SECTION 1 - PREAMBLEThe Island Private School is an international English-speaking, progressive, polysystemic school for children from all over the world from kindergarten to graduation. The school’s curriculum is based on the International Program and/or Waldorf Program for students aged from two (2) to twelve (12) years. Our students consist of a wide variety of cultural backgrounds and nationalities. The curriculum is taught in English, and grades and marks for assessment purposes reflect standard international practice. The Island Private School issues a formal School Leaving Certificate at the end of year 12 to each student successfully competing the curriculum.
We take our responsibilities as a data controller very serious, and we are committed to using the personal data we hold in accordance with the law and purely for the School’s legitimate purpose.
This Privacy Policy is compliant with the General Data Protection Regulation (GDPR) 2016/679, and it provides detailed information about how we process personal data. We undertake to comply with all regulations applicable when processing personal data, in particular the provisions on the Protection of Natural Persons Against the Processing of Personal Data and the free Circulation of this Data, Law 125(I) / 2018,
http://www.cylaw.org/nomoi/arith/2018_1_125.pdf and the General Data Protection Regulation (EU Regulation 2016/679) or the "GDPR"
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679Please read our Privacy Policy carefully to fully understand how we process personal data. This Privacy Policy applies to the following website
http://www.isl.cy If you have questions regarding your personal data or its use, please contact the Data Protection Officer by email at gdpr@isl.cy
The purpose of this Privacy Policy is to explain to users of the site, the following:
- The way in which their personal data is collected and being processed. All data that can identify a user must be considered as personal data, which includes but is not limited to first and last name(s), age, residential and postal address, email address, location of the user or his/her/it’s IP address.
- What the users’ rights are regarding his/her/its data.
- Whom is the responsible party for the processing of personal data being collected.
- Whom these data are transmitted to.
- The site's policy regarding “cookie” files defined more in particular in our Cookie Policy.
This Privacy Policy complements the legal notices and the General Conditions of Use, that users can consult at the following address:
http://www.isl.cySECTION 2 - TYPES OF PERSONAL DATA WE COLLECT AND PROCESSWe collect and process personal data about prospective, current and former students and their parents and/or legal guardians, staff, suppliers and contractors, friends and supporters, sponsors and any other individuals connected to or visiting The Island Private School including students that is enrolled in our summer school program.
The personal data that we process takes different forms, which includes but is not limited to factual information, expressions of opinion(s), images or other recorded information which identifies or relates to a natural person. The personal data we will collect includes the following:
- First name and surname, addresses, telephone numbers (personal/home/office), e-mail addresses and any other relevant contact details.
- Parents’ and/or legal guardian’s names (first name and surname), telephone numbers (personal/home/office), identification and/or passport numbers, addresses, e-mail address, nationality, race and sex.
- Next of kin data which will include first name and surname, relationship to the parents and/or legal guardian, contact number.
- Admission relating documents and information, academic records and marks, disciplinary records, other education related records of students, information about special educational needs, references, examination scripts and marks.
- Education and employment data.
- Photo images, audio and video recordings.
- Financial information.
- Programs, courses, meetings and/or events and information relating to school trips and summer school being attended.
We will also need to process special category personal data (e.g. concerning the health and/or ethnicity and religion), and we do so in accordance with applicable law (including with respect to safeguarding or employment) or by explicit consent.
SECTION 3 - DATA COLLECTION AND PROCESSING GENERAL PRINCIPLESThe provisions of Article 5 of the EU Regulation 2016/679, provides the principles that complies with the collection and processing of site user data, as follows:
- Lawfulness, loyalty and transparency (data can only be collected and processed with the necessary consent of the user who owns the data. When personal data is collected, the user will be informed that his/her/its personal data is being collected).
- Limited purposes (the collection and processing of data is carried out to meet one or more objectives determined in these general conditions of use).
- Minimization of the collection and processing of data (only the data necessary for the purpose and proper execution of the objectives by the site are being collected).
- Retention of reduced data over time (personal data is only kept for a limited period, or for such time as it will have necessary purpose, of which the user is informed. If the retention period cannot be communicated, the personal data is only kept for as long as we have a legitimate interest, and it is necessary).
- Integrity and confidentiality of the data collected and processed (the data controller undertakes to guarantee the integrity and confidentiality of the personal data collected).
- Integrity and confidentiality of special category data collected and processed (the data controller undertakes to guarantee the integrity and confidentiality of the data collected).
In order to be lawful and for the legitimate purpose, Article 6 of EU Regulation 2016/679, makes provision for the collection and processing of personal data can only take place if collection and processing complies with at least one of the conditions:
- The user has express consent to the processing of his/her/its personal data.
- The processing of the personal data is necessary for the proper performance of a contractual obligation and or admission and our service to be provided.
- The processing of personal data meets a legitimate obligation.
- The processing is explained by a necessity linked to the safeguard of the vital interests of the person concerned or of another natural person.
- The processing can be explained by a necessity linked to the performance of a task in the public interest or which comes under the exercise of an official authority.
- The processing and collection of personal data is necessary for the purposes of the legitimate and private interests pursued by the controller or by any third party.
SECTION 4 - PERSONAL DATA COLLECTED AND PROCESSED BROWSING THE WEBSITE- Data being collected and processed
The personal data collected on the Island Private School website is as follows:
- Name (first name) and surname.
- E-mail address.
- Phone number (personal/home/office).
- Student name (first name) and surname.
- Student birthdate.
- Students level of English.
This data is being collected when the user performs one of the following actions on the website:
- Submit and send a pre-registration form(s), registration form(s), or contact form, which will include the date as mentioned above. The data controller will keep all the data collected in its computer systems on the website and under reasonable security conditions for a period of five (5) years or until the data is not necessary to be retained anymore.
The collection and processing of personal data meets the following purposes:
- E-mail: sending newsletters and/or information leaflets, upcoming events, responding to a request for information.
- Transfer of personal data to third parties
Personal data may be transmitted to third parties that include but is not limited to Waldorf of Cyprus, service providers, teachers, referees, sport coaches, Google, ect.
- Data Hosting
The Island Private School website is hosted by: Tilda Publishing Ltd. Republic of Ireland.
The data collected and processed by the site are exclusively hosted and processed in Tilda Publishing Ltd. Republic of Ireland.
SECTION 5 - COLLECTING, HANDLING AND SHARING OF PERSONAL DATAWe will collect most of the personal data we process directly from the individual concerned (in some cases from the students, their parents and/or legal guardians). When necessary, we may also collect data from third parties (these examples include information being collected from previous schools, teachers, referees, sport coaches, professionals or authorities working with the individual) or from any publicly available resources (this will include the media, press and social media) .
Personal data held by us is only processed by appropriate, well informed, and trained staff members and for the purposes for which the data was provided and collected for. We take appropriate technical and organisational steps to ensure the security of personal data about individuals (students/parents and/or legal guardians/staff), including policies around the use of technology and devices, and the access to the school system within our organisation. We will not transfer personal data outside of the European Union unless in circumstances we are satisfied that the personal data that is being transferred will be afforded an equivalent level of protection, and we will inform and notify the individual when such data is transferred outside of the European Union.
In the course of school’s business and day to day operation, we transfer and share personal data (including special category personal data where appropriate) with third parties such as examination boards, the school’s professional advisors, employees, referees, sport coaches, and relevant authorities (e.g. Ministry of Education, Welfare Office, Department of Statistics, Immigration Office, Tax Department, Social Insurance Services). Some of the systems we use are provided by third parties, which includes the hosting of database, school website, school calendar, school email, platforms and applications. This is always subject to contractual assurances that personal data will be kept securely and only in accordance with our specific directions, and which is legitimate. We will not share and/or sell personal data to organisations for their own purposes.
SECTION 6 - PURPOSES WHY WE PROCESS PERSONAL DATA We process personal data to support the school’s operation and activities as a private school duly registered by the Cyprus Ministry of Education and more in particular for the following reasons:
- The selection and admission of students and potential students.
- The provision of education to students including the administration of the school curriculum and timetable, monitoring student progress and their educational needs, reporting on the above internally and to parents and/or legal guardians and/or professional advisors, administration of students’ entries to internal and external examinations, reporting upon and publishing the results/marks, providing references for students (including after a student has left the school or finished the curriculum).
- The provision of educational support and related services to students (and parents and/or legal guardians) including the maintenance of discipline; provision of careers and library services; administration of sports fixtures and teams, school trips, provision of the school’s IT and communications system and virtual learning environment (and monitoring the same) all in accordance with our Student Use of Educational Technology Policy.
- The provision of educational courses during school holidays to students enrolled on such courses and/or summer school.
- The safeguarding of students’ welfare and provision of pastoral care, welfare, health care services by school staff.
- Research into and development of effective teaching and learning methods and best practice which include the International Program curriculum and Waldorf Program curriculum.
- Compliance with legislation and regulations including the preparation of information for inspections and the submission of information to the Ministry of Education and other government departments.
- Operational management including the compilation of student records; the administration of invoices, fees and accounts, the management of the School’s property, the management of security and safety arrangements (including the use of CCTV in accordance with our CCTV Policy and monitoring of the School’s IT and communications systems in accordance with our Student Use of Educational Technology Policy), management planning and forecasting; research and statistical analysis, the administration and implementation of the School’s rules and policies for students and staff, the maintenance of archives and other operational purposes.
- Staff administration including the recruitment of staff and/or engagement of temporary or substituted teachers, sub-contractors, the administration of payroll, social security and annual and sick leave, review and appraisal of staff performance, conduct of any grievance, capability or disciplinary procedures, and the maintenance of appropriate human resources records for current and former staff, and providing references.
- The promotion of our school via its website, the prospectus and other publications and communications (including our social media channels).
- Maintaining relationships with the wider school community by communicating with the body of current and former students and/or their parents and/or legal guardians and/or organising events.
The processing set out above is carried out to fulfil our legal obligations (including those under our School Application Pre-Admission and Admission Form and staff employment contracts). We also expect these purposes to form our legitimate interests as to the collection of personal data to enable us to render our services as school.
SECTION 7 - STUDENT DATAThe rights under data protection legislation belong to the individual to whom the data relates to. However, we will often rely on parental and/or legal guardian consent to process personal data relating to students (if consent is required) unless, given the nature of the processing in question, and the student's age and understanding, it is more appropriate to rely on the student's consent. Parents and/or legal guardians should be aware that in the course of the students’ interaction with teachers and other students your own or your child’s personal data may be shared with the class or teacher, depending on the interests of the child (the student), the parents’ and/or legal guardian’s rights at law or under their contract, and all the circumstances involved.
By providing your consent to this privacy policy you acknowledge and consent to the ordinary disclosure of personal data, for the purposes of keeping parents and/or legal guardians informed about the student's activities, progress and behavior, and in the interests of the student's welfare, unless, in the school's opinion, there is a good reason to do otherwise.
SECTION 8 - FUND-RAISING AND MAILING LIST We will fundraise from individuals, companies and foundations who want to support our school and events. We do not use third-party profiling companies, but we may analyse publicly available data about potential donors and sponsors (e.g. from LinkedIn, Facebook ect.) to create a profile of interests and preferences so that we can make appropriate requests to such individual(s), companies and foundations.
SECTION 9 - DATA PROCESSOR AND DATA PROTECTION OFFICER9.1. The Data Controller
The person responsible for processing personal data is:
Nectaria Ioannou, HR Director of The Island Private School
The HR Director can be contacted by email at the following address
nioannou@isl.cy
The data controller is responsible for determining the purposes and means used for the processing of personal data and how personal data will be safeguarded.
9.2. Obligations of the data controller
The data controller undertakes to protect the personal data collected, not to transmit them to third parties without the user having been informed and to respect the purposes for which these data were collected. In addition to the above, the data controller undertakes to notify the user in the event of rectification or deletion of the data, unless this entails disproportionate formalities, costs and procedures for the data controller. In the event that the integrity, confidentiality and/or security of the user's personal data is compromised and/or exposed, the controller undertakes to inform the user by any means and within the provided timeframes.
9.3. The Data Protection Officer
In addition, the user is hereby informed that Konstan Biryukov, the HR Director of The Island Private School, has been appointed as the Data Protection Officer. The role of the Data Protection Officer is to ensure the proper implementation of national provisions and supranational laws relating to the collection and processing of personal data. The Data Protection Officer can be reached by email at the following address gdpr@isl.cy
SECTION 10 - USER RIGHTSIn accordance with the regulations concerning the processing of personal data, the user has the rights listed hereinbelow. In order for the data controller to comply with requests, the user is required to communicate, the users first and last name as well as his e-mail address. The data controller is required to respond to the user within a maximum of thirty (30) days. If the request is manifestly excessive or similar to previous requests, we may ask you to reconsider or charge a proportionate fee, but only where GDPR allows it.
Users have various rights under GDPR to access and understand the personal data we hold, and in some cases to ask for it to be erased or amended or for us to stop processing it, but subject to certain lawful exemptions and limitations.
Users will always have the right to withdraw consent, where given, or object to receiving generic or fundraising and/or newsletters communications. Please be aware however, that we may have another lawful reason to process the personal data in question even without your consent. That reason will usually have been asserted under this privacy policy, or may exist under some form of contract or agreement with the individual (e.g. an employment or parent and/or legal guardian contract, or because of a purchase of goods or services). If you would like to access or amend your personal data or would like it to be transferred to another person and/or organisation or have some other objection to how your personal data is used, please make your request in writing to the Data Protection Officer.
You should be aware that certain data is exempt from the right of access. This may include information which identifies other individuals, or information which is subject to legal privilege. We are also not required to disclose any student examination scripts (though examiners' comments may be disclosed), nor any confidential reference given by the school for the purposes of the education, training or employment of any individual.
- Right to limitation and opposition of data processing - the user has the right to request the limitation or to oppose the processing of his/her/its data by the site, without the site being able to refuse, except to demonstrate the existence of legitimate and compelling reasons, which may prevail over the interests and rights and freedoms of the user. In order to request the limitation of the processing of his data or to formulate an opposition to the processing of his/her/its data.
- Right not to be the subject of a decision based exclusively on an automated process. In accordance with the provisions of EU Regulation 2016/679, the user has the right not to be the subject of a decision based exclusively on an automated process if the decision produces legal effects concerning him/her/it or affects him/het/it significantly in a similar way.
- Right to determine the fate of data after death. The user is reminded that he can organize what should be the future of his data collected and processed if he/she/it dies.
- Right to refer to the competent supervisory authority. The right to complain to a Data Protection Authority about our collection and use of your personal data. For more information, if you are in the European Economic Area (EEA), please contact your local data protection authority in the EEA. You may report a complaint or if you feel that we have not addressed your concern in a satisfactory manner you may lodge a complaint with the office of the Commissioner for Personal Data Protection at http://www.dataprotection.gov.cy
SECTION 11 - USE OF “COOKIES” FILESThe website may use “cookie” techniques. A "cookie" is a small file, stored by the site on the user's hard drive, containing information relating to the user's browsing habits and history. These files allow it to process statistics and traffic information, to facilitate navigation and to improve the service for the comfort of the user. For the use of "cookie" files involving the saving and analysis of personal data, the consent of the user is necessarily requested. This users consent is considered valid for a maximum of thirteen (13) months. At the end of this period, the website will again request the user's authorisation to save "cookie" files on their hard drive.
Opposition of the user to the use of "cookie" files by the site. It is brought to the attention of the user that he/she/it can oppose the recording of these "cookie" files by configuring his/her/its navigation software.
In the event that the user decides to deactivate the "cookie" files, he/she/it may continue browsing the website. However, any malfunction of the website caused by this manipulation could not be considered as being due to the publisher of the site.
Description of the "cookie" files used by the website - the site editor draws the user's attention to the fact that the following cookies are used during navigation:
- A session cookie is installed automatically. It is mandatory for the proper functioning of the website.
- Google Analytics cookies to measure the audience of the site.
SECTION 12 - HOW LONG WE KEEP PERSONAL DATAWe retain personal data only for a legitimate and lawful reason and only for so long as necessary and/or required by law. We have retention guidelines which set out the time period for which different categories of data are kept. If you have any specific queries about our record retention or wish to request that your personal data is considered for erasure, please contact the Data Protection Officer.
SECTION 13 - CONDITIONS FOR MODIFICATION OF THE PRIVACY POLICYThis privacy policy can be viewed at any time on this page. The publisher of the website reserves the right to modify it in order to guarantee its conformity with the law in force. Consequently, the user is invited to regularly consult this privacy policy in order to stay informed of the latest changes and updates that will be made to it. It is brought to the user's attention that the last update of this privacy policy took place on: 24 June 2022. By browsing the site, the user certifies that he/she/it has read and understood this privacy policy and accepts its conditions, with particular regard to the collection and processing of his/her/its personal data, as well as the use of files. " Cookies ". This privacy policy applies to the website:
http://www.isl.cyThe purpose of this privacy policy is to explain to user(s) of the website:
- The way in which their personal data is collected and processed. Must be considered as personal data, all data that can identify a user. These include the first and last name, age, postal address, email address, location of the user or his/her/its IP address.
- What are the rights of users regarding this data.
- Who is responsible for the processing of personal data collected and processed.
- To whom this data is transmitted.
- If applicable, the site's policy regarding “cookie” files.
This privacy policy supplements the legal notices and the General Conditions of Use that users can consult at the address:
http://www.isl.cyContact
For security reasons, the school can receive visitors by appointment only.
You can request an appointment using the form below. Thank you for your understanding.
THE ISLAND PRIVATE SCHOOL
gdpr@isl.cy