Privacy policy
Personal Data Act (523/99), Section 10
EU General Data Protection Regulation (2016/679)
Prepared on 11 December 2024
1. Data Controller
South Karelia IB World School
2. Name of register
The Personal Data Register of South Karelia IB World School
3. The person responsible for the register
Sanna Prior
IB Coordinator
tel. 020 617 5712
sanna.prior@edu.imatra.fi
4. Purpose of the register
The controller processes the personal data of pupils and students for the purpose of providing education. The controller also processes personal data of its staff in order to fulfil its employment obligations.
5. Data content of the register
The data processed in the register is necessary for the purposes for which the register is intended:
- personal and contact data
- data relating to academic performance and the organisation of studies
- the names and contact details of the student's guardians
- interests and behaviour on the controller's websites and services
- data relating to the device used by the individual: e.g. terminal device, IP address, operating system and browser
6. Sources of information
Personal data is collected from the data subject or from the guardian of a student under 18 years of age. Part of the data is generated from information about the student's educational activities, which is entered in the register by the teacher.
7. Data disclosure and transfer
The data will not be disclosed without the consent of the data subject except to the extent permitted and required by law or as required by the authorities. A student's personal data may be disclosed for the purposes of organising, monitoring and statistics to the Matriculation Examination Board, Statistics Finland, secondary education services, the National Assessment Centre (KARVI), the National Insurance Institution, the Finnish National Board of Education or other authorities. Data may also be disclosed to a new educational institution in the event of a change of educational institution in order to fulfil contractual obligations.
The controller will not transfer or disclose personal data outside the European Union or the European Economic Area.
8. Data retention period
The controller will only keep the data for as long as necessary for the purpose for which it is collected.
9. Register security
The databases in which the data is stored are technically and physically secure, so that no outside parties have access to them. Access to data is restricted to those who need it to carry out their duties.
10. Right to access, rectification and deletion
The data subject has the right to check what information about him or her has been entered in the register, the right to request the correction of inaccurate personal data and the right to have his or her data erased from the register. The request for inspection, correction or deletion must be sent in writing, signed and addressed to the person responsible for the register.
11. Right of transfer and prohibition
The data subject has the right to receive personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format, where the processing is based on consent or on a contract, and the processing is carried out automatically. The data subject's right to restriction of processing under Article 18 of the EU General Data Protection Regulation.
The right to data portability and the right to object will enter into force on 25 May 2018.
12. Changes to the Privacy Policy
We are constantly improving and developing our websites, so changes may be made to this Privacy Policy from time to time. The controller reserves the right to update and amend the Privacy Policy. Where required by law, we will inform data subjects accordingly.