Personal Data Handling

We respect the privacy of our students and their parents and wish to be completely transparent about the information we collect, how we use it and your right to control this data. This page outlines how International School of Hellerup collects and utilizes personal data in compliance with the General Data Protection Regulation (GDPR), a European Union legislation that came into effect on the 25th of May, 2018.

1. School Contact Information

If you have any questions regarding the data we collect, we are contactable on the following phone number: +45 70 20 63 68 and on email address info@ish.dk. Our CVR number is: 32 03 58 84. The International School of Hellerup is established at the following address:

Rygårds Allé 131,  2900 Hellerup,  Denmark

2. Purpose and Justification for Handling Your and Your Child’s Data

We use your data in order to fulfil our obligations as a school in compliance with the laws for private primary and secondary schools in Denmark. For example, we collect student and parent information in connection with a student’s admission to the school in order to apply for state subsidy.

3. Categories of Personal Data

3.1. Ordinary data

We use, most typically, ordinary data such as names, addresses, gender and age. Information necessary for the day to day running of the school does not require specific consent.

3.2. CPR numbers

The use of CPR numbers in connection with legally required obligations to receive state subsidy does not require specific consent. When the school is required to communicate CPR numbers, it will occur via secure e-mail and when possible using e-boks.

3.3. Sensitive data

In rare cases we process sensitive data such as medical information regarding students and parents if special treatment is requested due to disability or special social circumstances. This takes place after having obtained specific consent.

3.4. Other data held

There is video surveillance of the areas where cameras are in operation. Photographs of students displayed on the school website and social media channels require explicit consent. 

4. Data Recipients

Generally it is only the school that will make use of the personal data held regarding students and parents. The school has guidelines for which forms of data are used and when an employee is to have access to the personal information of students and parents. For example, it is typically only the school leadership and administration who will have access to all data. The teaching teams for the classes will only have access to the students in those classes.

The school does make use of external contractors in connection with the electronic handling of data. These third parties only handle personal data in the manner that they are instructed to in the form of a data protection agreement between the school and the contractor. We forward information to the Ministry for Education and other public authorities only when we are under obligation to do so.

5. Storage of Personal Data

The school stores personal data according to the relevant guidelines provided (see www.datatilsynet.dk). This data is stored in a secure database with the relevant data protection agreements. The school only stores personal data for as long as it is necessary to fulfil its obligations as an educational institution. Our standard protocols are as follows:

• The school only stores your personal data for as long as it is necessary for ISH’s documentation of a student’s academic progression.
• Economic information such as SPS applications and fees will be retained for five years.
• Contact information for use in connection with alumni relations will only be kept with consent.
• Examination records will be stored for 30 years.

6. Withdrawing consent

At any time, you have the right to withdraw your consent. This can be done by contacting the school using the contact information listed in Section 1 above. If you chose to withdraw your consent, this does not affect the legality of the school’s handling of your data that was used based on prior consent up until the point at which consent was revoked. Therefore, if you withdraw your consent, this withdrawal becomes effective from that point only. If consent was granted in connection with the distribution of images or videos on the internet, the school will do everything that is technically possible with the tools in our possession to remove this personal data. 

7. Your rights

In accordance with the rules for data protection, there are a number of rights connected to the school’s handling of personal data.If you wish to exercise these rights, you must contact the school.

7.1. The right to view data

You have the right to see the data that is held regarding you and certain other kinds of data. The school may charge a fee for this access. The Danish Data Protection Authority states on their homepage that the holders of private data can charge 10kr for each provided printed page up to a maximum price of 200kr.

7.2. The right to correction

You have the right to correct incorrect information about yourself.

7.3. The right to deletion

In certain cases, you possess the right to have information regarding yourself deleted before the school’s standard deletion protocols, see Section 5.

7.4. The right to limitation

In certain cases, you have the right to limit the use of your personal data. If you make use of this right, the school, from this point onwards, may only handle your data (with the exception of storage) with your consent; in situations where a basis for justification can be established; or in order to protect a person or the community as a whole.

7.5. The right to transfer

In certain cases, you have the right to receive your personal data in a structured, commonly used and machine readable format, as well as having this personal data transferred from one responsible entity to another without hindrance. You may read more about your rights in the Data Authority’s guidelines, which are available at www.datatilsynet.dk (may not be available in all languages).

8. Complaints to the data authority

You have the right to lodge complaints to the Data Authority if you are dissatisfied with the way that the school handles your personal data. You may find the contact information for the Data Authority at www.datatilsynet.dk