Privacy and Personal Data Protection Policy.

01Who we are and the purpose of this Policy

Prime School International, hereinafter referred to as “Prime School”, “Prime” or the “School”, is an international educational institution operating in Portugal and welcoming students from different nationalities, cultures and academic backgrounds.

This Privacy and Personal Data Protection Policy explains, in a clear and transparent manner, how Prime School collects, uses, stores, protects and, where necessary, shares personal data as part of its educational, administrative, admissions, communication and institutional activities.

This Policy applies, in particular, to the personal data of:

• current students, former students and prospective students;
• parents, guardians, legal representatives and authorised family members;
• individuals interested in admissions processes;
• visitors to our websites, premises, events and Open Days;
• participants in school activities, extracurricular activities, Summer Camps, boarding programmes, visits, events and initiatives promoted by the School;
• suppliers, partners, service providers, educational agents and other entities with whom Prime School has a relationship.

Prime School recognises the particular sensitivity involved in processing the personal data of children and young people. For this reason, the School adopts enhanced protection, confidentiality and security measures, in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, and other applicable legislation in Portugal.

This Policy may be complemented by other internal or external Prime School documents, including the Cookie Policy, image use policies, admissions terms and conditions, contracts for the provision of educational services, security policies, school regulations, digital platform policies and data retention policies.

The use of cookies and similar technologies on Prime School websites is governed by our Cookie Policy, which should be read together with this Privacy Policy.

This Policy may be reviewed periodically whenever necessary to ensure legal compliance, alignment with best practice and consistency with the School’s activities.

02What personal data means

Personal data means any information relating to an identified or identifiable natural person.

A person is considered identifiable when they can be identified, directly or indirectly, by reference to elements such as their name, identification number, location data, electronic identifiers or other elements specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Personal data may include, among other examples:

• name;
• address;
• email address;
• telephone number;
• date of birth;
• nationality;
• civil identification number, tax number or passport number;
• academic data;
• financial or banking data;
• images, photographs and videos;
• health data;
• information concerning special educational needs;
• information relating to family circumstances;
• data relating to access to digital platforms;
• information concerning behaviour, attendance and school record.

03What personal data we may collect

As part of its activities, Prime School may process different categories of personal data, depending on the relationship with each data subject.

We may collect and process, in particular:

• student identification data, such as name, date of birth, gender, nationality, first language, country of birth, identification document number, passport or visa details, where applicable;
• contact details of parents, guardians, legal representatives, fee payers, authorised family members and emergency contacts;
• academic data, including previous schools, reports, assessments, examinations, certificates, school history, attendance, behaviour, curriculum plans and academic progress;
• data relating to the admissions process, including forms, interviews, communications, submitted documents, entrance assessments and information required to assess an application;
• financial and administrative data, including billing information, payments, tuition fees, discounts, scholarships, bank details, receipts and information required to comply with tax and accounting obligations;
• health data, including allergies, medication, relevant medical conditions, dietary requirements, emergency information, insurance, accidents or incidents occurring in the school context;
• data relating to special educational needs, learning support, educational adjustments, individual support plans and information necessary to provide appropriate academic, pastoral or wellbeing support;
• image and sound data, including photographs, videos, recordings of school events, images captured by CCTV systems, where applicable, or content produced within the scope of school activities;
• data relating to the use of digital platforms, IT systems, online educational tools, institutional emails, school applications, learning platforms and academic management systems;
• data relating to school transport, meals, extracurricular activities, study visits, trips, international programmes, boarding, Summer Camps and other activities promoted by the School;
• visitor data, including entry records, contact details, participation in events, requests for information and interactions with admissions or marketing teams;
• data concerning suppliers, partners and service providers, including professional contact details, contractual information, billing and data required to manage the commercial relationship.

Prime School applies the principles of data minimisation, necessity and proportionality, collecting only data that is adequate, relevant and necessary for legitimate processing purposes.

04How we collect personal data

Prime School may collect personal data directly from data subjects or through their legal representatives, namely parents, guardians or legal representatives.

Data may be collected through:

• contact forms on the website;
• requests for information;
• application and admissions processes;
• contracts for the provision of educational services;
• communications by email, telephone, digital platforms or in person;
• meetings, interviews, school visits and Open Days;
• documents provided by parents or guardians;
• information generated during school attendance;
• attendance, assessment, behaviour and pastoral or academic monitoring records;
• educational platforms, IT systems and applications used by the School;
• events, school activities, study visits, Summer Camps or extracurricular programmes;
• suppliers or service providers supporting the School’s activities;
• previous schools, official bodies, public authorities or legally authorised entities.

Whenever data is collected from third parties, Prime School will seek to ensure that such collection has an appropriate legal basis and is carried out transparently and proportionately.

05Why we process personal data

Prime School processes personal data in order to ensure the operation of the School, provide educational services, safeguard the safety and wellbeing of students, comply with legal obligations and communicate appropriately with the school community.

The main purposes of processing include:

• managing requests for information and initial contacts;
• managing application, admissions and enrolment processes;
• assessing the academic and pedagogical suitability of applicants;
• providing educational services;
• academic, pedagogical and pastoral monitoring of students;
• managing assessments, examinations, reports and school results;
• communicating with parents, guardians and legal representatives;
• administrative, financial and accounting management;
• billing, collection of tuition fees and payment management;
• organising extracurricular activities, study visits, events, trips, Summer Camps and international programmes;
• managing meals, transport, boarding, insurance and medical support services;
• protecting the health, safety and wellbeing of students;
• supporting students with special educational needs;
• managing incidents, accidents, disciplinary procedures or safeguarding concerns;
• complying with legal, tax, regulatory and administrative obligations;
• responding to judicial, administrative, educational or regulatory authorities;
• managing complaints, disputes, pre-litigation or litigation;
• managing digital platforms, IT systems and educational tools;
• ensuring the security of premises, including CCTV, where applicable;
• institutional communication, newsletters, events and relevant information for the school community;
• marketing, promotion of activities, admissions campaigns and institutional promotion, where there is an appropriate legal basis;
• managing former students and the alumni community, where applicable;
• improving services, statistical analysis, internal planning and quality assessment.

06Legal bases for processing

Prime School only processes personal data where there is an appropriate legal basis.

The main legal bases used are:

Where processing is necessary for the performance of a contract for the provision of educational services or for pre-contractual steps, such as requests for information, applications, admissions, enrolments, school visits or preparation of proposals.

Where processing is necessary to comply with legal obligations to which Prime School is subject, including tax, accounting, educational, employment, administrative, security, public health, child protection or cooperation obligations with competent authorities.

Where processing is necessary for the purposes of the legitimate interests pursued by Prime School or by third parties, provided that such interests are not overridden by the rights, freedoms and guarantees of the data subjects, particularly where children are concerned.

Legitimate interests may include, for example:

• efficient management of the School;
• security of the premises;
• communication with parents and guardians;
• improvement of educational services;
• fraud prevention;
• management of disputes;
• appropriate institutional promotion;
• maintaining relationships with former students, where applicable;
• organisation of school events;
• internal use of images for administrative, educational or school community communication purposes.

In certain situations, Prime School may request specific, freely given, informed and explicit consent, namely for certain uses of images, marketing communications, newsletters, promotional campaigns or other purposes that legally require consent.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where consent is required for the processing of a minor’s personal data, Prime School will seek consent from the holder of parental responsibility or legal guardian, unless the student is legally entitled to provide such consent.

Where processing is necessary to protect the vital interests of the student or another person, particularly in medical emergencies, accidents, safety risks or situations requiring urgent intervention.

Where processing is necessary for the establishment, exercise or defence of Prime School’s rights, the rights of students or the rights of third parties in judicial, administrative or extrajudicial proceedings.

07Processing of children’s and young people’s data

Prime School recognises that the personal data of children and young people deserves special protection.

Such data is processed with particular care, taking into account the student’s age, maturity, educational context, rights and the parental responsibilities of parents, guardians or legal representatives.

The School will only process children’s and young people’s personal data where there is an appropriate legal basis and where the processing is necessary, proportionate and consistent with the student’s best interests, the provision of education, safeguarding, wellbeing or the fulfilment of legal or contractual obligations.

08Processing of special categories of data

In certain situations, Prime School may process special categories of personal data, including health data, information concerning special educational needs, ethnic origin, religion, dietary restrictions or other sensitive data.

Such processing will only take place where there is an appropriate legal basis and where it is necessary for legitimate purposes, such as:

• protecting students’ health and safety;
• providing medical care or responding to emergencies;
• educational adjustments and support for special educational needs;
• safeguarding and child protection;
• management of allergies, medication or dietary restrictions;
• organisation of study visits, trips, sports activities or international programmes;
• compliance with legal obligations;
• defence of legal claims;
• explicit consent, where applicable.

If the School implements any system involving biometric data, this will only be done where strictly necessary, legally permitted and subject to appropriate safeguards, prior information and any required consent or authorisation.

Prime School applies enhanced confidentiality, security and access restriction measures to this type of data.

09Use of images, photographs and videos

Prime School may capture and use images, photographs or videos of students in the context of the School’s activities, including events, lessons, extracurricular activities, study visits, presentations, ceremonies, competitions, Summer Camps, internal materials or institutional communications.

Images may be used for different purposes:

• internal identification and security;
• recording school activities;
• communication with parents and guardians;
• educational or administrative materials;
• internal newsletters;
• yearbooks, presentations or school community publications;
• institutional and promotional communication, where there is an appropriate legal basis.

Any external use of students’ images for promotional, advertising or marketing purposes will be carried out in accordance with applicable law and, where required, subject to specific consent.

Parents, guardians or data subjects may request clarification or exercise their rights in relation to the use of images under the terms of this Policy.

10Marketing, communications and digital campaigns

Prime School may process personal data for institutional communication, promotion of events, admissions campaigns, Open Days, newsletters, school activities, Summer Camps or other initiatives related to the School.

Where communication is commercial or promotional in nature and depends on consent, such consent will be requested in advance.

Prime School may use contact details, such as email or telephone number, to communicate with interested families, applicants, parents or former students, always on an appropriate legal basis.

Prime School may use digital advertising platforms to promote its educational services. Where personal data is used for this purpose, such as encrypted email lists, website interaction data or audience segmentation tools, this will be done only where there is an appropriate legal basis and with suitable safeguards.

The data subject may, at any time, object to receiving marketing communications or withdraw consent previously given.

11Digital platforms, technology and educational tools

Prime School uses digital platforms and technological tools to support its educational, administrative and communication activities.

These tools may include, among others:

• school management platforms;
• online learning systems;
• institutional emails;
• parent communication applications;
• assessment platforms;
• secure storage systems;
• productivity tools;
• educational software;
• video conferencing systems, where applicable;
• digital tools supporting teaching and learning.

The use of these platforms is carried out in accordance with principles of security, necessity, proportionality and access control.

Whenever Prime School uses technology providers or processors, it will seek to ensure that they provide appropriate data protection safeguards and only process personal data in accordance with the School’s instructions and applicable law.

12CCTV and security

Where CCTV systems are used, they are intended to support the security of people and property, access control, incident prevention and the protection of the School community.

CCTV will only be used in areas where it is lawful, necessary and proportionate. It will not be used in areas where there is a heightened expectation of privacy, except where legally permitted and strictly necessary.

CCTV footage, where applicable, will be retained for the period legally permitted or necessary for the purpose for which it was collected. Access to CCTV footage will be restricted to authorised persons and may be shared with competent authorities where legally required or necessary.

13With whom we may share personal data

Prime School may share personal data with third parties only where this is necessary, appropriate and legally permitted.

Data may be shared, in particular, with:

• parents, guardians or legal representatives, where applicable;
• School staff who need access to the data as part of their duties;
• teachers, pedagogical teams, admissions teams, administrative teams and student support teams;
• health professionals, psychologists, therapists, specialist technicians or educational consultants;
• providers of transport, meals, extracurricular activities, trips, insurance or Summer Camps;
• providers of digital platforms, IT systems, cloud storage, communication and academic management services;
• educational, tax, judicial, police, administrative or regulatory authorities;
• official bodies, certification entities, examination centres or educational institutions;
• previous or future schools, where necessary for transition, references or educational continuity;
• professional advisers, including lawyers, auditors, accountants, insurers or security consultants;
• partner entities involved in educational programmes, placements, certifications, examinations or school activities;
• courts, enforcement agents or debt collection entities, in the event of contractual breach or dispute.

Prime School does not sell personal data to third parties.

14International data transfers

In some situations, Prime School may need to transfer personal data to countries outside the European Economic Area, namely when using international technology platforms, educational tools, cloud services, partner institutions, international examination bodies or global educational programmes.

Whenever this occurs, Prime School will seek to ensure that the transfer is carried out with appropriate safeguards, in accordance with applicable legislation, including through adequacy decisions, standard contractual clauses, appropriate technical and organisational measures or another legally recognised mechanism.

15Security of personal data

Prime School adopts appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure, unauthorised access or unlawful processing.

These measures may include, among others:

• access controls;
• restriction of permissions on a need-to-know basis;
• use of passwords and authentication;
• secure storage;
• back-ups;
• protection of IT systems;
• contractual confidentiality obligations;
• internal training and awareness;
• incident response procedures;
• supplier assessment;
• data minimisation;
• pseudonymisation or anonymisation, where appropriate.

Despite the measures adopted, no system is completely immune to risk. In the event of a personal data breach that may pose a risk to the rights and freedoms of data subjects, Prime School will act in accordance with applicable legislation, including, where necessary, notification to the Portuguese Data Protection Authority and to the affected data subjects.

16How long we keep personal data

Prime School keeps personal data only for as long as necessary to fulfil the purposes for which it was collected, unless there is a legal obligation, legitimate interest or need to retain it for a longer period.

Retention periods may vary depending on the nature of the data and the purpose of processing.

By way of example:

• applicant data may be kept for the period necessary to manage the admissions process and, where appropriate, for future places, related contacts, queries or the defence of legal claims;
• data relating to unsuccessful applications may be retained for a limited period in order to respond to queries, manage future applications or defend legal claims;
• student data may be kept during school attendance and subsequently for the period necessary to comply with legal, academic, administrative or archival obligations;
• financial and billing data will be kept for the periods required by law;
• health and special educational needs data will be kept only for the period necessary for the purpose that justified its collection, without prejudice to legal obligations or the defence of legal claims;
• marketing data will be kept until consent is withdrawn, objection to processing is made or the applicable purpose ceases;
• CCTV data, where applicable, will be kept for the period legally permitted or necessary for the purpose for which it was collected.

When data is no longer required, it will be securely deleted, anonymised or archived, as appropriate.

17Former students and alumni

Where applicable, Prime School may maintain contact with former students and families for alumni, institutional or community-related purposes.

This may include communications about school news, alumni activities, events, reunions, institutional updates or opportunities to remain connected with the School community.

Former students and families may object to this type of communication or withdraw consent, where applicable, at any time.

18Data subjects’ rights

Under applicable legislation, data subjects have several rights in relation to the processing of their personal data.

These rights include:

The data subject has the right to know whether their personal data is being processed and to access such data, as well as information on the purposes of processing, categories of data, recipients, retention periods and other legally required details.

The data subject may request the correction of inaccurate, outdated or incomplete data.

The data subject may request the erasure of their personal data where the applicable legal requirements are met, namely where the data is no longer necessary for the purpose for which it was collected or where consent has been withdrawn and there is no other legal basis for processing.

The data subject may request the restriction of the processing of their personal data in certain circumstances, namely where they contest the accuracy of the data or where processing is unlawful and they object to erasure.

Where legally applicable, the data subject may request to receive their personal data in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.

The data subject may object to the processing of their personal data where processing is based on Prime School’s legitimate interests or where direct marketing is concerned.

Where processing is based on consent, the data subject may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

The data subject has the right to lodge a complaint with the Portuguese Data Protection Authority if they consider that the processing of their personal data breaches applicable legislation.

The rights listed above are not absolute and may be subject to legal limitations, namely where there are legal retention obligations, relevant public interests, the protection of third parties or the need to defend legal claims.

19Exercising your rights

To exercise your rights or request clarification regarding the processing of your personal data, you may contact Prime School through the following channels:

• Email: [insert Prime School privacy contact email]
• Address: [insert official address of the responsible entity]
• Telephone: [insert Prime School general contact number]

Prime School may request additional information to confirm the identity of the requester before responding to the request.

Requests will be reviewed and answered within the legally applicable timeframes.

20Data controller

The data controller is the legal entity responsible for Prime School International that determines the purposes and means of processing personal data in the context of providing educational services and related activities.

• Data controller: [insert full legal company name]
• Tax identification number: [insert tax number]
• Address: [insert official address]
• Email: [insert contact email]
• Telephone: [insert telephone number]

21Data Protection Officer or privacy contact

Where Prime School has appointed a Data Protection Officer or privacy contact, their details will be made available through the School’s official channels.

For data protection matters, please contact:

• Email: [insert DPO or privacy contact email]
• Address: [insert address, if applicable]

22Changes to this Policy

Prime School may update this Privacy and Personal Data Protection Policy whenever necessary, namely to reflect legal, regulatory, organisational, technological or operational changes.

The most recent version will be made available through the School’s official channels.

23Contacts

For any question relating to this Policy or the processing of your personal data, you may contact:

• Prime School International
• Email: [insert privacy contact email]
• Telephone: [insert telephone number]
• Address: [insert official address]

You may also contact the Portuguese Data Protection Authority, the competent supervisory authority in Portugal.