INFORMATION OBLIGATION
Pursuant to Art. 13 of the General Regulation on the Protection of Personal Data of April 27, 2016 (Official Journal EU L 119 of May 4, 2016) – the GDPR, we would like to inform you that:
- The controller of your personal data will be:
Embassy International School Sp. z o.o., with its registered office at ul. Edmunda Biernackiego 10, 30-043 Krakow, entered into the National Court Register by the District Court for Krakow-Śródmieście in Krakow, 11th Commercial Division of the National Court Register, under the National Court Register number (KRS): 0000569069, Tax Identification Number (NIP): 6762491287, Statistical Number (REGON): 362122984.
hereinafter referred to as the „Controller” or „EMBASSY”
- The Data Protection Officer has been appointed in the person of Dorota Gross, who you can contact regarding the protection of your data and related matters via e-mail at: dpo@embassyschool.org or in writing to the address of our registered office, as indicated in para. 1. 1)
- Purposes, basis and scope of data processing by EMBASSY
3.1. Activities related to the processing of your personal data:
- admission of a child to school, kindergarten or nursery,
- implementation of educational tasks,
- ensuring the child’s safety during their stay in the facility,
- enabling the child to use the full offer of the school,
- implementation of promotional tasks by the facility,
- fulfilment of legal obligations incumbent on the facility,
- implementation of agreements concluded with institutions,
- informing about the implementation of educational and recreational tasks and the upbringing of the child,
- ensuring the safety of employees and property of the facility,
- fulfilment of tax obligations, including accounting,
- care for the highest quality of services provided,
- in connection with the use of the fan page,
- in connection with the use of YouTube,
- video surveillance.
3.2. Each time, the purpose, basis, period, scope and recipients of personal data processed by EMBASSY result from the activities taken by you with respect to the services or activities listed below.
| Purpose of data processing | Basis for processing and period of data storage | Maximum scope of data processed |
| Conducting recruitment | Art. 6.1 (a) of the GDPR – CONSENT The data from application forms completed or documents sent is stored for up to 2 years. | Name, surname, age of the child, date and place of birth, gender, nationality, languages spoken, declaration on the child’s special needs; data of legal guardians (name, surname, telephone number, e-mail address); child registration form. Data from teachers’ application documents. |
| Concluding agreements | Art. 6.1 (b) of the GDPR – AGREEMENT with the required attachments pursuant to the Civil Code. The data is stored for the period required by law in connection with the storage of agreements concluded with clients for a period of 10 years from its termination. | Data of the child (Name, surname, age of the child, date and place of birth, gender, nationality, languages spoken, declaration on the child’s special needs; data on health contraindications) Data of legal guardians (name, surname, telephone number, e-mail address, Personal Identification Number (PESEL), ID or passport number). |
| Financial settlements | Art. 6.1 (c) of the GDPR – LEGAL OBLIGATION resulting from the Act on Value Added Tax. The data is stored for the period required by law in connection with the storage of financial documentation for a period of 6 years. | Parent’s name, address of residence; amount. |
| Correspondence | Art. 6.1 (f) of the GDPR – LEGITIMATE INTEREST OF THE CONTROLLER The data from correspondence is stored for a period of 2 years. | Identification data, name and surname, postal address, e-mail address, IP address, data from correspondence, message content. |
| Running websites and social networks: Facebook and YouTube | Art. 6.1 (a) of the GDPR – CONSENT The data is stored until the consent of the data subject is withdrawn. In the case of photos or videos – until the consent is withdrawn or for a period of 5 years. | IP address, name, surname, telephone number, email address, comments posted, photos, videos. |
| Claiming rights | Art. 6.1 (f) of the GDPR – LEGITIMATE INTEREST The data is stored until the expiry of rights or claims related to the provision of services. | Data necessary to conduct the proceedings. |
| Video surveillance | Art. 6.1 (f) of the GDPR – LEGITIMATE INTEREST The data from video surveillance is stored for 30 days. | Data from video surveillance on the premises of EMBASSY. |
- Upon the expiry of the above-mentioned periods, the data is permanently deleted or anonymized.
3.3. Legal regulations:
- Act of April 23, 1964 – Civil Code;
- Act of June 26, 1974 – Labour Code;
- Act of September 7, 1991 on the education system;
- Act of December 14, 2016 – Education Law;
- Act of April 15, 2011 on the educational information system;
- Act of October 13, 1998 on the social insurance system;
- Act of July 18, 2002 on the provision of electronic services;
- Act of September 29, 1994 on accounting;
- Act of March 11, 2004 on Value Added Tax;
- Act of May 10, 2018 on the protection of personal data
- Ordinance of the Minister of Health on the types, scope and templates of medical documentation;
- Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR)
- as well as all secondary legislation to these regulations.
- The recipients of your personal data are:
- other entities cooperating with respect to ensuring the continuity of the services provided,
- suppliers providing technical/organizational solutions for the provision of services/management of EMBASSY (including the suppliers of ICT, courier/postal, equipment and other services),
- providers of legal and advisory services,
- persons authorized by you as part of exercising your rights
- the recipient of data with respect to the processing of orders in IT systems is
- the recipient of data with respect to the publication of photos or comments on the fan page is Facebook (META), which is a separate data controller.
- the recipient of data with respect to the publication of videos is YouTube, which is a separate data controller.
- Your personal data will be transferred (partially) outside the European Economic Area – European Union countries, Norway, Liechtenstein, Iceland) only upon prior consent.
- Data profiling.
6.1. Your personal data may be subject to profiling only with respect to website operation and may consist in automatic analysis or forecasting of a given person’s behaviour on the website. Details are described in the cookie settings. Cookies can be disabled by the website user in the settings/cookie settings. The controller ensures that it will does not refer to your documentation during profiling.
- Your rights.
- You have the right to request the following from the Controller: access to, rectification, deletion or limitation of processing of personal data, the right to object to processing, the right to transfer data, the right to withdraw consent at any time.
- You have the right to lodge a complaint with the supervisory authority at https://uodo.gov.pl/pl/p/kontakt
- Providing personal data is obligatory based on the law – refusal to provide data may result in refusal to provide the service. To the remaining extent, it is voluntary.
Controller’s representation
EMBASSY INTERNATIONAL SCHOOL represents and ensures that the organizational and technical measures it uses to ensure the safety of personal data processing meet the requirements set out in the GDPR, in particular the provisions of Art. 32 of the GDPR. In order to exercise your rights or obtain information related to data protection, please send a message to: dpo@embassyschool.org
Detailed information will be available on the website and in the facility of EMBASSY INTERNATIONAL SCHOOL.