The English School  – Privacy Notice

1. Introduction

This Privacy Notice provides information to all data subjects, including but not limited to students, parents/guardians, staff, prospective students and staff, alumni and website visitors (“you”), regarding how The English School (the “School”, “we”) processes Personal Data in accordance with applicable data protection legislation, including the General Data Protection Regulation 2016/679 (“GDPR”) and the Cyprus Data Protection Law 125(I)/2018. The School maintains an internal data protection framework with policies, procedures and mechanisms which describe the processing, safeguarding and the principles of data protection established in the context of GDPR and the local legislation.

2. Our role:

The School mainly acts as the Data Controller regarding processing Personal Data concerning students, parents/guardians, staff, as well as prospective or alumni students, parents, staff and webpage visitors specifically in the context of providing educational services. This means that we are responsible for the lawfulness of processing carried out by the School and thus have the overall control over the purposes and means of the processing.

The School has appointed a Data Protection Officer (“DPO”), who may be contacted at dpo@englishschool.ac.cy in relation to data protection matters or the exercise of data subject rights.

3. What Personal Data do we process and how?

We process Personal Data that we receive from you in the context of academic, employer or business relationship. To the extent necessary and in order to operate at the highest education standards, we may also collect and otherwise process Personal Data not specified below, however we will always notify and describe the purposes as necessary at the point of collection.
For all special categories data (also known as sensitive data), we will always communicate to you the purposes for which we wish to use your sensitive information when it is being collected, and, the relevant applicable legal basis in each case for example, if necessary, your explicit consent at that time.
The following categories of Personal Data may be proceeded as part of the School’s operation and educational activities:

• Contact details;
• Identity information;
• Student registration and academic information, including homework, assessments and examination information;
• Parent/guardian information;
• Staff and employment-related information;
• Payment, accounting and transaction information;
• Health data
• Pastoral information and other Special Categories of Personal Data, where applicable;
• Photographs, video recordings and other media;
• CCTV images;
• Information processed through the School’s online teaching platforms; and
• Website and portal information, including login information and technical information such as IP address, operating system, browser type and preferences.

Personal Data may also be processed as part of other core or ancillary School activities, including teaching and student administration, extracurricular activities and School events.

4. Legal basis for processing

The legal bases used for Personal Data processing, depending on the relevant processing activity, may include:

• Contractual necessity;
• Legitimate interests, including where applicable for the safeguarding of students, health and safety and security of staff and visitors on campus, and the protection of School assets;
• Consent and, where applicable, explicit consent; and
• Legal obligations.

5. Why do we process Personal Data?

When acting as Data Controller, the School will rely on (a) your consent to process certain data sets such as media (images, videos) files, cookies or other analytics through the use of our website, (b) the necessity to perform our contractual obligations with regard to all the educational services provided, (c) on our legitimate interest provide that this interest is not overridden by your rights and freedoms (e.g. safeguarding, providing quality and safe facilities, etc), (d) legal or regulatory obligations we must fulfil as an academic institution.

6. Disclosure of Personal Data

We may share certain data with relevant national authorities or bodies under our legal obligations or in accordance with Data Protection Law. Such authorities may be the Ministry of Education, Social Insurance department etc. We may also share Personal Data in the context of international examinations and admissions to higher education institutions following students and parents instructions and exam boards or institutions requirements. Data may be also shared with our subcontractors for maintenance purposes and other third parties Software providers, Information security and information technology consultants, Legal advisors etc.

7. Retention of Personal Data

We do not retain Personal Data in a form which may enable the direct or indirect identification of a Data Subject for longer than is necessary for the purposes for which the data is being processed or more than is provided for by specific legislation. Personal Data of students relating to registration, education, exams, and graduation are retained as long as they are registered students and then archived and retained for longer period. Other Personal Data which are also archived and kept for longer periods include data which the School is required to retain for legal and/or regulatory purposes. In that case the School implements all technical and organisational measures to safeguard the data for the full life cycle.
We maintain an internal records retention policy which provides for every category of Personal Data a specific retention period or criteria for disposal of data. You may email dpo@englishschool.ac.cy for particular Personal Data retention periods.

8. Data Transfers

We do not normally transfer your Personal Data outside of the European Economic Area (“EEA”). However, your Personal Data may be transferred to entities and institutions, located outside the EEA, provided that such transfers are carried out either a) on the basis of an adequacy decision by the EU Commission in accordance with GDPR Article 45, or b) on the basis of at least one of the other appropriate safeguards, such as the up-to-date EU approved Standard Contractual Clauses. Where none of the appropriate safeguards are applicable, we may carry out the transfer on the basis of at least one of the specific situations, i.e. the data subject’s specific consent, necessity for the performance of a contractual obligation etc. In addition, we will always take into account the relevant provisions under Cyprus Data Protection Law. In any event, we always make sure we take all reasonable and practicable measures to ensure the secure transfer in accordance with the GDPR.

9. Your data subject rights

   When the School acts a Data Controller, Data Subjects may exercise their data privacy rights which the GDPR affords them. These include the right to:
   1. receive certain information about the School’s Processing activities (Right to be informed)
   2. request access to their Personal Data that we process; (Right to Access)
   3. in limited circumstances, request the erasure Personal Data, for example if it is no longer necessary in relation to the purposes for which it was processed; (Right to Erasure)
   4. request the rectification of inaccurate data or to complete incomplete data; (Right to Rectification)
   5. right to request to restrict Processing in specific circumstances; (Right to Restriction)
   6. in limited circumstances, receive or ask for their Personal Data to be transferred to another data controller in a structured, commonly used and machine-readable format; (Right to Portability)
   7. object to Processing based on our legitimate interests or, where applicable, the performance of a task carried out in the public interest
   8. object to decisions based solely on automated Processing, including profiling; (Right not to be subject to automated-decision making) (not applicable to the School at the moment)

   Other rights include: the right to be notified of a Personal Data Breach which is likely to result in high risk to your rights and freedoms; the right to make a complaint to the Supervisory Authority; the right to withdraw consent to Processing at any time.

   Please note that these rights are not absolute and subject to exceptions. These therefore may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure under applicable law. The applicability of your rights depends on the legal basis on which we rely in each case.
   If you wish to exercise any of these rights, please contact our DPO by email at dpo@englishschool.ac.cy .

   We will respond without undue delay and in any event within one month of receipt of your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. Where an extension is required, we will inform you within one month of receipt of the request and explain the reasons for the delay.
   If you wish to raise a complaint on how we have handled your Personal Data, you may contact us to have the matter investigated.

   If you are not satisfied with our response or believe we are not processing your Personal Data in accordance with the law, you may lodge a complaint to:

   Office of The Commissioner for Personal Data Protection
   Office address: Iasonos 1, 1082 Nicosia, Cyprus
   Postal address: P.O.Box 23378, 1682 Nicosia, Cyprus
   Tel: +357 22818456
   Fax: +357 22304565
   Email: commissioner@dataprotection.gov.cy

10. Data security

We are implementing all appropriate and necessary technical and physical security measures to ensure a level of security appropriate to the risk, in order to prevent any Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Personal Data transmitted, stored or otherwise processed.

We are also regularly assessing the effectiveness of all technical and organisational measures to ensure the security of the Personal Data processed on our systems, equipment and facilities taking into account all the relevant security standards and legal requirements. We maintain an internal information security policy and all staff is responsible to abide by the School’s Data Protection Security Manual to protect of our Personal Data.

11. Changes to Privacy Policy

We may update this policy from time to time, so please review it frequently. If any material changes are made to this Privacy Notice, we will use reasonable endeavours to inform you in advance by email, notice on the website or other agreed communications channels.

Last review October 2026