Privacy Statement 

Contents

  1. Who are we?

          1.1. BSB as Data Controller

          1.2. Data Protection Officer

  1. Scope of this Statement

  2. What information do we collect about you?

  3. Why do we need your data?

  4. Do we request your consent for processing?

          5.1. What is a lawful basis for processing?

          5.2. What are our lawful basis for processing?

  1. With which other parties do we share your personal data?

  2. Where is the data stored and processed?

  3. How long do we retain your personal data?

  4. How do we protect your personal information?

  5. What are your rights?

          10.1. Your rights in detail

          10.2. How you can exercise your or your child’s rights

  1. How can you submit questions or complaints?

  2. Amendments to this Statement

1. Who are we?

1.1. BSB as Data Controller

With this Statement (hereafter referred to as the ‘Statement’) we wish to inform you why and how your personal data are collected and processed by The British School of Brussels (‘BSB’), a not-for-profit organisation under Belgian law, having its registered office in Belgium at Pater Dupierreuxlaan 1, 3080 Tervuren, and registered in the Belgian Crossroad Bank for Enterprises under enterprise number 0408.705.045 (hereafter collectively referred to as ‘ we’ or ‘the school’).

Our contact details can be found in point 11 of this Statement.

We are responsible for processing the personal data that we request and use. As Data Controller, we take the measures that ensure that you:

  • continue to be informed about our processing of your personal data and your rights;
  • retain control of the personal data that we process;
  • are able to exercise your rights relating to your personal data. More information on your rights can be found in point 10 of this Statement.

1.2. Data Protection Officer

We have also appointed a Data Protection Officer. This is an expert on the protection of personal data, who offers an additional guarantee for the correct processing of your personal data by us. You can contact the Data Protection Officer through the channels set out in point 11 of this Statement.

2. Scope of this Statement

This Statement relates to the school’s processing of personal data about prospective, current and past students and their parents (hereafter referred to as ‘you’ and, where referring to a parent’s relationship to his or her child, as ‘your child’).

3. What information do we collect about you?

‘Personal data’ means all information relating to you as a given living natural person. The personal data we collect process and store includes information such as:

  • names, addresses, telephone numbers, e-mail addresses and other contact details;
  • family details;
  • academic, disciplinary and other education-related records, information about special educational needs, references, assessment data and records and marks;
  • education and employment data;
  • images, audio and video recordings (for the purposes of school celebrations and marketing);
  • financial information;
  • passport details
  • schools previously attended (where appropriate).

We also collect and process the so-called sensitive data, namely:

  • personal data such as religion;
  • health-related information.

4. Why do we need your data?

The school will process your personal data for a range of contractual, statutory and public or legitimate interest purposes, including the following:

  • to administer your contract with the school
  • to deliver and administer your child’s education, record the details of your child’s studies and determine and/or confirm his/her achievements
  • to communicate effectively with you by post, email and phone, including the distribution of the school newsletter
  • to promote the school on our website or school-controlled social media, the school prospectus and other publications and communications conducted by the school
  • to establish, exercise, defend and indemnify our rights or those of the people who may represent us, for example, in the event of disputes
  • to administer the financial aspects of your relationship with us
  • to deliver IT facilities to you
  • to deliver facilities and services to you (e.g. sport, libraries, accommodation)
  • to enable your participation at events (e.g. functions, graduation)
  • to operate security (including CCTV), governance, disciplinary, complaint, audit and quality assurance processes and arrangements
  • to support your training, medical, safety, welfare and religious requirements
  • to compile statistics and conduct surveys and research for internal and statutory reporting purposes
  • to fulfil and monitor our responsibilities under equalities, immigration and public safety legislation
  • to enable us to contact others in the event of an emergency (we will assume that you have checked with the individuals before you supply their contact details to us).

Our website www.britishschool.be uses cookies, which are small text files stored on your device, and similar technologies. You can find more information about the use of cookies in our Cookie Statement, as made available on the aforementioned website.

5. Do we request your consent for processing?

5.1. What is a lawful basis for processing?

We must have a valid lawful basis in order to process personal data. There are six available lawful basis for processing. At least one of them must apply whenever we process your personal data:

  • Consent: you have given clear consent to process your data for a specific purpose
  • Contract: the processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract
  • Legal obligation: the processing is necessary for us to comply with the law
  • Vital interests: the processing is necessary to protect someone’s life
  • Public task: the processing is necessary for us to perform a task in the public interest or for official functions, and the task or function has a clear basis in law
  • Legitimate interests: the processing is necessary for our legitimate interests unless there is a good reason to protect your personal data, which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

No single basis is ’better’ or more important than the others. Which basis is most appropriate to use will depend on the purpose of the processing and our relationship with you.

5.2. What are our lawful bases for processing?

We consider the processing of your personal information for the purposes mentioned under point 4 of this Statement to be either necessary for the performance of our contractual obligations with you (e.g. to manage your child’s education, experience and welfare while being educated at BSB), or necessary for compliance with a legal obligation (e.g. visa monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. teaching and research), or necessary for the pursuit of the legitimate interests of the school or an external organisation (e.g. to distribute relevant newsletters).

If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. In case we require your consent with a certain processing activity, a consent form is provided to you, i.e. parents and/or mature students, under one of the following forms:

  • paper-based consent forms;
  • electronic consent forms;
  • digital applications to obtain consent.

Where we ask for any sensitive information, such as that concerning your nationality, religion or health/disability, you will normally have the option to refuse your consent by not supplying it.

6. With which other parties do we share your personal data?

The school will share your data with the following people and/or entities:

  • We share personal data with our employees, but only those who effectively need access to perform their duties have access to your data. These employees act under our supervision and responsibility.
  • We also call on external suppliers who have contracts with the school, such as:
    • catering
    • photographer
    • healthcare service provider
    • IT contractor
    • IT software provider.

Since such third parties have access to personal data within the scope of the services and/or products we have requested, and we ensure that technical, organisational and contractual measures are taken so that your personal data will only be processed and used for the purposes stated in point 3 of this Statement.

  • We can be legally obliged to provide your personal data to exam boards, administrative authorities or judicial authorities.

7. Where is the data stored and processed?

Your data will in principle, not be transported outside the EU. In any case, we will ensure that the minimum legal requirements and security standards are respected at all times. If we suspect that your data will be stored and processed outside the EU, we will ensure that the same level of protection is used as is applicable within the EU, e.g. by contracting with those non-EU entities according to a model approved by the European Commission. If that same level of protection cannot be guaranteed, we will ask for your explicit consent prior to the transfer of your or your child’s data outside the EU.

As regards international trips outside the EU that the school organises for your child, you will always be contacted for your consent. The consent will be limited in time and content if it be required.

8. How long do we retain your personal data?

We only store your data for as long as this is necessary for the purposes for which the data is to be used as stated in point 4 of this Statement. As soon as your data is no longer required and we do not have a legal obligation to retain it we will permanently erase or, if this is not possible, anonymise the data in our systems.

Since the need to retain data may vary by the type of data and by the purpose of the processing, the actual retention periods may vary considerably.

We can hereby inform you that we take the following criteria, among others, into account when determining the retention periods:

  • how long is the personal data needed for the requested service to be provided?
  • have we been given permission for a longer retention period?
  • do we have a legal, contractual or similar obligation to retain the data?

Your personal data will, in any case, be retained and used for as long as necessary to comply with our legal obligations, to settle disputes or to enforce our agreements.

9. How do we protect your personal information?

Your personal data is considered to be strictly confidential. We take the appropriate technical and organisational measures to protect the provided and collected personal data from destruction, loss, unintended alteration, damage, accidental or unlawful access or any other unauthorised processing.

10. What are your rights?

10.1. Your rights in detail

i. The right to access your or your child’s personal data

You have the right to access and inspect your or your child’s personal data processed by us. We will provide you with a copy of your personal data in this connection free of charge if you so request.

ii. The right to rectify your or your child’s personal data

You have the right at any time to have incorrect, incomplete, inappropriate or outdated personal data erased or rectified. If you dispute the accuracy of your or your child’s personal data, you may request a limitation of its processing for a period that enables us to verify the accuracy of your personal data.

iii. The right to withdraw your consent

If the processing is based on your consent, then you have the right to withdraw this consent at any time.

iv. The right to object to certain processing

If your personal data is processed on the basis of a public interest or our legitimate interest (e.g. for statistical purposes), you have the right to object to the processing of your personal data for reasons relating to your specific situation. We shall then no longer process the personal data unless (i) for the establishment, exercise or defence of legal claims, or (i) if we demonstrate compelling legitimate grounds for the processing which override your or your child’s interests, rights and freedoms.

If you objected to a processing operation, you may request that we limit the processing of your personal data pending the verification whether our legitimate grounds override those of you.

v. The right to have your or your child’s personal data erased

You are entitled to have your or your child’s personal data deleted. Based on this, if you no longer wish to have a relationship with us you can ask us to stop using your personal data. However, we may keep personal data that is required for purposes of proof.

Under this right of erasure, you also have the right to ask us at any time to stop using your personal data that is processed on the basis of your consent or our legitimate interest. Due to legitimate interests, we may still continue to process your personal data after weighing your interests against ours, unless you decide to terminate your relationship with us.

vi. The right to data portability

With respect to the processing of your personal data based on your consent, or because it is necessary for the performance of your contract with us, you may ask us to forward your or your child’s personal data to you - in a structured, commonly used and digital form - so that you can keep your data for personal (re)use, or to forward this data directly to another data controller, to the extent that this is technically feasible for us.

vii. The right not to be subject to automated decision making, including profiling

We will not use your personal information to carry out any wholly automated decision-making that affects you.

10.2. How you can exercise your or your child’s rights

To exercise the rights mentioned above you may send us a written request:

  • by email: dpo@bdo.be
  • at the following postal address: Attention DPO, The British School of Brussels (BSB) Pater Dupierreuxlaan 1, 3080 Tervuren, Belgium

When exercising your right, we request that you clearly state the right to which you wish to appeal and any processing operation(s) you oppose or which consent you wish to withdraw.

Important notice to parents: before responding to a request about your child’s personal data, we will consider whether your child is mature enough to understand his or her rights. Where a child is not considered to be mature enough, an adult with parental responsibility may exercise the child’s data protection rights on their behalf. If we are confident that your child can understand his or her rights, then we will in principle only respond directly to your child. In such case, we will allow you, the parent, to exercise your child’s rights on their behalf if your child authorises this, or if it is evident that this is in the best interests of your child.

11. How can you submit questions or complaints?

If you have a question or complaint about our processing of personal data please contact us through the following channels:

  • by email: dpo@bdo.be
  • at the following postal address: Attention DPO, The British School of Brussels (BSB) Pater Dupierreuxlaan 1, 3080 Tervuren, Belgium

If you are not satisfied with our response, if you have any comments regarding the exercise of your or your child’s rights or if you believe that our processing of your or your child’s personal data does not comply with the legislation, then you are entitled to file a complaint with the Data Protection Authority. All information on this matter can be found at

https://www.dataprotectionauthority.be/

12. Amendments to this Statement

We may amend or supplement this Statement as we deem necessary. If significant changes are made to this Statement, we will also notify you accordingly. We also encourage you to review this Statement periodically to find out how we process and protect your or your child’s personal data.

26/6/2018


This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies.