DATA PROTECTION AND USE OF IMAGES POLICY

A. Data Protection

The personal data and sensitive personal data (both as defined under the Personal Data Protection Act 2010 (“PDPA”), of pupils, parents, guardians and such other individuals appointed by the parents and/or guardians in relation to the needs and/or well-being of the pupil (collectively referred to as “our data subjects”), including but not limited to names, dates of birth, addresses, contact details, personal status (including a person’s gender identity), nationality, religion, ethnicity, next of kin, medical data (including information about the person’s physical or mental health or condition), financial data, and CCTV, photos and video recordings etc., collected by the College can be retained, used, disclosed and/or processed, by the teachers and/or other staff of the College, internally (for example, by teachers and/or other staff who use this information regularly in the course of their duties and/or by teachers and/or other staff who need to have it close at hand, for example in case of any injury to the pupil) and externally, where required by law and/or in exchanging of information between academic institutions and/or in relation to third party service providers of the College and/or by reason of the application of the European Union’s General Data Protection Regulation. The data may be retained/stored, including but not limited to, in computers, servers, mobile phones, hard drives, USB thumb drives, other storage devices, databases and/or as part of a manual filing system of the College.

Furthermore, we may be required to submit some or all of these personal data of our data subjects or we may submit the same in the interests of or for the benefit of the child’s academic pursuits/choices/options or in compliance with conditions attached to such submissions to relevant agencies or organisations or bodies within and outside of Malaysia. Examples of this include but are not limited to local Ministry of Education and its requirements or other Malaysian legal requirements, examination boards for IGCSEs and A Levels, for the marking of examination papers, for university applications, to government bodies for statistical records, to legal authorities and/or enforcement agencies with regard to possible disciplinary or civil or criminal matters, pursuant to a court order and medical records in the event of an emergency, accident or other health related incident.

It must also be noted that this data, whilst stored internally in the manner and/or mediums as stated above, may also be automatically duplicated and stored at offshore data storage sites (for example in iCloud) as a consequence of the operating system that is used internally or as part of the College’s disaster recovery or risk strategy.

Our data subjects hereby agree to the collection, retention, use, disclosure and/or processing of this data and waive prior notice every time the same is collected/retained/used/disclosed/processed from the time parents apply to enrol their child at the College, in all of the scenarios set out above and in such other situations generally, subject to where the same is done, in the College’s absolute and sole opinion, in the interests of and/or for the benefit of the pupil or where it is done reasonably, for the promotion of the College. The College will further also rely on the College’s
‘Privacy Notice for Parents and Child(ren) – How We Use your Data’ in exercising its rights in respect of personal data and sensitive personal data of our data subjects.

Our data subjects also agree to forthwith update data that has been provided where there are any changes, and also to report incorrect data forthwith upon discovery of the same. The College shall not be responsible nor liable for any loss and/or damage caused as a result of such data not updated and/or incorrect data and our data subjects shall jointly and severally indemnify the College for any loss and/or damage it may suffer resulting therefrom.

Finally, the College shall take all reasonable steps to ensure that all data is destroyed or permanently deleted if it is no longer required for the purpose for which it was collected / retained /used /disclosed /processed.

For avoidance of doubt, by signing the Acceptance Form to the Letter of Offer, parents have agreed and consented to the guidelines and policies herewith.