Privacy Notice for the Personal Data processed via Veracross

Dear parents,

Veracross is our web-based platform that allows you to submit an application with us.

It represents an important step of the admission process as well as a collection point of personal data pertaining to you and your children. Considering this context, please find below a privacy notice dedicated to the personal data processed via Veracross.

All personal data processed at the level of AISB are handled according to the General Data Protection Regulation no. 679 / 2016 applicable in the European Union (“GDPR”). AISB acts as controller with regard to your personal data and the personal data of students (“Personal Data”), meaning AISB establishes the purposes and means of processing the Personal Data.

For the purposes of this Privacy Notice, please note that the term “processing” shall represent any operation performed on Personal Data, whether or not by automated means such as collection, recording, storage, adaptation, alteration, consultation, use, disclosure by any means, erasure or destruction.

The purposes for which AISB processes your Personal Data:

Via Veracross, AISB processes your Personal Data for the following purposes:

• Granting access to the Veracross platform;
• Reviewing the application and documents uploaded to support the application and taking a decision as regards admission;
• Conveying various messages related to your application (e.g., to book a testing);
• Drafting the enrollment agreement;

The categories of Personal Data that AISB processes, include, but are not limited to the following:

AISB processes all the Personal Data that you fill in the Inquiry Form and the Application for Admission Form, including, but not limited to the identification data, family and household data, health data and data on the educational background of your child. Additionally, Personal Data are collected and processed from the various documents, reports that you upload on the Veracross platform.

All the data processed via Veracross are obtained directly from you, and may be further completed by references that AISB asks from former schools attended by your children or derived from various tests your child takes as part of the admission procedure.

The lawful basis for the processing operations conducted on the personal data provided via Veracross

• For the performance of the enrollment contract, as well as in order to take steps at your request for entering into the enrolment contract and to further provide the educational services.

Please note that there are some mandatory categories of personal data necessary to AISB in order to conclude the enrolment agreement and provide the educational services to students at a high standard and in the best interest of the students.

The mandatory categories of personal data are included in the on-line application form that you are filling in as part of the application process. All the categories of data that are compulsory for the conclusion of the contract are marked accordingly in the application form.

Please take into consideration, that all the mandatory categories of data are necessary for AISB to be able to evaluate your application and finally to enroll your child. Failure to provide all the information marked as mandatory will lead to impossibility of AISB to process your application and to enter into a contract with you.

• For the performance of a task carried out in the public interest, considering that AISB provides educational services, regarded as a service of public interest, according to the Romanian provisions governing the education system;
• The legitimate interest pursued by AISB.

The legitimate interest pursued by AISB shall be used as a lawful basis for processing, especially after the enrollment process is completed, moment when you will be provided with additional information on the legitimate interests pursued by AISB.

With respect to the processing of the special categories of personal data under the GDPR, respectively health data, please take into consideration that AISB processes health data based on the following legal grounds:

• The necessity of the Medical Office to process such data for the purpose of preventive and occupational medicine, medical diagnosis and the provision of health or social care or treatment on the basis of European Union or national law;
• Processing is necessary for reasons of substantial public interest, on the basis of European Union or national law. Such a legal ground is used especially in those situations where the school has to assess the learning capacity of a student and adapt the teaching activities to the special needs of a student.

Disclosure of Personal Data

At this stage of our relationship, AISB discloses your Personal Data only to those members of AISB, staff, who are involved in the admission process and that will further take all the steps to ensure the enrollment of the student. In this respect, please take into account that only the Medical Office has access to the students’ medical records.

Other departments of the school have access to health data in order to protect a substantial public interest based on European Union or national law (e.g., assessing various medical conditions of a child triggering special learning needs).

Third country transfers

AISB transfers your personal data to the United States of America, respectively to the provider of the Veracross web-based platform that has obtained EU – US Privacy Shield certification.

Retention of Personal Data

Personal data uploaded in Veracross are held for as long as you are in a contractual relation with us, and afterwards for a standard period of 5 year, period for which AISB can justify a need in storing such personal data.

For the situations where you have submitted an application via Veracross but unfortunately, AISB was not able to proceed to the enrollment phase, the personal data collected from you will be held for a period of 3 years.

Your rights related to the processing of Personal Data by AISB

The GDPR provides certain rights related to the processing of personal data, that both you and the students have. In this respect, please be informed that students that have an appropriate level of understanding could exercise the rights listed in this section, individually.

AISB respects all the rights mentioned under the GDPR and is committed to furnishing the appropriate means by which you can exercise these rights. Please note, that at this stage of interaction, respectively applying to AISB via Veracross, not all rights described below may prove useful to you, however we have presented all the rights under the GDPR.

• The right of access, which entails your possibility to solicit access to this data, as well as additional information regarding the Personal Data, such as: the purposes of processing, the categories of recipients the Personal Data are being disclosed to and the envisaged retention period.
• The right to rectification, that allows you to request AISB rectification of any inaccurate Personal Data that AISB may hold, as well as to have your incomplete Personal Data to be completed.
• The right to erasure meaning that in the situations expressly regulated by law, you may request erasure of your personal data.
• The right to restriction of processing, signifying your right to obtain restriction of processing your Personal Data from AISB’s part. Please bear in mind that this right can be exercised only in specific situations laid down by the GDPR.
• The right to data portability implying your right to receive the personal data in a structured, commonly used and machine-readable format and further to transmit such data to another controller.
• The right to object to the processing of your Personal Data by AISB, on grounds relating to your particular situation.
• The right to lodge a complaint designates your right to challenge the manner in which AISB performs processing of your Personal Data with the competent data protection authority.
• The right to withdraw your consent given for various processing operations, in cases where the consent represents the lawful basis for processing.

Cookies

Veracross is using cookies in order to provide you with a user-friendly and easy to access platform.

A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is a small piece of data sent from a website and stored in your web browser while you are browsing that website. Cookies are required to use Veracross. The absence of such cookies will make the platform unable for your use.

Veracross uses the following cookies:

1. Session Cookie: it stores a unique identifier that authenticates you to the service, after passing the authentication page.
2. Persistent cookie: it stores an authentication token that will enable access to the service when you come back after logging out. The activation of this persistent cookie is optional, you can choose to enable it when you authenticate yourself to Veracross, by ticking the box “Remember me”.

Contact Point

In the situation where you may wish to exercise any of the rights listed above or to obtain additional information or clarifications on the subject of processing your Personal Data please contact AISB, via its appointed Data Protection Officer – responsible for ensuring that AISB complies with all the requirement of the GDPR.

Contact Details of AISB’s Data Protection Officer:

E-mail address: dpo@aisb.ro

Phone Number: +4021/2044237

I acknowledge that I have read and understood the information presented in this Privacy Notice.