Thank you for visiting the website of Bavarian International School gAG (BIS). We take the protection of your personal data very seriously and strictly observe the appropriate laws and regulations. We would like to take this opportunity to inform you about the steps taken by BIS to ensure the protection of your data as well as how your data may be processed and the purpose of doing so. The legal framework are set by the European Union (“EU”) General Data Protection Regulation (“GDPR”) and the revised German Federal Data Protection Act (BDSG-new).
The primary reason that BIS uses personal data is to enable the School to provide educational and support services to enrolled students. With regard to such processing, BIS will qualify as a data controller. This notice explains how BIS collects, processes and stores personal information of parents, students, staff, service providers / supplier, applicants and interns, who this information might be shared with and the ways in which the School protects and accounts for the protections to privacy. The notice also explains decisions that parents, students, staff, service providers / supplier, volunteers, applicants and interns can make about their personal data held by BIS.
What is Personal Data
Personal data is data that the School holds about students, parents, staff, service providers / supplier, volunteers, applicants and interns (“data subjects”) which identifies them. The School needs to know the basic personal data of parents, staff, service providers / supplier, volunteers, applicants and interns (such as but not limited to contact details, dates of birth, languages, gender, diplomas achieved, and criminal background checks) and students (including names, addresses, dates of birth, languages, academic progress, examination results and behaviour records). This could also mean recording and processing special categories of personal data such as medical data. CCTV, photos and video recordings are also personal data (all together, the “Personal Data”).
This notice applies to all Personal Data collected for or on behalf of the School whether in analogue form (documents and forms in writing) or in digital form (such as information systems, databases and emails).
Legal Basis for processing of personal data by BIS
Personal Data will be collected, processed and stored for the purpose of the enrolment and education of students, the employment of staff or the execution of contracts and agreements with the School.
We do so under the lawful basis that the processing is necessary for the performance of a contract in which you as the data subject is entering or has entered into (Art. 6 (1) a) GDPR). In some circumstances we may have to process data for other purposes that are not necessary for the performance of the contract but are within the lawful basis of Art. 6 (1) b)-f) of the GDPR. In such cases, the processing may be based upon
- our legitimate interests, such as providing a safe learning environment, maintaining the BIS community, fundraising, etc.,
- on the protection of you or your children’s vital interests,
- on the compliance with our legal obligations and/or
- on the consent you or your children may have provided to us.
Collection of Personal Data
How we use the personal data collected
BIS collects personal data, including special categories of personal data of students and parents to provide a safe and caring international environment for teaching, learning and general educational purposes.
More specifically we process your or your children’s personal data for the following purposes, and other purposes that are compatible with the purposes described below:
- to undertake and manage the School’s admissions processes
- to provide a safe and secure learning environment
- to comply with child protection requirements
- to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress
- to provide our educational services
- to provide safe transportation services
- to provide support and care for emotional and psychological wellbeing (pastoral and counselling)
- to protect the health of the students and staff we serve
- to provide a tailored learning environment and make evidence based education decisions for the children we serve
- to enable the children we serve to continue or progress their education at other educational organisations
- to support and develop our employees in the performance of their duties
- for financial planning to help in the future planning and resource investment purposes
- to meet our statutory reporting requirements to the education and other authorities
- to help investigate any concerns or complaints you may have
- to build and maintain the BIS community, including through fundraising
- to make you aware and inform you about our services, news, events and activities that are undertaken at or in association with BIS to communicate with you within the framework of your relationship with BIS
- to ensure the safety and security of students and staff, including camera surveillance
- for forecasting and planning for education service provision
- to respond to requests of our staff and (former) students regarding historic information pertaining to their time at BIS.
How we collect your personal data
Personal data relating to you or your children can be obtained directly from you or your children, for example via completing the Application and Health and Consent forms, via the website, via meetings with teachers and staff, etc.
Personal data relating to you or your children can also be obtained via other information channels, such as previous schools, health professionals, social media channels, etc.
Personal data relating to you or your children also obtained by actions of BIS itself or its data processors, e.g. through evaluations, camera surveillance, access control measures, etc.
Categories of personal data being processed
The categories of personal data that BIS collects and processes include:
- Personal information (such as name, unique number and address)
- Special categories of data (such as health information, ethnicity)
- Educational and evaluation data (such as assessments, relevant medical information, special educational needs information, exclusions / behavioural information and psychological reports and assessments)
- Attendance information (such as sessions attended, number of absences and absence reasons)
- Logging and audit in the use of IT systems and education technology apps, applications and cloud based systems
- Communication and correspondence data (such as emails, letters and other types of correspondence)
- Photographs, audio and videos.
Special categories of data
The education services we provide require us to collect and process special categories of data, such as health information, for the purposes of safeguarding the protection of your children and the wellbeing of those within our care. We do not disclose or share special categories of data without explicit and unambiguous consent unless we have to do so where we are required to by law, or where we have good reason in protecting the vital interests of an individual, or where not doing so would place someone else at risk.
Collecting data with consent
Whilst the majority of data provided to BIS is required for the performance of a contract, agreement or by law, some of it is provided on a voluntary basis. In order to comply with the GDPR, BIS will inform parents, staff, service providers / supplier, volunteers and interns when consent is required to process the data. Where consent is provided the data subject is free to withdraw consent at any time.
There may be instances where the data subject may not want BIS to process or share Personal Data. In these cases, BIS may not be able to fulfil the contracted or agreed service, or only do so in a limited way, or be able to comply with a statutory obligation. In those instances, BIS may not be able to comply with such a request. Data subjects can contact the School’s Data Protection Officer by emailing email@example.com or by regular mail to Bavarian International School, Data Protection Officer, Hauptstraße 1, 85778 Haimhausen, Germany, if they wish to withdraw consent.
Storing and processing of Personal Data
Storing personal data
We keep personal data for as long as necessary with regard to the purposes described above or for any other purposes that may be communicated to you.
In general, your personal data are stored on our own servers and on the servers of our external providers, located in the European Union. Regarding transfers outside the European Union, see below.
Sharing and transfer of personal data
Your personal data is shared internally within BIS for the purposes of delivering the services required.
For the purposes described above, BIS may need to share your personal data externally with certain recipients, as well as with third parties processing your data on behalf of BIS. More specifically, this includes the following categories of recipients:
- PTO (Parent Teacher Organisation), Organic Garden (internal caterer), schools, colleges or universities that the students attend after leaving BIS; other international schools (amongst others for the purposes of trips, sports and activities), other third party education and sport service providers (Outward Bound / International Award), travel agents (for overnight trips);
- Local education authorities in Bavarian;
- Doctors / medical institutions or social service organisations (amongst others where sharing is in the vital interests, or where not sharing could have a negative impact on the individual);
- Providers of information systems that are necessary for BIS to deliver the admissions, administration, teaching and learning, pastoral development, transportation and child protection services;
- Providers of IT hosting and maintenance services;
- Government organisations, police, health and social care (where we are required to do so by law, or where we have obtained your consent to do so).
Transfer to third countries
Personal data may also be transferred to organisations outside Germany and outside the European Union. This may for example occur for the purposes of student application for college or university. Various teaching and learning applications of providers that are based outside the European Union are also used.
For such transfers of personal data outside the European Union, BIS has implemented suitable safeguards in the form of standard contractual clauses where required under applicable data protection legislation. Where this is not the case the data is anonymised before transmission. More information on these transfers and suitable safeguards can be requested from the data protection officer (see below).
Retention of data
BIS will retain Personal Data for as long as required by law or best educational practice. BIS retains Personal Data after parents, students, staff, service providers / suppliers, volunteers and interns have left BIS in order to provide traceability. It is widely accepted that a School should hold data on the achievements and experiences of a child for their benefit in later life should they need to access that information.
Subject to appropriate safeguards, BIS may keep some information during a longer period if needed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Such information will be anonymised where reasonable. More information on data retention periods is provided in our Data Retention Policy, which can be requested from the DPO.
Publication of photos and videos by the school
Photos and videos are important media that significantly enhance communication about the School’s programmes and activities to the BIS community, prospective families, alumni, and the general public. For this reason, the School uses such media on its website, in its print publications, press releases, and articles for external publications.
Furthermore, photos and video are also created for educational purposes by students and teachers and play an important role in the instructional programme.
As members of the BIS community, parents, students, staff, service providers / suppliers, volunteers and interns may be filmed or photographed. These images may be used for both educational and promotional purposes. We are conscious and respectful of the privacy of all BIS community members and therefore the publication of these images takes place under the following conditions:
Publications destined for the BIS community, including the password protected internet pages, School Yearbook and School newspapers: students, parents, staff, service providers / suppliers, volunteers and interns may be identified by name in images found in publications such as the BIS Yearbook, weekly blog posts, School newspapers or other in-house documents. On the password protected portals, individuals may be identifiable by name. Images and video clips that appear on these pages may identify students, parents, staff, service providers / suppliers, volunteers and interns either directly or indirectly depending on their context. These pages are password protected and only available to members of the BIS community.
Publications destined for the general public, including the BIS public website, School publications, press releases and articles: individuals will not be identified by name in photos or video clips without prior agreement. Students who take part in School productions such as plays, concerts, athletic tournaments or other events that are open to the general public and which are publicised outside the School may be identified by name in photos or video clips that are published by the School.
If such photographs and videos reveal any sensitive personal data of you or your child, we will only process and use such photographs and videos if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so. Please contact the Marketing Office if you have specific concerns about photos being published: firstname.lastname@example.org
Camera surveillance / CCTV
We collect information in the form of camera footage via our CCTV-systems to ensure the safety and security of students, staff and BIS property. We retain these CCTV images as per BIS works agreement with the works council. The footage will be deleted, unless we need to retain the images for further investigation or law enforcement purposes. Access to these images can be requested through the Data Protection Officer (see below).
Automated Decision Making / Profiling
The School’s IT systems may profile the use, access and content of all users. The profiling enables identification of safeguarding and child protection risks or concerns, on the basis of your explicit consent. Some education apps profile the behaviour, use and outcomes of children. The School has an internal process to assess the impact of this on students. In evaluating the use of these apps the School will consider the benefit gained from using it for the student to learn, develop and explore, against the negatives identified from profiling. Decisions will always be made by BIS employees and not be automated as a result from profiling.
Cookies – Storing Information on Your Computer
What are cookies?
To ensure the best experience on its electronic media, BIS sometimes place small data files on your computer, known as cookies. Cookies help the site remember your settings – language, font size and other preferences for how you want to view the site on your computer – this is so that you do not have to keep re-entering them whenever you come back to us. Third party analytics are used to track and measure usage of BIS sites so that the School can continue to produce engaging content. These cookies may track things such as time spent on the sites or pages visited which helps the School to understand how it can improve the experience for users.
Our cookies are not used to identify you personally. They are just there to make the site work better for you.
How you can control cookies?
You can control and/or delete cookies as you wish – for details, see AboutCookies.org. You can delete all the cookies already on your computer and you can set most browsers to block them being placed. But if you do this, you may have to manually adjust some preferences every time you visit the site. It is recommended that all cookies are left on in case they are used to provide a service which might otherwise not be accessible.
Server Log Data
The website provider collects and saves server log data, which your browser automatically provides to us. These are:
- type and version of the browser
- operation system
- referrer URL
- hostname of the computer
These data will not be merged with other data sources. Basis for this processing is Art. 6 (1) 1b of the GDPR.
Rights of the User
Parents and students may exercise a number of rights with regard to the processing of their personal data vis-à-vis BIS, in so far as they effectively have those rights under applicable data protection legislation, such as the European General Data Protection Regulation 2016/679 of 27 April 2016 and the New German Federal Data Protection Act (new BDSG), as may be amended from time to time.
The first point of contact in connection with the processing of personal data and the exercise of the rights described below is the BIS Data Protection Officer (email@example.com). BIS shall respond to such requests and may or may not act upon them, in principle within a period of one month, all in accordance with applicable data protection legislation.
In addition, you also have the right to contact or file a complaint with the Bavarian Data Protection Authority: Bayerisches Landesamt für Datenschutzaufsicht: http://www.lda.bayern.de.
The rights which you may have under applicable data protection legislation are:
- Right to information and access – to request access to and a copy of the personal data BIS holds on you, as well as the right to information about relevant aspects of the data processing by BIS. This Notice serves to inform you thereon, but do get in touch if you have any questions.
- Right to rectification – to correct inaccurate personal data or to complete incomplete personal data.
- Right not to be subject to automated individual decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
- Right to restriction of the processing – to limit the processing, e.g. where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate.
- Right to data portability – to receive your personal data in a structured, commonly used format and to transmit it or have it transmitted to another international school.
- Right to object – the right to object on grounds relating to your particular situation to the processing of personal data based on the legitimate interests of BIS, and the right to object to the processing for direct marketing purposes.
- Right to erasure (the “right to be forgotten”) – to request the deletion or removal of personal data in specific circumstances, for example if your personal data are no longer necessary for the purposes pursued by BIS or if there no longer is a legal ground for the data processing.
Where the processing of your personal data is based upon consent, you and/or your child have the right to withdraw consent at any time. Such withdrawal of consent shall not affect the lawfulness of the processing based on consent before the withdrawal.
There may be instances where you may not want us to process or share your personal information. In these cases, we may not be able to fulfil the service you need, or do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if this is the case.
BIS has developed its internal organisation in such a way that it complies with the specific requirements regarding data protection.For the time that BIS stores and uses Personal Data, the School will ensure the appropriate security of this Personal Data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Our website is hosted on internal servers, the technology is provided from Finalsite (Active Internet Technologies LLC). Data collected via our website is secured via a SSL encrypted connection.
Please note that communication and data processing via e-mail might cannot be 100% restricted from illegal access.
Liability for Links
Our website contains links to third-party websites over which we have no control. Consequently, we cannot accept any liability for the content of these external websites. Sole liability for the content of linked websites rests with the relevant provider or operator.