DATA PRIVACY POLICY

WHO WE ARE

Le Régent Crans-Montana College

Rue du Zier 4
3963 Crans-Montana Switzerland

INTRODUCTION

Le Régent College complies with the relevant national data protection regulations. We are committed to keeping personal data accurate, up-to-date, safe, secure and will not keep personal data longer than necessary. This privacy notice explains how we use the personal data of parents, students, employees, alumni and the extended Le Régent College community, who we share it with and the ways in which we protect and account for the protections to privacy. This notice applies to all personal data collected for and on behalf of the school. This pertains to information collected in analogue (forms, documents, in writing) and through technological means such as information systems and email. For these purposes, Le Régent College acts as Data Controller which means it determines how an individual’s personal data

is processed and for what purposes. From time to time, we will make you aware when we require additional personal data for processing through a separate specific privacy notice. Le Régent College parents, students, employees, alumni and the extended Le Régent College community are all encouraged to read this Privacy Notice and understand Le Régent College’s obligations regarding data protection to its community. Le Régent College reserves the right to amend this privacy notice. In such case the ‘last updated’ date at the bottom of this page will be amended accordingly.

HOW WE USE PERSONAL DATA

The school collects personal data and sensitive categories of personal data of students, parents, employees and alumni to provide a safe and caring international environment for teaching, learning and general educational purposes. We use the information you provide for purposes that are necessary and required to undertake the performance of the contract into which you are entering or have entered into and do so as we are required to do by law.
We use the information you provide in the following ways:
● to undertake and manage the school’s admissions and enrolment process
● to provide a safe learning environment
● to comply with child protection requirements
● to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress
● to provide support and care for emotional and psychological wellbeing (pastoral and counselling) ● to protect the health of the students and employees we serve
● to provide a tailored learning environment and make evidence based education decisions for the children we serve
● to enable students to take part in standardised or external assessments
● to enable the children we serve to continue or progress their education at other educational organisations
● to monitor (where appropriate) the responsible and safe use of IT and communication systems
● to support and develop our employees in the performance of their duties

● for financial planning to help in the future planning and resource investment purposes
● to meet our statutory reporting requirements to the education and other authorities
● to help investigate any concerns or complaints you may have
● to ensure campus security including video surveillance and monitoring of campus entry and exit
● to make you aware of services, information, news, events and activities that are undertaken at or in association with Le Régent College

● to maintain relationships with alumni and the extended Le Régent College community including direct marketing or fundraising activities
● to respond to requests from former employees, parents and students for information related to their time at Le Régent College.

BASIS ON WHICH LE RÉGENT COLLEGE PROCESSES PERSONAL DATA

We process Personal Data to carry out the education services as prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered into. In some circumstances we may have to process data for other purposes that are not necessary for the performance of the contract. Where this is the case, we will either have legitimate interest to do so, need to as there is a legal requirement, we have your consent, or because it is in the

vital interests of the individual for us to process or share information.

CATEGORIES OF PERSONAL DATA PROCESSED BY LE RÉGENT COLLEGE

Categories of personal data processed by Le Régent College

● personal data (such as name, unique number, address, telephone contacts and e-mail address as well as employment information including employer, position and work contacts)
● special categories of data (such as health and nationality) (see below)
● other relevant categories for the performance of our services (such as assessment, relevant medical information, languages spoken, special educational needs information, exclusions / behavioural information and psychological reports and assessments)

● attendance information (such as lessons attended, number of absences and absence reasons)
● logging and audit in the use of IT systems and education technology apps, applications and cloud based systems
● photographs and videos (see below).

Special Categories of Data

The education services we provide require us to collect and process special categories of data for the purposes of safeguarding, the protection of vulnerable children, and wellbeing of those within our care. We do not disclose or share special categories of data without explicit and unambiguous consent unless we have to do so where we are required to by law, or where we have good reason in protecting the vital interests of an individual, or where not doing so would place someone else at risk.

Special categories of data such as nationality or health may be used from time to time in forecasting and planning for education service provision. Where used in this way, the data will be anonymised.

Photographs and Videos

Photographs and videos are a key media through which to record and share everyday life at Le Régent College to the parents, students, employees, alumni, the extended Le Régent College community, prospective families and the general public. Le Régent College uses such media for promotional purposes on, including but not limited to: the school website, printed publications, electronic newsletters and Le Régent College social media. Photographs and video are also generated for educational purposes (records of lessons, field trips, sports, events, staff professional development) by faculty and students and play an important role in the delivery of our teaching and learning programme.

We process Personal Data to carry out the education services as prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered into. In some circumstances we may have to process data for other purposes that are not necessary for the performance of the contract. Where this is the case, we will either have legitimate interest to do so, need to as there is a legal requirement, we have your consent, or because it is in the vital interests of the individual for us to process or share information.

As members of the Le Régent College community, parents, students, employees and alumni may be photographed or filmed and these photographs or film used for promotional or educational purposes. Photographs or videos used for promotional purposes will not identify individuals by their full name. If individuals are identified by name, then this will only be done with prior consent.

Publications intended for the Le Régent College community including the password protected portals and Le Régent College Virtual Learning Environment and Yearbook, may identify parents, students, employees, alumni and members of the extended Le Régent College community either directly or indirectly depending on their context. These publications however, are usually only accessible to members of the school community.

PARTICIPATION IN OUR COMMUNITY

We are keen to ensure all individuals associated with Le Régent College can participate in the community. To do so we will use the Personal Data you have provided to make you aware of services, information, news, events and activities that are undertaken at or in association with the school and do so under the lawful basis of legitimate interests. We may invite you to sign up for information or to be contacted on other activities such as campus development. For the purposes of fundraising we will require your explicit consent. If at any point you do not wish to receive these updates, you can let us know by contacting the Data Protection Officer (contact details below)

COMMUNICATING WITH YOU

Where we need to contact you, we may keep a record of emails, letters and other types of correspondence. Where we need to communicate sensitive or confidential information to you we may

use additional and proportionate security measures to do so.

CCTV

We collect information in the form of CCTV to ensure the safety and security of students and employees. We retain CCTV images for up to three months after which they are deleted. Access to these images can

be requested through the Data Protection Officer (contact details below).

COLLECTING STUDENT INFORMATION AND CONSENT

Whilst the majority of student information you provide to us is required for the performance of a contract or by law, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you when we require consent to process the information. Where consent is provided you or your child are free to withdraw consent at any time. You can contact our Data Protection Officer (contact details below) if you or your child wish to withdraw consent.

STORING PERSONAL DATA

We keep personal data for as long is as reasonable given the requirement of our staff and students to request historic information pertaining to their time at Le Régent College. We do so as it would be accepted that a school would hold data on the achievements and experiences of the child for the purposes of their benefit in later life should they need access to that information.

SECURITY

Whilst we store and use your personal data we will ensure the appropriate security of your personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures.

SHARING AND TRANSFERS OF PERSONAL DATA

The information we collect is shared within Le Régent College for the purposes of delivering the services required. The information we collect may also be shared with other organisations or with third party processors in the undertaking of a service or contract in the delivery of the education services we provide.

Example of who we may share data with:
● schools, colleges or universities that the students attend after leaving us
● our local education authorities in Switzerland
● family nurses, doctors or social service organisations where sharing is in the vital interests, or where not sharing could have a negative impact on the individual
● providers of information systems that are necessary for Le Régent College to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services
● government organisations, police, health and social services (where we are required to do so by law, or where we have your consent to do so).
● insurance companies that require personal details to provide the necessary insurance whilst the student is at Le Régent College.

Personal data is transferred to organisations outside Switzerland and outside the European Union for the purposes of student application for college or university. Various teaching and learning applications are also used that are based outside Switzerland. Information on these and the protections afforded by these data processors can be requested from the Data Protection Officer (contact details below).

IT SYSTEMS

All the personal data we process is processed by Le Régent College. For the purposes of IT hosting and maintenance this information is located on servers within the school or within hosted servers provided by our service providers. No 3rd parties have access to your personal data unless the law allows them to do so. Where the law allows and information is shared with 3rd parties, we ensure they have the same protections in place as we do. We cannot deliver our education services without processing the data we collect and share.

In following the principles of Article 32 - Security of Processing of the GDPR, we have in place proportionate organisational and technical measures to protect personal data. More information on these can be requested via the Data Protection Officer (see point of contact details below).

LOCATION OF DATA

Below is a list of our main cloud-based IT solutions that we currently use, each of these have acquired GDPR compliance and offer the highest standard (ISO/IEC 27001) in data security:

ISAMS – ISAMS Data Centre, Maidstone, Kent, UK
Managebac/OpenApply – Amazon Web Services, Montreal, Canada
Firefly – Amazon Web Services, Seattle, USA
Google for Education – European Google Data Centres, Ireland, Netherlands, Belgium and Finland

Le Régent College Website – Equinix Data Centre, London, UK and Amsterdam, Netherlands

JamfPro MDM – Amazon Web Services, Seattle, USA
Apple School Manager – Apple Campus, California, USA

YOUR RIGHTS

Under data protection legislation, individuals have certain rights related to the processing of personal data. Students who have an appropriate level of maturity, may exercise these rights individually. These rights include:
● Right to be informed - be informed of how we are processing your personal data – this Privacy Notice serves to explain this to you but do contact us if you have any questions (see Point of Contact details below).

● Right of access - right to request access to information about you that we hold. Note that certain data is exempt from the right to access. This includes information that identifies other individuals, or any confidential reference given by Le Régent College for the purpose of the education, training or employment of an individual.

● Right to rectification - have your data corrected if it is inaccurate or incomplete
● Right to erasure - also known as ‘right to be forgotten’ allows you to be able to request the erasure of personal data in some circumstances such as where it is no longer needed by us for the purpose for which it was collected, or you have withdrawn your consent. The right to erasure is not an absolute right.
● Right to restrict processing - the right to request the restriction or suppression of your personal data in certain circumstances for example, where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate. Not, like the right to erasure, the right to restrict processing is not an absolute right.
● Right to data portability - allows you to receive personal data that you have provided us in a structured, commonly used machine-readable format. It also allows you the right to request us to transmit this data to another controller.
● Right to object - allows you, in certain circumstances, to object to the processing of your personal data. For example, you may object to processing of your data for direct marketing or to object to automated individual decision-making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual). Another example would be to object to processing of personal data that is likely to cause, or is causing, damage or distress.
● Right to withdraw consent - in those instances in which the processing of your personal data is based on consent, you have the right (subject to age provisions) to withdraw that consent. Please note that the processing will end from the moment the withdrawal takes place without any effect on the processing that took place prior such withdrawal.
● Right to complain - while the first point of contact related to the processing of your personal data or in exercising any of the rights identified above should be us (see point of contact below), you also have the right to directly contact the Supervisory Authority in Switzerland which is:

Federal Data Protection and Information Commissioner (FDPIC)

Feldeggweg 1 CH- 3003 Berne Switzerland

There may be instances where you may not want us to process or share your personal data. In these cases, we may not be able to fulfill the service you need, or do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if that’s the case.

Le Régent College, in responding to any requests related to the processing of your personal data will do so within a month in accordance to the applicable data protection legislation.

POINT OF CONTACT

If you would like to discuss anything in this privacy notice, or if you wish to exercise any of the rights listed under section 13 above then please contact:
Data Protection Officer dpo@leregentcollege.com

Top