Data protection information on the registration form for the Alea School

1. Responsible person:

The responsible body is Alea School gemeinnützige GmbH in Gründung, Kurparkstr. 29, 63619 Bad Orb, Germany (hereinafter: “Alea School”), phone: 0605091705060, e-mail: learn@alea.school.

2. Data processing

When registering for the Alea School via the online form, the following data is collected as mandatory information (hereinafter “mandatory information”):

Surname and first name, address, gender, date of birth, nationality, language skills, name of the school currently attended and school reports from the last two school years (including information contained therein such as grades or, if available, participation in additional extracurricular activities) as well as the level in question (5th or 6th grade).

Salutation, surname and first name, parent/guardian status, address, company/employer, telephone number, e-mail address of the registering parent/guardian.

If additional information is provided outside the mandatory information marked as such, e.g. in the field “Further information” on special interests and hobbies of the child to be registered, this is voluntary (hereinafter “voluntary information”).

If you voluntarily upload a photo of the child to be registered, this will also contain personal data such as, in particular, the appearance/image of the child; the photo may also allow conclusions to be drawn about specific personal data of the child in accordance with the German Data Protection Act. Art. 9 para. 1 GDPR (e.g. racial and ethnic origin, genetic and/or biometric data, health data).

In the case of an application for a scholarship, the following mandatory information is also collected:

Desired scholarship (Norbert Strauss Scholarship or Bad Orb Scholarship), confirmation of residence in Bad Orb and membership of a Bad Orb association, if applicable, confirmation that the child’s income is below the stated average net household income, proof of income, letter of motivation or thesis from the child and letter of recommendation from a former or current teacher of the child (including information contained therein, such as details of voluntary work or special achievements of the child).

3. Purpose of processing and legal basis

The legal basis for the processing of the mandatory data is the execution of the registration for the Alea School (possibly with the use of a scholarship) and thus the preparation or execution of the contractual relationship with the Alea School, Art. 6 I lit. b) GDPR.

The legal basis for the processing of voluntary information is your consent (Art. 6 I lit. a) GDPR). Insofar as you voluntarily provide us with special personal data within the meaning of Art. Art. 9 para. 1 GDPR, the legal basis for this is your consent in accordance with Art. Art. 9 para. 2 lit. a) GDPR.

4. Disclosure to third parties

The technical operation of our data processing systems is generally carried out by Microsoft Azure on our behalf. We use other processors for individual processes. If required by law, the data will also be transmitted to the education authority.

In this phase of the registration and application process, the data is only made accessible to the employees involved in the registration and application process.

5. Storage of the data: Subject to the revocation of consent, the data will be stored for an indefinite period of time for a specific purpose and in compliance with statutory retention periods
   The data is stored permanently encrypted and only the necessary instances have access rights. Access to this data is encrypted and by means of multi-factor authentication.
6. Rights of data subjects: Every data subject has the right of access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR and the right to data portability under Art. 20 GDPR. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with Section 19 BDSG).

Insofar as we process data to protect legitimate interests exclusively on the basis of Art. 6 para. 1 f) GDPR, the data subject has the right to object to the processing of their data on grounds relating to their particular situation (Art. 21 GDPR). If the data subject lodges an objection, we will no longer process the data concerned unless we can demonstrate legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

If consent has been given, this is voluntary and can be revoked at any time with effect for the future. The legality of the data processing carried out on the basis of the consent until the revocation is not affected by the revocation.