Privacy policy

ST. GEORGE INTERNATIONAL SCHOOL AND PRESCHOOL 2021/2022

PERSONAL DATA PROTECTION POLICY

Rationale

We, St. George International School and Preschool consider of great importance and seriousness the protection of personal data, we collect and process personal data in strict compliance with the requirements of the legislation of the Republic of Bulgaria and the General Regulation of Data Protection (Regulation (EC) 2016/679). The purpose of this Personal Data Protection Policy is that you are informed how we process your data, what personal data we would collect for you, for what purpose, terms of keeping, security measures, in which cases, and with whom we share your data, and respectively what are your rights.

WHO BEARS THE RESPONSIBILITY FOR THE PROCESSING OF YOUR DATA?

Responsibility for the processing of your data is born by St. George International School and Preschool, in its capacity of Data Administrator within the meaning of Regulation (EC) 2016/679.

For any questions relating to the processing of your personal data (and/or your children’s), you can contact us or your personal data protection officer at St. George International School and Preschool, Mrs. Nadezhda Shemshirova, at 0899992866 or write to us to the address Sofia, 47, N. Vaptsarov Blvd. or to the email address gdpr@stgeorgeschool.eu.bg.

HOW DO WE COLLECT PERSONAL DATA?

Generally, we receive personal data directly from the subject or his / her guardian/trustee when the subject is a child (minors) or you are a person who is charged by the guardian/trustee with rights and/or obligations regarding a pupil and the service we provide.

It may also be necessary to process personal information that we receive from other organisations, educational institutions, state / municipal authorities, companies or other third parties, for example – personal doctor, speech therapist, etc.

WHAT PERSONAL DATA DO WE COLLECT AND FOR WHAT PURPOSE THEY ARE PROCESSED:

In accordance with the General Data Protection Regulation, personal data is defined as: “Any information relating to an identifiable natural person or a natural person who may be identified (“data subject”); a natural person who can be identified, is one who can be identified, directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person.”

Website

When you visit our website, www.stgeorgeschool.eu, we may collect data about your use of the website through so-called “cookies”. Cookies are small text files that are remembered on your computer or mobile device on your first visit to our website. In this connection, see the Policy on Cookies (“Cookies”).

For the purpose of enrolling pupils

St. George International School and Preschool seeks to attract pupils with high academic and personal skills, and for us it is important to provide complete information about the learning process, the objectives of St. George International School and Preschool so that parents and prospective pupils can make an informed decision about their choice of education institution. In this connection prior survey of pupils is made, taking into consideration his / her age, academic potential and maturity of the pupil, the readiness for the respective class, school results and recommendations, participation in competitions, projects and initiatives, fluency in English. The survey is used as a means of obtaining information on the exact determination of the candidate-pupil level, allowing an individual approach to him/ her.

The personal data you provide by filling in the Application Form are the following:

About your child: Three names, PIN, birthplace, gender, nationality, age, native language, how the child is addressed (preferred / favourite), home address, including health information about your child: blood group, allergies, cardiovascular system, locomotory system diseases, central nervous system diseases, impaired vision, other important health information, medications at increased body temperature;

About the parents of the child: two names, date of birth, nationality, occupation and place of work, contact telephones and email.

Purpose of collection and processing: Identification of pre-contractual relations in connection with the implementation of the procedure for application and admission at St. George International School and Preschool, as well as the precise determination of the candidate – pupil level and an individual approach to him / her. Given the fact that the survey is carried out on the territory of St. George International School and Preschool and the candidate – pupil attends St. George International School and Preschool, the purpose of collecting information about his / her health condition is with a view to the prompt and adequate response of the competent persons in the event of an accident or a sudden deterioration / exacerbation of the health condition.

Method of keeping: On paper and electronic media.

Period of keeping: In the event that no contract is concluded with St. George International School and Preschool, the period for keeping the information is 3 (three) year;

In the event that a contract is concluded with St. George International School and Preschool, the deadline for keeping the information incorporated in the Application Form is 5 (five) years after the contractual relationship.

For the purposes of conclusion and implementation of the Tuition Contract

The provision of personal data is a mandatory contractual requirement as well as a requirement for the conclusion of a contract. In most cases, we require your personal data for the purpose of signing a contract to comply with a legal obligation or to protect our legitimate interest. Of course, for part of the services, you yourself provide this information by choosing and agreeing that it is processed. Without this data, we could not provide the relevant services. St. George International School and Preschool processes the data only for the purposes for which it is collected and does not use it for other purposes. These purposes are fully related to the education service offered. In particular, these purposes are:

• Conclusion of contracts;
• Administration of concluded contracts;
• Offering additional products and services;
• Settlement of financial relations;
• Ensuring effective communication;
• Providing security;
• Care for the life and health of pupils.

Personal data needed to conclude an education contract:

• Three names of the parent (legal representative) with whom the contract is concluded;
• PIN of a parent (legal representative) with whom the contract is concluded;
• Number of the personal identification card of a parent (legal representative) with whom the contract is signed;
• Three names of the child to be enrolled;
• PIN of the child to be enrolled.

Purpose of collection and processing: Identification of contractual relations.

Method of keeping: On paper and electronic media.

Period of keeping: For the purpose of performance of the contract and settlement of legal disputes and claims or protection of claims arising from contractual or legal obligations, by the end of the year following the end of the limitation period of the respective reciprocal claims.

Personal data necessary for the implementation of an education contract:

• Email address of a parent (legal representative) – Purpose: required for electronic diary, communication and use of Web e-payment Portal;
• Telephone number and address as per personal identification card / respectively, address for correspondence with the parents – Purpose: for communication and in case of emergency;
• PIN of a parent, child health data – Purpose: requirement of the Ministry of Education and other state and municipal institutions;
• Date of birth, place of birth and address of the child – Purpose: for identification, issuance of a certificate of completed educational stage, enrolment for competitions and transport service;
• Three names, photo and date of birth of a third person – Purpose: for identification, when indicating a third party authorized to take your child after the completion of St. George International School & Preschool sessions;
• Banking data – in connection with the identification and proper servicing of the payments made under the Education Contract.

Method of keeping: On paper and electronic media.

Period of keeping: For the purpose of performance of the contract and settlement of legal disputes and claims or protection of claims arising from contractual or legal obligations, by the end of the year following the end of the limitation period of the respective reciprocal claims.

• Settlement of legal disputes and claims or protection against claims as well as enforcement, arising from contractual or legal obligations in relation to the legitimate interest of the claimant or defendant under Art. 6 (1) (f) of the General Data Protection Regulation, and
• To the extent that processing and use of your data may be required by law, e.g. the observance of the deadlines for keeping documents for tax and commercial purposes or for fulfilment of the obligations for identification and registration under the Measures against Money Laundering Act, 6 (1) (c) of the General Data Protection Regulation.

More data or additions to the data processing purposes can be found in the relevant contractual documents, templates, statement of consent and / or any other information you provide (e.g. in the context of using our website or our terms and conditions).

TO WHOM AND WHAT FOR WE PROVIDE PERSONAL DATA

St. George International School and Preschool uses third parties to support certain contractual activities or to fulfil a legal obligation. We do not provide your personal data to third parties before we are sure that all technical and organizational measures have been taken to protect this data by striving to carry out strict controls to meet this goal. The provision of personal data in some cases is mandatory in order to comply with our legal requirements and, in this connection, we provide information to:

• The Ministry of Education and the Regional Education Management – Sofia-City – under the Law on Pre-school and School Education and the related subordinate regulations;
• Other schools and institutions – under the Pre-school and School Education Act and the related subordinate regulations;
• The National Revenue Agency;
• External service companies (e.g. maintenance / technical support of IT / IT applications, archiving, document processing). The Company has expressly concluded an Agreement for the protection of the provided data;
• External companies – St. George International School and Preschool has expressly concluded an Agreement for the protection of the provided data;
• St. George International School and Preschool may also use “cloud” technology to process your data. In this regard, we would like you to know that in our practice we require a contract with the suppliers of such technologies that contains explicit instructions on data protection and confidentiality measures the suppliers are required to comply with.
• Processors of personal data that require your personal data to fulfill our contractual and legal obligations or in the context of our legitimate interest, for internal administrative purposes;
• The competent authorities which, by virtue of a statutory instrument, have the power to require the provision of information, including personal data, such as courts, prosecutors, private enforcement agents, various regulatory bodies such as the Consumer Protection Commission, the Commission for Personal Data Protection other state bodies;
• Auditors;
• Others.

In the organisation, only those departments that are committed to implementing our contractual relationships, legal obligations or protecting legitimate interests have access to the personal data you have provided. Within the frame of our contractual relationship, we can outsource the processing to subcontractors, which can access your personal data. Compliance with data protection rules is ensured through a contract with our subcontractors.

WE CAN COLLECT YOUR PERSONAL DATA ALSO IN THE FOLLOWING CASES:

• When transferring personal data from our group on the basis of the legal grounds provided for in Regulation 2016/679;
• By contacting us through all possible communication channels (e.g., letters and emails that we receive from you during our communication). The data is only used to process the query and provide a response. The ground for processing is the legitimate interest of the parties, which is conditioned by the desire and the need to respond to the inquiry, eventually to solve problems. When applying for a scholarship to non-governmental organizations – besides the basic personal data (three names, PIN, permanent address, correspondence address, e-mail, etc.) also
  – family status data,
  – data from income certificates (lease, management, employment contract), etc.;
• St. George International School & Preschool carries out video surveillance as an activity related to the processing of personal data. The data from the video surveillance shall be kept for a minimum period specified in the Data Keeping Procedure. The video surveillance activity is performed by a company with which St. George International School & Preschool has signed a service contract. Video surveillance is done on sites labelled with compact privacy notices. The purpose is to ensure the legitimate interest of the organization, as well as the security of employees and pupils and to protect their property, without in any way affecting the rights and dignity of the data subjects.
• When conducting recruitment campaigns.

AUTOMATED ALGORITHMS

We do not use means of automated decision-making.

SECURITY

The security of the data you entrust to us is very important to us. We therefore protect your data by applying all the appropriate technical and organizational means at our disposal in order to prevent unauthorized access, unauthorized or malicious use. St. George International School and Preschool takes measures to protect your personal data from accidental loss and unauthorized access, use, modification or disclosure. There are policies and procedures designed to protect information from loss, misuse and unauthorized disclosure. In addition, we take additional information security measures, including access control, strict physical protection and reliable practices for collecting, keeping and processing information. Some of the actions taken are:

1. Physical, organizational and technical protection measures:
   – defining the controlled access zones;
   – defining the premises where personal data are processed, incl. where our servers are located as well as access restriction;
   – defining the organization of physical access;
   – defining the technical means for physical protection – in special rooms and lockers;
   – defining an infringement response team.
2. Protection by staff:
   – familiarizing the staff with the specifics of processing personal data and the legal framework in the field of personal data protection,
   with this policy and other related internal regulations;
   – confidentiality of information;
   – staff training.;
3. Protection of documents:
   – defining deadlines for keeping;
   – dissemination rules;
   – procedures for destruction, inspection and control of processing.

WHEN DO WE PROCEED WITH THE DELETION OF YOUR PERSONAL DATA?

We keep all the information we have collected for you and destroy it in a specified order within the statutory time limits and if there are none – within the time limits set by us in our Keeping Restriction Policy.

All terms defined by St. George International School and Preschool meet the purposes of the personal data provided, respectively the provided services. Personal data will be kept for the time it takes to fulfil the above purposes. In some cases, we keep the personal data for the period of the total limitation period (5 years) for the purpose of ascertainment and protection from legal claims.

Some keeping deadlines are legally defined:

– 10 years under the Law on Accounting for the storage and processing of accounting data;
– 50 years, according to Ordinance № 8 of 11.08.2016 on the information and documents in the system of pre-school and school education (in force from 15.09.2017).

Transfer between countries

St. George International School and Preschool does not transfer the collected information outside the European Union. In the event that such a transfer is necessary, we will verify that an adequate level of protection is ensured within the meaning of the General Regulation on the protection of personal data. You will also be informed about the category of personal data and the grounds for the transfer.

Your rights with regard to personal data

At any time, you may ask St. George International School and Preschool to provide you with information and access to the personal data that is collected and stored for you. You may also require St. George International School and Preschool to correct, delete or update such personal data. We also provide you with the right to object and limit the processing of personal data and your rights in automated decision making. St. George International School and Preschool takes the necessary measures to exercise the rights of the subjects to be carried out in accordance with the requirements of Regulation (EC) 2016/679 and the applicable legislation.

You may at any time withdraw your consent to the collection, keeping and use of your personal data with St. George International School and Preschool. The right to withdraw your consent to processing the data may be exercised when it is processed solely on the basis of your explicit consent. However, the withdrawal will not affect the data that have been legally processed until the withdrawal.

When exercising the right to data portability, you have the right to require personal data to be forwarded directly to us by another personal data administrator, as far as this is technically feasible.

Part of your rights, such as data deletion or objection to processing, may be restricted by applicable law.

Data subjects can take advantage of their rights by filling in the templates prepared by the Administrator and published on St. George International School and Preschool’s website at www.stgeorgeschool.eu or by writing in free form. Requests for access to information or for correction are submitted either personally or by an explicitly authorized person, by means of an explicit written authorization. An application may also be made electronically, in accordance with the Law on Electronic Document and Electronic Signature.

St. George International School and Preschool examines and decides on all received requests or complaints, except for anonymous submissions where the data subject cannot be uniquely identified. Requests / complaints shall be considered within one month of their receipt. If necessary, this period may be extended by a further two months, considering the complexity and the number of requests. We will inform you of any such extension within one month of receipt of the request, indicating the reasons for the delay.

The response shall be communicated to the data subject in writing or by another convenient way specified by him / her. If we do not meet your request within the required deadlines, or refuse to accept a complaint, we will state the reasons why we have not acted or refused to do so.

The actions for the exercise of the rights of the data subjects are carried out free of charge. St. George International School and Preschool reserves the right to charge a fee in case of repeatability or excessive demand.

We would like to inform you that under the current legislation, you have the right to file a complaint about the way your data is processed with the Supervisory Authority Commission for Personal Data Protection, 1592 Sofia, 2, “Prof. Tsvetan Lazarov” Blvd. or www.cpdp.bg.

ARE YOU OBLIGED TO PROVIDE PERSONAL DATA ABOUT YOU AND YOUR CHILD?

With regard to pupils’ admissions campaigns and within the framework of a contractual relationship on the provision of education service, you must provide the relevant personal data necessary to initiate, conduct and terminate these relationships and to fulfil the related obligations, and we are legally required or entitled to collect such personal data in order to protect our legitimate interests and to protect the life and health of learners. Without processing this data, we would not be able to provide the education services.

Changes to this Personal Data Protection Policy

This personal data protection procedure can be changed over time. Such changes will take effect immediately after their disclosure. Regular review of this page ensures that you will always be aware of what information we collect, how and for what purposes the Chiefs of Staff of St. George International School and Preschool uses it and under what circumstances (if any) we will share it with other parties.