1. Introduction
We promise to respect any personal data you share with us and keep it safe. We aim to be clear when we collect your data and not do anything with it you would not reasonably expect. We will keep this policy updated to show you all the things we do with your personal information so that you can be confident when sharing your information with us that it will only be used for the purposes outlined here. If you have any questions please do not hesitate to contact the Business Director on dpo@stcatherines.gr or 210 2829750 x204.
St Catherine’s British School (the School) is fully committed to compliance with the requirements regulation GDPR 2016/679/EE*. The School will therefore follow procedures that aim to ensure that all employees, contractors, agents, consultants, partners or other members of the School who have access to any personal data held by or on behalf of the School, are fully aware of and abide by their duties and responsibilities.
For the purposes of this Privacy Policy, the School is the “data controller” of personal data about pupils, their parents and/or guardians and members of staff.
2. Statement of Policy
In order to operate safely and efficiently, the School has to collect and use personal data about people with whom it works (data subjects). This may include families of pupils, pupils themselves, members of the public, current, past and prospective employees, clients and customers, and suppliers. This personal data must be handled and dealt with properly, however it is collected, recorded and used, and whether it be held on paper or electronically, regardless of media. Processing may include obtaining, recording, holding, disclosing, destroying or otherwise using personal data. In this policy any reference to pupils includes current, past or prospective pupils.
The School regards the lawful and fair treatment of personal data as very important to its successful operations and to maintaining confidence between the School, its pupils, their parents or guardians, staff and those with whom it carries out business.
3. The Principles
The School shall, as far as is reasonably practicable, comply with the six data protection
principles contained within the GDPR. Personal data shall be:
- processed lawfully, fairly and in a transparent manner
- obtained for specified purposes and only processed in accordance with those purposes
- adequate, relevant and not excessive
- accurate and up-to-date
- not kept for longer than necessary
- processed with integrity and confidentiality
4. Personal Data
Personal data covers both facts and opinions about a living individual who can be identified from that data (or from that data and other information in the School’s possession). It includes information necessary for employment such as the employee’s name and address and details for payment of salary. It may also include information about the employee’s health and professional development.
The School may process a wide range of personal data of pupils, their parents or guardians as part of its operations. This personal data may include (but is not limited to) names and addresses, dates of birth, bank details, academic, disciplinary, admissions and attendance records, photographs, references, school reports, examination scripts and marks.
5. Processing of Personal Data
Consent may be required for the processing of personal data unless the processing is necessary for the School to undertake its obligations to public authorities, pupils, their parents or guardians, or staff or unless the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Any information which falls under the definition of personal data, and is not otherwise exempt, will remain confidential and will only be disclosed to third parties with the consent of the appropriate individual or under the terms of this policy. This is the case regardless of how the information is held on computer or paper, it also includes personal data stored in an email, on a tablet or on a smartphone.
The School does have some CCTV cameras, however, they are not used inside the School, nor do they have a sound facility. They are used for the purpose of protecting the perimeter of the School.
6. Sensitive Personal Data
The School may sometimes learn of and be required to process sensitive personal data regarding a member of staff, a pupil, their parents or guardians. Where sensitive personal data is known by the School, the need to process this data will be explained to the data subject and explicit consent of the data subject or appropriate representative will be required. There will only be exceptions to the rule when it is in the best interest of safeguarding a pupil.
Under GDPR legislation the areas of sensitive personal data are:
• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data and biometric data
• health
• sex life or sexual orientation
7. Handling of Personal Data
The School will:
- observe in full conditions regarding the fair collection and use of personal data
- meet its legal obligations to specify the purpose for which personal data is used
- collect and process appropriate personal data and only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements
- ensure the quality of personal data used
- apply retention procedures to determine the length of time personal data is held
- take appropriate technical and organisational security measures to safeguard personal data
- ensure that personal data is not transferred abroad without suitable safeguards
- ensure that the rights of people about whom the personal data is held can be fully exercised
Personal data must be processed in line with data subjects’ rights. Data subjects have a right to:
- request access to data about them held by the School (see paragraph 9 of this policy below)
- the right to prevent processing in certain circumstances such as for direct marketing purposes or where the processing is likely to cause damage or distress to themselves or anyone else
- the right to ask to have inaccurate data about them amended
8. Data Protection Officer
The School’s Business Director is the current School’s Data Protection Officer. They will endeavour to ensure that personal data is processed in compliance with the policy and the principles of the Act.
9. Rights of Access to Information
Data subjects have a right of access to personal data about themselves held by the School. Any individuals wishing to access their personal data should put their request in writing to the Data Protection Officer.
The School will endeavour to respond to any such written requests as soon as is reasonably practicable and this will always be within one month.
A data subject can assist the School in responding to a data subject access request by specifying:
• the format of personal information being requested (e.g. hard copy documents or electronic communications)
• what the personal information relates to (e.g. education, pastoral care etc.)
• the date or date range of when the personal information was created
The rights belong to the individual(s) to whom the data relates. The School will, however, in most cases rely on parental consent (or the consent of a guardian) to process data relating to pupils unless, given the nature of the processing in question, and the pupil’s age and understanding, it is unreasonable in all the circumstances to rely on the parent’s (or guardian’s) consent. The School will grant the pupil direct access to their personal data if in the School’s reasonable belief the pupil understands the nature of the request. As a general guide, a child aged 15 or older is expected to be mature enough to understand the request they are making.
Where a pupil raises a concern confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents or guardian, the School will maintain confidentiality unless it has reasonable grounds to believe that the pupil does not fully understand the consequences of withholding their consent, or where the School believes disclosure will be in the best interests of said pupil or to safeguard other pupils.
The School will treat as confidential any reference provided by the School for the purpose of the education, training or employment, or prospective education, training or employment of any pupil or employee.
The School acknowledges that an individual may have the right to access a reference relating to them received by the School. Such a reference will only be disclosed if such disclosure will not identify the source of the reference or where the referee has given their consent.
The data subject can also contact the School and request the right to be forgotten, requesting erasure of their personal data. Upon request being made, the School will inform you on the process.
10. Accuracy
The School will endeavour to ensure that all personal data held in relation to data subjects is accurate. Staff must notify the Personnel Department of any changes to personal data held about them, and pupils and their parents (or guardians) should contact the relevant School Office. An individual has the right to request that inaccurate personal data about them be erased or corrected.
11. Disclosure of Information
The School may receive requests from third parties to disclose personal data it holds about data subjects. The School confirms that it will not generally disclose information unless the individual has given their consent or a legal obligation applies.
12. Use of Personal Information by the School
The School will, from time to time, make use of personal data relating to data subjects in the following ways:
- photographic images of pupils or members of staff may be put in internal School publications (e-newsletter, information screens etc) and on the School and our alumni websites. Parents, guardians and students (where appropriate) will be asked to opt-in to photographs of them being used in these instances
- the School will not publish photographs in external publications without the express agreement of the appropriate individual
- for fundraising, marketing or promotional purposes; pupils, parents, alumni and former parents will be asked to opt-in to receiving these communications by email
- to determine your interests, preferences and potential to support the School (financially or otherwise) so that we can contact you in the most appropriate way and with the most relevant information. To help with this we may also use publicly available information such as listed directorships, geographical information, published works of reference and public website profiles
Should an individual wish to limit or object to any such use they should notify the Headteacher in writing.
13. Data Protection Responsibilities
Day-to-day responsibility is undertaken by members of support and academic staff. They will endeavour to ensure that all personal data is processed in a compliant manner. In addition, the School will ensure that:
- there is someone with specific responsibility for data protection in the School
- everyone managing and handling personal data understands that they are contractually responsible for following good data protection practice
- everyone managing and handling personal data is appropriately trained to do so
- everyone managing and handling personal data is appropriately supervised
- anyone wanting to make enquiries about handling personal data, whether a member of staff or a member of the public, knows the process to follow
- queries about handling personal data are promptly and courteously dealt with
- methods of handling personal data are regularly assessed and evaluated
- performance with handling personal data is regularly assessed and evaluated
- explicit (written or electronic) consent is gained for any processing requiring consent
- data sharing with third parties is carried out under a written agreement, setting out the scope and limits of the sharing. Any disclosure of personal data will be in compliance with approved procedures
- there will be a written briefing for data subjects on the type of data stored, the procedures followed and how to exercise their rights.
All staff within all levels of the School will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure and, in particular, will ensure that:
- personal data held on computers and computer systems is protected by the use of secure passwords
- individual passwords should be such that they are not easily compromised.
All contractors, consultants, partners or other agents of the School must:
- ensure that they and all of their staff who have access to personal data held or processed for or on behalf of the School, are aware of this policy and are fully trained in and are aware of their duties and responsibilities regarding data protection. Any breach of any provision of good data protection practice will be deemed as being a breach of any
contract between the School and that individual, company, partner or firm - provide the School with information about how it processes data held on its behalf (if requested)
14. The Website
The website operates within St Catherine’s Privacy Policy, a detailed Website Privacy Policy can be found here.
15. Enforcement
If an individual believes that the School has not complied with this Policy, he or she should notify the Business Director on dpo@stcatherines.gr or 210 2829750 x204.
Employees may use the School’s Grievance Procedure. Parents (or guardians) may use the Complaints Procedure for Parents and Pupils. Pupils may also contact the relevant Head of Key Stage or School.
16. Data Breach Management
In the event of a suspected breach of data regulations the following will be addressed by the School:
- containment and recovery
- assessment of ongoing risk
- notification of breach
- evaluation of response
The School will follow the advice provided by the Information Commissioner’s Office (UK) and the Hellenic Data Protection Authority on how to manage data breaches and when to notify.
17. Reviews
This policy will be reviewed every three years by the Executive Leadership Team and the Board of Governors.
18. Future Planning
The policy will be developed following issues raised by the internal audits, external audits and the internal reviews and in accordance with the law and regulation as it applies with a particular view to further information being released about GDPR compliance prior to May 2018 when full compliance with the regulation will be enforced.
Policy Date: March 2018
Policy Updated: May 2018