Contents
With this Statement (hereafter referred to as the ‘Statement’) we wish to inform you why and how your personal data are collected and processed by The British School of Brussels (‘BSB’), a not-for-profit organisation under Belgian law, having its registered office in Belgium at Pater Dupierreuxlaan 1, 3080 Tervuren, and registered in the Belgian Crossroad Bank for Enterprises under enterprise number 0408.705.045 (hereafter collectively referred to as ‘ we’ or ‘the school’).
Our contact details can be found in point 11 of this Statement.
We are responsible for processing the personal data that we request and use. As Data Controller, we take the measures that ensure that you:
We have also appointed a Data Protection Officer. This is an expert on the protection of personal data, who offers an additional guarantee for the correct processing of your personal data by us. You can contact the Data Protection Officer through the channels set out in point 11 of this Statement.
This Statement relates to the school’s processing of personal data about prospective, current and past students and their parents (hereafter referred to as ‘you’ and, where referring to a parent’s relationship to his or her child, as ‘your child’).
‘Personal data’ means all information relating to you as a given living natural person. The personal data we collect process and store includes information such as:
We also collect and process the so-called sensitive data, namely:
The school will process your personal data for a range of contractual, statutory and public or legitimate interest purposes, including the following:
Our website www.britishschool.be uses cookies, which are small text files stored on your device, and similar technologies. You can find more information about the use of cookies in our Cookie Statement, as made available on the aforementioned website.
We must have a valid lawful basis in order to process personal data. There are six available lawful basis for processing. At least one of them must apply whenever we process your personal data:
No single basis is ’better’ or more important than the others. Which basis is most appropriate to use will depend on the purpose of the processing and our relationship with you.
We consider the processing of your personal information for the purposes mentioned under point 4 of this Statement to be either necessary for the performance of our contractual obligations with you (e.g. to manage your child’s education, experience and welfare while being educated at BSB), or necessary for compliance with a legal obligation (e.g. visa monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. teaching and research), or necessary for the pursuit of the legitimate interests of the school or an external organisation (e.g. to distribute relevant newsletters).
If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. In case we require your consent with a certain processing activity, a consent form is provided to you, i.e. parents and/or mature students, under one of the following forms:
Where we ask for any sensitive information, such as that concerning your nationality, religion or health/disability, you will normally have the option to refuse your consent by not supplying it.
The school will share your data with the following people and/or entities:
Since such third parties have access to personal data within the scope of the services and/or products we have requested, and we ensure that technical, organisational and contractual measures are taken so that your personal data will only be processed and used for the purposes stated in point 3 of this Statement.
Your data will in principle, not be transported outside the EU. In any case, we will ensure that the minimum legal requirements and security standards are respected at all times. If we suspect that your data will be stored and processed outside the EU, we will ensure that the same level of protection is used as is applicable within the EU, e.g. by contracting with those non-EU entities according to a model approved by the European Commission. If that same level of protection cannot be guaranteed, we will ask for your explicit consent prior to the transfer of your or your child’s data outside the EU.
As regards international trips outside the EU that the school organises for your child, you will always be contacted for your consent. The consent will be limited in time and content if it be required.
We only store your data for as long as this is necessary for the purposes for which the data is to be used as stated in point 4 of this Statement. As soon as your data is no longer required and we do not have a legal obligation to retain it we will permanently erase or, if this is not possible, anonymise the data in our systems.
Since the need to retain data may vary by the type of data and by the purpose of the processing, the actual retention periods may vary considerably.
We can hereby inform you that we take the following criteria, among others, into account when determining the retention periods:
Your personal data will, in any case, be retained and used for as long as necessary to comply with our legal obligations, to settle disputes or to enforce our agreements.
Your personal data is considered to be strictly confidential. We take the appropriate technical and organisational measures to protect the provided and collected personal data from destruction, loss, unintended alteration, damage, accidental or unlawful access or any other unauthorised processing.
i. The right to access your or your child’s personal data
You have the right to access and inspect your or your child’s personal data processed by us. We will provide you with a copy of your personal data in this connection free of charge if you so request.
ii. The right to rectify your or your child’s personal data
You have the right at any time to have incorrect, incomplete, inappropriate or outdated personal data erased or rectified. If you dispute the accuracy of your or your child’s personal data, you may request a limitation of its processing for a period that enables us to verify the accuracy of your personal data.
iii. The right to withdraw your consent
If the processing is based on your consent, then you have the right to withdraw this consent at any time.
iv. The right to object to certain processing
If your personal data is processed on the basis of a public interest or our legitimate interest (e.g. for statistical purposes), you have the right to object to the processing of your personal data for reasons relating to your specific situation. We shall then no longer process the personal data unless (i) for the establishment, exercise or defence of legal claims, or (i) if we demonstrate compelling legitimate grounds for the processing which override your or your child’s interests, rights and freedoms.
If you objected to a processing operation, you may request that we limit the processing of your personal data pending the verification whether our legitimate grounds override those of you.
v. The right to have your or your child’s personal data erased
You are entitled to have your or your child’s personal data deleted. Based on this, if you no longer wish to have a relationship with us you can ask us to stop using your personal data. However, we may keep personal data that is required for purposes of proof.
Under this right of erasure, you also have the right to ask us at any time to stop using your personal data that is processed on the basis of your consent or our legitimate interest. Due to legitimate interests, we may still continue to process your personal data after weighing your interests against ours, unless you decide to terminate your relationship with us.
vi. The right to data portability
With respect to the processing of your personal data based on your consent, or because it is necessary for the performance of your contract with us, you may ask us to forward your or your child’s personal data to you – in a structured, commonly used and digital form – so that you can keep your data for personal (re)use, or to forward this data directly to another data controller, to the extent that this is technically feasible for us.
vii. The right not to be subject to automated decision making, including profiling
We will not use your personal information to carry out any wholly automated decision-making that affects you.
To exercise the rights mentioned above you may send us a written request:
When exercising your right, we request that you clearly state the right to which you wish to appeal and any processing operation(s) you oppose or which consent you wish to withdraw.
Important notice to parents: before responding to a request about your child’s personal data, we will consider whether your child is mature enough to understand his or her rights. Where a child is not considered to be mature enough, an adult with parental responsibility may exercise the child’s data protection rights on their behalf. If we are confident that your child can understand his or her rights, then we will in principle only respond directly to your child. In such case, we will allow you, the parent, to exercise your child’s rights on their behalf if your child authorises this, or if it is evident that this is in the best interests of your child.
If you have a question or complaint about our processing of personal data please contact us through the following channels:
If you are not satisfied with our response, if you have any comments regarding the exercise of your or your child’s rights or if you believe that our processing of your or your child’s personal data does not comply with the legislation, then you are entitled to file a complaint with the Data Protection Authority. All information on this matter can be found at
https://www.dataprotectionauthority.be/
We may amend or supplement this Statement as we deem necessary. If significant changes are made to this Statement, we will also notify you accordingly. We also encourage you to review this Statement periodically to find out how we process and protect your or your child’s personal data.
26/6/2018