a) The School collects and processes the following student PI:

• Personal information (such as full name, ID or passport number, unique pupil registration number, address, email and address, phone number)
• Characteristics (Such as language, nationality, city of birth)
• Attendance information (sessions attended, number of absences and absence reasons)
• Curricular record (academic achievements, other skills and activities)
• Assessment information (such us grades and disciplinary reports, interim reports, academic record, ranks, averages, notices sent to parents)
• Academic information (such as previous school, year of enrolment and departure, further education e.g. military / university)
• Images including individual head shots of students, video and audio recordings of individuals engaging in School activities or captured by the School’s CCTV system.
• Relevant medical information (such as medical history and medical conditions)

b) The School collects and holds the following Guardian PI:

• Name and surname
• Contacts details (Such as email, phone number and address)
• Bank details
• Financial background
• Marital status
• Languages spoken
• Next of kin information
• Information on after school carers of the child

As a School we may from time to time, collect and process special categories of PI. Special categories of PI include health related information, criminal convictions, information revealing racial or ethnic origin and religious or philosophical beliefs. We provide below the legal justifications for collection and processing of special categories of PI.

• Selection and admission of School students
• To provide education services, extra-curricular activities and educational support services to students which include student enrolment and registration, student disciplinary matters, student progress monitoring, determination of student’s eligibility for additional learning support, transportation and financial aid, School and public examinations participation, teacher-parents meetings, School sport-teams participation, educational trips, availability of School equipment to students for educational and research purposes.
• The security of students and School employees.
• The School’s operational management which includes, compiling and preserving a student record, implementing and managing security and safety measures (CCTV system is in place), management of the School’s property and equipment, administration of fees and invoices, compilation and management of archives for statistical, historical and operational purposes.
• To provide or receive information and references about past, current and prospective students to or from any educational institution and to provide references to potential employers of past students.
• For compliance with legal and regulatory obligations of the School
• For the promotion of the School using the website, leaflets, prospectuses, yearbooks newspaper articles and other publications and communications which also include our social media.
• Communication with Guardians for School related matters. Contacting the guardian in case of emergency, or regarding the educational progress of a student or for the non-attendance or late attendance or any other issues relating to a student’s conduct in the School.

Legal obligations of the School: Compliance with laws, regulations, rules, codes and guidelines.

Performance of a contract: We will need to use your PI in order to perform our obligations under our contract with you.

Legitimate interests of the School and other individuals:

The School has a legitimate interest in:

• Promoting and providing education to School students;
• Fulfilling its contractual and legal obligations;
• Ensuring and maintaining the efficient operational functioning;
• Providing security to students and School personnel;
• Protecting School property including IT and network security;
• Establishing a line of communication with you as a Guardian of the student;
• Promoting the interests and objectives of the School for example, marketing purposes, fundraising and maintaining relationships with alumnae and the School community;
• Enforcing legal claims, including debt collection via out of court procedures.
• Obtaining appropriate professional advice and insurance.
• Assessing the quality of its educational service
  

Consent: For certain processing activities we may require the explicit and informed consent of appropriate individuals (Guardians or students).

Public Interest: We believe that we are acting in the public interest when providing education.

Vital interests of students or other individuals: For example, to prevent someone from being seriously harmed or killed.

Consent: For certain processing activities we may require the explicit and informed consent of appropriate individuals (Guardians or students).

Processing is necessary for purposes of preventive medicine: The School has a First Aid station with a qualified nurse.

Vital interests of students or other individuals: For example, to prevent someone from being seriously harmed or killed.

Establishment, exercise or defence of legal claims.

We may share your PI with any of the following:

• Professional advisors (lawyers and accountants)
• Regulators, government and law enforcement authorities;
• Courts, tribunals, arbitrators or other judicial or disciplinary committees;
• Insurance companies
• School third party service providers such as IT providers, web developers, and social media providers.
• Any medical experts such as doctors and hospitals in case of emergency

The School has entered into contractual agreements with service providers who process PI on behalf of the School, in order to ensure that PI will be processed securely and only in accordance with the School’s specific directions.

We will only keep your PI for as long as it is necessary to fulfil the purposes of collection and use. We will keep your PI for the purposes of satisfying any legal, regulatory, accounting, reporting requirements, to provide our services and for the establishment or defence of our legal claims.

We determine the appropriate retention period for PI, by considering the volume, nature and sensitivity of the PI, the potential risk of harm from unauthorised use, loss or disclosure of your personal data, the purposes of processing PI and whether we can achieve those purposes through other means, and the applicable legal requirements.

We apply a variety of security technologies and procedures to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to PI.

As a data subject you may address any concern you have on a matter relating to your data protection rights to the School’s Data Protection Officer by sending an email to dpo@grammarschool.ac.cy. In some cases students who are at least 18 years of age, and Guardians, may request in writing, access to and rectification or erasure of their PI, object to PI processing or file a complaint with the Data Protection Commissioner.