and prevent further processing, if there is no other ground under which we can rely to process your Personal Data.
- Restriction: Require certain Personal Data to be marked as restricted in some circumstances, for example, whilst we resolve any complaint we may have received. Restriction means that whilst we still store the data, we will not process it until such time as the restriction may be lifted.
- Portability: Have a copy of any Personal Data you have provided to us returned to you, or transmitted to another controller in a commonly used, machine readable format.
- Prevent processing: Require NAE to stop any processing based on the legitimate interests ground unless NAE’s reasons for undertaking that processing outweigh any prejudice to your data protection rights.
- Marketing: Require NAE to prevent processing of your Personal Data for direct marketing purposes.
- Raise a complaint: Complain to your local Data Protection Authority about our processing of your Personal Data.
If you have any queries relating to your rights or exercise of your rights, please contact us.
Changes to our PICS and/or Cookies Policy
This PICS was last updated on 16thMay 2018.
What are cookies?
Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating web domain on your subsequent visits to that domain. Most web pages contain elements from multiple web domains so when you visit the Website, your browser may receive cookies from several sources
We use the cookies on this website to help you navigate our website efficiently, perform certain functions and to collect site statistics. These cookies do not store any personal information that would, on its own, allow us to identify individual users of this service without your permission. Please be aware that restricting cookies may impact on the functionality of the website and could mean that key features do not work properly. We strongly recommend allowing cookies from this website so that we can provide you with a full service.
What type of cookies do we use?
We use a number of suppliers (3rd Party) who also set cookies on our website on our behalf in order to deliver the services that they are providing. If you would like more information about the cookies used by these suppliers, as well as information on how to opt-out, please see the information in the tables provided below.
To help you make an informed decision, we have categorised the cookies used on this site into two categories;
- Necessary cookies – these cookies are fundamental to ensure the site works correctly.
- Optional cookies – These cookies could help us track how you use the website so that we can improve the information and experience provided to you. They may also provide additional features by 3rd party providers to allow you to socially share content or comment on this website.
Nord Anglia Education Limited
End of Session
This session cookie is used to store anonymous details about the pages visited by you on this website and is required to provide this functionality to you. If you do not allow this cookie this website will not work correctly
Nord Anglia Education Limited
This cookie that tells us that you have accepted cookies from this site and allows us to stop showing you the same message each time you visit the site.
These Cookies are used by YouTube follow your preferences and track the usage of content supplied by YouTube. The Cookies collect information in an anonymous form to help you keep your preferences when viewing content and to supply you with tailored relevant search results. If you have a Google account and are logged in this data can be linked to your personal profile.
How to control and delete cookies
Alternatively, you may wish to visit www.aboutcookies.org which contains comprehensive information on how to do this on a wide variety of browsers. You will also find details on how to delete cookies from your computer as well as more general information about cookies. For information on how to do this on the browser of your mobile phone you will need to refer to your handset manual.
We do not use ’spyware’, that is web bugs or hidden identifiers or other similar devices to gain access to information, store hidden information or to trace your activities.
We keep a record of traffic data which is logged automatically by the server. This includes your IP address, the website address you visited before ours, the website address you visit after leaving our site and which pages you visit on our site. We do not store or analyse this traffic data in a way that identifies any individual. We also use Google Analytics for site statistics – see 'Cookies’ above for details of how this works.