IBA Consulting
12 Takovska Street
11000 Belgrade, the Republic of Serbia
INFORMATION NOTICE ON PERSONAL DATA PROCESSING
This Information Notice on Personal Data Processing (hereinafter the “Information Notice”) is dedicated to the parents of children/students applying with the IBA Consulting (hereinafter “IBA”) and is intended to offer an overview on the processing activities performed by IBA with respect to the personal data of students and the parents or legal guardians of students requesting IBA’s services.
This Information Notice is dived into various sections for an easier reading experience. Please consult the sections of this document below:
Contents
1. Useful terms and definitions 2
4. Legal ground for processing 4
5. Third parties with access to personal data 4
7. Profiling and automated decision 5
Enjoy the reading and for additional information or clarifications please contact us!
- Useful terms and definitions
In order to provide you with a clear understanding of this Information Notice, we have reproduced some of the most used terms and definitions you will encounter throughout this document:
- Personal data means any information related to a natural person that directly identifies that person or makes that person identifiable. Examples of personal data are the name, all the data comprised in the identification documents, contact details, marital status, data about health status, behavioral data, photos, videos etc.
Some personal data are considered sensitive data, such as health data, political or religious affiliations, and ethnic origin and require specific processing obligations from IBA’s part, if applicable.
Please be informed that IBA is committed to observe each of its legal obligations, including the obligations related to the special categories of personal data.
- Processing means any operation conducted through automated or non-automated means on personal data, which includes without limitation the following: collection, recording, erasure, transfer, consultation, combination, restriction etc.
- Data subject/s refers to the natural person whose personal data are subject to processing. For the purposes of this Information Notice, the data subject are students, including future and former students and their parents, legal guardians or legal representatives.
- Controller means the natural or legal person, which determines the purpose and means of processing the personal data.
For the purposes of this Information Notice, the controller is IBA, in its capacity of consultancy agency in the field of international education. According to the applicable data protection legislation, each controller is obliged to present the data subject with comprehensive information on the processing of their personal data (more popular as “privacy policy”); hence, IBA has compiled this Information Notice.
- Sources of personal data
The primary source of personal data for IBA is you, considering that you are giving us data on you and your child through applications form and through our communication via email or other means of communication.
Main categories of personal data processed by IBA consist of:
- Identification data, such as: first name, family name, national identification number, other personal data that may result from passports / identity cards or other types of identification documents;
- Health data, such as: the medical report requested in the enrollment phase and medical checks reports, various examinations related to student’s health status that have to be performed in the course of education;
- Contact details, such as: telephone number, e-mail address;
- School records, such as: results during the education in the school etc.;
- Audio/video data: pictures and videos of students;
- Travel data, such as: visa requirements, travel arrangements etc.;
- Preferred educational institutions: school/college and/or university that your child and you are interested in, together with all related information.
Failure to provide this sort of personal data will result in the inability of IBA to provide the services under the agreement between you as a parent and IBA.
- Purposes for processing
Each processing operations is performed by IBA for a clear and legally allowed purpose.
The main purpose for processing of students and parents of students’ data is performance of the consultancy service in the process of finding the right place for your child as future student in one of the educational institutions IBA cooperates with.
The services offered by IBA imply processing personal data for a wide range of other purposes, such as:
- Provision of visa application assistance upon your request as a parent;
- Communication with designated educational institution and other institutions on behalf of you and your child;
- General management of IBA’s affairs such as event planning and quality assessment;
- Communication through social media and other electronic means.
- Legal ground for processing
According to applicable legislation, each controller should inform data subjects on the legal grounds used for processing personal data. Therefore, IBA hereby expressly lays down the legal grounds, which allow IBA the processing of personal data:
- Fulfilling our obligations under the consultancy agreement or taking steps at your request in order to enter such agreement, constitutes legal ground on which we can base our processing. Under this legal ground, we process solely personal data necessary for the provision of consultancy services.
- Where your personal data are not necessary for the execution of the consultancy agreement, we use your consent granted for the use of the name, surname, photos and videos of your child in the yearbook, in social media postings, on IBA’s website, in internal IBA directory, in marketing materials, IBA’s publications.
- In case of students’ health data, that are required to be submitted in course of enrollment with educational institutions, IBA uses your explicit consent as the legal ground in accordance with applicable data protection legislation to forward such data to specific educational institution.
- Third parties with access to personal data
Our activity as a consultancy agency in the field of international education implies disclosure of personal data to third parties and foreign countries.
Please consult the categories of third parties to whom IBA discloses personal data in the following section:
- Other educational institutions or organizations;
- Public authorities and institutions, national or foreign, judicial courts and foreign embassies or other forms of diplomatic missions.
Given the international nature of our business and that we cooperate with educational institutions, personal data reach third countries, in the following situations:
- transfer of personal data to the EU/EEA countries to educational institutions, based in those countries;
- transfer of personal data to the USA and Canada, to educational institutions based in USA and Canada, based on your explicit consent.
- Period of storage
IBA stores and uses the personal data of you and your child for as long as the consultancy agreement is in force.
After the termination of the consultancy agreement, the personal data are kept for as long as applicable legislation requires.
In those situations where the applicable legislation does not provide for retention periods, IBA stores the personal data for additional 5 years, according to the reasonable necessities that may appear in this period (e.g. in case your child decides to change the educational institution in which he/she was initially enrolled).
- Profiling and automated decision
Nowadays, an important subject related to personal data is the creation of profiles and the automated decisions that can be based on profiling. Profiling refers to automated processing of personal data carried out in order to analyze and predict behavior of data subjects. Further, automated decisions are those decisions that significantly affect the data subject and that are taken without human intervention, solely through automated means.
IBA does not perform any type of profiling, nor does IBA take any automated decision related to students and their parents.
- Exercise of rights
The applicable data protection legislation provides for a series of rights that data subjects can exercise with regard to the processing of their personal data by controllers.
We have listed these rights in the following sections together with explanations regarding their application:
- The right to lodge a complaint with the supervisory authority. In case when you consider that the processing related to your child’s personal data infringes the data protection legal provisions, you can address this issue to the supervisory authority.
- The right to access your personal data. This right applies in case when you want a confirmation from IBA regarding the processing activities that IBA deploys on your personal data.
Further, you may ask for more information on personal data processing and also you can request a copy of personal data that IBA holds about you. The right to obtain a copy of the personal data handled by IBA cannot be exercised in situations where this will adversely affect the rights and freedoms of others.
- The right to be forgotten allows you to solicit erasure of your personal data, but solely under specific conditions provided by applicable legislation.
- The right to rectification offers you the possibility to request IBA to rectify inaccurate or incomplete personal data.
- The right to data portability means your right to receive the personal data that IBA collected directly from you in a structure and machine readable format, solely when such data is processed by automated means and the processing is based on the agreement you signed with IBA or on your consent. Further, you can request these data to be transferred by us directly to another controller. Please take into consideration that this right cannot be exercised in the situation where this will adversely affect the rights and freedoms of others.
- The right to object the data processing applies solely when the processing is based on the legitimate interests of IBA and given your particular situation you consider that the processing infringes your rights and liberties.
- The right to restriction of processing, means your right to request IBA to restrict processing of personal data under particular situations, such as:
- For the period of time necessary for us to correct inaccurate personal data, in cases where you have exercised your right to rectification of personal data;
- When the processing conducted by IBA is unlawful, but you do not want the data to be erased;
- The personal data are no longer useful for IBA, but you need us to keep them for you to be able to establish, exercise or defend legal claims;
- You have objected the processing of personal data by IBA and for the period necessary for us to verify the objection you request the restriction of processing.
- The right to withdraw your consent applies in each situation where processing is based on the consent expressly granted by you. You have the right to withdraw such consent at any time. Please bear in mind that withdrawal of consent will not affect to processing activities performed before such withdrawal.
- Contact us
You can always obtain more information on the processing your personal data by IBA by contacting us at office@iba-edu.org.
Finally, IBA kindly asks parents to provide information on processing of personal data to their children, as children are the primary data subjects exposed to the processing performed by IBA.
Consent Form
| Name of the parent 1/guardian 1 | __________________________ |
| Name of the parent 2/guardian 2 | __________________________ |
| Name of the child/children (applying to some of IBA services): | __________________________ |
| __________________________ | |
| __________________________ |
Dear parents,
IBA Consulting (“IBA”) will, collects and processes your personal data or the personal data of your child/children during its consultancy engagement. In this respect, IBA is committed to observing all the provisions of applicable data protection rules.
Therefore, IBA needs your consent for some specific purposes of processing, as explained below.
Expressing consent
You are not obliged to give us your consent to the processing operations mentioned in the following section and should you decide to grant this consent please be informed that this consent can be withdrawn at any time by contacting IBA at: office@iba-edu.org.
Moreover, please take into consideration that you can decide to grant us consent solely for one/more or all the purposes of processing mentioned below.
You can express your consent by inserting the answer, which corresponds to your wishes, respectively by writing a YES or NO in the designated section under Parent 1 or Parent 2.
Please take into consideration that not completing any of the boxes of this form shall be construed as a denial of consent, thus making the processing of your child’s/ children’s personal data impossible by IBA in the above mentioned circumstances for the stated purposes.
- Processing of general health data of student and his/her allergies or special medical affections
During the process of enrolment of your child in a suitable educational institution, the relevant educational institution requires information on general state of health and special medical conditions or affections of your child, such as allergies and other important medical matters (e.g. immunizations, information on chronic diseases, injuries, potential inherited disorders etc.).
This access is needed primarily for the well-being of the respective child, so as the persons carrying for the respective child can ensure and act promptly in cases the child’s health condition changes. Access to certain health data (such as immunization records) is, however, also required by educational institutions for cross-checking of compliance with mandatory provisions of relevant state law and consequential allowing/denying your child/children to attend classes.
It should be mentioned that the access to such data is not available to all IBA’s staff, but to a limited number of staff members.
For the disclosure of general health data, allergies or medical affections a student suffers from, to IBA’s partners i.e. educational institutions, it is necessary for IBA to have your consent.
It should be stated that the above mentioned health data will not be used in any other purpose than the one presented here and that offering your consent is the only way of ensuring the health safety of your child/children (e.g. if he/she has a medical affection or allergies, or in case of emergency, when medical treatment is required), including attending classes by your child/children.
Please let us know if you consent to the processing of your child’s/children’s personal data on general state of health, allergies or special medical conditions/ affections.
| I agree with the processing of my child’s/children’s personal data on general state of health, allergies and special medical conditions/ affections.* | Parent 1 _______ | Parent 2 _______ |
Please insert the corresponding answer respectively (YES or NO). Nonetheless, please consider that parents and legal guardians should express the same answer regarding their child/children.
Please kindly note that if you choose not to grant your consent for processing of your child’s/children’s health data, IBA may not be able to complete the enrolment of your child/children in the relevant educational institution, as these kind of data are required by educational institutions.
- The processing of students’ images and video recordings
IBA may wish to process personal data in the form of your child/children’s name, surname, age, photography and video recordings (hereinafter referred to as “images”) in accordance with the data privacy applicable legal provisions.
As such, IBA would like to use it and post it on its Facebook official page, Instagram official page, LinkedIn official page, YouTube channel or on IBA’s website as a form of promotion of IBA’s services.
In order for the processing mentioned in this section to be in conformity with the specific relevant data privacy legal provisions, IBA is required to collect your consent.
Please let us know if you consent to the processing of your child’s/children’s images for the purposes mentioned at this point.
| I consent to the use of my child’s/children’s images on IBA’s social networks (official Facebook, Instagram, LinkedIn and YouTube account). | Parent 1 _______ | Parent 2 _______ |
| I consent to the use of my child’s/children’s images on IBA’s website. | Parent 1 _______ | Parent 2 _______ |
| I agree to the use of my child’s/children’s images in IBA’s newsletter, accompanied by the name, surname and class/age of the child. | Parent 1 _______ | Parent 2 _______ |
| I agree to the use of my child’s/children’s images in IBA’s publications used for promotional activities, accompanied by the name, surname and class/age of the child. | Parent 1 _______ | Parent 2 _______ |
