Thank you for visiting the website of Munich International School e.V. (MIS). We take the protection of your personal data very seriously and strictly observe the appropriate laws and regulations. We would like to take this opportunity to inform you about the steps taken by MIS to ensure the protection of your data as well as how your data may be processed and the purpose of doing so. The legal frameworks are set by the European Union (“EU”) General Data Protection Regulation (“GDPR”) and the revised German Federal Data Protection Act (BDSG-new).

This notice explains how MIS collects, processes and stores personal information of parents, students, staff, service providers / supplier, applicants and interns, who this information might be shared with and the ways in which the School protects and accounts for the protections to privacy. The notice also explains the rights that parents, students, staff, donors, service providers / supplier, volunteers, applicants and interns have over their personal data processed by MIS.

The term ‘personal data’ refers to any information that identifies you or can be used to identify a data subject when used in conjunction with other information.

The term ‘data subject’ describes the person about whom the personal data is about.

This notice applies to all Personal Data collected for or on behalf of the School whether in analogue form (documents and forms in writing) or in digital form (such as information systems, databases and emails).

We may process your personal data for the above purposes based on one or more of the following legal bases:

• We have an individual’s consent to do so (or their parent’s, if appropriate). You can withdraw your consent at any time by emailing dpo@mis-munich.de.
• it is necessary for the performance of a contract (e.g. our education agreement or an employment contract with a member of staff);
• It is necessary for our compliance with our legal obligations. In this respect, we may use personal data to exercise or perform any right or obligation conferred or imposed by law in connection with employment and/or for the prevention and detection of crime, and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
• It is necessary for our or a third party’s legitimate interests. These “legitimate interests” include our interests in providing high-quality education, fostering relationships with those in the school community, and our interests in managing and operating the school to the best of our abilities.
• it is necessary to protect an individual’s vital interests (in certain limited circumstances, for example, where a student has a life-threatening accident or illness while at school and we have to process that student’s personal data in order to ensure the student receives prompt and appropriate medical attention);
• it is necessary for the establishment, exercise or defence of legal claims;
• it is necessary for reasons of substantial public interest, including safeguarding purposes;
• it is necessary for medical purposes, including medical diagnosis and the provision of health care or treatment for students, managing related health care systems, and/or for assessing the working capacity of staff;
• it is necessary for archiving, research or statistical purposes;

MIS collects personal data, including special categories of personal data of students and parents to provide a safe and caring international environment for teacher, learning and general educational purposes.

Whenever we use (or “process”) any personal data (sensitive/special category or otherwise), we do so in accordance with applicable laws and regulations (including with respect to safeguarding or employment). Personal data held by us is processed by appropriate members of staff for the purposes for which the data was provided.

More specifically we process your or your children’s personal data for the following purposes, and other purposes that are compatible with the purposes described below:

- to undertake and manage the School’s admissions processes

- to provide a safe and secure learning for staff, students and visitors to the school

- to comply with child protection requirements including camera surveillance

- to provide our educational services and enrichment to our students, including the administration of our curriculum; reporting on the same internally and to parents; administration of students’ entries to public examinations, and providing references for students (including after a student has left)

- to support and enable the academic, pastoral and personal objectives of children, including the monitoring and reporting of progress and educational needs

- to provide educational support and related services to students, including extra-curricular activities and school trips

- to provide safe transportation services

- to provide support and care for emotional and psychological wellbeing (pastoral and counselling)

- to protect the health of the students and staff we serve

- to provide a tailored learning environment and make evidence-based education decisions for the children we serve

- to enable the children, we serve to continue or progress their education at other educational organisations

- for staff administration, including the recruitment of staff/engagement of contractors; to support staff with relocation; to support and develop our employees in the performance of their duties; administration of payroll, pensions and sick leave; review and appraisal of staff performance; conduct of any grievance, capability or disciplinary procedures; and the maintenance of appropriate human resources records for current and former staff; and providing references

-

- for financial planning to help in the future planning and resource investment purposes

- operational management, including the compilation of student records; the administration of invoices, fees and accounts; the management of school property; the management of security and safety arrangements ; the administration and implementation of our school’s rules and policies for students and staff; and the maintenance of historic archives

- to procure and manage goods and services, administer supplier and contractor relationships, manage contracts, conduct due diligence, and process invoices and payments

- to meet our statutory reporting requirements to the education and other authorities

- to help investigate any concerns or complaints you may have

- to facilitate parental participation in school through the Parent Teacher Verein;

- to build and maintain the MIS community, including through fundraising

- to make you aware and inform you about our services, news, events and activities that are undertaken at or in association with MIS

- to communicate with you within the framework of your relationship with MIS

- to organise and manage events and open days, including invitations, communications, registrations, attendance management, and related relationship management activities

- the promotion of our school through our website[s], our prospectus and other publications and communications (including through our social media accounts)

- to analyse website traffic, demographics and behaviour through the use of analytical tools and cookies

- for forecasting and planning for education service provision

- to keep a record of historical and memorable events relevant to the maintenance of a historical record and to respond to requests of our staff and (former) students regarding historic information pertaining to their time at MIS.

- compliance with legal and regulatory requirements

Personal data relating to you or your children can be obtained directly from you or your children, for example via completing the Application and Health and Consent forms, via the website, via meetings with teachers and staff, etc.

Personal data relating to you or your children can also be obtained via third parties, (for example, previous schools or health professionals) or from publicly available resources.

We also collect data about you when:

• you have expressed an interest in having a student attend our school.
• you have registered to attend (or have attended) one of our events;
• you visit our campus;
• you sign up to receive email from our newsletter and/or prospectus;
• you visit our website;
• you have expressed an interest in working for, or with, us; or
• you are employed by us or an organisation with whom we have a business relationship.

The categories of personal data that MIS collects and processes include:

- Names, addresses, telephone numbers, e-mail addresses, emergency contact information and unique reference numbers;

- Parent’s employment data

- Financial information and identification documents- Educational and evaluation data (such as assessments, relevant medical information, special educational needs information, exclusions / behavioural information and psychological reports and assessments)

- Employee and former employee data, including recruitment, training, performance management, payroll, and other HR information.

- Criminal records and background information

- Students' date of birth, nationality, and family details;

_ admissions, academic, disciplinary and other education-related records, references, examination scripts and marks;

- Attendance information (such as sessions attended, number of absences and absence reasons)

- Logging and audit in the use of IT systems and education technology apps, applications and cloud based systems

- Communication and correspondence data (such as emails, letters and other types of correspondence)

- Photographs, audio recordings and videos

- IP addresses, location data, and website statistics and analytics

- website cookies (please refer to MIS official cookie policy)

The education services we provide require us to collect and process special categories of data,, for the purposes of safeguarding the protection of your children and the wellbeing of those within our care.

This may include information about a data subject concerning:

• health;
• special education needs;
• biometric data (e.g. fingerprints)
• information relating to safeguarding and child protection/welfare
• race ethnicity; or
• religion.

We do not disclose or share special categories of data without explicit and unambiguous consent unless we have to do so where we are required to by law, or where we have another lawful reason.

Why we need your information

On a regular basis, we take photographs and/or videos of our students’ learning. These may be shared with others in our school community. Identifiable photographs of your child may be used for:

• educational and informational purposes (such as keeping records of lessons, field trips, sports, events, staff training), as we have a legitimate interest to do so;
• the identification of your child for health related purposes
• internal presentations and physical school displays
• school communications channels such as ClassList
• communications with the wider MIS school community including newsletters and blog posts
• community and alumni engagement, including commemorative or celebratory projects and events
• school records such as the MIS Yearbook
• marketing and publication purposes, if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

Where students, staff, service providers or suppliers, volunteers, or interns appear in photographs or videos published in school publications or communications intended solely for the school community (such as the MIS Yearbook or weekly blog posts) they may also be identified by name.

Where photographs or videos are published in materials intended for the general public (such as the MIS public website, school publications, press releases, or media articles) students, staff, service providers or suppliers, volunteers, and interns will not be identified by name unless their prior agreement has been obtained.

If such photographs and videos reveal any sensitive personal data of you or your child, we will only process and use such photographs and videos if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

Our lawful basis for processing this information is legitimate interests. Our legitimate interest in using these photographs and/or videos is to celebrate student achievements and communicate with the school community. For external publication intended for the general public (for example, using photographs and videos on the school website or social media channels) we seek your consent.

From time to time, our school may be visited by members of the media who will take photographs or, very rarely, make video recordings. For this use we will also seek your consent.

You are able to withdraw your consent at any time by requesting another copy of this consent form to change your preferences by emailing: mis-communications@mis-munich.de

In general, your personal data are stored on our own servers and on the servers of our external providers, located in the European Union. Regarding transfers outside the European Union, see ‘Transfers to Third Countries’.

We take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices and access to school systems.

Your personal data is shared internally within MIS for the purposes of delivering the services required.

For the purposes described above, MIS may need to share your personal data externally with certain recipients, as well as with third parties processing your data on behalf of MIS. More specifically, this includes the following categories of recipients:

- PTV, Sportverein, Il Cielo, schools, colleges or universities that the students attend after leaving MIS; Other international schools (amongst others for the purposes of trips, sports and activities);

- Local education authorities in Bavaria;

- Family nurses, doctors or social service organisations (amongst others where sharing is in the vital interests, or where not sharing could have a negative impact on the individual);

- Providers of information systems that are necessary for MIS to deliver the admissions, administration, teaching and learning, pastoral development, transportation and child protection services;

- Providers of IT hosting and maintenance services;

- Government organisations, police, health and social care (where we are required to do so by law, or where we have obtained your consent to do so).

Personal data may also be transferred to organisations outside Germany and outside the European Union. This may for example occur for the purposes of student application for college or university. Various teaching and learning applications of providers that are based outside the European Union are also used. For such transfers of personal data outside the European Union, MIS has implemented suitable safeguards in the form of standard contractual clauses where required under applicable data protection legislation. More information on these transfers and suitable safeguards can be requested from the data protection officer.

Photographs and videos of your children may be taken by staff and students throughout the school year to record and share everyday life at MIS. Your child may be identifiable in these photographs or videos. Identifiable photographs of your child may be used for:

educational and informational purposes (such as keeping records of lessons, field trips, sports, events, staff training), as we have a legitimate interest to do so;

the identification of your child for health related purposes, such as allergies, as it is in the vital interest of your child to do so; and

marketing and publication purposes, if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

If such photographs and videos reveal any sensitive personal data of you or your child, we will only process and use such photographs and videos if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

MIS will retain Personal Data for as long as required by law or best educational practice. MIS retains Personal Data after parents, students, staff, service providers / suppliers, volunteers and interns have left MIS in order to provide traceability, alumni management, and donor engagement. It is widely accepted that a School should hold data on the achievements and experiences of a child for their benefit in later life should they need to access that information.

Subject to appropriate safeguards, MIS may keep some information during a longer period if needed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Such information will be anonymised where reasonable.

Please note that images published on websites and public social media platforms may be indexed by search engines and may also be copied, cached, or scraped by third parties. Once this occurs, images are no longer within the control of the school, and it may not be possible to remove them entirely from circulation, even if the school deletes the original content.

Retention Schedule for Digital Media

Digital media will be processed as outlined below:

Publications destined for the MIS community, School Yearbook: students, parents, staff, service providers / suppliers, volunteers and interns may be identified by name in images found in publications such as the MIS Yearbook, weekly blog posts.

Publications destined for the general public, including the MIS public website, School publications, press releases and articles: individuals will not be identified by name in photos or video clips without prior agreement.

If such photographs and videos reveal any sensitive personal data of you or your child, we will only process and use such photographs and videos if and to the extent we have obtained you and/or your child’s consent where required under applicable data protection legislation to do so.

We collect information in the form of camera footage via our CCTV-systems to ensure the safety and security of students and staff. We retain these CCTV images for 5 days after which they are deleted, unless we need to retain the images for further investigation or law enforcement purposes. Access to these images can be requested through the Data Protection Officer (see below).

The School’s IT systems may profile the use, access and content of all users. The profiling enables identification of safeguarding and child protection risks or concerns, on the basis of your explicit consent. Some education apps profile the behaviour, use and outcomes of children. The School has an internal process to assess the impact of this on students. In evaluating the use of these apps the School will consider the benefit gained from using it for the student to learn, develop and explore, against the negatives identified from profiling. Decisions will always be made by MIS employees and not be automated as a result from profiling.

We use cookies on our website. For more information on how we use cookies, please refer to MIS official cookie policy.  

MIS uses Hubspot Dashboard, a web analytics service provided by Hubspot. Analytics and customization cookies are used to deliver user data to Hubspot Dashboards. These cookies collect information that is used either in aggregate form to help us understand how our Website is being used or how effective our marketing campaigns are, or to help us customise our Websites for you.

Data subjects may exercise a number of rights with regard to the processing of their personal data vis-à-vis MIS, in so far as they effectively have those rights under applicable data protection legislation, such as the European General Data Protection Regulation 2016/679 of 27 April 2016 and the New German Federal Data Protection Act (new BDSG), as may be amended from time to time.

The first point of contact in connection with the processing of personal data and the exercise of the rights described below is the MIS Data Protection Officer (dpo@mis-munich.de). MIS shall respond to such requests and may or may not act upon them, in principle within a period of one month, all in accordance with applicable data protection legislation.

In addition, you also have the right to contact or file a complaint with the Bavarian Data Protection Authority: Bayerisches Landesamt für Datenschutzaufsicht: http://www.lda.bayern.de.

The rights which you may have under applicable data protection legislation are:

Right to object – the right to object on grounds relating to your particular situation to the processing of personal data based on the legitimate interests of MIS, and the right to object to the processing for direct marketing purposes.

Right to information and access – to request access to and a copy of the personal data MIS holds on you, as well as the right to information about relevant aspects of the data processing by MIS. This Notice serves to inform you thereon, but do get in touch if you have any questions.

Right to rectification – to correct inaccurate personal data or to complete incomplete personal data.

Right to erasure – to request the deletion or removal of personal data in specific circumstances, for example if your personal data are no longer necessary for the purposes pursued by MIS or if there no longer is a legal ground for the data processing.

Right to restriction of the processing – to limit the processing, e.g. where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate.

Right to data portability – to receive your personal data in a structured, commonly used format and to transmit it or have it transmitted to another international school.

Right not to be subject to automated individual decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Where the processing of your personal data is based upon consent, you and/or your child have the right to withdraw consent at any time. Such withdrawal of consent shall not affect the lawfulness of the processing based on consent before the withdrawal.

There may be instances where you may not want us to process or share your personal information. In these cases, we may not be able to fulfil the service you need, or do so in a limited way, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if this is the case.

Please note that these rights are not absolute, and we may be entitled or required to refuse requests where exceptions or exemptions apply. 

MIS has developed its internal organisation in such a way that it complies with the specific requirements regarding data protection. For the time that MIS stores and uses Personal Data, the School will ensure the appropriate security of this Personal Data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Our website contains links to third-party websites over which we have no control. Consequently, we cannot accept any liability for the content of these external websites. Sole liability for the content of linked websites rests with the relevant provider or operator.

We are available for you at any time to answer your questions regarding the measures we have implemented to ensure your data protection and the processing of your personal data. If you wish to receive further information in addition to this Data Protection Notice or if you wish to receive detailed information about a specific topic please contact the Data Protection Officer at MIS.

For any questions or concerns relating to this Notice or the processing of your personal data by or on behalf of MIS, as well as for the exercise of any of the rights described above, please contact the MIS Data Protection Officer (dpo@mis-munich.de).