Data protection
Who the controller of personal data is, why we process it, how long we keep it and what rights data subjects have.
Data controller
The controller of the personal data of students, parents, employees and other people whose data we process is the school, represented by the head teacher. This information is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).
| Details | Value |
|---|---|
| Controller | Szkoła Podstawowa nr 7 im. Marii Konopnickiej w Zielonogaju |
| Address | ul. Akacjowa 12, 00-000 Zielonogaj |
| Phone | 71 000 10 20 |
| sekretariat@szkola.czytelnastrona.pl |
Data protection officer
We have appointed a data protection officer (DPO). You can contact the DPO on all matters relating to the processing of personal data and the exercise of related rights.
Data protection officer
By post: the school address marked “Data protection officer”.
Purposes and legal bases of processing
We process most data because education law requires it. We rely on consent only where the law provides no other basis, for example when publishing someone's image.
| Who it applies to | Purpose of processing | Legal basis |
|---|---|---|
| Students and parents | teaching, upbringing and care, keeping records of students' education | legal obligation – Article 6(1)(c) GDPR |
| Students | psychological and educational support, health information needed for care | legal obligation – Article 9(2)(g) GDPR |
| Applicants and their parents | carrying out admissions | legal obligation – Article 6(1)(c) GDPR |
| Employees and job applicants | employment and the employer's obligations | legal obligation and contract – Article 6(1)(b) and (c) GDPR |
| Contractors | concluding and performing a contract | contract – Article 6(1)(b) GDPR |
| People on school premises | safety – CCTV monitoring | task carried out in the public interest – Article 6(1)(e) GDPR |
| Students and their parents | publishing images on the website and in school materials | consent – Article 6(1)(a) GDPR |
| People writing to the school | replying to a message or a form on the website | consent or a task carried out in the public interest – Article 6(1)(a) or (e) GDPR |
Rights of data subjects
Everyone whose data we process has the right to:
- access their data and receive a copy;
- rectification of incorrect or incomplete data;
- erasure of their data, unless the law requires us to keep it;
- restriction of processing;
- object to processing based on the public interest;
- portability of data processed on the basis of consent or a contract;
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal;
- lodging a complaint with the President of the Personal Data Protection Office.
A request can be submitted at the school office, by post or to the data protection officer's address. We reply within a month; for complex matters we may extend this by two months, and we will let you know.
How long we keep data
We keep data for the period required by the regulations on archiving school records. Records of students' education, such as grade sheets and student registers, are kept for the periods set out in the uniform list of files.
Data processed on the basis of consent is deleted promptly after consent is withdrawn, unless the law requires it to be kept.
CCTV monitoring
CCTV covers the entrances to the building, the ground-floor corridors and the area around the school. It does not cover classrooms, changing rooms, toilets, the school nurse's office or rooms where psychological and educational support is provided.
Recordings are kept for 30 days and then automatically overwritten. Only people authorised by the head teacher have access to the recordings, and the area under CCTV is marked with signs at the entrances.
Who we share data with
We share data with bodies entitled to it by law. These include the local authority that runs the school, the regional education authority, the regional examination board and the education information system.
We also entrust data to companies that process it on our behalf, under data processing agreements. These are the e-register provider, the website provider and IT support.
We do not transfer data outside the European Economic Area. We do not make automated decisions and do not profile people.
Frequently asked questions from parents
Does the school publish photos of students?
Only with a parent's written consent, given on a form the parent receives when the child starts school. We do not caption photos with children's names.
Consent can be withdrawn at any time at the school office. Photos showing the child are then removed from the website.
Can I view CCTV footage?
Recordings are made available to the police, the public prosecutor and the courts. A parent who suspects an incident involving their child can contact the head teacher within 30 days. We will then secure the recording and hand it over to the authorised bodies.
Who can see my child's data in the e-register?
Access is available to the teachers who teach the child, the form teacher, the school counsellor, the psychologist, the school leadership and authorised school office staff. Parents can only see their own child's data.