Processing personal data

On May 25 2018 the new data and privacy security legislation (GDPR) came into effect. Please read the information below about how Bladins school processes personal data, and your rights as registered with Bladins. Bladins school protects your personal privacy and it is important to us that your personal data is processed in a correct and secure manner. All processing of personal data within Bladins is carried out in accordance with applicable data protection legislation.

What exactly is personal data?

Personal data is any kind of information related to a natural (living) person, such as name, personal number / social security number, address and email address.  

What does the processing of personal data entail?

The processing of personal data refers to all forms in which personal data is processed, such as the collection, registration, organisation, structuring, storing, processing, transferring and erasure of personal data, both analogue and digital.

What are the legal grounds for processing personal data?

Legal grounds must be met in order for Bladins to be allowed to process personal data. We rely primarily on the following legal grounds for the processing of personal data: 

Information of general interest

School activities demand that we process personal data in order to execute educational operations. Examples of information of general interest include information and data supported by law or other regulations, such as the School Act and the Health Care Act. 

Legal obligation

We process certain personal data in order to fulfil a legal obligation under EU or Swedish law. Examples of legal obligation is the data we are required to process by external authorities, such as the Accounting Act and collective agreements. 

Balancing of interest

In some cases, we can process personal data without the data subject’s consent, if our interests outweigh those of the subject, and if the processing is necessary for the purpose in question. An example of such a case is security cameras at school, where the interest of order and security outweighs personal interests. 

Consent

In some cases, written consent is obtained from the data subject, e.g. when publishing photos on our website. The consent form must clearly state the purposes for which the consent applies. 

What personal data do we process?

What personal data we process depends on which activity/business is involved, and what the matter concerns. The following list shows examples of personal data that Bladins processes. Note that this is not a complete list of personal data. 

 

Personal data

Legal ground

Purpose

Name, personal number, address, email, phone number, gender, username, password, admission information, class, study groups, mother tongue, leave of absence requests, absence reports, study plans, study time, study codes (login information)

Information of general interest

Education administration

Feedback on pedagogical processes, documentation of extra adjustments, submitted assignments and exam results, mother tongue, attendance, pedagogical assessments/templates, national exam results, study plans, assessments, action plans, documentation from parent-teacher conferences, course grades, final grades

Information of general interest

Teaching and learning

Final grades, disciplinary measures, discrimination/degrading treatment, extra adjustments, incident reports, complaints, course grades, attendance, national exam results, study plans, action plans

Information of general interest

The school’s systematic quality work

Final grades and national exam results

Information of general interest

Statistics

Name, personal number, address, email, school capitation allowance, class, education, decision basis for lunch allowance, disbursement basis (municipality)

Information of general interest

Finance and invoicing

Documentation from guidance talks

Information of general interest

Study and careers advisor

Documentation of extra adjustments, action programs, self-care, student health care investigations, student care team notes, counsellor notes, medical journal notes, attendance, notifications of concern to social services, psychological journal notes, special dietary needs, special educational needs, study plans, deviation reports from caregiver

Information of general interest

Student Health assignment

Video and safety camera

Balancing of interest

Order and safety

Name, address, email, phone number, CV, assessment, references, cover letter

Consent

Staff recruitment

Name, personal number, address, email, contracts, form of employment, workplace, children’s personal numbers, position, union affiliation, absence, gender, salary, illness and rehabilitation

Completion of agreement

Staff and salary administration

From where do we collect personal data?

Information containing personal data is primarily collected from you and your guardian if you are under 18 years of age. In addition, some personal information is generated internally at the school in connection with your studies, such as attendance, educational assessments, action programs and study plans. We also collect personal information from your municipality of residence, such as your registered address, when you are admitted to our school. 

Who do we share your personal data with? 

Personal data can be shared with our suppliers of student systems and educational tools, so called personal data assistants. By agreement, we ensure that suppliers process personal data in accordance with our instructions and applicable legal requirements. In some cases, we also have an obligation to share your personal data with other authorities.  

Where do we store your personal data? 

As a rule, we do not usually transfer personal data to any country outside the EU / EEA. However, data may be transferred in cases where a supplier has sub-suppliers in countries outside the EU / EAA. If your personal data is transferred to any country outside the EU / EAA, we will take necessary steps to legally transfer said personal data. We will ensure that your personal data is handled securely and with an adequate level of protection, comparable to the level of protection offered within the EU / EAA. This can be done by entering into an agreement with the recipient that includes the EU Commission’s standard contractual clauses or, if the transfer is made to the US, by the recipient certifying him/herself to follow the principles of the Privacy Shield. 

How long is your personal data stored with us?

We may only store personal data for as long as it is needed for the purpose of the personal data processing. The personal data is thereafter deleted or de-identified. 

In some cases, it may be permissible to store personal data after the original purpose ceases to be relevant. This may only be done for archival purposes of general interest, scientific or historical research or statistical purposes. 

How do we protect your personal data?

Bladins School has taken appropriate technical and organisational security measures to protect your personal information from inappropriate or involuntary disclosure, use, unauthorized access, deletion, modification or damage to your personal information. This is done, among other things, through firewall protection, backups, encryption and access control. 

What are your rights in connection with your personal data?

Right to information

You have the right to receive information when your personal information is collected, but you can also request to obtain information at a later stage.  

Right to erasure

Under certain conditions, such as when you have withdrawn a prior consent or if there is no legal basis for further processing your personal data, you have the right to request erasure of your personal data. In these cases please contact the school. When we are legally required to store certain personal data, the right to erasure does not apply.  

Right to restricted treatment

Under certain conditions you have the right to limit the processing of your personal data to include only the storage of personal data, e.g. while the school is investigating whether you have the right to erasure.  

Right to data portability

If you have provided your or your child’s personal data, you are in some cases entitled to obtain use of it elsewhere. You should then receive a copy of your personal data in a commonly available machine-readable format. This requires that the treatment is done on the basis of your consent or on a drawn agreement between you and the school.  

Right to object

If you believe that your personal data is used incorrectly, you have the right at any time to object to the processing at hand. 

Complaints

If you believe that your personal data has been processed incorrectly, please contact the school. You also have the right to submit your complaints directly to the Swedish Data Protection Authority. 

Who do I contact if I have questions or concerns?

If you have concerns we ask you to please contact us at gdpr@bladins.se

Who is responsible for the processed personal data?

Responsible for personal data is:

Bladins skola, stiftelsen
Org.nr. 846001-0948