About the Personal Data Processing

We aim to process as little personal data about you (and your parents, if you are under 18) as possible, and we only process the personal data we have when/if it is necessary and there is a legitimate reason to do it.

We only collect and process the personal data that is necessary for us to comply with our duties under secondary school legislation, where we need to be able to identify you, place you in your academic class, manage your absences, as well as to document that you can advance to the next grade level, sit for an exam, receive SU (State Educational Grant) or other benefits that you have applied for.

The basis for processing your personal data is found in the seconday school legislation, which you will find in the overview at the bottom of this document.

The information we process about you is ordinary personal data such as your name, address, email address, telephone number, CPR number (Danish personal identification number), grades, as well as:

• Information about which academic classes you are placed in, and your preferred field of study
• Your photo (used exclusively for internal display on Lectio)
• Individual agreements, e.g. on lending IT equipment or books to you
• Information about your subject results and overal grades
• Information about your participation in tests and exams
• Information about your absences and reasons for absence

We also process personal data if it is necessary for objective, operationally justified reasons, e.g. to carry out control measures, prevent cheating in examinations, and for the school's financial management, including:

• Information about you and your parents' access to and activity in our IT systems in which you are set up as users. To maintain our system and prevent abuse, we monitor traffic and behaviour in the school's IT system, Lectio, and the school network. This helps us prevent and address students cheating by, for example, using the internet during exams.
• Video recordings in areas where there is CCTV surveillance
• Payment card information and account numbers in connection with you or your parents' payment for study trips, etc.

In rare cases, it may be necessary to process confidential or sensitive personal data about you and possibly your parents if, for example:

• If you request schooling under special terms, e.g. due to disability or other special circumstances
• If you breach the school's study policy and rules of conduct, or we suspect cheating on tests or exams
• If you take a dyslexia test
• If you are going on a study trip (in which case, you and possibly your parents need to hand in a copy of your passport)
• If you apply for an exemption to receive out-of-home SU on the basis of, for example, special circumstances at home.
• As a part of student guidance and counselling

The legal basis for the above information is Article 9(2)(b) of the GDPR (compliance with the controller’s obligations), and Article 9(2)(f) of the GDPR (necessary for the establishment, exercise or defence of legal claims). In special cases, processing may take place on the basis of your consent, cf. Article 9(2)(a) of the GDPR.

In addition, we also carry out the following processing of personal data about you:

• Publishing a photo or video of you, for example, on the internet, the school's website, the school's social media profile or in the school's printed publications. Legal basis: Article 6(1)(f) of the GDPR (legitimate interests).
• Registration of sensitive[3] personal information about you as part of study guidance, if it is not used to apply for SPS funds, exemption for non-resident SU or other forms of support, e.g. extra time for exams.

You (and your parents, if you are under 18) give automatic consent to the above processing of your personal date upon admission to Birkerød Gymnasium.

Images of you in the school’s printed publications cannot be removed once the publications have been produced. As a student at the school, you are part of school life, and this life is also portrayed in printed publications. Therefore, it may occur that you appear in the image material used. If you are prominently featured in such an image, you will be asked before publication whether you consent to being included in the publication.

Transfer to third parties

As part of our processing of your personal data, your personal data may be transferred to countries outside the EU.

The personal data that may be transferred to countries outside the EU are the personal data that appear from the IT systems hosted on servers outside the EU, as well as your personal information and passport information, if you travel outside the EU on a study trip.

Birkerød Gymnasium ensures that data can be transferred lawfully, typically on the basis of the EU’s Standard Contractual Clauses (SCCs).

Disclosure

Birkerød Gymnasium discloses personal data about you only where this is required by law and is otherwise necessary for the performance of our duties as an upper secondary school.

Recipients of your information may include the receiving upper secondary school if you change schools, the Youth Guidance Centre (Ungdommens Uddannelsesvejledning) if you leave the school prematurely, and the Ministry of Children and Education or the Ministry’s agencies, as well as the Region or the Danish Agency for Higher Education and Science.

Your rights (and your parents' if you are under 18)

The right to access: You (or your parents) can gain access to which personal data we process about you (or them), what the purpose of the processing is, how long we store the personal data, where we received the data from (if we have not received it from you), whom we may pass the personal data on to, as well as on what basis we may transfer the personal data to third parties, cf. article. 15 of the Data Protection Regulation.

The insight can be provided either by us handing over a copy of the information and/or by asking you to log in with your user access into the IT system and see the information therein (if there is full access to your own information in the system).

However, the right to access may be limited if consideration of private interests, confidentiality of other people's information or confidentiality in the public administration requires it, cf. Section 22 of the Data Protection Regulation.

The right to object: You (or your parents) can object to our processing of personal data if your interests in not having personal data processed precede Birkerød Gymnasium's legitimate interests in being able to carry out the processing, cf. Article 21 of the Data Proection Regulation.

The right to rectification: You (or your parents) can have personal data about you that is incorrect or incomplete rectified or supplemented, cf. Article 16 of the Data Protection Regulation.

The right to restriction of processing: You (or your parents) have the right to have our processing of personal data restricted if there are special reasons for this, cf. Article 18 of the Data Protection Regulation.

The right to erasure: We store your personal data as long as necessary for the sake of Bikerød Gymnasium's documenation for our administration of your schooling.

Therefore, most information about you´is deleted 3 years after you become a student.

After 5 years, information in cases about application and administration of non-resident SU and SPS funds are deleted.

After 10 years, information about sanctions is deleted. Your diploma is deleted after 30 years.

If you withdraw your consent, which you have automatically given us upon registration, in certain cases, we will cease to process this personal data in the future. However, we may need to continue to process certain parts of the personal data for a limited period, e.g. as documentation for the administration of financial grants or special conditions that you have received on the basis of personal data that we may process.

If you exercise your right to have a published image or video deleted on the Internet, we will do what is technically possible with the tools at our disposal to remove your personal data again. However, we cannot guarantee that the material can be removed again from e.g. Google or Facebook.

How to make use of your rights: You (or your parents) must contact the school, cf. the section on formalities below, and state which right you wish to make use of and why. We will then assess whether we agree that the right can be exercised. If we do not immediately agree, we will give a reason for this, and you will then have the opportunity to express yourself before we make a final decision. Our decision on this must follow the Public Administration Act's rules on consultation, justification, and complaint guidance, cf. the Public Administration Act §§ 19–25.

Formality

Birkerød Gymnasium is the data controller for the personal data processing activities described above.

If you (or your parents) have questions or wish to exercise the rights described above, you can contact the school by email at: gdpr@birke-gym.dk.

If you (or your parents) wish to have an image or a video deleted from the website, you can contact the person responsible for the school’s website at it@birke-gym.dk.

If you (or your parents) want to have a photo or video deleted on Facebook or Instagram, the school's social media manager can be contacted at msa@birke-gym.dk.

Right of Appeal

Birkerød Gymnasium’s processing of personal data may be complained about by entering into dialogue with acting principal Helene V. Lindemann, ve@birke-gym.dk, or by lodging a complaint with the Danish Data Protection Agency (Datatilsynet), Borgergade 28, 5., 1300 Copenhagen K, Tel.: 33 19 32 00, Email: dt@datatilsynet.dk.

The basis for processing you and your parents' personal data is found in the secondary school legislation: 

Laws and notices for students who started their education after August 1, 2017: 

• Lov om de gymnasiale uddannelser (lov nr. 1716 af 27/12/2016)
• Bekendtgørelse om de gymnasiale uddannelser (bkg. nr. 497 af 18/05/2017)
• SU-loven (lovbkg. nr. 1037 af 30/08/2017)
• Almeneksamensbekendtgørelse (bkg. nr. 343 af 08/04/2016)
• Bekendtgørelse om studie- og ordensregler i de gymnasiale uddannelser (bkg. nr. 1077 af 13/09/2017),
• Bekendtgørelse om særlige tilskud til specialpædagogisk bistand ved ungdomsuddannelser m.v. (SPS- bekendtgørelsen) (bkg. nr. 1377 af 09/12/2013)

Laws and regulations for students who started their education before August 1, 2017: 

• Gymnasieloven (lovbkg. nr. 766 af 09/06/2015)
• HF-loven (lbk. nr. 767 af 09/06/2015)
• STX-bekendtgørelsen (bkg. nr. 776 af 26/06/2013)
• HF-bekendtgørelsen (bkg. nr. 779 af 26/06/2013)
• Almeneksamensbekendtgørelse (bkg. nr. 343 af 08/04/2016)
• Meritbekendtgørelsen (bkg. nr. 130 af 21/02/2011)
• SU-loven (lovbkg. nr. 1037 af 30/08/2017)
• Bekendtgørelse om studie- og ordensregler i de gymnasiale uddannelser uddannelser (bkg. nr. 1077 af 13/09/2017 samt § 9, 10 og 14 i den tidligere bkg. nr. 1222 af 04/12/2006),
• Bekendtgørelse om særlige tilskud til specialpædagogisk bistand ved ungdomsuddannelser m.v. (SPS- bekendtgørelsen) (bkg. nr. 1377 af 09/12/2013)

[1] This information is provided with reference to Article 13 and 14 of the Data Protection Regulation.

[2] THE EUROPEAN PARLIAMENT AND REGULATION OF THE COUNCIL (EU) 2016/679 of April, 27, 2016 on the protection of natural persons in connection with the processing of personal data and on the free exchange of such information and on the repeal of Directive 95/46/EC (General Data Protection Regulation).

[3] Sensitive personal data is information about e.g. political, religious or philosophical beliefs, health diagnoses, ethnic origin or information about sexual relationships or sexual orientation.