As part of the school’s day-to-day operation, in order to create a safe and caring learning environment, ISB collects various types of personal information as well as sensitive categories including personal information from parents, students, staff and on occasion third parties that have businesses with us.

Our school collects and processes some of the most essential data types for students and parents as listed in the table below.

Data category	Examples of typical data
Admissions process	Name, date of birth, previous school details, transcripts, references, address
Student characteristics	Nationality, language, gender
Parent’s data	Name, address, bank details, personal number, passports
Student assessment	Teacher reports, homework assignments, external examination results
Attendance	Classes attended, number of absences and reason for absence
Behaviours	Incidents, exclusions
Field trips and activities	Passport information or Id card information.
Medical information	Doctor’s report, vaccination records, allergies, individual health plans
Safeguarding	Child protection referral information
Special educational needs	Assessment information, specialist reports

We collect and utilise personal information in order to provide the above-mentioned educational services.

1. Provide our pupils with a quality education 
2. Support our pupils’ learning 
3. Engage you as parents in your child’s education 
4. Monitor and report on student’s academic progress and personal development
5. Provide our pupils with appropriate pastoral care  
6. Meet the standards of accrediting authorities 
7. Keep children in our care safe  
8. Comply with the legal requirements
9. Ensure the security of the school premises 
10. Process payments 
11. Process applications to the school 

The legal basis on which we depend for processing the personal information of our pupils and their parents under the General Data Protection Regulation (GDPR) is that it is required: 

• To perform or establish a contract (1, 2, 3, 4, 5, 10, 11) 
• To comply with legal obligations (7, 8) 
• To protect the vital interests of a data subject (7, 9, 11)
• As part of a task carried out in the public interest (1) 
• For the legitimate interests of the controller (6, 9, 10, 11) 

The use of pupils’ personal data in the form of images, audio, or video on the school’s website, social media, or other non-private channels is an exception to this. In this instance, we request your approval while providing examples of how such data could be used.

We only collect the information that is absolutely necessary for our purposes and store it for as long as it is essential to fulfil our contractual and legal obligations. The vast majority of information is collected during the application process and the annual re-registration process via OpenApply.

We strive throughout the year to keep our data correct and up to date, especially for vital information such as emergency contact numbers and valid email addresses.

All student and staff records will be kept in a secure environment at all times. Security measures will be in place for both paper and electronic records. This will guarantee that the confidentiality of pupil and staff data is preserved while allowing information to be shared lawfully and responsibly, and made available only to those who are authorised to view it.

The records of students and staff will be destroyed in compliance with Norwegian Archive standards and the ISB staff handbook. Records that have been determined to be historically significant will be archived.

Security
We will take necessary technological and organisational means to maintain the proper security of your personal information while we retain and use it, including protection against unauthorised or unlawful processing, as well as accidental loss, destruction, or damage.

We will not disclose information on our pupils and parents with anybody without their permission unless this is required by applicable law, the appropriate departments within the authorities with statutory responsibility for education, or the fulfilment of the contract entered into for the schooling of a child.

We share some of the most sensitive aspects of the personal information that we collect with suppliers that provide information systems or services that are essential to our school's daily operations. Where applicable, we sign into agreements with such suppliers to ensure that they meet with the GDPR's subcontractor requirements. ManageBac, our online learning platform where students can access curricular material and homework assignments, and Google Education Suite, where students can save files and engage with peers, are just two examples.

Some examples of our subcontractors are listed in the table below, along with details on how they handle personal information. This is a sample list for illustrative purposes; the entire list is not limited to these details. 

Company	Purpose	Data Protection Information
Google	Student email, document storage and collaboration	Google Suite for Education
Faria System	Curriculum management,  assessment and reporting Class attendance lists	ManageBac Open Apply
Follett	Library resources	Destiny Library System
Toddle	Curriculum management, assessment and reporting	Toddle
Apple	Using educational app in iPad	school.apple.com
Lightspeed	MDM for iPads	mobilemanager
Fortinet	Firewall of school	Fortinet Cloud
Microsoft	Windows server managing users, PCs, printers and all devices	Windows, Office 365

 

Transferring data overseas 

In the following circumstances, we may transmit your information to other countries: 

• When we keep information on computer servers located in other countries;
• When you or your child are away from home, we communicate with you.

Various teaching and learning applications from outside the EEA / EU are also employed.    

You have the right under GDPR to:

• You have the right to know what personal information we have on you or your young children.
• Request unrestricted access to the data.
• Have any inaccuracies been corrected?
• You can ask for your data to be erased if it is no longer required for us to use or store it, if you have withdrawn your consent,or if we do not have a legal basis to keep it.
• Limit the use of personal data that has been supplied for a specified purpose.
• Request a copy of your personal information in a commonly used digital format, such as a csv file (Data portability).

 

You also have the right to: 

• Object to personal data processing that is likely to cause, or is already causing, harm or distress.
• Prevent processing for direct marketing purposes.
• Object to automatic decision-making process.