Privacy

We are committed to protecting the privacy and security of our students, parents, staff, and visitors. This Privacy Policy outlines how we collect, use, disclose, and safeguard your personal information when you engage with our services.

We understand the importance of privacy and are dedicated to maintaining the confidentiality and integrity of your personal data. Our practices are designed to comply with applicable privacy laws and regulations, ensuring that your information is handled responsibly and transparently.

Who is responsible for your data

Aera Verlag GmbH will be what is known as the ‘Controller’ of the personal data you provide to us. This means that we will be responsible for your personal data. We collect and process personal data in the sense of the General Data Protection Regulation and the Federal Data Protection Law (Bundesdatenschutzgesetz). For issues relating to the use of personal data for pupils and parents, you can contact us at admissionsduesseldorf@stgeorgesschool.com /  admissionscologne@stgeorgesschool.com / admissionsmunich@stgeorgesschool.com. 

Aera Verlag GmbH (Heisterbacher Str. 240, 53332 Bornheim) is legally responsible as the data controller and can be contacted on 0049 2233 808870.

What data we collect

Application Stage

• Pupil information: name, address, date of birth, nationality, passport, place of birth, gender, current school information, medical history, mother tongue and other languages spoken. A passport photograph will be required.
• Parent (and Legal Guardian where applicable) information: name and address, contact details, nationality, passport, profession/job title and employer’s name and address.
• The name and address of the person/Company/third party responsible for paying the fees.

Enrolment and current pupil stage

• We will ask for confirmation of any personal information that we hold on you and your son/daughter made during the application stage.
• Any medical conditions will be asked for, as well as permission to administer some over the counter medicines. 
• Permission will be sought for your child to be photographed or filmed and for permission to have the image in the press, on social media, school marketing campaigns etc.
• We expect you to keep us up to date with any changes to your contact information or information about your child. From time to time, we will ask you to confirm that the details we have about you and your child are correct. 
• We will record academic and pastoral information about your child. 

On leaving

• When your son/daughter leaves the school, we would like to retain his/her and your information on our database. Your information will be marked as being former pupil data, and you will not receive any communications from the school that are intended for current pupils.
• We will ask for your permission to continue to hold your information and will also ask your son/daughter for their permission to continue to hold their information if they leave school after the age of 16.
• You will continue to be able to access your child’s information via the Parent Portal.
• We will keep a record of any public examinations that have been taken whilst at the school.

How we collect your data

Personal data not collected directly from pupils or parents are typically sourced from St. George’s School employees. For example, comments in school reports are written by the respective teachers. On occasion, we also receive data directly from third parties, such as previous schools and external professionals.

Why we need your data

We need your personal data to: 

• Verify your registration and your legal status
• Inform you of school information and notices
• Reach you in case of emergency 

We need up to date and accurate information on your child(ren) to: 

• Verify the information we have been given
• Ensure that we can undertake our duty of care by maintaining relevant details such as health, and other pastoral information
• Provide accurate information to third parties where appropriate (for example, examination boards)
• Administration and provision of electronic learning tools, including the necessary IT and personalised user licenses 

We will not store or process any personal data from you we do not need to fulfil these purposes. The legal basis for the collection and processing is Article 6 Clause 1 (a) of the GDPR in cases where an explicit consent for the processing of the data has been made, and Article 6 Clauses 1 (b) and 1 (f) of the GDPR otherwise. 

The collection and processing of the data is a necessary part of the school contract, since only if we have the necessary data can we properly fulfil our role as a school. For example, this is the only way that it is possible for us to fulfil our duty of care. 

In connection with the administration and provision of IT devices (such as a MacBook from Apple) and licenses for office tools and learning content (including licenses for cloud services related to Microsoft 365, Apple (iCloud), Adobe Creative Cloud, Digital Textbook) we need to register the user credentials of the pupils with the relevant licensor and service provider. The use of user credentials and information resulting from the use of the products is subject to the terms and conditions and the privacy policies of the relevant providers, for which we are not responsible.

For details, please refer to the following provider information and the Privacy Policies available on their websites:

• Microsoft 365: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (www.microsoft.com)
• Apple: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (www.apple.com)
• Adobe Creative Cloud: Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland (www.adobe.com)
• Digital Textbook: Kognity AB, Linnégatan 87D, 115 23 Stockholm, Sweden (www.kognity.com)

We administer the relevant accounts in accordance with the applicable terms of use and licenses. The administrator access will be used for the following purposes: technical administration and problem solving regarding the user accounts, control of user settings, IT security, enforcement of license terms and the applicable acceptable use policy. 

Generally, we do not access e-mails or personal files of pupils. Exceptions are set out in the Data Protection Policy. 

We will remove the user accounts related for the above tools and licenses as soon reasonably possible after the end of the school time or completion of the final examination.

What we do with your data?

All the personal data we process is processed by our staff in Germany. These staff may also process data whilst outside of Germany but within the European Union. This is so that we can ensure that your data is processed with the highest possible level of protection. For the purposes of IT hosting and maintenance, this information is located on servers within the European Union. 

We do not grant third parties’ access to your personal data unless we are legally compelled to do so. The only exceptions to this rule are the other companies in the St. George’s Group (currently Aera Verlag München GmbH and Aera Verlag Duisburg GmbH). Since certain administrative responsibilities within the St. George’s Group are conducted by particularly qualified employees at the Munich, Cologne and Düsseldorf Rhein-Ruhr sites, the data processing can, in some cases, be conducted by an employee of a St. George’s company, who technically is not an employee of the company with whom you have a contractual relationship. All employees of St. George’s Schools are bound by the same duties, and as such there will be no negative impact on our high standards of data protection. There are contractual arrangements between the St. George’s Schools to guarantee that data protection regulations are observed. 

Regarding the retention periods: If your application is unsuccessful or withdrawn, we will remove any personally identifiable data within 12 months. Should your child become a pupil at St George’s we will maintain information on you and your child for the time that your child is at the school. Once he/she has left we will maintain the records for 25 years. 

What are your rights?

• You have the right to be informed by the data controller about your personal data, as well as the right to correction or deletion or the restriction of the processing of personal data. You also have the right to object to the processing of personal data.To do so, please contact admissionsduesseldorf@stgeorgesschool.com / admissionscologne@stgeorgesschool.com or admissionsmunich@stgeorgesschool.com. 
• If you have given consent to your data being processed, you have the right to fully or partially revoke this consent at any time.
• If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. You can contact this individual by email at dataprotection@stgeorgesschool.com
• If you believe we are processing your personal data not in accordance with the law you can complain to the relevant regional authority, the Landesdatenbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. Additionally, if you live within the EU but outside of North-Rhine-Westphalia, you can instead complain to the data protection authority responsible for your place of residence.