ISZL Privacy Notice
- Who we are
- 1. How we use Personal Data
- 2. Basis on which ISZL processes Personal Data
- 3. Categories of Personal Data processed by ISZL
- 4. Participating in our Community
- 5. Communicating with you
- 6. CCTV
- 7. Collecting student information and consent
- 8. Storing Personal Data
- 9. Security
- 10. Sharing and transfers of Personal Data
- 11. IT Systems
- 12. Cookies
- 13. Your Rights
- 14. Point of Contact:
ISZL complies with the relevant national data protection regulations. We are committed to keeping Personal Data accurate, up-to-date, safe, secure and will not keep Personal Data longer than necessary. This privacy notice explains how we use the Personal Data of parents, students, employees, alumni and the extended ISZL community, who we share it with and the ways in which we protect and account for the protections to privacy. This notice applies to all Personal Data collected for and on behalf of the School. This pertains to information collected in analogue (forms, documents, in writing) and through technological means such as information systems and email. For these purposes, ISZL acts as data controller which means it determines how an individual’s Personal Data is processed and for what purposes.
From time to time, we will make you aware when we require additional Personal Data for processing through a separate specific privacy notice.
ISZL parents, students, employees, alumni and the extended ISZL community are all encouraged to read this Privacy Notice and understand ISZL’s obligations regarding data protection to its community.
ISZL reserves the right to amend this privacy notice. In such case the ‘last updated’ date at the bottom of this page will be amended accordingly.
Last updated: March 2020
The School collects Personal Data and sensitive categories of Personal Data of students, parents, employees and alumni to provide a safe and caring international environment for teaching, learning and general educational purposes. We use the information you provide for purposes that are necessary and required to undertake the performance of the contract into which you are entering or have entered into and do so as we are required to do by law.
We use the information you provide in the following ways:
● to undertake and manage ISZL admissions and enrolment
● to provide a safe learning environment
● to comply with child protection requirements
● to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress
● to provide support and care for emotional and psychological wellbeing (pastoral and counselling)
● to protect the health of the students and employees we serve
● to provide a tailored learning environment and make evidence based education decisions for the children we serve
● to enable students to take part in standardised or external assessments
● to enable the children we serve to continue or progress their education at other educational organisations
● to monitor (where appropriate) the responsible and safe use of IT and communication systems
● to support and develop our employees in the performance of their duties
● for financial planning to help in the future planning and resource investment purposes
● to meet our statutory reporting requirements to the education and other authorities
● to help investigate any concerns or complaints you may have
● to ensure campus security including video surveillance and monitoring of campus entry and exit
● to make you aware of services, information, news, events and activities that are undertaken at or in association with ISZL
● to maintain relationships with alumni and the extended ISZL community including direct marketing or fundraising activities
● to respond to requests from former employees, parents and students for information related to their time at ISZL.
We process Personal Data to carry out the education services as prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered into. In some circumstances we may have to process data for other purposes that are not necessary for the performance of the contract. Where this is the case, we will either have legitimate interest to do so, need to as there is a legal requirement, we have your consent, or because it is in the vital interests of the individual for us to process or share information.
Categories of personal data processed by ISZL
● personal data (such as name, unique number, address, telephone contacts and e-mail address as well as employment information including employer, position and work contacts)
● special categories of data (such as health and nationality) (see below)
● other relevant categories for the performance of our services (such as assessment, relevant medical information, languages spoken, special educational needs information, exclusions / behavioural information and psychological reports and assessments)
● attendance information (such as lessons attended, number of absences and absence reasons)
● logging and audit in the use of IT systems and education technology apps, applications and cloud based systems
● photographs and videos (see below).
Special Categories of Data
The education services we provide require us to collect and process special categories of data for the purposes of safeguarding, the protection of vulnerable children, and wellbeing of those within our care. We do not disclose or share special categories of data without explicit and unambiguous consent unless we have to do so where we are required to by law, or where we have good reason in protecting the vital interests of an individual, or where not doing so would place someone else at risk.
Special categories of data such as nationality or health may be used from time to time in forecasting and planning for education service provision. Where used in this way, the data will be anonymised.
Photographs and Videos
Photographs and videos are a key media through which to record and share everyday life at ISZL to the parents, students, employees, alumni, the extended ISZL community, prospective families and the general public. ISZL uses such media for promotional purposes on, including but not limited to: the ISZL website, printed publications, electronic newsletters and ISZL social media. Photographs and video are also generated for educational purposes (records of lessons, field trips, sports, events, staff professional development) by faculty and students and play an important role in the delivery of our teaching and learning programme. As members of the ISZL community, parents, students, employees and alumni may be photographed or filmed and these photographs or film used for promotional or educational purposes.
Photographs or videos used for promotional purposes will not identify individuals by their full name. If individuals are identified by name then this will only be done with prior consent.
Publications intended for the ISZL community including the password protected portals and ISZL Schoology Environment and Yearbook, may identify parents, students, employees, alumni and members of the extended ISZL community either directly or indirectly depending on their context. These publications however, are usually only accessible to members of the ISZL community.
We are keen to ensure all individuals associated with ISZL can participate in the community. To do so we will use the Personal Data you have provided to make you aware of services, information, news, events and activities that are undertaken at or in association with the School and do so under the lawful basis of legitimate interests. We may invite you to sign up for information or to be contacted on other activities such as campus development. For the purposes of fundraising we will require your explicit consent. If at any point you do not wish to receive these updates, you can let us know by contacting the School Data Protection Office (contact details below).
Whilst the majority of student information you provide to us is required for the performance of a contract or by law, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you when we require consent to process the information. Where consent is provided you or your child are free to withdraw consent at anytime. You can contact our Data Protection Office (contact details below) if you or your child wish to withdraw consent.
We keep Personal Data for as long is as reasonable given the requirement of our staff and students to request historic information pertaining to their time at ISZL. We do so as it would be accepted that a school would hold data on the achievements and experiences of the child for the purposes of their benefit in later life should they need access to that information.
The information we collect is shared within ISZL for the purposes of delivering the services required. The information we collect may also be shared with other organisations or with third party processors in the undertaking of a service or contract in the delivery of the education services we provide.
Example of who we may share data with:
● schools, colleges or universities that the students attend after leaving us
● our local education authorities in Switzerland
● family nurses, doctors or social service organisations where sharing is in the vital interests, or where not sharing could have a negative impact on the individual
● providers of information systems that are necessary for ISZL to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services
● government organisations, police, health and social services (where we are required to do so by law, or where we have your consent to do so).
Personal Data is transferred to organisations outside Switzerland and outside the European Union for the purposes of student application for college or university. Various teaching and learning applications are also used that are based outside Switzerland. Information on these and the protections afforded by these data processors can be requested from the Data Protection Office (contact details below).
All the Personal Data we process is processed by ISZL. For the purposes of IT hosting and maintenance this information is located on servers within the school or within hosted servers provided by our service providers. No 3rd parties have access to your Personal Data unless the law allows them to do so. Where the law allows and information is shared with 3rd parties, we ensure they have the same protections in place as we do. We cannot deliver our education services without processing the data we collect and share.
In following the principles of Article 32 - Security of Processing of the GDPR, we have in place proportionate organisational and technical measures to protect Personal Data. More information on these can be requested via the Data Protection Office (see Point of Contact details below).
Under data protection legislation, individuals have certain rights related to the processing of personal data. Students who have an appropriate level of maturity, may exercise these rights individually. These rights include:
● Right to be informed - be informed of how we are processing your Personal Data – this Privacy Notice serves to explain this to you but do contact us if you have any questions (see Point of Contact details below).
● Right of access - right to request access to information about you that we hold. Note that certain data is exempt from the right to access. This includes information that identifies other individuals or any confidential reference given by ISZL for the purpose of the education, training or employment of an individual.
● Right to rectification - have your data corrected if it is inaccurate or incomplete
● Right to erasure - also known as ‘right to be forgotten’ allows you to be able to request the erasure of personal data in some circumstances such as where it is no longer needed by us for the purpose for which it was collected or you have withdrawn your consent. The right to erasure is not an absolute right.
● Right to restrict processing - the right to request the restriction or suppression of your personal data in certain circumstances for example, where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate. Not, like the right to erasure, the right to restrict processing is not an absolute right.
● Right to data portability - allows you to receive personal data that you have provided us in a structured, commonly used machine readable format. It also allows you the right to request us to transmit this data to another controller.
● Right to object - allows you, in certain circumstances, to object to the processing of your personal data. For example, you may object to processing of your data for direct marketing or to object to automated individual decision-making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual). Another example would be to object to processing of Personal Data that is likely to cause, or is causing, damage or distress.
● Right to withdraw consent - in those instances in which the processing of your personal data is based on consent, you have the right (subject to age provisions) to withdraw that consent.Please note that the processing will end from the moment the withdrawal takes place without any effect on the processing that took place prior such withdrawal.
● Right to complain - while the first point of contact related to the processing of your personal data or in exercising any of the rights identified above should be us (see Point of Contact below), you also have the right to directly contact the Supervisory Authority in Switzerland which is:
Federal Data Protection and Information Commissioner (FDPIC)
CH- 3003 Berne
There may be instances where you may not want us to process or share your Personal Data. In these cases, we may not be able to fulfill the service you need, or do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if that’s the case.
ISZL, in responding to any requests related to the processing of your personal data will do so within a month in accordance to the applicable data protection legislation.