PERSONAL DATA PROTECTION POLICY

St. George International School & Preschool, re-registered with the Order of the Minister of Education and Science No RD 14-37 / 28.03. 2017, registered as Cambridge Primary School and Cambridge International School with No BG 032, an EDEXCEL Authorized Education Centre with No 97020 for conducting training and exams on the British National Curriculum, registered as an International School with the Standards and Testing Agency of the United Kingdom of Great Britain and Northern Ireland with No (ISN) 1440085, with seats and address of management: Sofia, 47, Nikola Vaptsarov Blvd., entered in the Commercial Register at the Registry Agency under UIC 204426056.

Between St. George International School & Preschool and Wonder Group AD a contract is signed for the provision of complex services, their organisation, conduct and administration during the course of the adopted compulsory curriculum in St. George International School & Preschool and the optional additional program. (“Data Protection Policy” of Wonder Group AD).

We, St. George International School & Preschool, consider of great importance and seriousness the protection of personal data, we collect and process personal data in strict compliance with the requirements of the legislation of the Republic of Bulgaria and the General Regulation of Data Protection (Regulation (EC) 2016/679). The purpose of this Personal Data Protection Policy is that you are informed how we process your data, what personal data we would collect for you, for what purpose, terms of keeping, security measures, in which cases, and with whom we share your data, and respectively what are your rights.

WHO BEARS THE RESPONSIBILITY FOR THE PROCESSING OF YOUR DATA?

Responsibility for the processing of your data is born by Private Secondary School “St. George” EOOD, in its capacity of Data Administrator within the meaning of Regulation (EC) 2016/679.

For any questions relating to the processing of your personal data (and / or your children’s), you can contact us or your personal data protection officer at St. George International School & Preschool, Mrs. Andriana Chomakovska, at 02/4144414 or write to us to the address Sofia, 47, N. Vaptsarov Blvd. or to the email address gdpr@stgeorgeschool.eu.bg

HOW WE COLLECT PERSONAL DATA?

Generally, we receive personal data directly from the subject or his / her guardian / trustee when the subject is a child (minors) or you are a person who is charged by the guardian / trustee with rights and / or obligations regarding a pupil and the service we provide.

It may also be necessary to process personal information that we receive from other organisations, educational institutions, state / municipal authorities, Wonder Group AD companies or other third parties, for example – personal doctor, speech therapist, etc.

WHAT PERSONAL DATA WE COLLECT AND FOR WHAT PURPOSE THEY ARE PROCESSED:

In accordance with the General Data Protection Regulation, personal data is defined as: “Any information relating to an identifiable natural person or a natural person who may be identified (“data subject”); a natural person who can be identified, is one who can be identified, directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person.”

WEBSITE

When you visit our website, www.stgeorgeschool.eu, we may collect data about your use of the website through so-called “cookies”. Cookies are small text files that are remembered on your computer or mobile device on your first visit to our website. In this connection, see the Policy on Cookies (“Cookies”).

FOR THE PURPOSE OF ENROLLING PUPILS

St. George International School & Preschool seeks to attract pupils with high academic and personal skills, and for us it is important to provide complete information about the learning process, the objectives of St. George International School & Preschool, so that parents and prospective pupils can make an informed decision about their choice of education institution. In this connection prior survey of pupils is made, taking into consideration his / her age, academic potential and maturity of the pupil, the readiness for the respective class, school results and recommendations, participation in competitions, projects and initiatives, fluency in English. The survey is used as a means of obtaining information on the exact determination of the candidate-pupil level, allowing an individual approach to him / her.

The personal data you provide by filling in the Application Form are the following:
About your child: Three names, PIN, birthplace, gender, nationality, age, native language, how the child is addressed (preferred / favourite), home address, including health information about your child: blood group, allergies, cardiovascular system, locomotory system diseases, central nervous system diseases, impaired vision, other important health information, medications at increased body temperature;

About the parents of the child: two names, date of birth, nationality, occupation and place of work, contact telephones and email.
Purpose of collection and processing: Identification of pre-contractual relations in connection with the implementation of the procedure for application and admission at St. George International School & Preschool, as well as the precise determination of the candidate – pupil level and an individual approach to him / her. Given the fact that the survey is carried out on the territory of St. George International School & Preschool and the candidate – pupil attends St. George International School & Preschool from 08.00. until 14.00, the purpose of collecting information about his / her health condition is with a view to the prompt and adequate response of the competent persons in the event of an accident or a sudden deterioration / exacerbation of the health condition.

Method of keeping: On paper and electronic media.

Period of keeping: In the event that no contract is concluded with St. George International School & Preschool, the period for keeping the information is 1 (one) year;

In the event that a contract is concluded with St. George International School & Preschool, the deadline for keeping the information incorporated in the Application Form is 5 (five) years after the contractual relationship.

FOR THE PURPOSES OF CONCLUSION AND IMPLEMENTATION OF THE EDUCATION CONTRACT

The provision of personal data is a mandatory contractual requirement as well as a requirement for the conclusion of a contract. In most cases, we require your personal data for the purpose of signing a contract to comply with a legal obligation or to protect our legitimate interest. Of course, for part of the services, you yourself provide this information by choosing and agreeing that it is processed. Without this data, we could not provide the relevant services. St. George International School & Preschool processes the data only for the purposes for which it is collected and does not use it for other purposes. These purposes are fully related to the education service offered. In particular, these purposes are:

  • Conclusion of contracts;
  • Administration of concluded contracts;
  • Offering additional products and services;
  • Settlement of financial relations;
  • Ensuring effective communication;
  • Providing security;
  • Care for the life and health of pupils.

Personal data needed to conclude an education contract:

  • Three names of the parent (legal representative) with whom the contract is concluded;
  • PIN of a parent (legal representative) with whom the contract is concluded;
  • Number of the personal identification card of a parent (legal representative) with whom the contract is signed;
  • Three names of the child to be enrolled;
  • PIN of the child to be enrolled.

Purpose of collection and processing: Identification of contractual relations.

Method of keeping: On paper and electronic media.

Period of keeping: For the purpose of performance of the contract and settlement of legal disputes and claims or protection of claims arising from contractual or legal obligations, by the end of the year following the end of the limitation period of the respective reciprocal claims.

Personal data necessary for the implementation of an education contract:

  • Email address of a parent (legal representative) – Purpose: required for electronic diary and communication;
  • Telephone number and address as per personal identification card / respectively, address for correspondence with the parents – Purpose: for communication and in case of emergency;
  • PIN of a parent, child health data – Purpose: requirement of the Ministry of Education and other state and municipal institutions;
  • Date of birth, place of birth and address of the child – Purpose: for identification, issuance of a certificate of completed educational stage, enrolment for competitions and transport service;
  • Three names and date of birth of a third person – Purpose: for identification, when indicating a third party authorized to take your child after the completion of St. George International School & Preschool sessions;
  • Banking data – in connection with the identification and proper servicing of the payments made under the Education Contract.

Method of keeping: On paper and electronic media.

Period of keeping: For the purpose of performance of the contract and settlement of legal disputes and claims or protection of claims arising from contractual or legal obligations, by the end of the year following the end of the limitation period of the respective reciprocal claims.

* Settlement of legal disputes and claims or protection against claims as well as enforcement, arising from contractual or legal obligations in relation to the legitimate interest of the claimant or defendant under Art. 6 (1) (f) of the General Data Protection Regulation, and

* To the extent that processing and use of your data may be required by law, e.g. the observance of the deadlines for keeping documents for tax and commercial purposes or for fulfilment of the obligations for identification and registration under the Measures against Money Laundering Act, 6 (1) (c) of the General Data Protection Regulation.

More data or additions to the data processing purposes can be found in the relevant contractual documents, templates, statement of consent and / or any other information you provide (e.g. in the context of using our website or our terms and conditions).

TO WHOM AND WHAT FOR WE PROVIDE PERSONAL DATA

St. George International School & Preschool uses third parties to support certain contractual activities or to fulfil a legal obligation. We do not provide your personal data to third parties before we are sure that all technical and organizational measures have been taken to protect this data by striving to carry out strict controls to meet this goal. The provision of personal data in some cases is mandatory in order to comply with our legal requirements and, in this connection, we provide information to:

  • The Ministry of Education and the Regional Education Management – Sofia-City – under the Law on Pre-school and School Education and the related subordinate regulations;
  • Other schools and institutions – under the Pre-school and School Education Act and the related subordinate regulations;
  • Durham University – the English partner of St. George International School & Preschool, processing results of candidate – pupils in order to determine the level of English knowledge when applying. For the purposes of the data protection provisions, Durham University is responsible for processing the abovementioned categories of data forwarded by us;
  • Cambridge International School and Cambridge Primary School – in fulfilment of contractual obligations, given the fact that St. George International School & Preschool is registered as Cambridge Primary School and Cambridge International School. For the purposes of personal data protection provisions, Cambridge International School and Cambridge Primary School are responsible for the processing of personal data forwarded by us;
  • External service companies (e.g. maintenance / technical support of IT / IT applications, archiving, document processing). The Company has expressly concluded an Agreement for the protection of the provided data;
  • Wonder Group AD – A contract for the provision of complex services, their organization, conduct and administration is signed between St. George International School & Preschool and Wonder Group AD during the course of the compulsory school curriculum and the optional additional program. As long as the parents conclude a Service Agreement with Wonder Group AD, within the meaning of the provisions for the protection of personal data, Wonder Group AD is an administrator of the data provided under this Service Agreement and is responsible for their management;
  • Processors of personal data that require your personal data to fulfil our contractual and legal obligations or in the context of our legitimate interest, for internal administrative purposes;
  • The National Revenue Agency;
  • The competent authorities which, by virtue of a statutory instrument, have the power to require the provision of information, including personal data, such as courts, prosecutors, private enforcement agents, various regulatory bodies such as the Consumer Protection Commission, the Commission for Personal Data Protection other state bodies;
  • Auditors;
  • Others.

In the organization, only those departments that are committed to implementing our contractual relationships, legal obligations or protecting legitimate interests have access to the personal data you have provided. Within the frame of our contractual relationship, we can outsource the processing to subcontractors, which can access your personal data. Compliance with data protection rules is ensured through a contract with our subcontractors.

WE CAN COLLECT YOUR PERSONAL DATA ALSO IN THE FOLLOWING CASES:

  • When transferring personal data from our group (Wonder Group AD, UIC 201181897) on the basis of the legal grounds provided for in Regulation 2016/679;
  • By contacting us through all possible communication channels (e.g., letters and emails that we receive from you during our communication). The data is only used to process the query and provide a response. The ground for processing is the legitimate interest of the parties, which is conditioned by the desire and the need to respond to the inquiry, eventually to solve problems. When applying for a scholarship to non-governmental organizations – besides the basic personal data (three names, PIN, permanent address, correspondence address, e-mail, etc.) also
  • family status data,
  • data from income certificates (lease, management, employment contract), etc.;
  • PSS “SAINT GEORGE” carries out video surveillance as an activity related to the processing of personal data. The data from the video surveillance shall be kept for a minimum period specified in the Data Keeping Procedure. The video surveillance activity is performed by a company with which PSS “SAINT GEORGE” has signed a service contract. Video surveillance is done on sites labelled with compact privacy notices. The purpose is to ensure the legitimate interest of the organization, as well as the security of employees and pupils and to protect their property, without in any way affecting the rights and dignity of the data subjects.
  • When conducting recruitment campaigns.

AUTOMATED ALGORITHMS

We do not use means of automated decision-making.

SECURITY

The security of the data you entrust to us is very important to us. We therefore protect your data by applying all the appropriate technical and organizational means at our disposal in order to prevent unauthorized access, unauthorized or malicious use. PSS “SAINT George” takes measures to protect your personal data from accidental loss and unauthorized access, use, modification or disclosure. There are policies and procedures designed to protect information from loss, misuse and unauthorized disclosure. In addition, we take additional information security measures, including access control, strict physical protection and reliable practices for collecting, keeping and processing information. Some of the actions taken are:

1. Physical, organizational and technical protection measures:

  • defining the controlled access zones;
  • defining the premises where personal data are processed, incl. where our servers are located as well as access restriction;
  • defining the organization of physical access;
  • defining the technical means for physical protection – in special rooms and lockers;
  • defining an infringement response team.

2. Protection by staff:

  • familiarizing the staff with the specifics of processing personal data and the legal framework in the field of personal data protection, with this policy and other related internal regulations;
  • confidentiality of information;
  • staff training.;

3. Protection of documents:

  • defining deadlines for keeping;
  • dissemination rules;
  • procedures for destruction, inspection and control of processing.


WHEN DO WE PROCEED WITH DELETION OF YOUR PERSONAL DATA?

We keep all the information we have collected for you and destroy it in a specified order within the statutory time limits and if there are none – within the time limits set by us in our Keeping Restriction Policy.

All terms defined by St. George International School & Preschool meet the purposes of the personal data provided, respectively the provided services. Personal data will be kept for the time it takes to fulfil the above purposes. In some cases, we keep the personal data for the period of the total limitation period (5 years) for the purpose of ascertainment and protection from legal claims.

Some keeping deadlines are legally defined:
– 10 years under the Law on Accounting for the storage and processing of accounting data;
– 50 years, according to Ordinance № 8 of 11.08.2016 on the information and documents in the system of pre-school and school education (in force from 15.09.2017).

Transfer between countries

PSS “SAINT GEORGE” does not transfer the collected information outside the European Union. In the event that such a transfer is necessary, we will verify that an adequate level of protection is ensured within the meaning of the General Regulation on the protection of personal data. You will also be informed about the category of personal data and the grounds for the transfer.
Your rights with regard to personal data

At any time, you may ask St. George International School & Preschool to provide you with information and access to the personal data that is collected and stored for you. You may also require St. George International School & Preschool to correct, delete or update such personal data. We also provide you with the right to object and limit the processing of personal data and your rights in automated decision making. PSS “SAINT GEORGE” takes the necessary measures to exercise the rights of the subjects to be carried out in accordance with the requirements of Regulation (EC) 2016/679 and the applicable legislation.

You may at any time withdraw your consent to the collection, keeping and use of your personal data with St. George International School & Preschool. The right to withdraw your consent to processing the data may be exercised when it is processed solely on the basis of your explicit consent. However, the withdrawal will not affect the data that have been legally processed until the withdrawal.

When exercising the right to data portability, you have the right to require personal data to be forwarded directly to us by another personal data administrator, as far as this is technically feasible.

Part of your rights, such as data deletion or objection to processing, may be restricted by applicable law.

Data subjects can take advantage of their rights by filling in the templates prepared by the Administrator and published on St. George International School & Preschool’s website at www.stgeorgeschool.eu or by writing in free form. Requests for access to information or for correction are submitted either personally or by an explicitly authorized person, by means of an explicit written authorization. An application may also be made electronically, in accordance with the Law on Electronic Document and Electronic Signature.

St. George International School & Preschool examines and decides on all received requests or complaints, except for anonymous submissions where the data subject cannot be uniquely identified. Requests / complaints shall be considered within one month of their receipt. If necessary, this period may be extended by a further two months, considering the complexity and the number of requests. We will inform you of any such extension within one month of receipt of the request, indicating the reasons for the delay.

The response shall be communicated to the data subject in writing or by another convenient way specified by him / her. If we do not meet your request within the required deadlines, or refuse to accept a complaint, we will state the reasons why we have not acted or refused to do so.

The actions for the exercise of the rights of the data subjects are carried out free of charge. St. George International School & Preschool reserves the right to charge a fee in case of repeatability or excessive demand.

We would like to inform you that under the current legislation, you have the right to file a complaint about the way your data is processed with the Supervisory Authority Commission for Personal Data Protection, 1592 Sofia, 2, “Prof. Tsvetan Lazarov” Blvd. or www.cpdp.bg.

ARE YOU OBLIGED TO PROVIDE PERSONAL DATA ABOUT YOU AND YOUR CHILD?

With regard to pupils’ admissions campaigns and within the framework of a contractual relationship on the provision of education service, you must provide the relevant personal data necessary to initiate, conduct and terminate these relationships and to fulfil the related obligations, and we are legally required or entitled to collect such personal data in order to protect our legitimate interests and to protect the life and health of learners. Without processing this data, we would not be able to provide the education services.

Changes to this Personal Data Protection Policy

This personal data protection procedure can be changed over time. Such changes will take effect immediately after their disclosure. Regular review of this page ensures that you will always be aware of what information we collect, how and for what purposes the Chiefs of Staff of St. George International School & Preschool uses it and under what circumstances (if any) we will share it with other parties.

This Personal Data Protection Policy was last updated on 31.08.2018.

error: Content is protected !!