Last updated on 4 November, 2019.
In the course of the services we provide to you, the International School of Brussels, Kattenberg 19, 1170, Brussels, Belgium (hereinafter “ISB” or “we”), will process personal data relating to you and your children. With regard to such processing, ISB will qualify as data controller.
In this capacity, ISB strives to comply with applicable data protection regulations, such as the European General Data Protection Regulation 2016/679 of 27 April 2016 and the Belgian act of 8 December 1992 on the protection of privacy in relation to the processing of personal data, as may be amended from time to time. This International School of Brussels Privacy Notice (hereinafter “Notice”) explains how we collect and use personal data, who we share it with and the ways in which we protect your privacy while doing so. This Notice applies to all personal data collected for and on behalf of ISB. This pertains to both information collected in analogue form (forms, documents, in writing) and through technological means, such as information systems and email.
From time to time, we may make you aware when we require additional personal data for processing activities through a separate specific privacy notice.
ISB reserves the right to make changes to this Notice from time to time, for example in the light of new developments or new legislation. ISB will always inform you of such changes in advance. In any event, it is recommended that you consult this Notice regularly.
1. How we collect your personal data
We may collect your personal data in a variety of ways:
- Personal data relating to you or your children can be obtained directly from you or your children, for example via completing the Application and Health and Consent forms, via information provided via the ISB Community Portal, via meetings with teachers and staff, etc.
- Personal data relating to you or your children can also be obtained via other information channels, such as previous schools, health professionals, social media channels, etc.
- Personal data relating to you or your children also obtained by actions of ISB itself or its data processors, e.g. through evaluations, camera surveillance, access control measures, etc.
2. Why we use your personal data
ISB collects personal data, including special categories of personal data of students and parents to provide a safe and caring international environment for teaching, learning and general educational purposes.
More specifically we process your or your children’s personal data for the following purposes, and other purposes that are compatible with the purposes described below:
- to undertake and manage the school admissions and enrolment
- to provide a safe and secure learning environment
- to comply with child protection requirements
- to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress
- to provide our educational services
- to provide support and care for emotional and psychological wellbeing (pastoral and counselling)
- to protect the health of the students and staff we serve
- to provide a tailored learning environment and make evidence based education decisions for the children we serve
- to enable the children we serve to continue or progress their education at other educational organisations
- to support and develop our employees in the performance of their duties
- for financial planning to help in the future planning and resource investment purposes
- to meet our statutory reporting requirements to the education and other authorities
- to help investigate any concerns or complaints you may have
- to build and maintain the ISB community, including fundraising
- to make you aware and inform you about our services, news, events and activities that are undertaken at or in association with ISB
- to communicate with you within the framework of your relationship with ISB
- to ensure the safety and security of students and staff, including camera surveillance
- for forecasting and planning for education service provision
- to respond to requests of our staff and (former) students regarding historic information pertaining to their time at ISB.
3. On which basis ISB processes your personal data
We collect and use personal data to carry out the education services as prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered into. In some circumstances we may have to process data for other purposes that are not necessary for the performance of the contract. In such cases, the processing may be based upon (i) our legitimate interests, such as providing a safe learning environment, maintaining the ISB community, fundraising, etc., (ii) on the protection of you or your children’s vital interests, (iii) on the compliance with our legal obligations and/or (iv) on the consent you or your children may have provided to us.
4. The categories of personal data being processed
The categories of personal data that ISB collects and processes include:
- personal information (such as name, unique number and address)
- special categories of data (such as health information, ethnicity)
- educational and evaluation data (such as assessments, relevant medical information, special educational needs information, exclusions / behavioural information and psychological reports and assessments)
- attendance information (such as sessions attended, number of absences and absence reasons)
- logging and audit in the use of IT systems and education technology apps, applications and cloud based systems
- communication and correspondence data (such as emails, letters and other types of correspondence)
- photographs and videos (see also section 8 and 9 of this Notice).
Special categories of data
The education services we provide require us to collect and process special categories of data, such as health information, for the purposes of safeguarding the protection of your children and the wellbeing of those within our care. We do not disclose or share special categories of data without explicit and unambiguous consent unless we have to do so where we are required to by law, or where we have good reason in protecting the vital interests of an individual, or where not doing so would place someone else at risk.
5. Storing personal data
We keep personal data for as long as necessary with regard to the purposes described in Article 2 of this Notice or for any other purposes that may be communicated to you.
In general, your personal data are stored on our own servers and on the servers of our data center service provider, located in the European Union. Regarding transfers outside the European Union, see Article 6 of this Notice.
6. Sharing and transfers of personal data
Your personal data is shared internally within ISB for the purposes of delivering the services required.
For the purposes described in Article 2 of this Notice, ISB may need to share your personal data externally with certain recipients, as well as with third parties processing your data on behalf of ISB. More specifically, this includes the following categories of recipients:
- Schools, colleges or universities that the students attend after leaving ISB; Other international schools (amongst others for the purposes of trips, sports and activities);
- Local education authorities in Brussels;
- Family nurses, doctors or social service organisations (amongst others where sharing is in the vital interests, or where not sharing could have a negative impact on the individual);
- Providers of information systems that are necessary for ISB to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services;
- Providers of IT hosting and maintenance services;
- Government organisations, police, health and social care (where we are required to do so by law, or where we have obtained your consent to do so).
Personal data may also be transferred to organisations outside Belgium and outside the European Union. This may for example occur for the purposes of student application for college or university. Various teaching and learning applications of providers that are based outside the European Union are also used. For such transfers of personal data outside the European Union, ISB has implemented suitable safeguards in the form of appropriate contractual clauses where required under applicable data protection legislation. More information on these transfers and suitable safeguards can be requested from the ISB Privacy Officer (see section 11 below).
8. Camera surveillance
We collect information in the form of camera footage via our CCTV-systems to ensure the safety and security of students and staff. We retain these CCTV images for 21 days after which they are deleted, unless we need to retain the images for further investigation or law enforcement purposes. Access to these images can be requested through the ISB Privacy Officer (see section 11 below).
9. Photographs and videos
Non-targeted photographs and videos of you/your child may be used for educational or other purposes where we have a legitimate interest to do so, for example, to document the broader learning environment at ISB, within marketing and promotional activities, including alumni, ISB Summer and Sports Camps, or for the identification of you for security or health-related purposes such as allergies and/or life-threatening medical conditions.
There are other occasions, however, where ISB may wish to publish your image for example, as a way of documenting and sharing learning at ISB. In such instances, ISB Staff and students may, where applicable with permission, take photographs and videos throughout the school year to record and share everyday life at ISB.
The making and usage of non-targeted images (i.e. images that reproduce a more general and rather spontaneous, non-posed image, without focusing on one or more persons, such as general atmospheric pictures or group pictures) is based on ISB’s legitimate interests. Individuals have the right to opt-out from such images at any time.
For the making and using of individual or targeted images the consent of the data subject is required and collected via the relevant Consent Form. Targeted images refers to individual photographs or videos whereby specific persons constitute the main subject or when one or a few people are highlighted during a group activity or when posing for an image.
9.1 Use of personal devices or personal accounts
Where personal devices are used to take photograph and/or video images the holder of the device becomes the ‘data controller’ for them and accepts liability including in the event of a data breach, or any other requests made by the data subjects contained within the images.
Where your own personal device is used to document photographs and/or videos of learning at ISB, you are to be considered the data controller for such images and as such, are wholly liable for their use and/or distribution. In this capacity as data controller, you are also wholly responsible for amending, removing or deleting any personal data pertaining to any data subject affiliated to ISB, without undue delay upon their request, including where such data may have been uploaded to your social media accounts.
9.2 Uploading of photographs and videos
ISB strives to enable ISB staff and students to embrace developments in educational applications for learning purposes and to achieve this within a framework designed to guarantee the highest levels of data protection for all members of our community. Where images, videos and personal data of students may be uploaded to online resources or storage systems, this shall be carried out only where appropriate contracts have been established with such vendors according to Data Protection Legislation, if required, and under the following conditions:
where we have a legitimate interest to do so, (for example marketing and print publications including school promotional literature, and promotional images on school-managed websites).
on the basis of our contract with you to deliver educational services, (for example through the creation of necessary online accounts for learning, or through the uploading of data to educational services providers such as the IB or NWEA for MAP testing);
after you have granted your explicit consent via the relevant Consent Form.
9.2.1 Internal secure digital platforms
ISB uses secure digital platforms to process personal data internally and to share student learning with you. These platforms are not accessible to a wider external community and are founded on a contract with the service provider, which includes a guarantee to protect the data processed within it. The use of such secure platforms is based upon a legitimate interest in the course of delivering education services.
9.2.2 External digital platforms
ISB also manages official school social media accounts including, but not limited to Facebook, Twitter, Instagram and Graduway. These accounts are created in the absence of a formal data processing agreement with the service provider, and as such, a high level of data privacy cannot be guaranteed.
Faculty and Staff at ISB may also have personal social media accounts, created either through their isb.be email account, or an alternative personal email address, which they use to document day to day learning at ISB. ISB does not manage these accounts. For any processing of personal data via these accounts, the person holding the relevant account qualifies as the data controller.
9.3 Performing arts, sporting events and live streaming
Significant events within the school calendar such as graduation or sports matches may include live streaming. Where such events are ISB hosted, live streaming occurs through unlisted or password protected online resources such as YouTube.
Furthermore, where performing arts or sporting events are held externally, such events may also be live streamed according to conditions agreed upon by the external host, who will then qualify as the data controller.
10. Your rights
Parents and students may exercise a number of rights with regard to the processing of their personal data vis-à-vis ISB, in so far as they effectively have those rights under applicable data protection legislation, such as the European General Data Protection Regulation 2016/679 of 27 April 2016 and the Belgian act of 8 December 1992 on the protection of privacy in relation to the processing of personal data, as may be amended from time to time.
The first point of contact in connection with the processing of personal data and the exercise of the rights described below is the ISB Privacy Officer (email@example.com). ISB shall respond to such requests and may or may not act upon them, in principle within a period of one month, all in accordance with applicable data protection legislation.
In addition, you also have the right to contact or file a complaint with the Belgian Data Protection Authority:
The rights which you may have under applicable data protection legislation are:
- Right to object – the right to object on grounds relating to your particular situation to the processing of personal data based on the legitimate interests of ISB, and the right to object to the processing for direct marketing purposes.
- Right to information and access – to request access to and a copy of the personal data ISB holds on you, as well as the right to information about relevant aspects of the data processing by ISB. This Notice serves to inform you thereon, but do get in touch if you have any questions.
- Right to rectification – to correct inaccurate personal data or to complete incomplete personal data.
- Right to erasure – to request the deletion or removal of personal data in specific circumstances, for example if your personal data are no longer necessary for the purposes pursued by ISB or if there no longer is a legal ground for the data processing.
- Right to restriction of the processing – to limit the processing, e.g. where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate.
- Right to data portability – to receive your personal data in a structured, commonly used format and to transmit it or have it transmitted to another international school.
- Right not to be subject to automated individual decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Where the processing of your personal data is based upon consent, you and/or your child have the right to withdraw consent at any time. Such withdrawal of consent shall not affect the lawfulness of the processing based on consent before the withdrawal.
There may be instances where you may not want us to process or share your personal information. In these cases, we may not be able to fulfil the service you need, or do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if this is the case.
11. ISB Privacy Officer & Contact
For any questions or concerns relating to this Notice or the processing of your personal data by or on behalf of ISB, as well as for the exercise of any of the rights described in Article 10 of this Notice, please contact the ISB Privacy Officer (firstname.lastname@example.org).
12. Applicable law and jurisdiction
This Notice and any disputes arising out of in relation to this notice shall be exclusively governed by and construed in accordance with Belgian law. The courts of Brussels, Belgium, shall be exclusively competent for any disputes arising out of or in relation to this Notice.
This Privacy Notice has last been updated on 16 April, 2018.