PRIVACY NOTICE

Version updated in February 2023

 

AVENOR processes personal data on its employees, prospective, current and former students but also of their parents or legal representatives, as part of its everyday operations of providing educational services. 

AVENOR handles your personal data according to the General Data Protection Regulation no. 679/ 2016 applicable in the European Union (“GDPR”). For these purposes, AVENOR acts as data controller with regard to your personal data and the personal data of students, meaning AVENOR establishes the purposes and means of processing the Personal Data.

For the purposes of this Privacy Notice, please note that the term “processing” shall represent any operation performed on Personal Data, whether or not by automated means such as collection, recording, storage, adaptation, alteration, consultation, use, disclosure by any means, erasure or destruction.

AVENOR wishes to be completely transparent with regard to the processing of Personal Data and therefore, we have presented below all the information you may need on this subject matter.

Please take a little of your time to read this privacy notice to understand the data processing operations carried out by AVENOR.

 

1.  The purpose for which AVENOR process your Personal Data:

AVENOR processes Personal Data that pertain to you or to the students for the following purposes:

  • Provision of educational services, starting with the application process, enrolling students, administration of classes and timetable, teaching activities in their own spaces and online, administration of internal and public examinations, assistance regarding the application process to various universities, issuance of academic records and academic assessment reports.     
  • Provision of educational ancillary services: running the Virtual Learning programme, pastoral care, career and personal counselling, library services, extracurricular activities, school trips, managing school’s publications, setting up the virtual learning environment and granting access to AVENOR Intranet and Internet network as well as monitoring the use of AVENOR network.     
  • Ensuring campus security: monitoring access on campus, performance of video surveillance, ensuring security in online education sessions.   
  • Provision of the medical care and counselling that students may need.
  • Ensure mandatory safety measures imposed by authorities to restore education conditions at Avenor premises, as well as to ensure a hybrid education system, in accordance with the Framework Methodology announced by the Ministry of Education and Research in September 2020.
  • Ensuring the conditions of maximum safety and confidentiality regarding the management of data regarding the history and interactions of Covid-19, the appearance and evolution of some Covid-19 symptoms and the systematic processing of data regarding the state of health and pre-existence of chronic diseases.·         
  • School administration: handling student records and other academic documentation, managing contact lists of students and parents (names, phone, e-mail), administration of fees and accounts, internal audits and controls, reporting and statistics creation, implementing school policies, ensuring collaboration with other schools and educational entities, archiving, assessing the quality of our services, facilitating research activities.     
  • School related communications: conveying various messages related to the students and AVENOR’s activities by any communication means.
  • Communication for the smooth running of distance and online school activities.    
  • Organising fundraising activities and other school events (e.g., concerts, theatre productions, talent shows), including marketing communications related to the fundraising activities organised by AVENOR.
  • Participation in a series of domestic and international online events and conferences where the organiser requests access to student registration and participation data (names, email addresses).  
  • Dispute resolution and litigations.

 

2. The categories of Personal Data that AVENOR processes, include, but are not limited to the following:

  • Identification and contact information (first and last name, citizenship, country of birth, address, information included in ID’s / passports, phone number, e-mail etc.); 
  • Bank details;
  • Health data: medical history, allergies, immunisation records, disorders, medical examination results and other medical data of the students; 
  • Medical documents, employee records and medical records, questionnaires regarding the history of Covid-19 interactions, specific symptoms of Covid-19 and special medical data regarding the existence of chronic diseases, declared on one’s own responsibility.
  • Data related to the educational background and regarding school performance of the students: academic results and assessment reports, disciplinary and behavioural data,  hobbies, results of educational diagnosis testing, teacher’s feedbacks, etc.;
  • Behavioural data as well as data on preferences / interests of students;
  • Data on students’ email addresses, IP addresses and video recordings associated with the online distance education system;  
  • Family information: siblings enrolled in Avenor, household information, language background, profession and workplace of parents etc.;

Generally, the Personal Data held by AVENOR were provided directly by the parents or resulted from the interaction the parents and the students have with the school. In some cases, we receive personal data from third parties (e.g., representatives of former schools attended by students) supply data.

 

3. The lawful basis for the processing operations we conduct with regard to the Personal Data

AVENOR collects and further processes Personal Data, based on one of the following legal grounds, expressly laid down by the GDPR:

The consent you have granted us, prior to any processing of the personal data, for:

  • the use of students’ photographs and videos in various school publications, AVENOR’s website and social media pages;
  • the use of your contact details for direct marketing communications on AVENOR’s fundraising activities;
  • other consents that may be granted periodically for various Personal Data processing activities.

Please note that there are some mandatory categories of personal data necessary to AVENOR in order to conclude the enrolment agreement and provide the educational services to students at a high standard and in the best interest of the students.

The mandatory categories of personal data are included in the application form, which you have filled in on-line and listed in the enrolment contract you already have / will sign with AVENOR. All the categories of data that are compulsory for contract conclusion are marked accordingly in the application form.

Please take into consideration that all the mandatory categories of data are necessary for AVENOR to be able to evaluate your application and finally to enrol your child. Failure to provide all the information marked as mandatory will lead to the impossibility of AVENOR to process your application and to enter into a contract with you.

  • A legal obligation that requires AVENOR to process your Personal Data (e.g. for invoicing).
  • For the performance of a task carried out in the public interest, considering that AVENOR provides educational services, regarded as a service of public interest, according to the Romanian applicable provisions on education, many processing operations conducted by AVENOR that are strictly related to educational purposes will be founded on this lawful basis for processing. We refer here mainly to issuing and storing academic records, evaluating students’ performance etc.
  • The legitimate interest pursued by AVENOR.

AVENOR relies on this legal ground in order to provide the educational services it has committed to deliver and additional services related to this scope at the highest standards, always for the benefit of the students and without outweighing the parents or the students’ rights and liberties.

AVENOR may invoke the legitimate interest legal ground in the following cases:

  • monitoring use of the AVENOR’s virtual learning environment and network, including monitoring the use of e-mails account provided by AVENOR;
  • conducting fundraising activities, including marketing of such activities;
  •  enforcement of legal claims, addressing complaints and third party controls;
  • management, control, reporting and performing statistics on schools activity;
  • ensuring security at AVENOR premises, including through video monitoring systems;
  • maintaining close relationships with alumni and AVENOR’s community;
  • collaboration with other schools and educational institutions;
  • performance of agreements with suppliers, including insurance suppliers;
  • access to grants and other funding sources.

With respect to the processing of the special categories of personal data under the GDPR, respectively health data, please take into consideration that AVENOR processes health data based on the following legal grounds:       

  • The necessity of the Medical Office to process such data for the purpose of preventive and occupational medicine, medical diagnosis and the provision of health or social care or treatment on the basis of European Union or national law;
  • Processing is necessary for reasons of substantial public interest, on the basis of European Union or national law. Such a legal ground is used especially in those situations where the school has to assess the learning capacity of a student and adapt the teaching activities to the special needs of a student.
  • The explicit consent granted by you for the disclosure of the personal data of students related to the allergies they suffer from.
  • Processing of special personal data of students and employees for reasons of vital interest, absolutely normal in conditions of emergency and alert: data on the history of interaction with Covid-19 infected persons, data on possible symptoms associated with Coronavirus, data on possible chronic diseases from Occupational Medicine centres, family doctors or by completing questionnaires at your own risk.
  • Psychologist teachers may have access to a number of sensitive personal data related to a certain psychological profile, the existence of files of children and the current activities of psychological consultations.

 

4. Disclosure of Personal Data

AVENOR discloses your Personal Data only to those members of AVENOR, staff and collaborators, who need access to the personal data mainly for ensuring the provision of the educational and ancillary services. In this respect, please take into account that only the Medical Office has access to the students’ medical records. Other departments of the school have access to specific health data based on the consent you have expressed (i.e. for allergies) or in order to protect a substantial public interest based on Union or national law (e.g., various medical conditions triggering special learning needs).

With respect to the disclosure of your Personal Data to third parties, outside AVENOR, please note that such disclosure is performed solely in the regular activity of the school. The categories of recipients include the following:

  • IT providers, including educational applications, online learning tools, email marketing platforms such as MailChimp or information management systems like Engage by Double First, etc.
  • Cafeteria Owner in its capacity of independent provider of meal services on campus; 
  • Other nurseries, schools or colleges by transferring schooling files;
  • Other educational institutions or organisations, not limited to other schools;
  • Extracurricular event organisers, including in situ and online events; 
  • Providers of remote communication and collaboration platforms used in Virtual Learning sessions;
  • Travel agencies, catering and transportation providers;
  • AVENOR’s photographer and video crew;  
  •  Courier services providers;
  • Utilities services providers;
  • Public authorities and institutions, national or foreign, judicial courts and foreign embassies or other forms of diplomatic missions;
  • Tax, legal and accounting consultants.

 

5. Third country transfers

AVENOR may transfer the personal data of students and parents to a third country only for the purpose of participating in school activities, excursions or international camps that are the subject of our institution activity. In addition, for the smooth running of the examination conditions, AVENOR may transfer the personal data of students in the United Kingdom – to Cambridge International Examinations. As of 01.01.2020, all transfers of personal data to our UK partners are legally justified by the EU-UK post-Brexit GDPR adequacy agreements.

For any other situation, AVENOR will ask for your prior consent.

 

6. Retention of personal data

AVENOR holds all your Personal Data for as long as you are in a contractual relation with us, and afterwards the maximum standard period set by legislation for each category of personal data. AVENOR keeps the student file and all the data related to the student interaction with AVENOR mainly for the scope of assessing the school’s activity and the quality of services provided but also for addressing potential request of students with regard to their school trajectory within AVENOR, which usually appear after the students have graduated.

Notwithstanding the retention period, please be informed, that all the academic records and other school acts and documents related to study activities are kept for an indefinite period of time, according to the legal obligations that AVENOR has in this respect. Moreover, in any case where a legal provision imposes a minimum retention period, AVENOR will keep the Personal Data for at least that mandatory period.

 

7. Your rights related to the processing of Personal Data by AVENOR

The GDPR provides certain rights related to the processing of personal data, that both you and the students have. In this respect, please be informed that students that have an appropriate level of understanding could exercise the rights listed in this section, individually.

AVENOR respects all the rights mentioned under the GDPR and is committed to furnishing the appropriate means by which you can exercise these rights, according to the details mentioned below:

  • The right of access, which entails your possibility to obtain the confirmation from AVENOR whether your Personal Data is being processed by AVENOR or not, and if the case may be you are entitled to solicit access to this data, as well as additional information regarding the Personal Data, such as: the purposes of processing, the categories of recipients the Personal Data are being disclosed to and the envisaged retention period. In the situations where you may need to exercise the right of access, please consider contacting AVENOR and requesting confirmation or access to your Personal Data by completing our Access to Personal Data Request Form and submitting it by e-mail. Please consider that there might be specific situations that are exempted from the right of access, such as information that identifies other individuals or which is subject to confidentiality obligations.
  • The right to rectification, that allows you to request AVENOR rectification of any inaccurate Personal Data that AVENOR may hold, as well as to have your incomplete Personal Data to be completed.    
  • The right to erasure meaning that in the situations expressly regulated by law, you may request erasure of your personal data. Please take into account, that the cases where the law provides for the possibility of erasure of personal data amount to the situations where the processing is unlawful or where the processing is based on your consent, and you have withdrawn such consent.    
  • The right to restriction of processing, signifying your right to obtain restriction of processing your Personal Data from AVENOR’s part. Please bear in mind that this right can be exercised only in specific situations laid down by the GDPR such as when you challenge the accuracy of your Personal Data. During the period necessary for us to rectify your data, you may ask us to restrict the processing of your Personal Data.
  • The right to data portability implying your right to receive the personal data in a structured, commonly used and machine-readable format and further to transmit such data to another controller. This right to data portability shall be applicable only to the personal data you have provided to us and where the processing is carried out by automated means based on your consent or for the performance of the contract you have concluded with AVENOR.     
  • The right to object to the processing of your Personal Data by AVENOR, on grounds relating to your particular situation. The right to object applies to the situations where AVENOR relies on consent as legal basis for processing (e.g. using your e-mail address for conveying fundraising related messages).         
  • The right to lodge a complaint designates your right to challenge the manner in which AVENOR performs processing of your Personal Data with the competent data protection authority.
  • The right to withdraw your consent given for various processing operations, in cases where the consent represents the lawful basis for processing. In cases where you withdraw your consent to processing your Personal Data, please note that the processing will end from the moment the withdrawal takes place without any effect on the processing that took place prior such withdrawal.

 

8. Profiling

AVENOR may create and use profiles to evaluate the performance of its students, to identify gaps in their development or to assess specific traits that characterise students’ personality, preferences, and behaviour or professional inclinations.

 

9. Video surveillance

AVENOR has implemented a video surveillance system on the campus, in order to ensure security of its students, staff and all the other persons that enter our premises. The security and wellbeing of our students is our primary concern and these video cameras allow us to offer real time protection. All measures taken to ensure the security and confidentiality of recorded video images are set forth in the Video Surveillance Policy at Avenor locations.

 

10. Contact Point

In the situation where you may wish to exercise any of the rights listed under point 7 of this Privacy Notice or to obtain additional information or clarifications on the subject of processing your Personal Data, please fill in this form and send it according with the GDPR to the responsible with data protection at AVENOR – Data Protection Officer.

Contact Details of AVENOR’s Data Protection Officer:

E-mail: dpo@avenor.ro

 

________________________________________

The present Privacy Notice shall apply along with other policies / procedures adopted at the level of AVENOR, such as:

  • Video Surveillance Policy;
  • Record Retention and Disposal Policy;
  • Policy on Publication of Photographs and Video Recordings; 
  • Avenor GDPR policy during the enforcement of special measures;
  • Good practice guide for providing Online School activities.