PRIVACY NOTICE

DATA CONTROLLER:

Colegio San Mateo / St. Matthew, Calle 215 #50-24, Bogotá, Colombia

Colegio San Mateo / St. Matthew (also known as "the School") is part of Inspired Education Holdings Limited, which is a company registered in England with number 09268120 and registered office at Sixth Floor, 3 Burlington Gardens, London, W1S 3EP, United Kingdom. Inspired operates numerous affiliated schools worldwide through its regional offices in Europe, Africa, the Middle East, Asia-Pacific and Latin America.

1. INTRODUCTION

This policy is drafted in accordance with Statutory Law 1581 of 2012 (and other regulations that modify, add to, complement or develop it), Decree 1377 of 2013 and Regulatory Decree 1074 of 2015 and is created with the objective of providing information to interested parties about how the School treats personal data.

2. TYPES OF PERSONAL DATA PROCESSED

We process personal data of our current and former students and their families and/or legal representatives and of our employees, candidates, suppliers, contractors, potential customers and third parties interested in finding out more about our School.

The personal data processed are mainly the following:

• Names, addresses, telephone numbers, email addresses and other contact details;

• Nationality, location and language;

• Family situation;

• Protection of information (such as court orders)

• Education and employment data;

• Images, audio and video recordings, including CCTV footage (video images);

• Financial information;

• Previously attended educational establishments.

Other types of data that we may collect and process, in accordance with the purposes of the School, are related to the health condition, criminal record and other confidential information relating to an individual, such as:

• Information about the health status or provision of medical care relating to a specific individual;

• Behavioural information;

• Special educational needs

• Criminal record linked to a specific individual;

• Biometric information;

• Ethnicity;

• Religion or ideology;

• Sexual identity.

3. HOW WE COLLECT AND PROCESS DATA

The School collects information in a number of ways, including:

• In person and over the telephone;

• Through our website and the cookies used on it;

• From email and hand-delivered paper documentation, including job applications, consent forms, application form, etc.;

• Through online tools, such as apps, educational platforms and other software used by the School;

• Through any CCTV cameras located on our premises;

• Through third parties, such as professionals or authorities acting on behalf of the data subjects;

4. PURPOSES AND LEGITIMACY TO PROCESS DATA

4.1. Purposes: The School processes personal data for the lawful and legitimate development of the educational activity of the School. The School collects and retains information from students and parents when necessary to:

• Respond to queries;

• Ensure that the student meets the School's admission criteria;

• Provide academic services, including support for student learning, monitoring and reporting on student progress;

• Provide students with safeguarding services;

• Provide students with medical and nursing care, uniforms, lunch service and bus transportation, among other necessary services;

• Meet the student's educational, social, physical and emotional requirements;

• Contact parents/legal guardians when necessary and keep them informed about their child's educational progress or school events, etc.

• In order to celebrate the achievements of the School and to keep a record of the history of the School, the School may take photographs and recorded images of students to share in yearbooks, the School website, etc., always with the informed consent of parents or students of legal age. You may withdraw your consent at any time;

• Send commercial communications in the event of prior authorization from the interested party. You may unsubscribe from receiving commercial communications by clicking on the “unsubscribe” section.

The personal data subject to processing may only be communicated to other Schools in the Inspired group with the prior written consent of the interested party or when necessary and the personal data will be processed for the same legitimate purposes mentioned here.

4.2. Legitimacy: We process your data under your consent and contractual obligation, in addition to complying with the legal obligations that may arise from said contract and our commercial activities. We may also be acting to protect the interests of children. In the case of marketing purposes, we act in accordance with your consent and our legitimate interests.

5. PROCESSING DATA OF CHILDREN AND TEENAGERS

The School will process the personal data of children and adolescents in accordance with the provisions of Article 7 of Law 1581 of 2012 and when such processing responds to and respects the best interests of children and adolescents and ensures respect for their fundamental rights.

The rights of children and adolescents will be guaranteed in accordance with the constitutional and legal provisions and guaranteeing full respect for their fundamental rights.

When provided for by Law 1581 of 2012, the School will request authorization from the parents or legal representative of the child or adolescent for the processing of data prior to the minor exercising his or her right to be heard, an opinion that will be assessed taking into account the maturity, autonomy and capacity to understand the matter.

6. PROCESSING DATA OF CANDIDATES

If you wish to send us your CV through the “Careers” section, you must create an account to use the employment platform and send us your application. Your information will be shared with Inspired Education Group as the owner of the Global Careers Site platform under the terms set out at: https://careers.inspirededu.com/data-privacy-statement and incorporated into the data base owned by COLEGIO SAN MATEO / ST. MATTHEW . Our Human Resources department will process your data for the purpose of including your application in our selection processes.

7. SHARING DATA WITH THIRD PARTIES

When a student has been accepted and is enrolling in another educational institution, the School transfers information about the student to that new center. This may include copies of the student's school records and medical information.

This allows the new center to continue providing services for the student's education, to support the student's social and emotional health and well-being, and to comply with legal requirements, among other obligations.

Furthermore, since the School is part of the international network of INSPIRED Schools, it is possible that the student studies at any of the Schools in the group, so the communication of data between the centers will be necessary, including the international transfer of data where appropriate, in accordance with the authorizations that have been granted by the Holders of the personal data.

Your personal data will not be rented or sold to third parties.

8. INTERNATIONAL DATA TRANSFER

In the event that, for legitimate reasons such as student exchange programs, or in the execution of the educational contract that may be developed in other countries, personal data may be transferred to countries outside of Colombia, including countries that may offer a lower level of data protection. In such cases, we will implement the necessary measures to ensure the adequate protection of your personal data in accordance with the applicable data protection regulations. Likewise, in the event of such transfers, parents/legal guardians and the student will be clearly and correctly informed.

9. DATA STORAGE

Personal information will only be retained for the period of time necessary to fulfil the purpose for which it was collected, unless for a longer period for archiving in the public interest, scientific or historical research or statistical purposes. Once personal information is no longer required or permitted to be retained for legal or business purposes, it will be destroyed or anonymized.

10. YOUR RIGHTS

In accordance with Article 8 of Law 1581 of 2012, you have the right to exercise the following rights:

- To know, update and rectify your personal data regarding the Data Controllers or Data Processors. This right may be exercised, among others, with regard to partial, inaccurate, incomplete, fractional data, which lead to error, or data whose processing is expressly prohibited or has not been authorized;

- To request proof of the authorization granted to the Data Controller, except when it is expressly excepted as a requirement for processing, in accordance with the provisions of Article 10 of this law;

- To be informed by the Data Controller or Data Processor, upon request, regarding the use that has been given to your personal data;

- To submit complaints to the Superintendence of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to or complement it;

- Revoke the authorization and/or request the deletion of the data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Data Controller has incurred in conduct contrary to this law and the Constitution;

- Access free of charge to their personal data that have been subject to Processing.

Likewise, article 12 of the Law recognizes the duty of the Data Controller to inform the Data Subject about:

- The Processing to which their personal data will be subjected and the purpose of the same;

- The optional nature of the response to the questions asked, when these are about sensitive data or about the data of girls, boys and adolescents;

- The rights that assist them as data subject;

- The identification, physical or electronic address and telephone number of the Data Controller

Without prejudice to the exceptions provided for in the law, the Data Processing requires the prior and informed authorization of the data subject, which must be obtained by any means that can be subject to subsequent consultation. Anyone who accesses personal data without prior authorization must in all cases comply with the provisions contained in this law.

You can exercise your  rights in accordance with the School's policy and the form that the School makes available by sending a written request and a copy of your passport or identification document so that we can identify you to the email: habeasdata@csma.edu.co,  or to the School's address located at Calle 215 # 50-24.

11. REVOCATION OF AUTHORIZATION AND/OR DELETION OF DATA.

The School has provided a free and agile mechanism through which the data subject may at any time, and provided there is no legal or contractual obligation that prevents this, request the School to delete personal data and/or revoke the authorization that it has granted for the Processing of these, through the procedure established in this policy or by submitting the indicated request.

12. STORAGE AND PROTECTION OF INFORMATION

The School applies appropriate technical and organisational measures to ensure the security, confidentiality, integrity and privacy of your personal data, preventing unauthorised access or unlawful processing, as well as accidental loss, destruction or damage to the same.

13. COMMON USE WITH SOCIAL NETWORKS OR OTHER APPLICATIONS

This website contains links to other websites such as platforms or social networks. Our School is not responsible for the privacy practices or the content of such sites. You should be aware that the processing of your personal information is carried out by those sites and is governed by their respective privacy policies.

If you do not want these sites to collect and process your information, please review their respective privacy policies and/or log out of them before using our Services.

14. COOKIES USED ON OUR WEBSITE

We use cookies to provide you with a better experience when using our website, as well as to store information about our visitors. This information is linked to your session ID and is a way of monitoring single user access.

The web server is allowed to remember some data relating to the user, such as their preferences for visiting the pages of this server, name and password, products that are most interesting to them, etc.

The Cookies that we use on our website and that require informed consent from the user are functional cookies and targeting cookies. Consent is not required for mandatory cookies, which are those of a technical nature necessary for the operation of the website or the provision of services expressly requested by the user.

15. COMPLAINTS

If you are not satisfied with our response to your request, wish to discuss anything to do with this privacy notice or believe we are processing your personal data in breach of applicable data protection rules, please contact our Data Protection Officer at: habeasdata@csma.edu.co  or the Colombian data protection authority, Superintendencia de Industria y Comercio (SIC) at contactenos@sic.gov.co or https: https://sedeelectronica.sic.gov.co/atencion-y-servicios-a-la-ciudadania/peticiones-quejas-reclamos-y-denuncias.

16. PRIVACY NOTICE UPDATES

We may need to update this privacy notice from time to time, so we encourage you to review this information from time to time.

This version was last updated in October 2024