We are committed to protecting and respecting yours and your child’s privacy. In this privacy notice, references to “we”, “us” or “our” is a reference to The Olive Tree school and the school which your child is attending, may be attending or has attended.
Please read the following carefully to understand our views and practices regarding your and your child’s personal data and how we will treat it.
For the purposes of the General Data Protection Regulation 2016/679 (“GDPR”), we are the data controller and our address is The Olive Tree School Carrer les Modistes, 8, 08810 Sant Pere de Ribes, Barcelona
If you are reading this privacy notice online, we recommend that you print and retain a copy for future reference.
RIGHT OF INFORMATION
By virtue of that which is stipulated in article 13 of the European Regulation on Data Protection, we inform you that:
The Olive Tree School, registered in Sant Pere de Ribes, Carrer les Modistes, 8, 08810 is responsible for handling data of a personal nature.
The organisation’s Data Protection Officer is: CIPDI Tratamiento de la Información SL
The data that you provide us using the forms that you will find on the website and those that you send to our Email, will be used to manage the provision of the services that you request, to manage the request that you present and to manage the delivery of information about our activities via Email or post.
The recipients of the information are the center staff and the people and entities that work together with them to comply with the obligations. When there is a legal obligation, your data may be provided to the state authorities, within the sphere of their competencies.
You are required to provide us with all the data that we request and it is essential that this correctly corresponds with your current situation.
Should you refuse to provide them, we will be unable to assist you correctly.
The Olive Tree School does not create profiles in accordance with articles 22 and 4 of the RGPD (General Data Protection Register).
The data provided will be stored provided you do not withdraw your consent.
You have the right to exercise your rights to access your personal data, to rectify or suppress them, to limit their use, to oppose the proposed treatment, to consent expressly to the possibility of your information being transferred and to not being subject to a decision based solely on automated use. To exercise your rights and for any clarification, you may write to the address that appears in this document, by Email (email@example.com) or phone (+34 931 88 62 15)
The relevant organism for dealing with any conflicts that may arise from the signing of this document is the Data Protection Authority located in Madrid (28001), c / Jorge Juan 6.
The user will be understood to accept the established conditions if they click on the ‘ACCEPT’ button that can be found on all the data collection forms, or by sending an Email to the contact addresses that appear on the website.
The personal data collected on our users is stored in the database described above, which guarantees the necessary technical and structural measures to assure the integrity and security of the personal information provided and has a security document establishing all the technical measures at its disposal to avoid loss, incorrect use, alteration, unauthorised access and theft of the data that you have provided. You should nevertheless be aware that internet security measures are not unassailable.
The treatment of personal data is in accordance with the regulations established in the General Regulation on Data Protection.
INFORMATION WE COLLECT ABOUT YOU AND YOUR CHILD
You may give us personal data about you or your child, in a number of ways; these include:
using, visiting or interacting with our website (such as filling out forms or registering on our website);
visiting our school;
corresponding with us by phone, e-mail or post; and
sending information directly to us, for example when paying our fees, giving us medical records or information about your child’s health, completing school admission forms, signing our contract or providing information as requested by us and/or which is necessary from time to time.
The information you give us may include the following information about you and / or
full name of all the parents and the child/children;
date of birth and year group of the child/ children;
parents’ and children’s contact details (including home address, e-mail address, and mobile, home and/or work phone number);
online forms or other details for permissions;
parents’s financial and credit card information;
photograph of the child/ children;
passport details, NIE, nationality and other information relating to immigration status of the parents and the child/children;
education and health records (including special education needs, medical or physical conditions and/or accidents) of the child/ children;
previous educational records and achievements of the child/ children;
(where appropriate) family circumstances (including your relation to the child and your marital status); and
race, religion and ethnicity (should you choose to share this information)
Information we receive from other sources
We may be working closely with third parties (including, for example, your child’s previous or new school(s), medical practitioners, photographers, local authorities, education authorities, business partners, payment and delivery services, debt collectors, lawyers and credit reference agencies) and may receive information about you from them.
3.1 Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to our Data Protection Officer at firstname.lastname@example.org or +34 931 88 62 15.
We have also appointed a Data Protection Co-ordinator. Please contact the school for further details about the Data Protection Co-ordinator overseeing data protection matters at your child’s school.
5 USES MADE OF THE INFORMATION
Information you give to us
We will use the information you give to us to pursue the following legitimate interests:
to deliver educational services to your child, and ensure the most efficient management of the schools;
to store this information on the school’s chosen management information system;
to use your child’s photograph as part of a manual ID system on the school management information system;
to contract with other companies and organisations for the purposes of fraud protection and credit risk reduction;
your child is attending after school clubs or open days or extra development activities we offer as part of the education and overall development of your child at the school (you will be able to opt-out this at any time);
to send out surveys to you by email for school improvement (you will be able to opt-out this at any time).
Our schools also rely on software applications and other technology to process personal data about you and your children. These include the school’s text and email messaging communications, billing system and co-ordination of school trips. The third parties we use to deliver these applications are carefully chosen and vetted by us to ensure that, among other things, your and your child’s personal data is kept secure. For further information on the kind of technology we use, please contact our Data Protection Officer or Data Protection Co-ordinator.
We will also use the information you give to us as is necessary to carry out our obligations arising from the contract (or potential contract) between you and us and to provide you with the information and services that you request from us. We will provide education services to your child and will use personal data where necessary to deliver these services. We will also use your personal information to invoice you for our services pursuant to the contract between you and us. We will also require a certain amount of personal information about you and your child at the pre-contract enquiry and application stage, please see our admissions protocol regarding which information we collect at this stage.
In addition, we may be required by corresponding applicable law to do the following (which is not an exhaustive list):
keep an admissions and attendance register;
keep pupil files (including, where relevant, special education needs and child protection files);
keep a record of behaviour sanctions; and
provide an annual written report on pupil progress and attainment.
Inevitably, there will be an overlap between what we do that is necessary to (a) perform our contract with you, (b) carry out our legal obligations and (c) pursue a legitimate interest although we have tried our best to demarcate these as set out above. If you have any questions about these please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).
Information we collect about you from our website
We will use this information for the following legitimate interests:
to inform you about available places in the future;
to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
to improve our website to ensure that content is presented in the most effective manner, and your online experience is as effective and appropriate as possible, for you and for your computer;
to allow you and your child to participate in interactive features of our service, for example virtual learning environments, when you choose to do so; and
as part of our efforts to keep our website safe and secure.
Information we receive from other sources
We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for one of the purposes set out above (depending on the types of information we receive). For example, we may receive a court order relating to you which impacts on our use of your and your child’s information to protect the welfare of the child.
Also, social services or health practitioners may provide us with information (particularly sensitive personal data) about your child which may need to be added to the school’s child protection or special educational needs file. This kind of processing of sensitive personal data may be necessary (a) for the purposes of carrying out our obligations in the field of social security or social protection law, (b) for medical diagnosis or provision of health care and/or (c) to protect the vital interests of your child or another person taking into account the mental and physical capacity of your child.
In order to achieve the purposes described in paragraph 4.8, our school may do the following:
keep a list of your child’s allergies or medical requirements within the classroom or staffroom in case of emergency. It is necessary for the school to have a list readily available to our staff so that we are able to look after your child promptly in the event of a medical emergency; and
rely on software applications and other technology to process medical information (such as allergies, accidents and injuries) about you and your children. For further information on the kind of technology we use, particularly in the context of processing sensitive personal data about your child, please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).
You or your child do not have to give us details about your child’s race, religion or ethnicity if you do not want to. If you do provide us with this information, we only use these details to assist us with the day-to-day running of the school (for example, if your child’s religion means that he or she has particular dietary requirements then we will of course be much better informed if we have this information to cater to your child’s requirements).
Where you have given consent to the above, you can withdraw this consent at any time by contacting the Data Protection Coordinator.
SENSITIVE PERSONAL DATA
When we hold details about you or your child’s medical condition or health, race, ethnicity or religion, this type of information is called “sensitive personal data” which means the school must adopt higher standards of care to make sure this kind of data is safe and doesn’t fall into the wrong hands. It also means that we need to ask for your consent to collect and process that data when we ask for it. We will need to hold sensitive personal data about you or your child (a) for carrying out our obligations in the field of social security or social protection law, (b) for medical diagnosis or provision of health care or (c) to protect your or your child’s vital interests (d) for equal opportunities monitoring (e) for dietary requirements (f) for facilitating religious customs and practices e.g. prayer, dress and holidays / festivals. Every time we collect sensitive data from you about you or your child, we will inform you and collect your consent to the processing of that data. In order to achieve this, the school may also use software applications and other technology.
TRANSMISSION OF PERSONAL INFORMATION OUTSIDE THE EEA
The data that we process about you and your child may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). We try to limit this where possible but it may be necessary where, for example, one of our suppliers, has a data centre outside the EEA. We will take all steps reasonably necessary to ensure that your and your child’s data is treated securely and in accordance with this privacy notice and that the appropriate legal safeguards are in place prior to the transfer, for example ensuring that any contracts between us and the recipient of the information have EU-approved standard data protection clauses, or the country we are transferring the data to is deemed by the EU Commission a country with adequate protection.
Under the GDPR, you and your child have the following rights:
Right to correction. You have the right to have inaccurate personal data about you or your child rectified.
The right to be forgotten. The right to be forgotten. You have the right to request that we delete yours and your child’s personal data where: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or processed; (b) you withdraw your consent to processing for which we previously obtained your consent; (c) you object to the processing and, as a result, we agree to cease that processing (please see paragraph 7.1.5 for more details); (d) the personal data has been unlawfully processed; and (e) we are required to erase the personal data in order to comply with the law.
Right to restriction. You have the right to obtain from us the restriction of processing where: (a) you contest the accuracy of the personal data we hold about you; (b) the personal data has been unlawfully processed; (c) we no longer need the personal data but they are required in limited circumstances; and (d) you object to the processing and, as a result, we agree to cease that processing (please see paragraph 7.1.5 for more details).
Right to request transfer. In certain circumstances, you have the right to receive personal data from us in a structured, commonly used and machine-readable format and the right to transmit it to a third party organisation.
Right to object. You have the right to raise an objection to any of our processing in paragraphs 4.1 and 4.2, including profiling and to decisions which are based solely on automated processing. Please tell us if you object to any type of processing that we do and we will work with you to address any concerns you may have.
Right to object to marketing. If you do not want us to process your personal data for direct marketing and particularly you do not want to receive commercial communications trough electronic means, please send us an email to the following e-mail address: email@example.com and we will ensure that you will not receive any direct marketing communications.
Right to complain to the competent authority. Whilst we would always prefer it if you approached us first about any complaints or queries you may have, you always have the right to lodge a complaint with the AEPD.
Right to request access.You have the right to access personal data we hold about you. We encourage you to contact the school’s Data Protection Co-ordinator and request our standard SAR form for you to complete in order to help us process your request.
HOW LONG WE KEEP PERSONAL INFORMATION
We will not keep any personal data about you for any longer than is necessary for the purposes for which the personal data are processed.
As a general rule, we keep your child’s education records during the life of the contractual relationship with us and for 6 years afterwards, with access restricted, at which point we destroy the file.
We follow a personal data retention policy which determines how long we keep specific types of personal information for. For further information about the criteria we use to determine what periods we keep specific information, please contact our Data Protection Officer or Data Protection Co-ordinator.
USE OF OUR WEBSITE
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict risk based procedures and security features to try to prevent unauthorised access.
CHANGES TO OUR PRIVACY NOTICE
Any changes we make to this privacy notice in the future will be posted on our website and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice.