Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 enforces legislation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This regulation came into force on 25th May 2018 with introduction of the EU General Data Protection Regulation (GDPR), which aims to protect all EU citizens from privacy and data breaches in today’s data-driven world. PASCAL Schools are committed to using all personal data held in accordance with this law, taking their responsibility as a data controller extremely seriously.
In this Privacy Policy, personal data refers to data that PASCAL Schools hold regarding both parents/guardians/carers and their children. For any questions regarding personal data or its use, kindly e-mail your enquiries to dpo@pascal.ac.cy.
This Privacy Policy provides information about how PASCAL Schools use personal data about individuals including their current, past and prospective staff, pupils, and parents/carers/guardians.
This Privacy Policy applies alongside any other information PASCAL Schools may provide about a particular use of personal data, for example, when collecting data via an online or paper form.
The personal data held by PASCAL Schools are either given directly by parents/carers/guardians or as a result of children attending or applying to attend the School. This data is not solely restricted to the academic performance of pupils, but also incorporates other information that relates to either parents/carers/guardians or their children, not excluding the financial obligations that arise from attending the School.
More specifically, the data that PASCAL Schools may hold and process are:
– Contact details, including: home addresses; mobile, home and work telephone numbers;
and e-mail addresses;
– The identification card number/passport number of both parents/carers/guardians and
of the pupil;
– Pupils’ academic performance, test/exam answers, attendance records, projects and
academic assignments;
– Parents’/carers’/guardians’ financial obligations to the School and receipts of payment;
– The parents’, carers’ or guardians’ profession;
– Details referring to specific or special needs of the pupil such as: Special Education Needs
and/or Disabilities (SEND); allergies or other medical information; dietary requirements; expert reports (e.g. psychologists’ reports); and court decrees that concern the pupil or the parents, carers or guardians to which the school must comply;
– Details and information necessary for entry applications to universities or other educational institutions;
Policy Review Date: May 2020
– Log files recording connection information to the Schools’ electronic platforms;
– The ethnic minority of Cypriot nationals that are entitled to fee subsidies from the Cypriot
government;
– Pupils’ nationality, gender, date of birth and, where voluntarily given, the pupil’s religion;
– CCTV footage which is exclusively used for internal safety and security purposes; CCTV is
not used in private areas such as the toilets.
PASCAL Schools process personal data in order to ensure and support the Schools’ operations and the quality of service offered to pupils and their parents, carers or guardians, in particular:
– Obtaining information about parents/carers/guardians and their children from the admission forms and the selection process;
– The provision of education to pupils including: the administration and management of the School curriculum and timetable; monitoring pupils’ progress and educational needs; reporting internally and to parents, carers and guardians; administration of pupils’ entries to examinations; administration of pupils’ entries to universities, colleges or other higher educational institutions, reporting upon and publishing the results; and providing references for pupils (including after a pupil has left the School);
– The provision of educational support and related services to pupils (and parents, carers and guardians) including: the maintenance of discipline; provision of careers and library services; administration of sports fixtures and teams plus school trips; and provision of the Schools’ IT and communications system and virtual learning environment;
– The provision of academic/educational/activity-based courses during summer holidays to students enrolled on such courses;
– The research into, and development of, effective teaching, learning and assessment methods and best practice;
– Operational management including: the compilation of pupil records; the administration of invoices, fees and accounts; the management of security and safety arrangements (including the use of the Schools’ IT and communications systems); management planning and forecasting; research and statistical analysis; the administration and implementation of the Schools’ rules and policies for pupils and staff; and the maintenance of historic archives and other operational purposes;
– Staff administration including: the recruitment of staff; engagement of contractors; administration of payroll; Provident Fund and sick leave; review and appraisal of staff performance; disciplinary procedures; the maintenance of appropriate human resources records for current and former staff; and providing references;
– The promotion of the Schools through their websites, the prospectus and other publications and communications (including through their social media channels);
– Maintaining relationships with the Alumni and the wider school community by communicating with the body of current and former pupils and/or their parents, carers or guardians and organising events;
– Financial information in relation to the payment of fees;
– To comply with the legislation relating to Private Schools and to comply with the regulations of the Ministry of Education and Culture;
– To comply with any legal proceedings or police enquiries;
– Occasionally, the School may use consultants, experts or other advisors to assist the
School in fulfilling its obligations and might need to share information with them if this is relevant to their work.
The processing set out in section 4 of this Privacy Policy is carried out to fulfil PASCAL Schools’ legal obligations (including those to parents/carers/carers and employees). The Schools also expects these purposes to form their legitimate interests.
This section contains information about the legal basis that PASCAL Schools are relying upon when handling data.
Legitimate interests
This means that the processing is necessary for legitimate interests, except when the processing is deemed unfair. The School relies on legitimate interests for the ways it uses information.
Specifically, the School has a legitimate interest in:
– Providing educational services to children that attend the School;
– Safeguarding and promoting the welfare of children that attend the School;
– Promoting the objects and interests of the School;
– Facilitating the efficient operation of the School; and
– Ensuring all relevant legal obligations of the School are complied with.
– Necessary for a contract
PASCAL Schools will need to use parents’/carers’/guardians’/pupils’/employees’ personal information in order to perform their contractual obligations.
Legal obligation
Where the School needs to use parents’/carers’/guardians’/pupils’/employees’ personal information in order to comply with a legal obligation, for example, to report a concern to Social Welfare Services, PASCAL Schools may also have to disclose information to third parties such as the courts, the local authority or the police where legally obliged to do so.
Vital interests
For example, to prevent someone from being seriously harmed or killed.
PASCAL Schools retain personal data only for legitimate and lawful reasons, and only for so long as necessary. Some records, such as copies of Apolytiria, are kept indefinitely or until parents/guardians/carers notify the School for erasure. Most records are erased 7 years after graduation/termination of studies.
Any personal data held by the School for marketing and service update notifications will be kept by the School until parents/guardians/carers notify the School that they no longer wish to receive this information.
However, please bear in mind that the School will often have lawful and necessary reasons to hold onto some personal data, even following such request.
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where parents/guardians/carers have requested the School no longer keep in touch with them, the School will need to keep a record of the fact in order to fulfil parents’/guardians’/carers’ wishes (called a “suppression record”).
For specific queries about PASCAL Schools’ record retention periods, or to request that your personal data is considered for erasure, please e-mail dpo@pascal.ac.cy.
The new General Data Protection Regulation gives you the right to access your personal data held and processed by the School and PASCAL group of companies, free of charge. Access to data will be made available in an easily accessible and widely used format. Kindly note that access to your personal data will be possible within one month from the date an application is received. In the event that there is a large number of applications, the time required to provide such access may be extended by up to two additional months. In the event that a time extension is necessary, the School will communicate the required time extension and the reason for the requested extension.
Apart from the right of access to your personal data, you also have the right to change and correct your personal data. It is understood that the right to change the personal data held does not extend to the right of tampering with the academic performance results of a pupil, unless it is a case of an incorrect entry.
This is subject to certain exemptions and limitations.
With the exception of the cases referred to in this document, the processing of your personal data will not be made for purposes other than those for which you have already consented, i.e. for the execution of the contract to provide private education to children and for the other reasons raised in this document.
Any individual wishing to access or amend their personal data, or who has some other objection to how their personal data is used, should put their request in writing via the following e-mail address: dpo@pascal.ac.cy.
Requests that cannot be fulfilled
The right of access is limited to your own personal data, and certain data is exempt from the right of access. This will include information which identifies other individuals (and parents, carers and guardians need to be aware this may include their own children, in certain limited situations, or information which is subject to legal privilege, for example, legal advice given to or sought by the School, or documents prepared in connection with a legal action).
Refusal to erase your personal data may also be applicable in cases where there is an outstanding financial obligation towards the School, an impending or ongoing legal or other proceedings, or the personal data is required to be held by law, or for other reasons, or statistical or scientific research purposes.
The School is also not required to disclose any pupil examination scripts (or other information consisting solely of pupils’ test answers), provide examination or other test marks ahead of any ordinary publication, nor share any confidential reference given by the School itself for the purposes of the education, training or employment of any individual.
Whilst you have the “right to be forgotten”, the Schools will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing personal data: for example, a legal requirement, or where it falls within a legitimate interest identified in this Privacy Policy. All such requests will be considered on their own merits.
Parents’, carers’ and guardians’ requests
Parents, carers and guardians will, in general, receive educational and pastoral updates about their children, in accordance with the rules and regulations of the School. Where parents/carers/guardians are separated, the School will, in most cases, aim to provide the same information to each person with parental responsibility, but may need to factor in all the circumstances including the express wishes of the child.
Consent:
The School’s, and PASCAL group of companies’, current Privacy Policy does not allow the promotion or transmission of personal data to third parties for marketing, advertising or other purposes. In the event that this policy changes, personal data will not be shared unless express written consent is duly received.
In cases of remote/internet based teaching, third parties will not be allowed to participate or access the class without prior consent from the parents/guardians of the pupils involved.
Where the School is relying on consent as a means to process personal data, any person may withdraw this consent at any time, for example, with regard to use of images.
Please be aware, however, that the School may not be relying on consent but may have another lawful reason to process the personal data in question without your consent. That reason will usually have been asserted under this Privacy Notice, or may otherwise exist under some form of contract or agreement with the individual (e.g. an employment contract, or because a purchase of goods, educational services or membership of an organisation such as an Alumni or Parents’ Association has been requested).
Whose rights?
The rights under GDPR belong to the individual to whom the data relates. However, the School will often rely on parents’, carers’ and guardians’ authority or notice for the necessary ways it processes personal data relating to pupils, for example, under the Registration Form. Parents, carers, guardians and pupils should be aware that this is not necessarily the same as the School relying on strict consent. Where consent is required, it may, in some cases, be necessary or appropriate – given the nature of the processing in question, and the pupil’s age and understanding – to seek the pupil’s consent.
In general, the School will assume that pupils’ consent is not required for ordinary disclosure of their personal data to their parents, carers and guardians, e.g. for the purposes of keeping them informed about the pupil’s activities, progress and behaviour, and in the interests of the pupil’s welfare. That is, unless, in the Schools’ opinion, there is a good reason to do otherwise.
Pupils are required to respect the personal data and privacy of others, and to comply with the Schools’ Acceptable Use Policy and the School’s rules.
To be able to register a child at the School, both parents/carers/guardians must give their consent for the child’s registration. Also, both parents, carers or guardians must give consent for the processing of the personal data given and held for both the parents, carers or guardians and of the child. In the event that the student is 18 years of age or higher, the consent of the student is also necessary for the processing of their personal data. This provision is not applicable in the case that there is a court order from a recognised court of law that dictates otherwise, or in the case of other extenuation circumstances accepted by the School.
The School will endeavour to ensure that all personal data held in relation to an individual is as up-to-date and accurate as possible. Individuals must notify the School, via the e-mail address dpo@pascal.ac.cy, of any significant changes to important information, such as contact details and medical details, held about them.
An individual has the right to request that any out-of-date, irrelevant or inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under GDPR).
The School will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices plus access to School systems. All staff and school officials will be made aware of this Privacy Policy and their duties under GDPR and shall receive appropriate training.
The School will update this Privacy Policy as required. Any substantial changes that affect an individual’s rights will be communicated to them as far as is reasonably practicable.
The PASCAL group of companies have appointed Mr Antonis Antoniou as their Data Protection Officer (DPO), who can be contacted by telephone on 22509000 or via the following e-mail address: dpo@pascal.ac.cy.
For your convenience, you can initially contact your Local Data Protection Assistant (LDPA):
Policy Review Date: May 2020