General Privacy Notice

In this General Privacy Notice, the following terms are used with their respective meaning:

"Personal Data"	means any and all information relating to an identified or identifiable person, such as a Student, a Prospective Student, a Parent, and/or Contractor;
"Special Category of Data"	means any and all information relating to the special categories of data set out in Article 5, II, of LGPD. Within the scope of the activities performed by the School, this category of data is related to health or medical care data of Students, as well as racial, ethnic, or sex life origin;
"Data Subject"	refers to the individual whose data is the subject of data processing, i.e., Students, Prospective Students, and Contractor;
"Data Processing"	refers to any operation carried out with personal data under the terms and limits determined by LGPD;
“The Brazilian General Data Protection Regulation – (“LGPD”)"	refers to Law No. 13.708/18 – The Brazilian General Data Protection Regulation – responsible for the regulation of data processing within the Brazilian territory;
"Students"	refers to children and adolescents enrolled in courses (including but not limited to regular courses and prep courses) or educational services rendered by the School;
"Prospective Students"	refers to Prospective children and adolescents who will potentially be enrolled at the School;
"Children"	refers to Students or Prospective Students up to 12 (twelve) years of age;
"Adolescents"	refers to Students or Prospective Students between 12 (twelve) and 18 (eighteen) years of age;
"Contractor"	refers to the individual (s) financially responsible for the Student(s) or Prospective Student(s) and is also the person declared as responsible for the legal representation of the Student(s) or Prospective Student(s);
"Data Protection Officer"	refers to the individual appointed by the School to interact with Data Subjects and the Brazilian National Data Protection Authority (ANPD);
"Online Platform"	means any website and/or online platform operated by SABIS® or by companies’ members of the SABIS® Group of companies;
"the School"	refers to SABIS® International School – Campinas, which is a company incorporated under Brazilian law to provide educational services to individuals located in the Brazilian territory;
"Personal Data Breach"	means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.  The School will report personal data breaches to the Brazilian supervisory authority where the breach is likely to adversely affect the personal data or privacy of the data subject.

 

 

For the purposes described in this General Privacy Notice, the School shall be taken as the legal person responsible for determining the purposes and means of the Personal Data that had been submitted by Students, Prospective Students, and Contractor and may be identified and contacted through the channels below:

• Address: Av. Giuseppina Vianelli di Napoli, nº 555 Bairro Jardim Bosque das Palmeiras Campinas – São Paulo, Brazil
• CNPJ Number: 26.411.734/0001-57
• Data Protection Officer E-mail: (privacy@sabis.net)
• Telephone Number: (+55 19 3295-5125)

 

 

As part of its educational activities, the School will collect and process the Personal Data identified below, with the following purpose (red) and legal basis (blue):

                                                                                

Identification Data: Types of data that enable the identification of the Data Subject who has or will have any legal bond with the School – Students, Prospective Students, and Contractor – consisting, for example, of full name, date of birth, nationality, place of birth, profession, home address, E-mail address, postal code, and telephone and/or cell phone number(s).

Purpose: The Personal Data is collected in order to enable the proper identification of Students, Prospective Students, and Contractor that either have established or will establish a contractual relationship with the School.

Legal Basis: The processing of Identification Data by the School will be carried out in order to allow the School to perform the tasks and services described in the Agreement (hereinafter referred as the “Agreement”) to which the Data Subject is party, pursuant to Article 7, V, of LGPD.

Attention: The absence of consent for the processing of Personal Data of Students and/or Prospective Students registered with the School and/or Prospective Students, particularly regarding authorization for the processing of "Identification Data," would impede the rendering of educational services by the School as these pieces of information are essential for the performance of the Agreement.

 

Financial Data: Personal Data that allows the School to perform bank collection or compensation for the educational services provided or for the registration of Students or Prospective Students, consisting, for example, of CPF number, bank details, payment information, and credit card details.

Purpose: Financial data is collected to enable the School to properly and securely charge for its services.

Legal Basis: Financial data will be processed due to the need for the School to execute, or be allowed to execute, the Agreement in which the Data Subject takes part, according to Article 7, V, of LGPD.

 

Data Concerning Health: Personal Data relating to specific health conditions of Students and Prospective Students.

Purpose: Data concerning the health of Students and Prospective Students is collected to enable the School to render appropriate medical treatment when and if necessary, either during or before the execution of the educational services Agreement, as a preparatory measure by the School for the timely provision of services.

Legal Basis: This type of data will always be processed in the best interest of Students and Prospective Students, with the specific consent of the Contractor, pursuant to the purposes mentioned above.

 

 

Student’s Performance Data: Data related to the Student's pedagogical performance, consisting, for example, of disciplinary and educational observations, evaluations, tests, reports of grades, and absences.

Purpose: Performance Data is collected to allow Students, their Representatives, and the School to be aware of the Student's pedagogical performance. Amongst the intended purposes are (i) supporting Student learning; (ii) monitoring Student learning performance; (iii) verifying the quality of educational services provided by the School to Students; and (iv) compliance with legal and regulatory obligations, which determine, for example, the measurement of Student grade averages and attendance.

Legal Basis: Performance Data will be handled with the consent of the Contractor, always in their best interest and within the parameters informed above.

Attention: The absence of consent for the processing of Personal Data of Students and/or Prospective Students registered with the School, particularly regarding authorization for the processing of "Student’s Performance Data", would impede the rendering of educational services by the School as these pieces of information are essential for the performance of the Agreement.

 

Photography and Filming: Students and Prospective Students’ images that are used for cadastral or security matters.

Purpose: The images are collected in order to allow the School to correctly identify its Students and Prospective Students during or prior to the provision of educational services, as well as to implement appropriate security measures in the School premises via the CCTV system and others.

Legal Basis: Images of Students and Prospective Students will be treated by the School when at least one of the Contractor grants specific consent to do so.

 

Direct Marketing: Students, Prospective Students, and Contractor may be asked to provide Personal Data, such as their name and E-mail address, for the purpose of receiving marketing communications by E-mail.

Purpose: The processing will only be carried out after the Data Subject’s voluntary disclosure, who will be asked to affirmatively opt into E-mail marketing communications.

Legal Basis: Specific consent to do so.

 

The School shall only collect data for specific purposes and with a proper legal basis for processing. Data obtained for specific purposes will not be processed for purposes different from the ones specified in this General Privacy Notice unless the School properly notifies Data Subjects regarding it.

The collection of Personal Data occurs in the following cases:

Data Provided by the Data Subject:

• Voluntary completion of registration forms, applications, or vacancy forms per Contractor;

• Direct contact by E-mail, telephone, or any other form of electronic correspondence and/or letters;

• The Student or the Contractor voluntarily creates a profile on any of the Online Platforms provided by SABIS^®;

• Through filling out electronic or paper forms, evaluations, reports, tests, simulations, notes, attendance lists, as well as taking part in interviews and meetings, all of which are deemed necessary for the achievement of the educational services contracted and are submitted by the Student to one of the School’s agents.

 

Internet Trackers:

The Data Subject’s personal information may be electronically collected for statistical purposes and to improve the SABIS^®’s website. The School and its service providers may also use other tracking technologies for website management and user tracking. The School and its service providers may use tracking technologies, such as cookies (files stored in the Data Subject’s browser), analytics tools, or pixels to measure browsing behavior and personalize content for the user.

 

Online Platforms:

The School uses Online Platforms while rendering its educational services and, therefore, provides its Students access to software that the School does not operate. Please note that this General Privacy Notice does not apply to third-party software. This Privacy Notice does not govern the practices of third parties, including the School’s partners, third-party service providers, and/or advertisers, even when those services are branded as or provided on behalf of the School.

 

Third Parties:

This consists of the collection of Personal Data that is provided and/or shared by authorized third parties or government agencies, including:

• Doctors, therapists, speech therapists, and other health professionals, always with specific consent of the Contractor and in the Student’s best interest;

• Other educational establishments;
• Government bodies and regulatory authorities.

 In case of medical emergencies, the Personal Data of Students may be collected without specific consent. Its processing will be carried out exclusively for the protection of the Children or Adolescents, according to Article 14 of LGPD.

Personal Data from third parties will be adequately analyzed by the School in order to ensure that the information has been collected and is being shared on a legal and/or regulatory basis and is accurate and up to date.

 

 

The School is not responsible for, nor does it hold any interference with, any filming or photographs made by Students, Prospective Students, and Contractor during the regular School day activities or social events organized by the School.

However, in order to provide a healthy environment for its Students, the School will publicize guidelines among its members, Students, and Contractor on sharing images and footage of Students, reminding all those participating in the School environment of the provisions in this General Privacy Notice, including:

• Reminding Students’ Parents and/or Contractor about their option of updating their consent preferences for any data processing operation involving their Children and/or Adolescents.

• Requesting that photographs and footage of Students taken during the School’s social events must not be shared on social media without prior authorization from the Contractor of the Child and/or Adolescent subject of that Personal Data.

• Reminding Students and the Contractor about the terms of this General Privacy Notice.

 

The School recognizes the need to safeguard the Personal Data and the privacy of its Students, both at School and on social media.

Under the terms of the EDUCATIONAL SERVICES AGREEMENT signed between the School and the Contractor, the School is authorized to use the Student's image, by means of photographs, videos, and/or recordings, for the purpose of publicizing the educational services provided on Online Platforms and general media, always in the best interest of the Student and the legitimate interest of the School.

The School recognizes the need to protect the Personal Data and privacy of its Students, both at School and on social media, and, therefore, will only use the images of the Student with the specific consent of the Contractor, which will be collected from the Contractor through a particular form.

 

  The processing of the Personal Data of Children will be restricted to the purposes outlined above in Clause 3 and will depend on the specific and detached consent of the Contractor, as per the TERMS OF CONSENT FORM.

 

Access to the Personal Data of Students, Prospective Students, and their Contractors will be restricted to professionals and agents assigned to the specific function of developing the enrollment process, selection, and rendering of educational services proposed by the School.

 

The School takes advanced administrative, technical, organizational, and physical measures to protect the Personal Data under its control. These measures include computer protection mechanisms and secure files and facilities. In turn, once the purpose of the data processing is fulfilled, the School adopts appropriate measures to securely delete or permanently dissociate the Personal Data, depending on the applicable legislation and compliance with the minimum data retention principle.

The School will only keep Personal Data for as long as necessary to process Students’ and Prospective Students’ applications or to inform about future opportunities unless it is required to retain it for an underlying period, which will be done on the basis of the provisions of Law No. 13.708/2018 – General Data Protection Law, as well as the ANPD Resolutions and Publications.

The School reserves the right to contract third parties – Processors – to carry out the storage of Personal Data under its custody, in which case these Processors will have to process the Personal Data of prior written instructions determined by the School and to ensure the confidentiality and security of Personal Data.

 

The School does not share Personal Data with any third parties unless in the following situations:

• With regulatory authorities, courts, and government agencies to comply with legal orders, legal or regulatory requirements, and government requests;

• With Service Providers ("Processors"), regulatory authorities, and government agencies to detect and prevent fraud or other criminal activity and to protect the rights of the School or others;

• For credit protection, when related to the Personal Data of the Contractor;

• With Service Providers ("Processors") for the execution of contracts and business development at the request of the School.

When Personal Data of Students, Prospective Students, and Contractor has to be shared with third parties other than as described above, the School will notify the Data Subject to obtain specific consent for that purpose, subject to exceptions provided in applicable law.

Accordingly, the School reserves the right to store Personal Data under its custody with Processors who may or may not be located in the Brazilian territory. When Personal Data is transferred to other jurisdictions, the recipient of such information will always be countries or international organizations capable of providing an adequate degree of protection compatible with Law No. 13.708/2018 – The Brazilian General Data Protection Regulation.

As the School is a member of the SABIS^® School Network, the Personal Data may be transferred outside the territory of Brazil and securely replicated to the databases located in Microsoft Cloud Services in Ireland and SABIS Educational Systems Inc. in the United States. This is done to provide the Parents and Students with access to SABIS^® Applications and to support Students' learning by monitoring and following up on their academic and non-academic performance, including but not limited to exam results, attendance and discipline records, school calendar, study material, and Student Life Organization (SLO) participation.

The replicated Personal Data will also be used to run analytics/statistics on Students, sections, classes, and overall School's academic performance.

Authorized employees in SABIS Educational Services S.A.L. Adma, Lebanon, and SABIS Educational Systems Inc. have access to the replicated data in order to operate, develop, improve, deliver, or troubleshoot the Online Platform and provide and support the School with various technical and educational services.

The School utilizes OneDrive and SharePoint storage in Azure Europe to store and back up its data.

A copy of the School's backup is also transferred to SES Lebanon SharePoint storage in Azure Europe every week for data availability and disaster recovery purposes. The data stored on SharePoint is encrypted and can only be accessed by authorized IT personnel from SES Lebanon, which is strictly for disaster recovery. Furthermore, the School's data stored in Azure Cloud is backed up using the Azure backup tool and stored in Azure.

In addition, the School’s data stored in SES Inc. is backed up locally in the US Data Center and online via the Barracuda Cloud Backup service. The latter is a cloud backup solution using Azure and Amazon AWS cloud infrastructure in the US.

 

According to LGPD, Data Subjects have rights in relation to the processing of their Personal Data, among them:

• The right not to provide the School with their Personal Data unless this piece of information is essential for the purposes highlighted in this General Privacy Notice;

• The right to be informed about the existence of processing of their Personal Data;

• The right of access, rectification, and update of their Personal Data;

• The right to request the erasure of their Personal Data, except in those cases where the Personal Data is essential to the activity provided by the School or when its storage results from a legal, regulatory, contractual obligation or for the legitimate exercise of rights;

• The right to have their Personal Data transferred to another controller, consisting, for example, of sending Personal Data of Students to other educational institutes; and

• The right to withdraw their consent to the processing of their Personal data, when applicable.

If the Data Subjects choose to exercise any of the rights described above or if they have any questions about how their Personal Data is processed, they may contact the School’s Data Protection Officer through the channels highlighted in Item 2 of this General Privacy Notice.

The Student or Prospective Student’s Contractor is responsible for the accuracy of the information they provide during the registration process with the School.

The School reserves the right to amend or modify this General Privacy Notice at any time, considering, but not limited to, legislative, regulatory, and case law updates.

In the event of a change to the terms set forth herein, the School will notify the Contractors, detailing the changes through a pop-up notification on the website and, if applicable, requesting an update of consent for processing Children’s and adolescents’ data.

If you have any questions, please contact us through the channels provided in Item 2 of this Privacy Notice.