Privacy Policy

Who We Are

For the purposes of this policy, "we" refers to any organization that is part of the Turkish Maarif Foundation-Albanian Branch, including International Maarif Schools of Albania-Kindergarten, NYBE, NYHS, UNYT, and International Maarif Schools of Albania-Elbasan High-School.

This notice conforms to Albanian Data Protection Laws (the Data Protection Law).

Who to Contact

If you have a question, issue, or wish to change the way we currently use your data, please contact the UNYT GDPR team:

GDPR Team,
Address: University of New York Tirana, Rruga e Kavajës, pranë 21 Dhjetorit (Sheshi Ataturk) Tiranë, Shqipëri
Email: [email protected]
Phone: +355 4 4512345

What We Do with Your Data

This privacy notice provides information about how we will use (or “process”) personal data about individuals, including current, former, and prospective staff; current, past, and prospective pupils/students; their parents, careers, or guardians (referred to in this document as “parents”); suppliers of goods and services to the School; and any other members of our Community.

This information is provided in accordance with the rights of individuals under the Data Protection Law to understand how their data is used. You are encouraged to read this Privacy Notice thoroughly.

This Privacy Notice applies alongside any other information we may provide about a particular use of personal data, for example, when collecting data via an online or paper form.

This Privacy Notice applies in addition to our other relevant terms, conditions, and policies. These include but are not limited to:

Any contract between us and our staff or the parents of pupils/students;
Our policy on taking, storing, and using images/videos of children;
Our CCTV (where used);
Our retention of records policy;
Our safeguarding, or health and safety policies, including as to how concerns or incidents are recorded; and
Our IT policies.

Anyone who works for us, or acts on behalf of us (including staff, volunteers, directors, and service providers) should also be aware of and comply with this Privacy Notice and all relevant school policies.

Why We Need to Process Personal Data

In order to carry out our ordinary duties to members of our Community (including staff, pupils/students, former pupils/students, and parents), we may process a wide range of personal data about individuals (including current, past, and prospective staff, pupils/students, or parents) as part of our daily operation.

We will need to carry out some of this activity in order to fulfil our legal rights, duties, or obligations – including those under a contract with our staff or parents.

Other uses of personal data will be made in accordance with our legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals, and provided it does not involve special or sensitive types of data.

We expect that the following uses may fall within the category of the Schools (or its community’s) “legitimate interests”:

For the purposes of pupil/student selection (and to confirm the identity of prospective pupils/students and their parents);
To provide education services, including musical education, physical training or spiritual development, career services, and extra-curricular activities to pupils/students, and monitoring pupils`/students` progress and educational needs;
Maintaining relationships with alumni and the School community, including direct marketing or fundraising activity;
For the purposes of management planning and forecasting, research and statistical analysis, including that imposed or provided for by law (such as diversity or gender pay gap analysis and taxation records);
To enable relevant authorities to monitor the School’s performance and to intervene or assist with incidents as appropriate;
To give and receive information and references about past, current, and prospective pupils/students, including relating to outstanding fees or payment history, to/from any educational institution that the pupil/student attended or where it is proposed they attend; and to provide references to potential employers of past pupils/students;
To enable pupils/students to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils/students of the School;
To safeguard pupils`/students` welfare;
To monitor (as appropriate) use of the School’s IT and communications systems in accordance with the School’s IT acceptable use policy;
To make use of photographic images and videos of pupils/students, staff, and parents in school publications, on the School website, and (where appropriate) on the School’s social media channels in accordance with the School’s policy on taking, storing, and using images of individuals;
To enable payments to be made where appropriate to individual service providers.
For security purposes, including CCTV in accordance with the School’s CCTV policy; and
Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance for the School.

In addition, we may need to process special category personal data (concerning health, ethnicity, religion, biometrics, or sexual life) or criminal records information in accordance with rights or duties imposed on us by law, including as regards safeguarding and employment, or from time to time by explicit consent where required. These reasons may include:

To safeguard pupils`/students` welfare and provide, where necessary, medical care, and to take appropriate action in the event of an emergency, incident, or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so: for example, for medical advice, social services, insurance purposes, or to organizers of school trips;
To provide educational services in the context of any special educational needs of a pupil/student;
To provide spiritual education in the context of any religious beliefs;
In connection with the employment of its staff and volunteers;
To provide suitable food and drink at School or an event while being respectful of religious, cultural, and/or medical requirements, including allergies;
To run any of its systems that operate on biometric data, such as for security and other forms of pupil/student identification (lockers, lunch, etc.); or
For legal and regulatory purposes (for example child protection, diversity monitoring, and health and safety) and to comply with our legal obligations and duties of care.

Types of Personal Data We Process

This will include, by way of example:

Names, addresses, telephone numbers, e-mail addresses, and other contact details;
Car details (about those who use our car parking facilities);
Bank details and other financial information, e.g., about parents who pay fees to the School;
Past, present, and prospective pupils`/students` academic, disciplinary, admissions, assessment and attendance records (including information about any special needs), and examination scripts and marks;
Where appropriate, information about individuals’ health, and contact details for their next of kin;
Records of gifts made and any gift aid declarations;
References given or received by the School about pupils/students, and information provided by previous educational establishments and/or other professionals or organizations working with pupils/students; and
Images of pupils/students, staff, and parents (and occasionally other individuals) engaging in school activities, and images captured by the School’s CCTV system (in accordance with the School’s policy on taking, storing, and using images);
Credit Card Data

All personal financial and credit card information is treated as “highly sensitive data” and must be handled as specified under the standards. It is strictly prohibited to retain (or store electronically or manually) the following elements of personally identifiable information (PII):

Full credit/debit card number;
Card Validation Code (CVC, CVV2, CVC2);
Customer’s pin number (PIN); or
Expiration date or contents of the magnetic strip of a payment card.
Cardholder name in combination with any of the above information.

No credit card numbers or information is transmitted or stored by means of any non-approved software application, personal computer, mobile device, e-mail account, facsimile, multi-functional device, or paper document.

No credit card information is to be requested or obtained through a non-secure environment.

Where We Collect Information About You From

We collect information in the following ways:

When You Give It to Us Directly

You may give us your information as a prospective, current, or former pupil/student, or member of staff, or parent, or in order to receive information from the School, sign up for one of our events, make a donation, purchase our products, or communicate with us. Sometimes when you support us, your information is collected by an organization working for us (e.g., an online payment company), but we are responsible for your data at all times.

When You Give It to Us Indirectly

Your information may be shared with us by independent organizations. These independent third parties will only do so when you have indicated that you wish to share your details with the School and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

When You Give Permission to Other Organizations to Share or It Is Available Publicly

We may receive and record information from organizations or individual universities that we use to better understand our former pupils`/students` university choices and to inform careers and university advice given to current pupils/students.

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our fundraising methods, products, and services.

The information we get from other organizations may depend on your privacy settings on these sites or the responses you give, so you should regularly check them. This information comes from the following sources:

Third-Party Organizations

You may have provided permission for a company or other organization to share your data with third parties, including charities. This could be when you buy a product or service, register for an online competition, or sign up with a comparison site.

Social Media

Through usage of social media and messaging services like Facebook, WhatsApp, Instagram, or Twitter, you give us permission to access information from those accounts or services. By joining an official School app, page, or group on social media, you consent to allowing us to contact you through that platform. Your consent is granted also in case of usage of third-party apps to communicate with us.

Information Available Publicly

This may include information found in places such as the Commercial Register and information that has been published in articles/newspapers. This information is already in the public domain.

When We Collect It As You Use Our Websites

Like most websites, we use “cookies” to help us make our sites – and the way you use them – better. Cookies mean that a website will remember you. They are small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example, by automatically filling your name and address in text fields.

In addition, the type of device you are using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you are using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.

CCTV

Some parts of our campus are monitored by CCTV. These areas are clearly marked by suitable signage. We use any video and audio recorded to protect our pupils/students, staff, and visitors while they are on-site, to deter crime, and to help maintain good order within the School grounds. We retain this information for a period of up to three months. Access to CCTV footage is controlled. CCTV footage may be passed on to the Police or other relevant authorities.

Who Helps Us Process Your Data

Occasionally, we will need to share personal information relating to our community with third parties, such as:

Professional advisers (e.g., lawyers, insurers, PR advisers, and accountants);
Government authorities (e.g., tax authorities, police, or the local authority); and
Appropriate regulatory bodies (e.g., Schools Inspectorate, Ministry of Education).

For the most part, personal data collected by the School will remain within the School and will be processed by appropriate individuals only in accordance with access protocols (i.e., on a ‘need to know’ basis). Particularly strict rules of access apply in the context of medical records held and accessed only by the School medical team and appropriate medical staff under his/her supervision, or otherwise in accordance with express consent.

Finally, in accordance with Data Protection Law, some of the School’s processing activity is carried out on its behalf by third parties, such as IT systems providers, web developers, or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and only processed in accordance with our specific directions.

Keeping in Touch and Supporting the School

The School will use the contact details of parents, alumni, and other members of the School community to keep them updated about the activities of the School, or alumni and parent events of interest, including by sending updates and newsletters, by email and by post. Unless the relevant individual objects, the School will also:

Share personal data about parents and/or alumni, as appropriate, with organizations set up to help establish and maintain relationships with the School community.
Contact parents and/or alumni (including via the organizations above) by post and email in order to promote and raise funds for the School.
Collect information from publicly available sources about parents’ and former pupils`/students` occupations and activities, in order to maximize the School’s fundraising potential, improve the School’s careers program, and improve community reach.
Use the photographic and video shootings of the pupils/students and their work in school yearbooks, the school website, the school promotional film, the school publicity brochure, etc., and various social media accounts such as, without being limited to, Facebook, Twitter, Instagram, and YouTube pages.

Should you wish to limit or object to any such use, or would like further information about them, please contact the GDPR Team.

Direct Marketing

We will contact you to let you know about activities at the School, news about current and former pupils/students, and to ask for performing payments, donations, or other support.

Occasionally, we may include information from partner organizations or organizations who support us in these communications. We make it easy for you to tell us how you want us to communicate, in a way that suits you.

We do not sell personal details to third parties. We do share some information with our affiliates and group companies and entities. We have a statutory duty to share some information with government bodies when requested.

Photographs and Videos

We use photographs and videos of pupils/students, parents, staff, volunteers, and other guests at School events for marketing and other publicity purposes also via social media and apps. We will use the photographic and video shootings of the pupils/students and their work in school yearbooks, the school website, the school promotional film, the school publicity brochure, etc., and various social media accounts such as, without being limited to, Facebook, Twitter, Instagram, and YouTube pages.

Changes to This Notice

We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our Website or by contacting you directly. If you have any questions, comments, or suggestions, please let us know by contacting the GDPR Team.