The Privacy Policy is defined with the aim of complying with the fundamental principle of transparency of the General Data Protection Regulation (GDPR) and national legislation on the protection of personal data (Law 58/2019 of August 8, which ensures the implementation GDPR and Law 46/2012, of August 29, which regulates the protection of personal data in electronic communications). This means that all data controllers and data subjects must be aware of what is actually done with all data, without secrets or ambiguities. This Privacy Policy will be published and presented on the Escola Internacional Cesário Verde website (hereinafter referred to as the School), so that all data subjects have access to this document.

The School (CESÁRIO VERDE – ENSINO E FORMAÇÃO, LDA., which carries out its activity under the name “IES Cesario Verde International School Portugal”, with headquarters at Avenida Infante D. Henrique, n.º 308, 1950-421 Lisbon, registered at the Commercial Registry Office of Loures under registration number and NIPC 501313877, with share capital of 100.000,00 Euros and email geral@cesarioverde.com) is responsible for the processing of personal data, as it determines how personal data is processed and for what purpose.

The present Privacy Policy applies together with any other information the School may provide about a specific use of personal data, for example when collecting data via an online or paper form.

This Privacy Policy applies together with other relevant terms and conditions and policies of the School, including, in particular:

• Contract between the School and the students’ legal representatives;
• Internal Regulations of the School;
• Communication Policy with Parents and Students;
• Whistleblower reporting policy;
• Study visits and educational trips;
• Authorized consent for the use of student images;

Anyone working for the School or acting on its behalf (including employees, interns, volunteers and service providers) will receive training on personal data protection and the policies in force at the School, in accordance with their role.

WHY DOES SCHOOLS NEED TO PROCESS PERSONAL DATA

To fulfill its duties towards its students and parents or legal representatives, the School needs to process a wide range of personal data from various data subjects (including students and their current, former and future legal representatives) as part of its daily operation.

Within the scope of the various activities that the School carries out, data processing is necessary for different purposes and based on different legal bases:

• Pre-contractual due diligence, within the scope of:
  • Applications from students and their legal representatives in order to carry out the selection process of future students;
• Execution of the contract(s) concluded with the legal representatives of the students, both in terms of registration and enrollment in the different academic years and in extracurricular activities:
  • Registration and registration;
  • Provide educational services, including music education, physical training or spiritual development, extracurricular activities, and monitor students' progress and educational needs;
  • Management of participation in educational digital platforms, such as E-schooling, including digital distance learning platforms;
  • Management of the relationship with the School;
  • Billing and collection of educational services provided;
  • Support for students and their legal representatives;
  • Sending communications and information related to educational services;
  • Management and processing of students’ school careers;
  • Organization of teaching and non-teaching activities in which students enroll, including activities and events promoted by external entities in which the School participates, including control of attendance and attendance;
  • Organization of travel, transport, study visits and the like;
• Compliance with the various legal obligations to which the School is subject, due to the activity it carries out, namely:
  • School census from the Ministry of Education;
  • Student assessment;
  • External Assessment Tests and Attendance Equivalence Tests;
  • Allow competent authorities to control the School’s performance;
  • Allow students to participate in national or other assessments;
  • Publish evaluation guidelines;
  • Subsidies from the Ministry of Education;
  • Individual student process;
  • Management of complaints in the complaints book and other equivalent platforms;
  • Identification of students' needs within the scope of inclusive education
  • Psychological and psychopedagogical support;
  • School and personal accident insurance

If the School needs the personal data of data subjects to be able to conclude a contract, comply with the law or its contractual obligations, as applicable, failure to provide such personal data may make it impossible to conclude the contract or its termination. When requesting personal data from data subjects, the School will inform which data is mandatory and optional, as well as the consequences of not providing them.

• Legitimate interests of the School or third parties, provided that the fundamental rights and freedoms of data subjects do not prevail over those and do not involve special categories of personal data:
  • Maintain a register of student candidates for the purposes of future applications or vacancies;
  • IES Cesário Verde International School Portugal Privacy Policy
  • Maintain contact with former students and the school community, including direct marketing activities;
  • Management planning and forecasting, research and development as well as statistical analysis;
  • Provide and receive information and references about current and former students, including with regard to outstanding fees or payment history, to/from any educational institution that the student has attended or is proposed to attend; and provide references to potential employers of alumni;
  • Ensure compliance with School regulations and policies;
  • To carry out or cooperate with any complaint, disciplinary or investigation process carried out by the School or the competent authorities;
  • Management of the e-Schooling platform;
  • Access to the Virtual School;
  • Security of its facilities through access control to the School’s facilities;

When the School processes personal data based on the legitimate interests of the School or a third party, data subjects have the right to object to the processing of their personal data. With the exception of the objection to the data being processed for marketing purposes, the School may not be able to satisfy this request in all cases, in accordance with the provisions of the law, whenever it has compelling and legitimate reasons for the processing of the data that prevail over the interests, rights and freedoms of the data subject or for the purposes of declaring, exercising or defending a right in legal proceedings.

• Consent of data subjects and/or their legal representatives:
  • Provide nursing care and medication assistance;
  • Provide dietary care in the case of allergies or specific eating habits;
  • Capturing images and sound of students during activities and events to be used in school publications, on the school website and (where applicable) on the school's social media channels;
  • Maintain contact with legal representatives of potential future students, including direct marketing activities to publicize the School's events, activities and services

When processing is carried out based on the consent of data subjects, there is no legal or contractual requirement or other obligation for the data subject to provide us with their personal data. Consent from data subjects is voluntary and data subjects are free not to give their consent. Refusal of consent does not in any way influence or harm the existing relationship with the School nor the execution of the concluded contract. If the data subject gives their consent, they have the right to withdraw it at any time, and for this purpose they must contact the School using the contact information indicated at the end of this Privacy Policy.

• Defense of the vital interests of the data subject or another natural person:
  • Provision of urgent healthcare;
  • Providing assistance in the event of incidents or accidents involving students, legal representatives or visitors;

WHAT PERSONAL DATA IS PROCESSED BY THE SCHOOL

The School collects and processes personal data necessary to pursue the purposes referred to above or others that the School may identify, such as:

• Identification Data: name, photograph, gender, age, place and date of birth, nationality, place of birth, marital status, identification document number, date of issue and validity, NISS, NIF, mother tongue, health user number, health subsystem/insurance company, respective designation and number, degree of kinship in relation to the student, siblings enrolled at the School;
• Contact data: mobile phone, telephone number, address, personal and professional email addresses and other contact details;
• Qualification data and professional status: education and educational qualifications, profession, company and position, place of work and whether the professional activity is carried out in the area of ​​influence of the educational establishment;
• Banking, financial and transaction data: IBAN, NIF, invoices, credit notes, receipts as well as, for the purposes of obtaining subsidies, IRS declaration, bank declaration, income receipt, household and other information and forms required by the Ministry of Education for this purpose;
• Academic data, including the student's individual file number, class, year in attendance, disciplinary, admission and attendance data, as well as assessment, including tests, exams, tests, forms and other assessment methods and respective grades, guidelines or classification ;
• Data on subject options: foreign language;
• Data on extracurricular and non-teaching activities: attendance list;
• Data on references given or received from the school about students, as well as pertinent information provided by and/or other professionals or organizations that work with students;
• Image and voice of students (and, occasionally, other individuals, namely legal representatives and family members) involved in teaching and non-teaching activities;
• Data on physical access to the School: student name and number, date and time of entry and exit, including students authorized to leave unaccompanied using an identification card;
• Access data to digital platforms (e.g.: Virtual School): student's individual file number, class, year attended, email and temporary password;
• Website usage data: IP address, browser and device used, location, day and time of access, collected and processed through cookies.

Additionally, the School will have to deal with special category personal data (related to health or religion) as well as data of a highly personal nature due to legal obligation or with the explicit consent of legal representatives, such as:

• Health data for legally required registration and registration renewal purposes, such as vaccination records;
• Health data for the provision of medical assistance or urgent health care, as well as in the event of an incident or accident;
• Health data regarding allergies and specific eating habits for the provision of dietary care;
• Health data necessary for the provision of educational services in the context of any special educational needs: specific needs of the student, clinical and psychological report, including, if applicable, technical-pedagogical reports, IES Cesário Verde International School Portugal Privacy Policy the individual educational program and other information necessary to comply with applicable legislation (Decree-Law 54/2018, of July 6);
• Health data necessary for reasons of public interest in the field of public health in the context of pandemics and the like, under the legally stipulated terms and in accordance with the guidelines of the competent authorities;
• Religion: religious convictions or confession within the scope of the discipline of Moral and Religious Education;
• Data processed within the scope of a complaint, disciplinary process, internal or external;
• Data of a highly personal nature within the scope of student protection that involves a serious risk to the health, physical or psychological integrity of the student;
• For legal and regulatory purposes (e.g. protecting children, monitoring diversity, health and safety and immigration/visa sponsorship compliance) and to fulfill your legal obligations and duties of care.

HOW THE SCHOOL COLLECTS, PROCESSES AND TO WHOM IT COMMUNICATES DATA

The personal data referred to above, as well as those that may be necessary for the purposes identified above or others that the School may identify, are collected through various means, namely, contracts, forms, website, digital platforms, in person, registrations for activities teaching and non-teaching, contacts, correspondence exchanged by email, post, telephone, interviews, meetings and other formats.

In general, the school receives personal data directly from the data subject (including, in the case of students, their legal representatives).

In most cases, personal data collected by the School will remain at the school and will be processed by employees and other collaborators in accordance with access protocols (i.e. on a “need to know” basis).

However, personal data will also be processed by third parties, which are subcontracted entities (for example, information technology service providers, maintenance and access management services for applications and websites, server hosting, cloud computing, communication as well as management service providers), who will process the data for the purposes described above, in the name and in accordance with the instructions of the School, being linked to the School through a written contract and which are required to implement necessary measures to ensure the confidentiality and security of data.

In addition to subcontracted entities, the School may also communicate personal data in the following cases:

• To entities and authorities (for example, Ministry of Education, AT, Social Security, General Directorate of Health, Commission for the Protection of Children and Young People, AIMA), courts in accordance with the law and to comply with legal obligations that are applicable to the School;
• Consultants (lawyers, accountants, auditors and other consultants) to exercise, establish or defend the School's legal rights;
  Insurers and insurance brokers;
• Banking institutions for payment processing;
• Travel agencies, event organization, logistics and transport companies;
• To third parties and their consultants in the event of a possible or effective sale, merger or other restructuring of the School;
• To the companies of the IES Group of which the School is part for the purposes of reporting and managing the Group at regional and central level;
• Educational establishments with which the School has partnerships, including international ones;
• School publishers (for example, Escola Virtual da Porto Editora);
• Partners or other entities that provide services or carry out extracurricular and/or non-teaching activities available at the School;
• Members of the multidisciplinary team designated by the School within the scope of inclusive education;
• Health professionals.

INTERNATIONAL DATA TRANSFERS

Your personal data will not be transferred to countries outside the European Economic Area (EEA), i.e. third countries, on a regular or systematic basis.

However, if at any time we need to transfer your personal information outside the EEA, we will take steps to ensure that the information receives the same level of protection as if it were within the EEA, including by entering into data transfer agreements, using the Clauses Model Contracts that the European Commission approved and adopting, whenever necessary, additional measures to ensure the same European level of protection, or through other legally provided mechanisms.

If you would like further information about the mechanism by which your data may be transferred outside the EEA, you should contact the School using the contact information set out at the end of this Privacy Policy.

CONSERVATION OF PERSONAL DATA

The School will keep personal data securely and only for the period of time necessary to achieve the purpose and for the legally established deadlines (namely, Ordinance No. 1310/2005, of December 21), without prejudice to the fact that they may be maintained for a longer period to prove compliance with legal, contractual or other obligations until the limitation period for corresponding rights has elapsed.

When the purpose that motivated the initial or subsequent processing of personal data ceases, the School will destroy or anonymize it, without prejudice to maintaining a limited amount of personal data for historical archiving purposes and statistical purposes.

YOUR RIGHTS

Data subjects (both students and legal representatives) have a number of rights under the GDPR and the Personal Data Protection Law to access and understand what personal data is held and processed by the School and, in some cases, to request that it be erased or altered, or transferred to another location, or that the school no longer handles them – but subject to certain legally stipulated restrictions and limitations.

The School will endeavor to respond to requests to exercise personal data protection rights as soon as reasonably possible and, in any case, within the legal deadlines.
(which are generally one month, but responding to more complex or multiple requests, for example those involving third party information, may take longer).

As a data subject, you have the right to:

• get access to the personal data stored that concerns them;
• request the correction of incorrect, inaccurate or incomplete personal data;
• request the data erasure personal data that are no longer necessary or if their processing is unlawful;
• oppose the processing of your personal data for marketing purposes or for reasons that relate to your specific situation;
• request the limitation the processing of your personal data in specific cases;
• receive your personal data in machine-readable format and send it to another controller (“data portability");
• revoke consent at any time, without compromising the lawfulness of the processing carried out based on previously given consent;
• designate a person to exercise their rights, after their death (in the absence of which, they will be their heirs) or determine the impossibility of exercising them in relation to special categories of personal data or when they relate to the intimacy of private life, image or data relating to communications.

If you believe that the personal data we hold about you is incorrect, please let us know. However, the school will not necessarily delete or alter views, opinions, grades or records solely at the request of a person(s) who disputes it, although we may keep a record of the views of all parties.

You should be aware that your GDPR rights (including the right of access) are limited to your own personal data excluding information that identifies other individuals (including,
in certain situations, the students themselves) or information that is subject to professional secrecy.

All requests submitted by or on behalf of data subjects will therefore be considered on a case-by-case basis.

You can obtain more information about what each of these rights entails and what restrictions apply in https://www.cnpd.pt/bin/direitos/direitos.htm.

To exercise the rights referred to above, you must contact the School using the contact information indicated at the end of this Privacy Policy. If you send a request regarding your data, please specify the nature of your request and the type of processing to which it relates. The School may request further information to verify your identity.

You can also lodge a complaint with the National Data Protection Commission (www.cnpd.pt) in the case of:

• We do not respond to you within the legal deadline and as long as you have submitted your request through the means made available by the CRA for this purpose;
• We do not respond to your request or unjustifiably refuse to comply with your request;
• Understand that your rights have not been duly guaranteed, particularly regarding the right to limit treatment and the right to object to treatment.

DATA ACCURACY AND SECURITY

The School will endeavor to ensure that all personal data held is as up to date and accurate as possible. Data subjects must inform the School of any significant changes to important information, such as contact details.

The School will take appropriate technical and organizational measures to ensure the security of the personal data it processes, including policies regarding the use of technology and devices
and access to systems.

CHANGES TO THE PRIVACY POLICY

The School will periodically update this Privacy Policy in response to changes in legislation, regulations and guidance from Data Protection Authorities as well as technical or commercial developments. The changes will be published on the School's website, so regular consultation is recommended, without prejudice to appropriate measures being taken to inform data subjects, according to the importance of the changes made.

In any case, you can view the last updated date indicated at the beginning of this Privacy Policy.

CONTACTS

Any comments, queries or questions regarding this Policy should be directed to the School, using the following contact details geral@cesarioverde.com