Introduction

At Canadian International School of Hong Kong we value the rights and freedoms of all people. This includes respecting your privacy and protecting your personal data. This privacy policy describes how we collect and use (or "process") your information. It also tells you how to contact us as well as outlining what rights you have with regard to your personal data.  

Who we are?

Canadian International School of Hong Kong (“we”, “our”, “us”) is a school located at 36 Nam Long Shan Road, Aberdeen, Hong Kong.  We provide education to children from Nursery* (2 years old) through to Grade 12. 

What is the purpose of this privacy policy?

The purpose of this privacy policy is to provide detailed information about how we process personal data. 

Our privacy policy should be read in conjunction with our other policies and terms and conditions which make reference to personal data.

Please read this policy carefully and, if you have questions regarding your personal data or its use, please contact the Data Protection Officer by emailing DPO@cdnis.edu.hk.

We will update this Privacy Policy from time to time. Any substantial changes that affect how we process your personal data will be notified on our website and to you directly, as far as practicable.

What is the personal data?

The term ‘personal data’ refers to any information which identifies you or can be used to identify a data subject when used in conjunction with other information. 

The term ‘data subject’ describes the person about whom the personal data is about.

What personal data do we collect about you?

We process personal data about visitors to our website; prospective, current and past: students and their parents; staff and contractors; donors and supporters; and other individuals connected with or visiting our school. 

The personal data we process takes different forms. Examples include:

• names, addresses, telephone numbers, e-mail addresses, emergency contact information;
• IP addresses, location data, and website statistics and analytics; 
• website cookies;
• students' date of birth, nationality, family details;
• HKID card or passports/ entry permit numbers;
• admissions, academic, disciplinary and other education related records, references, examination scripts and marks;
• parents’ employment data, education background;
• bank account details;
• images, audio and video recordings;
• financial information and identification documents (e.g. for bursary assessment or for fundraising);
• employee and former employee data including recruitment, training, performance management, payroll, and other HR information;
• criminal records;
• health and dietary requirements;
• special education needs; 
• biometric data (e.g. fingerprints);
• information relating to safeguarding and child protection/welfare;
• race ethnicity; or 
• religion. 

How do we obtain your information?

We collect most of the personal data we process directly from the data subject concerned (or often in the case of students, from their parents.  In some cases, we collect data from third parties (for example, referees/references, and previous schools) or from publicly available resources. 

We also collect data about you when:

• you have expressed an interest in having a student attend our school and /or have a child attending the school's admission assessment;
• you have a child enrolled at the School;
• you have registered to attend (or have attended) one of our events;
• you visit our website;
• you sign up to receive email our newsletter and/or prospectus;
• you have expressed an interest in working for, or with, us; or
• you are employed by us or an organisation with whom we have a business relationship.

By selecting CDNIS for the education of your child(ren), and thereby providing personal data to us, you are consenting to the applications of this Privacy Policy and the collection, use, access, transfer, disclosure, storage and processing of your and your child(ren)'s personal information to the extent necessary to deliver educational programmes and adjunct services to the student as described in this Policy.

How do we retain your personal data?

CDNIS is an educational institution. As such, the personal data you submit to us in Hong Kong may be transferred, used, processed, stored and accessed worldwide (post-secondary applications, CAS Week excursions, etc) as we consider appropriate and only in relation to the delivery of our education programmes. In addition, we may disclose and transfer personal data for the delivery of school activities (CAS Week, ASA programme, etc), with government organizations (Centre for Health Protection, etc), other educational institutions and other persons who we consider appropriate, in connection with the services provided to or requested by you.  By enrolling your child(ren) in CDNIS, you understand and consent to such transfer.

Whenever we use (or “process”) any personal data, we do so in accordance with applicable laws and regulations (including with respect to safeguarding or employment). Personal data held by us is processed by appropriate members of staff for the purposes for which the data was provided.

We take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices, and access to school systems.

In the course of school business, we share personal data (including special category personal data where appropriate) with third parties such as examination boards, the school’s nurse/doctor, the school’s professional advisors and relevant authorities.

We may also be required to share your personal data with other organisations for legal or statutory purposes, or where we have your consent to do so.  Moreover, some of our systems are managed or operated by third parties (e.g. hosted databases, school website, school calendar, school post and my school portal or cloud storage providers).

Sharing data with these parties is always subject to contractual assurances that personal data will be kept securely and only in accordance with our specific directions.  We do not transfer personal data you have provided unless we are satisfied that the personal data will be afforded an equivalent level of protection.

Additionally, the school will provide information to each pupil/parent (which can include relevant personal data of the respective child) as necessary to facilitate school operations.

Moreover, we may transfer data to other countries but in doing so will rely either on the existence of adequacy agreements or upon standard contractual clauses as part of agreements with data processors.  For more information on how we transfer data to other countries is available upon request by contacting our Data Protection Officer at DPO@cdnis.edu.hk.

Purposes for which we process personal data

We process personal data to support our operation as an independent school.  In particular, we use the data for:

• the selection and admission of students;
• the provision of education and enrichment to our students, including the administration of our curriculum; monitoring student academic progress and educational needs; reporting on the same internally and to parents; administration of students’ entries to public examinations, and providing references for students (including after a student has left);
• the provision of educational support and related services to students;
• the safeguarding of students’ welfare and provision of pastoral care, welfare, health care services and support;
• the provision of a safe and secure environment for students, staff, and visitors to the school;
• compliance with legal and regulatory requirements;
• operational management including the compilation of student records; the administration of invoices, fees and accounts; the management of school property; the management of security and safety arrangements and monitoring of the school’s IT and communications systems in accordance;; the administration and implementation of our school’s rules and policies for students and staff; and the maintenance of historic archives;
• staff administration including the recruitment of staff/engagement of contractors; administration of payroll, pensions and sick leave; review and appraisal of staff performance; conduct of any grievance, capability or disciplinary procedures; and the maintenance of appropriate human resources records for current and former staff; and providing references;
• development including fundraising;
• analysing website traffic, demographics and behaviour through the use of analytical tools and cookies; 
• the promotion of our school through our website[s], our prospectus and other publications and communications (including through our social media accounts);
• maintaining relationships with our alumni and former employees;
• for keeping a record of historical and memorable events relevant to the maintenance of a historical record.

What is our legal basis for processing your personal data?

We may process your personal data for the above purposes based one or more of the following legal bases:

• we have an individual’s consent to do so (or their parent’s, if appropriate). You can withdraw your consent at any time by emailing DPO@cdnis.edu.hk
• it is necessary for the performance of a contract (e.g. an employment contract with a member of staff);
• it is necessary for our compliance with our legal obligations. In this respect, we may use personal data to exercise or perform any right or obligation conferred or imposed by law in connection with employment; and/or for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
• it is necessary for our or a third party’s legitimate interests. These “legitimate interests” include our interests in providing high quality education, fostering relationships with those in the school community, and our interests in managing and operating the school to the best of our abilities;
• it is necessary to protect an individual’s vital interests (in certain limited circumstances, for example where a student has a life-threatening accident or illness while at school and we have to process that student’s personal data in order to ensure the student receives prompt and appropriate medical attention);
• it is necessary for the establishment, exercise or defence of legal claims;
• it is necessary for reasons of substantial public interest, including safeguarding purposes;
• it is necessary for medical purposes, including medical diagnosis and the provision of health care or treatment for students, managing related health care systems, and/or for assessing the working capacity of staff;
• it is necessary for archiving, research or statistical purposes.

Consent

Under data protection laws, the rights belong to the individual to whom the data relates (i.e. the data subject). However, where consent is required as the lawful basis for processing personal data relating to students we will often rely on parental consent unless, given the nature of the processing in question, and the student’s age and understanding, it is more appropriate to rely on the student’s consent.

Parents should be aware that in such situations they may not be consulted, depending on the interests of the child, the parents’ rights at law or under their contract, and taking into account all the relevant circumstances.

In general, we will assume that students’ consent is not required (and that other lawful bases are more appropriate, as described above) for ordinary disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the student’s activities, progress and behaviour, and in the interests of the student’s welfare, unless, in the school’s opinion, there is a good reason to do otherwise.

However, where a student seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, we may be under an obligation to maintain confidentiality unless, in our opinion, there is a good reason to do otherwise; for example where the school believes disclosure will be in the best interests of the student or other students, or is required by law.

What are our responsibilities for looking after your personal data?

We pledge to meet, and where possible exceed, internationally recognized standards of personal privacy protection, in compliance with the Personal Data (Privacy) Ordinance of the Hong Kong Special Administrative Region ('the Ordinance').   You can also review the Ordinance by following this link to the government's website.

What rights do you have over your personal data?

Under data protection laws, you have the right to:

• obtain access to, and copies of, the personal data that we hold about you (subject to legal exceptions);
• correct the personal data we hold about you if it is incorrect;
• require us to erase your personal data in certain circumstances e.g. if it is used for a purpose other than the one originally stated, or if it was acquired by fraudulent or other unlawful means;
• require us to restrict our data processing activities in certain circumstances;
• receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of your transmitting that personal data to another data controller;
• object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights (including a right to object to receiving fundraising or communications, and to object to our profiling you for the purposes of fundraising or keeping in touch);
• where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal.

We try to ensure that all personal data held in relation to an individual is as up to date and accurate as possible.  Please notify the relevant school department of any significant changes to important information, such as contact details, held about you. 

Parents may also check and update their personal data via the Parent Portal at any time. A request for access or correction to, or deletion of personal data or for information regarding policies and practices and kinds of personal data held by us must be in writing and sent to us via registered postal mail. 

The Personal Data (Privacy) Ordinance requires a data access request to be made in accordance with the form which is available here. We may charge a reasonable fee for the processing of any data access request.

Please note that these rights are not absolute, and we may be entitled or required to refuse requests where exceptions or exemptions apply.

We will respond to any such written requests as soon as is reasonably practicable and in any event within statutory time limits.  

If you have any questions or concerns about how we are using your personal data or if you would like to exercise any of your information rights, please contact us at DPO@cdnis.edu.hk.

How do we retain and store your personal data?

All personal data is securely stored in accordance with legal requirements. We retain personal data only for legitimate purposes, relying on one or more of the lawful bases as set out above, and only for so long as necessary for those purposes, or as required by law.  

Contact us

If you have questions, requests or issues, please let us know how we can help. Our Data Protection Officer can be reached at DPO@cdnis.edu.hk.

Controller Details

The Data Protection Officer
Canadian International School of Hong Kong
36 Nam Long Shan Road
Aberdeen
Hong Kong