Additional information on data protection

Who is the controller of your personal data?

Identity: TEACHING, CULTURAL AND TRAINING ASSOCIATION OF THE GAZTELUETA SCHOOL (COLEGIO GAZTELUETA)

NIF: G-95329009

Postal Address: Barrio de Artaza 87, (48940) Leioa - Bizkaia

Telephone: +34 944 63 30 00

E-mail: [email protected]

For what purposes do we process your personal data?

In case you are pupil or parent / guardian / legal representative of a pupilAt COLEGIO GAZTELUETA we only and exclusively process the data provided by the interested parties in order to maintain the contractual relationship established and to be able to provide the educational and training services that we provide, such as managing applications for school places, enrolment, academic and administrative management, management of teaching, complementary and extracurricular activities and other services associated with them, managing the sending of requested information, providing the interested parties with information on the extension and improvement of our services, adapting these services to the preferences and tastes of the parents, guardians or legal representatives of our students and users, the design of new services related to the above, the design of new services related to the above, the sending of updates to the services and the sending, by traditional means and/or by legal representatives, of the information requested by our students and users, adapt said services to the preferences and tastes of the parents, guardians or legal representatives of our students and users, the design of new services related to the previous ones, the sending of service updates and the sending, by traditional and/or electronic means, of technical, operational and commercial information about the services currently offered by the Centre, or with the Centre as an intermediary, or which it plans to provide in the future, or the sending of satisfaction survey forms, which the recipients are not obliged to answer and which will be anonymous.

In case you are user COLEGIO GAZTELUETA will process your data in order to attend to your requests:

• your request for contact.
• their interest in learning more about the school, seeing the facilities and answering any questions they may have.
• your request to receive news concerning the College at the e-mail address provided by you.

In case you are candidateAt COLEGIO GAZTELUETA we only and exclusively process the data that you have provided us with in order to attend to your application for incorporation into the personnel selection processes open at the Centre. To this end:

• We collect, store, structure, collate and analyse your personal data.
• We value your skills and your personal situation.
• We do NOT automatically process your personal data for profiling purposes. We only compare your professional profile with those of other potential candidates in order to be able to assess your application and identify whether you are the candidate who best meets the requirements for the position to be filled at COLEGIO GAZTELUETA.

In case you are supplierAt COLEGIO GAZTELUETA we process your data for the following purposes:

• Maintenance, development and control, in all its aspects, of the contractual relationship.
• Internal supplier management.
• Collection and payment management.
• Administrative management.
• Sending tax information

Personal data will not be processed under any circumstances for purposes incompatible with those described above, which are those of COLEGIO GAZTELUETA.

How long will we keep your personal data?

The personal data which GAZTELUETA SCHOOL collected are those strictly necessary for the fulfilment of the purposes for which they were collected. explicit and legitimate, declared and known to those concerned, for which they have been obtained within the scope of the established contractual relationship.

The personal data provided will be kept for as long as the contractual relationship is maintained. Subsequently, provided that the right to erasure has not been exercised, they will be kept taking into account the legal deadlines applicable in each specific case, depending on the type of data and the purpose of the processing.

COLEGIO GAZTELUETA will keep the data and documentation justifying the legal relationship during the conservation periods established by the applicable sectorial regulations, as well as during the periods of limitation of civil, criminal, administrative or any other type of action that may arise from the relationship established.

Once these deadlines have expired, the personal data will be deleted unless the owner of the data or his or her representatives are in favour of the erasure. parents, guardians or legal representatives have expressly authorised the storage and inclusion in the "Alumni" file. for the purpose of sending information on the Centre's various activities and services.

In accordance with education regulations, COLEGIO GAZTELUETA is responsible for the custody and archiving of the pupils' academic records, which is why this data will be kept indefinitely. In addition to strictly academic information and data, academically relevant psycho-pedagogical and medical reports will form part of the file.

In the case of candidates We will retain your data for two (2) years from your last confirmation of interest, so that we can contact you again for future selection processes, unless you decide to exercise your right to erasure in accordance with art. 17 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and for as long as necessary to comply with the obligations and deadlines set by the applicable regulations.

In the case of suppliersThe personal data provided will be kept for the period of time necessary to comply with the purpose for which they were collected, and in any case until the end of the contractual relationship and once the period of limitation of possible legal actions has elapsed.

Notwithstanding the above, the personal data provided may be kept duly blocked for the time required by the applicable regulations.

What is the legitimacy for the processing of your data?

Depending on whether you are a pupil, parent or guardian or legal representative of the pupil, candidate or user of the website of GAZTELUETA SCHOOL the lawful basis for processing your data may be:

• the express authorisation of the holder or his legal representative;
• the performance of the contract for the provision of educational and training services which binds the parents, guardians or legal representatives of our students with COLEGIO GAZTELUETA,
• the 23rd Additional Provision of Organic Law 2/2006, of 3 May, on Education and other autonomous provisions.
• legitimate interest in accordance with art. 6.1.f) of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which empowers us to process your data "where necessary for the purposes of the legitimate interests pursued by the controller [...]".GAZTELUETA SCHOOLor by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject [parent/guardian, pupil, candidate, etc.] which require the protection of personal data'. Such a legitimate interest could arise, for example, where there is a relevant and appropriate relationship between the data subject and the data controller, such as in situations where the data subject is a customer (parent/guardian, pupil, user) or is at the service of the data controller (Recital 47 RGPD). At COLEGIO GAZTELUETA we are legitimately interested in maintaining the loyalty of the school's families and/or users and in better meeting their expectations or previously expressed interests (e.g.: improving our services, managing requests and queries, offering new services and products similar to those contracted, providing information on courses, events, competitions, activities, workshops, etc.) without prejudice to our compliance with other obligations relating to the sending of commercial communications by electronic means in accordance with the LSSIyCE.

To which recipients will your data be communicated?

GAZTELUETA SCHOOL will not disclose data to third parties outside the legally or contractually stipulated cases, such as the Ministry of Education, the Hezkuntza Department of Education, Language Policy and Culture of the Basque Government.The Tax Administration, the Tax Administration and other Public Administration bodies with competence in the matter, Social Security bodies, other educational centres for the transfer of academic records, the police and judicial bodies.

If you have previously authorised COLEGIO GAZTELUETA to do so, COLEGIO GAZTELUETA will communicate your data to:

• the Parents' Association of the school, in order to be registered as a member of the Association and to be processed for the development of its activities (extracurricular activities, payment of contributions to the APYMA, etc.).
• the School's Alumni Association, for processing with a view to the development of its activity (sending information to Alumni, sending receipts, etc.).
• to the Gaztelueta Sports Club, so that it can deal with them in the development of its activity (organising sports, issuing receipts to families, etc.).
• the Gaztelueta Foundation, in order to collaborate with its aims (receive information about its activities, be able to make donations, etc.).
• the couples in charge of the course, so that they can carry out the task entrusted to them.
• When it is necessary for your child to participate in an activity (excursion, day trip, competition, etc.), we will communicate your details to the company organising the activity.
• to the medical care centre, to the insurance broker and to the insurance company contracted in the event of pupils suffering an accident at school that requires medical treatment.
• to other companies with commercial or strategic links to COLEGIO GAZTELUETA, so that they can send their campaigns offering goods or services similar or complementary to those of COLEGIO GAZTELUETA.

GAZTELUETA SCHOOL seek the prior express and informed consent of the data subjects for any other transfer of data outside the cases provided for by law or contract.

Are there any data processors whose legitimacy for the processing derives from the execution of a contract for the provision of services with COLEGIO GAZTELUETA?

In order to carry out the aforementioned purposes, COLEGIO GAZTELUETArequires the cooperation of third party service providers who may have access to your personal data as a result of the provision of the contracted services.

In any case, COLEGIO GAZTELUETAfollows strict criteria for the selection of these third parties in order to comply with its data protection obligations. To this end, in accordance with the provisions of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, General Data Protection Regulation (GDPR) COLEGIO GAZTELUETAhas signed with each of them the corresponding contract or legal act establishing the conditions and guarantees necessary for the processing of their data to be carried out in accordance with the law:

• BM y BB Asesores Consultores, S.L.: Tax, labour and accounting advice
• Telefónica Soluciones de Informática y Comunicaciones de España, S.A.U.: Development and maintenance of software applications enabling access to data over telecommunications networks.
• Acens Technologies, S.L.U: Hosting
• Ukabi, SL and Elkarmedia, S.L.: INIKA, Platform for academic and administrative management and communication.
• Bimarket, S.L.: Design, layout and printing of the quarterly school newspaper.
• Tamar Las Arenas, S.A.: Dining room
• Banco Santander: Issuance and collection of receipts and payment of payrolls
• The Rocket Science Group LLC (Mailchimp): E-mail marketing
• Google Inc: Google Drive, Google Docs and Google Analytics

Are data transferred to other countries?

Some of the tools we use to manage your data are contracted with third parties. To provide services strictly necessary for the development of our activity, GAZTELUETA SCHOOL shares data with the following providers under their respective privacy conditions:

• Google Analyticsa web analytics service provided by Google, Inc, a Delaware company whose principal office is at 1600 Amphitheatre Parkway, Mountain View (California), CA 94043, United States ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help COLEGIO GAZTELUETA analyse how users use the website. The information generated by the cookie about your use of the website is stored on your computer. www.gaztelueta.com (including your IP address) will be transmitted to and stored by Google on servers in the United States.
• Google Drivea cloud-based document hosting service provided by Google, Inc, a Delaware corporation whose principal office is at 1600 Amphitheatre Parkway, Mountain View (California), CA 94043, United States of America ('Google')
• Google Docs: a word processing and spreadsheet service maintained in the cloud, with access from any location and any type of computer with an Internet connection. Provided by Google, Inc, a Delaware company headquartered at 1600 Amphitheatre Parkway, Mountain View, Delaware.
• Email marketing: The Rocket Science Group LLC (Mailchimp), domiciled in the USA. More information at www.mailchimp.com The Rocket Science Group LLC (Mailchimp) processes the data in order to provide email marketing management services to COLEGIO GAZTELUETA.

Both Google Inc. and The Rocket Science Group comply with the EU-US Privacy Shield regulatory framework. You can view it here

https://www.privacyshield.gov/list

Apart from these cases, COLEGIO GAZTELUETA does not transfer data to third countries inside or outside the European Economic Area.

If in the future GAZTELUETA SCHOOL (a) to carry out such a transfer in connection with the organisation of language immersion courses or to introduce language immersion courses in the context of the organisation of language immersion courses, orhe possibility of attending school periods in schools in English-speaking countries shall require the prior express and informed consent of the parents, guardians or legal representatives of the pupils concerned.

What are your rights when you provide us with data?

Any person has the right to obtain information about whether or not in GAZTELUETA SCHOOL we are processing personal data concerning them, or not.

The persons concerned have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

In certain circumstances, data subjects may request that we restrict the processing of their data, in which case we will only retain the data for the purpose of pursuing or defending any claims.

Likewise, in certain circumstances and for reasons relating to their particular situation, data subjects may object to the processing of their data. GAZTELUETA SCHOOL cease to process the data, except for compelling legitimate reasons, or for the exercise or defence of possible claims.

You also have the right to lodge a complaint with the supervisory authority, the Spanish Data Protection Agency.

https://sedeagpd.gob.es/sede-electronica-web/

For more information about your rights, you can consult our Privacy Policy.

How can you exercise your rights?

In order to exercise your rights, you may write to GAZTELUETA SCHOOL to the postal or e-mail address indicated in the "Data Controller" section, or by any other means that allows accreditation of the sending and receipt of your request.

In order for us to be able to deal with your request, it is necessary for you to prove your identity to GAZTELUETA SCHOOLby sending a photocopy of the National Identity Card or any other legally valid means.