Privacy Policy

Introduction
American School of The Hague (ASH) complies with the relevant national data protection regulations, including the General Data Protection Regulations (GDPR) from 2018 American School of The Hague is committed to keeping personal information accurate, up-to-date, safe, secure and will not keep personal information longer than necessary. This privacy notice explains how American School of The Hague uses personal information, with whom it is shared and the ways in which it is protected. This notice applies to all personal data collected for and on behalf of the school. This pertains to information collected in analogue (forms, documents, in writing) and through technological means such as information systems and email.

From time to time, American School of The Hague will make you aware when we require additional personal information for processing, outside of that detailed in this policy, a separate specific privacy notice will be sent, or a consent form.

Who is the data controller:
The data controller who is responsible for the processing of personal data is the foundation Stichting The American School of The Hague, with its registered office at Rijksstraatweg 200 in Wassenaar, the Netherlands and is listed in the Trade Register under number 41153023.

How personal information is used:
American School of The Hague collects personal information and sensitive categories of personal information of students, parents, employees and at times third parties, to provide a safe and caring environment for teaching, learning and general educational purposes, as well as for administrative, business, HR, and marketing and communication purposes, for instance:

● to re-enroll your child (student) for the next academic year
● to undertake and manage the school admissions and enrolment
for approved school trips/sports events
● to provide a safe learning environment
● to comply with child protection requirements
● to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress
● to provide support and care for emotional and psychological wellbeing (pastoral and counseling)
● to protect the health of the students and staff we serve. American School of The Hague may also use data provided by other health professionals to safeguard staff and students.
● to provide a tailored learning environment and make evidence-based education decisions for the children we serve
● to enable the students to continue or progress their education at other educational organizations
● to enable the development of a comprehensive picture of the workforce and how it is deployed
● to create an admissions folder for the student/family to match students and families with others who speak the same language, or are from the same places to create, if and when accepted, school profiles, online etc.
● to enroll staff in the pension provider plan
● to create payroll records

American School of The Hague also processes personal data in the context of its regular business operations, including recruiting and selecting personnel, (financial) administration, security, management of ICT systems, compliance with statutory obligations, archiving and dealing with requests, complaints and disputes. It also processes personal data for marketing and communication purposes, including managing the school website, sending email newsletters and creating school profiles online (if and when accepted).

Automated Profiling
The profiling enables the school to assess child protection and safeguarding risks or concerns. The school has a process in place to ensure only those with the relevant training and expertise have access to the data generated by this processing activity. For specific information on who has access, and the retention of this information, please contact the Data Protection Officer.

Some educational applications profile the behavior, use and outcomes of students. The school has a process to assess the impact on students. In evaluating the use of these applications, the school will consider the benefit gained from using these applications for the student to learn, develop and explore, against the negatives identified from profiling.

What is the lawful basis for processing your personal data: 
American School of The Hague collects and uses personal information to carry out the services as prescribed above. It is done so under a lawful basis, as prescribed by the applicable laws and regulations, especially the General Data Protection Regulation (GDPR). In some circumstances American School of The Hague may be required to share your personal data for legal statutory purposes or under legitimate interests

American School of The Hague uses the information you provide for purposes that are necessary by law and required to undertake the performance of the contract into which you have entered and do so as is required by law. American School of The Hague will always ensure that there is a regulation for processing personal and sensitive information. American School of The Hague’s legitimate interest for processing your data is, inter alia, to provide an education for your child, to grant admission to the school and to serve other regulatory purposes.

Some of the personal data is provided to us on a voluntary basis. In order to comply with data protection law, American School of The Hague will inform you when consent is required to process your information. Where consent is provided, you or your child are free to withdraw consent at any time. You can contact our Data Protection Officer (contact details below) if you or your child wish/es to withdraw consent. If you do not complete the relevant form, then this will be taken as consent will be given.

Sources:
American School of The Hague obtains your personal data because you disclose this information yourself, or it obtains your personal data from third parties in the context of providing its services (or one of our other processing purposes), for example from counterparties, or from public sources such as the Trade Register.

Categories of personal data that are processed:
The categories of personal data that are collected, stored and shared, include: 
● personal information (such as name, date of birth, unique number and address) 
● other relevant categories for the performance of our services (such as assessment, relevant medical information, special educational needs information, exclusions / behavioral information and psychological reports and assessments) 
● attendance information (such as sessions attended, number of absences and absence reasons) 
● logging and audit in the use of IT systems and education technology apps, applications and cloud-based systems.
● photographs and videos taken by staff and students throughout the school year to record and share everyday life at American School of The Hague. Your child may be identifiable in these photographs 
● photographs taken for identification purposes e.g. ID cards. ASH has a separate process for handling school photos. For clarification on this, please email the Data Protection Officer on DPO@ash.nl
● Other categories of personal information necessary for the processing purposes stated above under the header ‘How personal information is used:’. 
● Information relating to administrative, business, HR, and marketing and communication are also outlines generically in this policy, as well in more detail in other internal ASH policies where necessary. 

Who is personal data shared with:
American School of The Hague does not share your personal data with third parties unless this is necessary for one of the processing purposes stated under the header ‘How we use personal information’ Examples of recipients of personal data are: 
● pension company, HR Recruitment system (Easycruit), Finance system (AFAS) 
● schools, colleges or universities that the students attend after leaving/graduating 
● education authorities 
● family nurses, doctors or social service organizations (where sharing is in the vital interests, or based on another statutory ground) 
● providers of information systems that are necessary for American School of The Hague to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services 
● third parties for school trips / outings 
● local authorities 
● other recipients necessary for the processing purposes stated above under the header ‘How is Personal Information Processed’ 

If third parties process the data in the capacity of a data processor, American School of The Hague enters into a written data processing agreement before sharing any personal data. 

Processing and transfers to third countries:
Personal information may be transferred to organizations outside the EU for the purposes of student applications for college or university. Various teaching and learning applications are also used that are based outside the EEA. Information on these and the protections afforded, where possible, Data processing Agreements can be requested from the Data Protection Officer.

What are your rights:
Under data protection legislation, everyone has the right to request access to information about them that we hold. To make a request for your personal information, contact the Data Protection Officer. 

You also have certain additional rights to:
● be informed of how American School of The Hague is processing your personal information – this Privacy Notice serves to explain this to you but do get in touch if you have any questions;
● have your data corrected if it is inaccurate or incomplete; 
● have your information erased (the right to be forgotten) in certain circumstances – e.g., where it is no longer needed by us, the purpose for which it was collected or you have withdrawn your consent; in accordance with GDPR Article 17. 
● restrict the use of your data in certain circumstances e.g., where you have told American School of The Hague that the data is inaccurate and that this is in the process of being checked. 
● In such circumstances American School of The Hague will continue to store your data but will not process it further until it has been checked and we have confirmed whether the data is inaccurate. 
● object to the processing of your data in certain circumstances - e.g., you may object to the processing of your data for direct marketing purposes. 
● object to decisions being taken by automated means or for it to be reviewed by manual intervention. 
● object to the processing of personal data that is likely to cause, or is causing, damage or distress. 
● prevent processing for the purpose of direct marketing 
● in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
and
● claim compensation for damages caused by a breach of the Data Protection regulations. 
● If you have any concerns about the way American School of The Hague is collecting or using your personal data, you should raise your concern with us in the first instance. 
● If you wish to exercise any of those rights, please contact the Data Protection Officer
● If you wish to know more about how American School of The Hague handle your information, how to complain or what your rights are, further information can be obtained through the ASH Data Protection Policy, and you can also email DPO@ash.nl. 
● If you are not satisfied with the response, or believe American School of The Hague are not processing your personal data in accordance with the law, you can contact the relevant supervisory authority. 

The competent supervisory authority in the Netherlands is the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl). 

Retention and storing of personal data:
The school recognizes that by efficiently managing its records, it will be able to comply with its legal and regulatory obligations and to contribute to the effective overall management of the institution. Records provide evidence for protecting the legal rights and interests of the school, and provide evidence for demonstrating performance and accountability. The school maintains separate retention policies for the individual areas/departments. For more information regarding data retention at ASH, please contact the DPO on DPO@ash.nl

American School will, in any event, retain your data no longer than necessary for the processing purposes stated above under the header ‘How personal information is processed’.

Pupil and staff records:

All student and staff records will be kept securely at all times. American School of The Hague will retain the forms with your child’s record for a maximum of 7 years after graduating or withdrawing from the school (full details are available from our retention policy, and more information can be obtained from the Data Protection Officer, DPO@ash.nl),  after which time they will be securely destroyed. Transcripts for graduating students will be retained for an indefinite period, and are kept on a secure digital system.

Other legal documents needed for pensions, salary etc., will be retained for an indefinite period. ASH will ensure that confidentiality is maintained for pupil and staff records whilst enabling information to be shared lawfully and appropriately, and to be accessible for those authorized to see it.

Physical files containing data will be kept at a secure off-site location. Records kept onsite, will be kept for students for a maximum of one school year before being digitized/sent to the off-site storage facility. Staff records that are kept by HR etc., will be kept in a secure physical location on and off site, as well as in a secure digital location.

The student and staff records will be disposed of in accordance with the safe disposal of records guidelines. If records have been identified as historically important, they will be archived at a secure off site location. 

Security: 
American School of The Hague stores and uses your personal data and ensure the appropriate security of your personal data including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures in accordance with Article 32 of the GDPR. 

Cookies: 
American School of The Hague may use cookies on our website. For more information on how cookies are used, please see the cookie policy. 

CCTV: 
American School of The Hague collects information in the form of CCTV to ensure the safety and security of students and staff. Only authorized security personnel may observe the operation of the system and may do so 24 hours a day, 365 days a year. The Business Manager, Director and or designated others (by the Business Manager/Director), may be given limited access. Unless otherwise required as evidence in pursuit of one of the stated purposes in the CCTV policy, images are stored for a maximum of 30 days before being overwritten, (or until the hard drive is full, in which case, the data is also overwritten).
American School of The Hague also has CCTV monitoring on the school buses. This is for Safety for students on the bus and to enable the review of incidents that may happen on the bus.

Contact:
If you would like to discuss anything in this privacy notice, or regarding questions about GDPR at ASH please contact us at dpo@ash.nl or: 

Data Protection Officer
American School of The Hague
Rijksstraatweg 200
2241BX Wassenaar
+31 70 511 24 00

American School of The Hague reserves the right to make changes to this privacy notice at any time in accordance with applicable legislation and regulations. Please check this webpage from time to time to see whether any changes have been made. 

Last Updated May 2024