Parental consents to the processing of pupils' personal data (PII)
Dear Parents,
All consents to the processing of pupils' PII will be recorded electronically in their folder on the school drive to which you have access via your child's school address.
We will only ask for your consent for activities that are not given under a legal obligation and based on the legitimate interests of the school. A template can be found on the website here.
Please be advised that consents are given voluntarily for the duration of the pupil's time at the school.
According to the Federal Data Protection Act, FADP, of 25 September 2020 (status as of 1 September 2023), you have the right to:
- Withdraw your consent at any time
- Request information about what personal data we process (you will see this in the signed consent form)
- Request access to this data from us and have it updated or corrected
- Request the erasure of this personal data
- Contact us if you have any doubts about compliance with the obligations related to the processing of personal data
The processing of personal data is dealt with in the school's internal guidelines, see below.
Mandatory information from the GDPR
The CSBH Geneva is the controller and in some cases only the processor of personal data.
Contact address of the controller:
CSBH Geneva
Chemin Fracois Lehmann 18A
1218 Le Grand Saconnex
Tel: +41 76 478 25
E-mail: info@csbh-zeneva.cz
WWW: www. csbh-zeneva.cz
Processing of Personal Data
Reasons for Processing Personal Data
Personal data may only be processed at the school:
• Based on legal regulations;
• Based on the legitimate interest of the school;
• Based on the consent of the students or their legal guardians.
Personal data processed under the Education Act, contract for ensuring education abroad:
• School register (e.g., name, surname, date and place of birth, birth number, permanent residence, citizenship, name and surname of legal guardians or other persons responsible for the child's upbringing (hereinafter JOOVD), phone contact for legal guardians or JOOVD);
• Documents related to student enrollment, educational progress, and completion;
• Class register;
• Records from staff meetings;
• Accident log and records of accidents, possibly medical reports related to health status.
Personal data processed based on legitimate interest, e.g.:
• Email of legal guardians;
• Health insurance of the student;
• List of people picking up the student from school and after-school care;
Personal data processed based on informed consent, e.g.:
• Taking photos and recording school activities;
• Student works (artwork, projects);
• Lists of students in competitions, applications for competitions.
Security of Personal Data
The school has implemented a system for ensuring the protection of personal data:
Internal regulations govern, for example:
• Storage of documents;
• Personal responsibility of individuals, confidentiality of data;
• Collecting only necessary personal data;
• Training all school employees on data protection;
Duration of Processing and Storage of Personal Data
Personal data is processed only for the necessary period, which is individual for each processing purpose. After this period has passed (when the reason for processing, for which consent was given, no longer applies), personal data is either destroyed or retained for a period defined by the valid record management guidelines.
Rights of Data Subjects
If your personal data or your child’s personal data is processed at the school, you have the right to:
• Request information from the school on how your personal data is being processed;
• Request access to your personal data processed by the school;
• Request correction of inaccurate personal data (if you believe that the personal data processed by the school is inaccurate);
• Request restriction or deletion of your personal data processed by the school. This right does not apply to legal data processing, e.g., the school register, or request a limitation of processing in accordance with the relevant legal basis for processing personal data;
• Object to the processing of personal data by the school;
• Request the portability of the personal data you provided to the school (e.g., in the case of transferring to another school);
• File a complaint with the supervisory authority;
If the processing of your personal data is based on your prior consent, you have the right to withdraw your consent. However, this does not affect the lawfulness of the processing based on the consent given before its withdrawal.
Processing Requests for Information (According to Data Subject Rights)
The school handles requests from data subjects without undue delay, no later than one month, and in exceptional cases, within two months.
Information is provided to students and their legal guardians free of charge. Only if the requests made by the data subject are obviously unreasonable (which is evidenced by the administrator) or disproportionate, especially if they are repetitive, may the school principal decide to impose a reasonable fee or refuse to fulfill the request.
What is GDPR?
The Federal Data Protection Act (FADP) is based on the General Data Protection Regulation (GDPR), which is mandatory for EU countries and is the most comprehensive set of data protection rules in the world.
The law applies to companies, institutions, and individuals who handle personal data – of employees, customers, clients, or suppliers, across sectors and industries. It also affects those who monitor or analyze user behavior on websites, apps, or smart technologies. The goal of the FADP is also to protect digital rights.