International Learning Group School Privacy Policy Declaration

For the purposes of this General Data Protection Regulation (GDPR) / Law on Personal Data Protection – Kosovo (LPPD) privacy policy declaration:

Data Controller

The Data Controller for International Learning Group (ILG) School data subjects, i.e. its employees, the students enrolled at the school, and their parents are the ILG Association and the Authorized Representative, the Executive Director, Rachel MacKinnon.

Data Protection Officer

The role and tasks of the Data Protection Officer (DPO) are currently being exercised by the Acting DPO, Besiana Pllana. Her contact details are data.protection@ilg-ks.org. 

Data Processing

The purpose of data processing at ILG School is legitimate as it is necessary to comply with the following requirements (Article. 5):

Legal requirement to comply with tax, labor, and educational legislation: ILG School is legally required to process and store data on its employees for labor and tax law purposes. We are legally required to collect, process, and store data on our students, including enrollment and progress records.

• Contractual requirement between the controller and the data subjects: ILG School is contractually obligated to collect, process, and store personal data about the students enrolled in our school, to ensure that educational goals are met and as proof of meeting our obligations as educator provider of care. 

• Vital interest of the data subjects: We are obligated to process and share some personal health data for vital interest purposes to ensure the health and safety of our staff and students.

• Consent: For additional data not covered by the above requirements, explicit consent from parents is requested. This refers solely to photos and video footage, to be used in internal and/or external publications. This consent can be withdrawn at any time.

Recipients of Personal Data

ILG shares personal data, where necessary, with the Kosovo Tax Administration, Kosovo Pension Savings Trust, Kosovo Ministry of Education, Kosovo Public Health Institution, Health Insurance Provider, and Financial Institutions. 

Transfer of Personal Data Abroad

ILG transfers personal data to a third country or international organization where necessary with the following: 

• ILG School uses the Toddle School management system to store, track, and process student attendance and progress data. For more information please visit GDPR | Toddle.

• Cognia is the authorizer of our accreditation in educational excellence and school improvement. ILG shares personal data with Cognia, a global network of educators to demonstrate international standards of educational excellence, to continually improve our service delivery, and to provide access to opportunities for our students. For more information, please see the COGNIA PRIVACY NOTICE

• ILG transfers personal data to the  International Baccalaureate Organization to meet its authorization requirements, including registration for IB examinations and assessments. Each of these service providers or authorizers is contractually required to adhere to ILG Data policy as well as GDPR and have their own extensive data policy adhering to the GDPR. For more information, please visit the IB privacy policy

  Storage of Personal Data

The personal data held by ILG will be stored for the maximum amount that is prescribed by law or by ILG policy. Several categories of personal data must be considered under their own criteria these include:

• Student records
• Employee records
• Other data (photos)

Any data, that is stored subject to legal requirements, will be kept for the legally mandated length of time. Any data, that is stored due to contractual requirements, will be kept until the time to enable legal action from either party has elapsed. Any data based on consent will be kept according to ILG internal policy, or until such a time that the consent is withdrawn.

Right to Request, Rectification, Deletion, and Data Portability

Under the GDPR/LPPD regulations data subjects have a general right to rectification or deletion of personal data, however these do not apply to most of the data processed by ILG as the purposes are based on legal and contractual requirements, and therefore override the right to object to processing. ILG School will comply with the data subject’s right to have any data rectified at all times, as well as any other rights as far as legally permissible. 

Right to Withdraw Consent

Where data is processed based on the consent of the data subject, as opposed to other requirements; such consent may be withdrawn at any time.

Right to Lodge a Complaint

Under the GDPR/LPPD regulations, the data subjects have the right to lodge a complaint with the Information and Privacy Agency, (AIP). They are also an important source of further information (in English and Albanian). 

Providing Personal Data

As stated above, the provision of personal data to ILG School is a legal and contractual requirement for all data subjects, both employees and students, and we reserve the right to refrain from entering into a contractual relationship with data subjects that refuse to provide such data. This, however, does not apply to any data for which explicit consent is requested. 

If the data subject chooses not to provide the required personal data, it could lead to various consequences.

In summary, failure to provide personal data that is required by law or contract may lead to ILG School being unable to provide employment or educational services to the individual. However, data that falls under consent requirements does not affect the individual’s status if not provided.

Automated Decision Making

ILG School does not use any automated decision-making or profiling based on personal or other data.