Privacy Notice

WHO WE ARE

Leysin American School S.A. (“LAS”) is a limited corporation based in Leysin, in the canton of Vaud, Switzerland, founded in 1960. Its identification number UID is CHE-107.024.781. In 2005, majority ownership of LAS was passed to the Foundation for the Advancement of International Education, a registered charitable foundation in the canton of Vaud. Its identification number IDE is CHE-112.481.256.

Last updated: 26, February 2019.

INTRODUCTION

The school complies with the General Data Protection Regulation (GDPR), which applies to citizens and residents of the European Union, and the Federal Act on Data Protection, which applies in Switzerland. We are committed to keeping personal information accurate, up-to-date, safe, secure and will not keep personal information longer than necessary. This privacy notice explains how we use personal information, who we share it with and the ways in which we protect and account for the protections to privacy. This notice applies to all personal data collected for and on behalf of the school. This pertains to information collected in analogue (forms, documents, in writing) and through technological means such as information systems and email.

From time to time, we will make you aware when we require additional personal information for processing through a separate specific privacy notice.

1. HOW WE USE PERSONAL INFORMATION

LAS collects personal information and sensitive categories of personal information of students, parents, employees, and at times third parties, to provide a safe and caring environment for teaching, learning, and general educational purposes. We use the information you provide for purposes that are necessary by law and required to undertake the performance of the contract into which you have entered and do so as we are required to do by law. We will always ensure we have a condition for processing personal and sensitive information.

We use the information you provide in the following ways:

to undertake and manage the school admissions and enrolment and summer programs
to approved school trips
to provide a safe learning environment to comply with child protection requirements
to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress to provide support and care for emotional and psychological wellbeing (pastoral and counseling)
to protect the health of the students and staff we serve. We may also use data provided to us by other health professionals to safeguard staff and students
to provide a tailored learning environment and make evidence-based education decisions for the children we serve to enable the children, we serve to continue or progress their education at other educational organizations
to enable the development of a comprehensive picture of the workforce and how it is deployed
to inform the development of recruitment and retention policies
to support the employee hiring and appraisal processes
to enable individuals to be paid
to support and develop our employees in the performance of their duties
to moderate teacher assessments of students
to support students in deciding what to do after leaving LAS
to develop and maintain relationships after graduation, successful completion of one semester, or upon request
to financial planning to help in the future planning and resource investment purposes
to meet our statutory reporting requirements to the Département de la formation, de la jeunesse et de la culture and other authorities
to help investigate any concerns or complaints you may have

2. WHY WE COLLECT DATA AND PERSONAL INFORMATION

We collect and use personal information to carry out the education services as prescribed above. We do so under a lawful basis, as prescribed by the associated Regulations. In some circumstances we may be required to share your personal data for legal statutory purposes or under legitimate interest. If we need to share your information we will ensure, if required, that you are advised.

3. CATEGORIES OF PERSONAL DATA PROCESSED BY LAS

The categories of personal information that we collect, hold and may share include:

personal information (such as name, date of birth, unique number, email address and mailing address)
special categories of data (such as health, religion, medical information, criminal records)
other relevant categories for the performance of our services (such as assessment, relevant medical information, special educational needs information, exclusions / behavioral information and psychological reports and assessments)
attendance information (such as sessions attended, number of absences and absence reasons)
logging and audit in the use of IT systems and education technology apps, applications and cloud-based systems
photographs and videos taken by staff and students throughout the school year to record and share everyday life at LAS. Your child may be identifiable in these photographs
photographs taken for identification purposes e.g. ID cards
admissions, academic, disciplinary, and other education / employment-related records
personal references, examination results, and grades
financial information (eg for financial aid assessment or for fundraising)
courses, meetings, or events attended

4. COLLECTING STUDENT INFORMATION

Whilst the majority of student information you provide to us is required for the performance of a contract or by law, some of it is provided to us on a voluntary basis.

In order to comply with data protection law, we will inform you when we require consent to process your information. Where consent is provided you or your child are free to withdraw consent at anytime. You can contact our Data Protection Officer (contact details below) if you or your child wish to withdraw consent.

5. RETENTION AND STORING OF PERSONAL DATA

The school recognizes that by efficiently managing its records, it will be able to comply with its legal and regulatory obligations and to contribute to the effective overall management of the institution. Records provide evidence for protecting the legal rights and interests of the school, and provide evidence for demonstrating performance and accountability.

All pupil and staff records will be kept securely at all times. Paper and electronic records will have appropriate security measures in place. This will ensure that confidentiality is maintained for pupil and staff records whilst enabling information to be shared lawfully and appropriately, and to be accessible for those authorized to see it.

The pupil and staff records will be disposed of in accordance with the safe disposal of records guidelines. If records have been identified as historically important they will be archived.

6. SECURITY

Whilst we store and use your personal data we will ensure the appropriate security of your personal data including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. We will notify you and the Federal Data Protection Commissioner of the Canton of Vaud, Switzerland of a data security breach when we are legally required.

7. WHO WE SHARE INFORMATION WITH

Example of who we may share data with:

schools, colleges, or universities that the students attend after leaving us
family nurses, doctors, or other organizations where sharing is in the vital interests, or where not sharing could have a negative impact on the individual
Département de la formation, de la jeunesse et de la culture, providers of information systems that are necessary for LAS to deliver the admissions, administration, teaching and learning, pastoral development, standardized testing bodies, college board, IB Organization, and child protection services
third parties for school trips/outings
law enforcement or other authorities if required by applicable law (eg permit and visa processing)
contracted third-party providers of services (eg photographer, travel service providers)

8. WHO WE SHARE WORKFORCE INFORMATION WITH

Unless there is a statutory requirement we do not share information about workforce members with anyone without consent unless the law and our policies allow us to do so.

We are required to share information about our school employees with Federal Tax Office (concerning payroll), AVS Authority (social security office) and BCV Foundation second pillar (workplace pension)

9. CCTV

We collect information in the form of CCTV to ensure the safety and security of students and staff. You have the right to access the images of you. We retain CCTV images for 30 days after which they are deleted. Access to these images can be requested through the Data Protection Officer (contact details below).

This policy sets out how Leysin American School as data controller manage the use of Closed Circuit Television System (CCTV). It also communicates your rights in relation to the personal data that is captured and recorded.

The establishment records and stores personal data on the CCTV system for the following purposes:

For security and personal safety of students, staff, visitors and members of the public.
For security in the protection and monitoring of buildings, equipment, and personal property of students, staff, visitors and members of the public.
For the purpose of prevention and detection of crime.
For disciplinary reasons in monitoring and upholding the establishment related rules.

Location and positioning of cameras:

Internal and external locations have been selected to achieve the purposes set out above.
Locations and positions are appropriate to the purposes of image capture and are not located in areas that require heightened levels of privacy (changing rooms, toilets).
Signage has been placed in visible locations notifying that CCTV is in use.
Locations and positions of cameras may change from time to time in response to tactics required to meet the purposes set out above. With the limited exception of the public facing entrance(s), the cameras are not filming the public.
Cameras are fixed and do not record audio.
Cameras will record continuously.

System operation and management

Only authorized staff may observe the operation of the system, and may do so 24 hours a day, 365 days a year.
Viewing of captured images will be restricted in a private environment and is restricted to authorized individuals.
Viewing of captured images will only be authorized in association with one of the purposes as above.
Where viewing is authorized, the purpose, time, date and images viewed will be documented and logged by the authorised viewer.
Unless otherwise required as evidence in pursuit of one of the stated purposes, images are stored for a maximum of 7 days before being deleted by Eagle Eye Networks.
The organization takes proportionate organizational and technical measures to ensure the security of processing in accordance with Article 32 of the GDPR.
Regular maintenance of the cameras and the system will take place to ensure the continuity of recording and good health of the system.

Image transfer and disclosure

A log is maintained of all images viewed, downloaded, transferred and disclosed. The log will document:
- supported purposes and lawful basis for the use of the images
- the individual(s) who released the images and the individual to whom the data has been transferred / disclosed
- the date, time and protections in place when the transfer / disclosure took place.
The establishment may receive CCTV images from third parties in achieving the purposes set out above. These parties may include transportation, accommodation organizations and other public bodies such as local government and police.

Your rights

The data protection law provides data subjects with a wide array of rights that can be enforced against organizations which process personal data. These rights may limit the ability of schools to lawfully process the personal data of data subjects, and in some cases these rights can have a significant impact on the way the school works.
For further information on your rights, please refer to the Information Rights Policy or contact our Data Protection Committee.

Any questions relating to this policy should be directed to: gdpr@.com

10. PROCESSING AND TRANSFERS TO THIRD COUNTRIES

Personal information may be transferred to organizations outside the EU for the purposes of student application for college or university. Various teaching and learning applications are also used that are based outside the EEA / EU. Information on these and the protections afforded by these data processors can be requested from the Data Protection Officer (contact details below).

11. AUTOMATED PROFILING

The school’s IT systems profile the use, access and content viewing of all users and is a processing activity derived from LAS Child Protection Policies. The profiling enables the school to assess child protection and safeguarding (pastoral) risks or concerns. The school has a process in place to ensure only those with the relevant training and expertise have access to the data generated by this processing activity.

Some educational applications profile the behavior, use and outcomes of children. The school has a process to assess the impact on children. In evaluating the use of these applications, the school will consider the benefit gained from using it for the child to learn, develop and explore, against the negatives identified from profiling.

12. IT SYSTEMS

For the purposes of IT hosting and maintenance all school information including personal data is located on servers within the school, or within hosted servers provided by our service providers. No third parties have access to your personal data unless the law allows them to do so. Where the law allows and information is shared with third parties, we ensure they have the same protections in place as we do. We cannot deliver our education services without processing the data we collect and share.

In following the principles of Article 32 - Security of Processing of the GDPR, we have in place proportionate organizational and technical measures to protect your personal information. More information on these can be requested via the Data Protection Officer (contact details below).

13. COOKIES

14. FUNDRAISING AND KEEPING IN TOUCH

Fundraising helps us to achieve our strategic objectives. We fundraise from individuals, companies, and foundations who want to support our mission. We do not use third-party profiling companies but we analyze publicly available data about potential donors to create a profile of interests and preferences so that we can make appropriate requests.

We keep in touch with alumni, current/past parents, and other members of the school community. We will only use your contact details if you have consented so that we can keep you updated about our activities and invite you to events of interest by email, digital message, and/or by post. We ask you to let us know your data preferences so that we can ensure our communications are relevant to you. You can update your data preferences at any time by email at alumni@las.ch.

15. REQUESTING ACCESS TO YOUR PERSONAL DATA

Under data protection legislation, anyone has the right to request access to information about them that we hold. To make a request for your personal information, contact the Data Protection Officer and or see our Information Rights Policy.

Aligned to the GDPR you also have certain additional rights to:

be informed of how we are processing your personal information—this Privacy Notice serves to explain this you but do get in touch if you have any questions;
have your data corrected if it is inaccurate or incomplete;
have your information erased (the right to be forgotten) in certain circumstances—e.g. where it is no longer needed by us the purpose for which it was collected or you have withdrawn your consent;
restrict the use of your data in certain circumstances e.g. where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate; to object to the processing of your data in certain circumstances—e.g. you may object to processing of your data for direct marketing purposes
to object to decisions being taken by automated means or for it to be reviewed by manual intervention
to object to processing of personal data that is likely to cause, or is causing, damage or distress prevent processing for the purpose of direct marketing in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

If you have any concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance.

You can also directly contact the Supervisory Authority in Switzerland:

Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Berne
Switzerland
Tel: +41 58 462 43 95
Fax: +41 58 465 99 96
www.edoeb.admin.ch

16. CONTACT

This Privacy Notice has last been updated on 25 February, 2019.