Privacy and Cookie Notices

COLEGIO EUROPEO DE MADRID PRIVACY NOTICE FOR PARENTS

 

1 INTRODUCTION

 

1.1 We are committed to protecting and respecting yours and your child’s privacy. In this privacy notice, references to “we”, “us” or “our” is a reference to Colegio Europeo de Madrid and the school which your child is attending, may be attending or has attended.
1.2 This privacy notice sets out the basis on which any personal data we collect from you or your child, or that you provide to us, is handled by us. We also have a privacy policy for our pupils, this is available on our website.
1.3 Please read the following carefully to understand our views and practices regarding your and your child’s personal data and how we will treat it.
1.4 For the purposes of the General Data Protection Regulation 2016/679 (“GDPR”) and the Ley Orgánica 3/2018, de Protección de Datos Personales y Garantía de los Derechos Digitales, we are the data controller and our address is C/ Cólquide nº 14, 28231, Las Rozas.
1.5 If you are reading this privacy notice online, we recommend that you print and retain a copy for future reference.

 

2 INFORMATION WE COLLECT ABOUT YOU AND YOUR CHILD

 

Information you give us

 

2.1 You may give us personal data about you or your child, in a number of ways; these include:

2.1.1 using, visiting or interacting with our website (such as filling out forms or registering on our website);
2.1.2 visiting our school;
2.1.3 corresponding with us by phone, e-mail or post; and
2.1.4 sending information directly to us, for example when paying our fees, giving us medical records or information about your child’s health, completing school admission forms, signing our parent contract or providing information as requested by us and/or which is necessary from time to time.

2.2 The information you give us may include the following information about you and your child:

2.2.1 full name of all the parents and the child/children;
2.2.2 date of birth and year group of the child/children;
2.2.3 parents’ and children’s contact details (including home address, e-mail address, and mobile, home and/or work phone number);
2.2.4 parent login information (i.e. username and password) for the website;
2.2.5 parents’ financial and credit card information;
2.2.6 photograph of the child/children;
2.2.7 passport details, nationality and other information relating to immigration status of the parents and the child/children;
2.2.8 education and health records (including special education needs, medical or physical conditions and/or accidents) of the child/children;
2.2.9 previous educational records and achievements of the child/children;
2.2.10 (where appropriate) family circumstances (including your relation to the child and your marital status);
2.2.11 race, religion and ethnicity (see paragraph 4.14); and
2.2.12 biometric data (including fingerprint data).

 

Information we receive from other sources

 

2.3 We may be working closely with third parties (including, for example, your child’s previous or new school(s), medical practitioners, photographers, local authorities, education authorities, payment and delivery services, debt collectors, lawyers and credit reference agencies) and may receive information about you from them.

2.4 We may also use a third party to collect:

2.4.1 location data to track, for example, your child on our bus services; and
2.4.2 information relating to monitoring, for example, your child’s usage of our school-issued devices.

2.5 We may also use CCTV footage to ensure the school is safe. We may receive information about you if you use any of the other websites we operate or the other services we provide.

 

3 CONTACT US

 

3.1 Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to our Data Protection Officer at DPO@Cognita.com or Plaza Doctor Letamendi 1-2, 4th Floor, 08007, Barcelona, Spain.
3.2 We have also appointed within each school a Data Protection Co-ordinator. Please contact the school for further details about the Data Protection Co-ordinator overseeing data protection matters at your child’s school.

 

4 USES MADE OF THE INFORMATION

 

Information you give to us

 

4.1 We will use the information you give to us to pursue the following legitimate interests:

4.1.1 to promote the objects and interest of our schools, and ensure the most efficient management of the schools;
4.1.2 to store this information on the school’s chosen management information system;
4.1.3 to use your child’s photograph as part of a manual ID system on the school management information system;
4.1.4 to contract with other companies and organisations for the purposes of fraud protection and credit risk reduction;
4.1.5 where your child is attending one of our schools, to provide you with information about other similar services (for example, after school activities or open days) we offer as part of the education and overall development of your child at the school (you will be able to opt-out this at any time);
4.1.6 once your child has left the school, to keep you up to date with key school news and upcoming events (you will be able to opt-out this at any time); and
4.1.7 to send out surveys to you by email as part of our Voice of the Parent campaign which is our school improvement tool (you will be able to opt-out this at any time).

4.2 Our schools also rely on software applications and other technology to process personal data about you and your children. These include the school’s management information system, virtual learning environments (including the setting of tasks and homework), revision tools, parents evening booking systems, text and email messaging communications, assessments of pupils’ progress, our group-wide billing system and co-ordination of school trips. The third parties we use to deliver these applications are carefully chosen and vetted by us to ensure that, among other things, your and your child’s personal data is kept secure. Some of our key systems include Capita (SIMS), Evolve, NetSuite, Salesforce, Confirmit and Lightspeed. For further information on the kind of technology we use, please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).

4.3 We will also use the information you give to us as is necessary to carry out our obligations arising from the contract (or potential contract) between you and us and to provide you with the information and services that you request from us. We will provide education services to your child and will use personal data where necessary to deliver these services. We will also use your personal information to invoice you for our services pursuant to the contract between you and us. We will also require a certain amount of personal information about you and your child at the pre-contract enquiry and application stage, please see our admissions protocol regarding which information we collect at this stage.

4.4 In addition, we may be required by corresponding applicable law to do the following (which is not an exhaustive list):

4.4.1 keep an admissions and attendance register;
4.4.2 keep pupil files (including, where relevant, special education needs and child protection files);
4.4.3 keep a record of behaviour sanctions; and
4.4.4 provide an annual written report on pupil progress and attainment.

4.5 Inevitably, there will be an overlap between what we do that is necessary to (a) perform our contract with you, (b) carry out our legal obligations and (c) pursue a legitimate interest although we have tried our best to distinguish these as set out above. If you have any questions about these please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).

 

Information we collect about you from our website

 

4.6 We will use this information for the following legitimate interests:

 

4.6.1 to inform you about available places in the future;
4.6.2 to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
4.6.3 to improve our website to ensure that content is presented in the most effective manner, and your online experience is as effective and appropriate as possible, for you and for your computer;
4.6.4 to allow you and your child to participate in interactive features of our service, for example virtual learning environments, when you choose to do so; and
4.6.5 as part of our efforts to keep our website safe and secure.

 

Information we receive from other sources

 

4.7 We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for one of the purposes set out above (depending on the types of information we receive). For example, we may receive a court order relating to you which impacts on our use of your and your child’s information to protect the welfare of the child.

 

4.8 Also, social services or health practitioners may provide us with information (particularly sensitive personal data) about your child which may need to be added to the school’s child protection or special educational needs file. This kind of processing of sensitive personal data may be necessary (a) for the purposes of carrying out our obligations in the field of social security or social protection law, (b) for medical diagnosis or provision of health care and/or (c) to protect the vital interests of your child or another person taking into account the mental and physical capacity of your child.

 

4.9 In order to achieve the purposes described in paragraph 4.8, our schools may do the following:

 

4.9.1 keep a list of your child’s allergies or medical requirements within the classroom or staffroom in case of emergency. It is necessary for the school to have a list readily available to our staff so that we are able to look after your child promptly in the event of a medical emergency; and
4.9.2 rely on software applications and other technology to process medical information (such as allergies, accidents and injuries) about you and your children. For further information on the kind of technology we use, particularly in the context of processing sensitive personal data about your child, please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).

 

When we disclose information

 

4.10 We may share your and your child’s personal information with:

 

4.10.1 Cognita Regional Office [School community Partners/SCP] in Spain;
4.10.2 a member of the Cognita group of companies, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in article 44 of the Code of Commerce;
4.10.3 local authorities, education authorities (for example, National Association of British Schools in Spain (NABSS)), COBIS, Ministry of Education (or local equivalents) SEN co-ordinators, social services or the police where we have reason to believe there are safeguarding concerns in respect of your child;
4.10.4 exam boards (for example, Cambridge Assessment and Pearson) in order to successfully administer exams;
4.10.5 where your child is not British or a national of the Schengen area, we may have to provide information about you or your child to the Spanish immigration authorities;
4.10.6 professional advisors, debt collector, suppliers and sub-contractors for the performance of any contract we enter into with them or you; and
4.10.7 credit reference agencies for the purpose of assessing your credit score where this is a condition for us entering into a contract with you.

4.11 We may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use the terms of the parents’ contract (between us and you) and other agreements. We may also rely on a legitimate interest to share your information with a third party, for example exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

 

Where we need to get your consent

 

4.12 We will not market services to you (other than in accordance with paragraph 4.1.5, 4.1.6 and 4.1.7 above) without your consent and you have the right to ask us not to use your contact details for marketing.

 

4.13 We will seek your express permission to post any photographs of your child on any of our marketing materials (including our prospectus, advertisements or website). Consent is based on the age and degree of maturity of the child:

 

4.13.1 where a pupil is under the age of 14 or does not have a sufficient degree of maturity, we require consent from all legal guardians to use images of the pupil on marketing materials, social media and/or within the school; and
4.13.2 where a pupil is over the age of 14 and has a sufficient degree of maturity, we require consent exclusively from the pupil to use images of the pupil on marketing materials, social media and/or within the school.

 

4.14 You or your child do not have to give us details about your child’s race, religion or ethnicity if you do not want to. If you do provide us with this information, we only use these details to assist us with the day-to-day running of the school (for example, if your child’s religion means that he or she has particular dietary requirements then we will of course be much better informed if we have this information to cater to your child’s requirements) and for equal opportunities monitoring purposes.
Where you have given consent to the above, you can withdraw this consent at any time by contacting the Data Protection Coordinator (see paragraph 3).

 

5 SENSITIVE PERSONAL DATA

 

When we hold details about you or your child’s medical condition or health, race, ethnicity or religion, this type of information is called “sensitive personal data” which means the school must adopt higher standards of care to make sure this kind of data is safe and doesn’t fall into the wrong hands. It also means that we need to ask for your consent to collect and process that data when we ask for it. We will need to hold sensitive personal data about you or your child (a) for carrying out our obligations in the field of social security or social protection law, (b) for medical diagnosis or provision of health care or (c) to protect your or your child’s vital interests (d) for equal opportunities monitoring (e) for dietary requirements (f) for facilitating religious customs and practices e.g. prayer, dress and holidays / festivals or (g) for identification purposes. Every time we collect sensitive data from you about you or your child, we will inform you and collect your consent to the processing of that data. In order to achieve this, the school may also use software applications and other technology.

 

6 TRANSMISSION OF PERSONAL INFORMATION OUTSIDE THE EEA

 

6.1 The data that we process about you and your child may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). We try to limit this where possible but it may be necessary where, for example, one of our suppliers, has a data centre outside the EEA. We will take all steps reasonably necessary to ensure that your and your child’s data is treated securely and in accordance with this privacy notice and that the appropriate legal safeguards are in place prior to the transfer, for example ensuring that any contracts between us and the recipient of the information have EU-approved standard data protection clauses, or the country we are transferring the data to is deemed by the EU Commission a country with adequate protection.

 

7 YOUR RIGHTS

 

7.1 Under the GDPR, you and your child have the following rights:

 

7.1.1 Right to correction. You have the right to have inaccurate personal data about you or your child rectified.
7.1.2 The right to be forgotten. You have the right to request that we delete yours and your child’s personal data where: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or processed; (b) you withdraw your consent to processing for which we previously obtained your consent; (c) you object to the processing and, as a result, we agree to cease that processing (please see paragraph 7.1.5 for more details); (d) the personal data has been unlawfully processed; and (e) we are required to erase the personal data in order to comply with the law.
7.1.3 Right to restriction. You have the right to obtain from us the restriction of processing where: (a) you contest the accuracy of the personal data we hold about you; (b) the personal data has been unlawfully processed; (c) we no longer need the personal data but they are required in limited circumstances; and (d) you object to the processing and, as a result, we agree to cease that processing (please see paragraph 7.1.5 for more details).
7.1.4 Right to data portability. In certain circumstances, you have the right to receive personal data from us in a structured, commonly used and machine-readable format and the right to transmit it to a third party organisation.
7.1.5 Right to object. You have the right to raise an objection to any of our processing in paragraphs 4.1 and 4.2, including profiling and to decisions which are based solely on automated processing. Please tell us if you object to any type of processing that we do and we will work with you to address any concerns you may have.
7.1.6 Right to object to marketing. If you do not want us to process your personal data for direct marketing and particularly you do not want to receive commercial communications trough electronic means, please send us an email to the following e-mail address: DPO@cognita.com and we will ensure that you will not receive any direct marketing communications.
7.1.7 Right to complain to the competent authority. Whilst we would always prefer it if you approached us first about any complaints or queries you may have, you always have the right to lodge a complaint with the AEPD.
7.1.8 Right to request access. You have the right to access personal data we hold about you. We encourage you to contact the school’s Data Protection Co-ordinator and request our standard SAR form for you to complete in order to help us process your request.

 

8 HOW LONG WE KEEP PERSONAL INFORMATION

 

8.1 We will not keep any personal data about you for any longer than is necessary for the purposes for which the personal data are processed.

8.2 As a general rule, we keep your child’s education records during the life of the contractual relationship with us and for 6 years afterwards, with access restricted, at which point we destroy the file.

8.3 We follow a personal data retention policy which determines how long we keep specific types of personal information for. For further information about the criteria we use to determine what periods we keep specific information, please contact our Data Protection Officer or Data Protection Co-ordinator (see paragraph 3).

 

9 USE OF OUR WEBSITE

 

9.1 Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict risk-based procedures and security features to try to prevent unauthorised access.

 

10 CHANGES TO OUR PRIVACY NOTICE

 

10.1 Any changes we make to this privacy notice in the future will be posted on our website and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice.

 

Dated 15 October 2020