First page 1 Next page Last page

Privacy Notice Website

Glenstal Abbey School

Privacy Notice Page | 1

Glenstal Abbey School - Privacy Notice

Reader Information

Title: Privacy Notice

Purpose:

To outline the approved Glenstal Abbey School’s management

approach to be followed in relation to Privacy Notice

Author:

Marius Carney

Publication date:

9th June 2023

Target Audience:

Board of Directors, Board of Management, Glenstal Abbey Trust,

Headmaster, Housemaster, Staff, service providers, students,

parents, guardians and third parties that have access to the

Glenstal Abbey School information.

Superseded Documents:

All other Privacy Notices.

Review Date:

9th June 2024

Contact Details:

Glenstal Abbey School at Morroe, Co. Limerick, V94 HC84 - E-mail

info@glenstal.com

Privacy Notice

Glenstal Abbey School are committed to safeguarding the privacy of your personal data.

Please read the following Privacy Notice to understand how we collect and use your

personal data, for example when you contact us, visit our website, or seek to avail of our

services. The Data Controller is Glenstal Abbey School, we can be contacted through

info@glenstal.com or through our registered office, which is located at Glenstal Abbey

School Morroe, Co. Limerick, V94 HC84. Please note that whenever you provide us with your

personal data, you are consenting to its collection, recording, organising, structuring, storing,

adaptation, alteration, retrieving, consulting, use, disclosure by transmission, dissemination

or otherwise making available, alignment or combination, restriction, erasure or destruction.

What Personal data do we collect?

Glenstal Abbey School may collect personal data such as your name and e-mail address

through our website interface on https://school.glenstal.com/ or through completion of our

enrolment form, e-mail communication, or other means of communication or contact that

we may have with you.

How we use your personal data

If you provide personal data to us, we will collect that information and use it for the

purposes outlined hereunder and in accordance with the terms and references within this

Privacy Notice.

Glenstal Abbey School

Privacy Notice Page | 2

Obligation to provide personal data

You are not obliged to provide your personal data to Glenstal Abbey School, you may provide

your name, address, contact details or e-mail address (as applicable) as a point of contact.

The purpose of collecting your personal data is outlined in the Appendix “A”, “B”, “C” or “D”

hereunder in respect of your personal or special category data, to aid the delivery of our

educational services etc. Failure to provide personal data will create difficulties in delivering

our educational services. The provision of personal or special category data is required

mainly in relation to aiding the performance of the functions conferred under enactment of

secondary legalisation by the Department of Education and Skills.

Explanation as to how the personal data could not possibly be processed by any other

means.

Failure to provide personal or special category data may create difficulties in delivering our

educational services. In such event we would have no other means of processing your educational

requirements.

Sharing your personal data

When you provide Glenstal Abbey School with your personal data, that data will be used,

processed or stored in the school. Glenstal Abbey School shares your personal or special

category data with the Board of Directors, Board of Governors, Board of Management, ,

Glenstal Abbey Trust, Principal, Headmaster, Housemaster, Deputy Principal, Teachers,

Administration Staff, Department of Education & Skills, Student Counsellor, Special

Educational Coordinator, State Examination Commission, Central Statistics Office,

Educational Research Centre, National Council for Special Education (NCSE), Tusla, HSE,

Department of Social Protection, Revenue Commissioners, Education Welfare Officer,

National Education Psychological Service (NEPS), Child and Adolescent Mental Health Service

(CAHMS), third-level educational institutions, prospective employers, Health & Safety

Authority, Cat 4 Assessment GL Education Group, Gap Students, Catering Company, Glenstal

Abbey Trust’s Health Centre’s Nursing Staff, OpenApply, KeepitSafe, External Counsellor,

Insurance Company, PaytoStudy (International Students), and An Garda Siochana as

applicable.

The Department of Education & Skills privacy notice is displayed at

https://www.education.ie/en/The-Department/Data-Protection/department-of-education-a

nd-skills-privacy-notice.pdf

Glenstal Abbey School will not share or pass on your personal data to any other persons or

third parties, third countries or international organisations other than those specified unless

you specifically request this.

Glenstal Abbey School

Privacy Notice Page | 3

In the event that we receive requests from government departments, agencies or other

official bodies, we will only disclose your information, if and to the extent that we believe we

are legally required to do so (for example, but without limitation, upon receipt of a court

order, warrant, subpoena or equivalent). Except as set out above, we will not disclose your

personal data save where we need to do so in order to enforce our rights.

If we are compelled to share your personal data, we take all reasonable steps to ensure that

it is treated securely and in accordance with this Privacy Notice.

Recipients of categories of Personal Data

The recipients of the categories of personal and special category data that Glenstal Abbey

School processes includes the following Headmaster, Teachers, Department of Education &

Skills, Student Counsellor, Special Educational Coordinator, Headmaster, Housemaster, Board

of Management, Board of Directors Administration, Staff, State Examination Commission,

National Council for Special Education (NCSE), Tusla, HSE, Department of Social Protection,

Revenue Commissioners, Education Welfare Officer, National Education Psychological

Service (NEPS), Child and Adolescent Mental Health Service (CAHMS), Counselling Service

and An Garda Siochana as applicable to each individual case.

Transfer to third country

The GDPR and Data Protection Acts require that Glenstal Abbey School specify whether or

not it transfers personal data to any third country or international organisation. Glenstal

Abbey School does not transfer any personal data to any third country or international

organisation.

Period of retention of personal data

Personal data provided to Glenstal Abbey School will be retained for a period of time

depending on the purpose of collecting each category of personal data.

1. In the event that personal data is provided in relation to the provision of our educational

services we are required to retain the personal data for a period of 7 years after the student

reaches the age of 18 years of age.

2. The retention period for documents in relation to provision of education by the school is

listed in respect of all school records in the attached Appendix.

3. The retention period for school documents in relation to Revenue records is available at

https://www.revenue.ie/en/vat/vat-records-invoices-and-credit-notes/vat-records-to-be-kep

t/how-long-do-you-keep-records-for.aspx

Product and service-related data

Glenstal Abbey School

Privacy Notice Page | 4

If you avail of our educational services or are employed by Glenstal Abbey School, we may

collect and process your personal and special categories of data as is outlined at Appendix

“A”, “B”, “C” or “D” as applicable.

In order to continuously provide our educational services, it may be necessary for us to

collect and process certain information relating to you. You acknowledge and agree that the

information we collect may include personal and or special category data as is outlined in

the Appendix “A”, “B”, “C” or “D” as is applicable to you.

We are committed to safeguarding the privacy of your personal and special category data

and we will never share this outside of those mentioned above.

Notice of Data Subject Rights

Right of Access

The data subject has the rights to obtain from Glenstal Abbey School (Controller)

confirmation as to whether or not personal data concerning him or her is being processed

and where such personal data is being processed, he / she will have the right to access their

personal data and ascertain the purpose of any processing, the categories of personal data

concerned, the recipients or categories of recipient to whom the personal data has been or

will be disclosed, in particular any recipients in third countries or international organisations,

the period for which the personal data will be retained or stored or if not possible the

criterial used to determine that period, the right to request from the controller rectification

or erasure of their personal data or restriction of processing of personal data concerning the

data subject or their right to object to such processing, the right to lodge a complaint to the

supervisory authority (Data Protection Commissioner), in the event that the personal data

was not collected from the data subject any available information as to their source and the

existence of any automated decision-making profiling and at least in such events meaningful

information about the logic involved as well as the significance and the envisaged

consequences of such processing for the data subject. In the event of personal data being

transferred to a third country or to an international organisation the data subject has the

right to be informed of the appropriate safeguards relating to the transfer. The data subject

also has the right to obtain a copy of the personal data undergoing processing from the

controller.

Right to Rectification

The data subject shall have the right to obtain from the controller without undue delay the

rectification of inaccurate personal data concerning him or her. Taking into account the

purposes of the processing, the data subject shall have the right to have incomplete

personal data completed, including by means of providing a supplementary statement.

Right to erasure (‘right to be forgotten’)

Glenstal Abbey School

Privacy Notice Page | 5

The data subject has the right to obtain from the controller the erasure of personal data

concerning him or her without undue delay and the controller shall be obliged to erase their

personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were

collected or otherwise processed;

(b) the data subject withdraws consent to the processing of his or her personal data for one

or more specific purposes, or where the European Union or Member State law prohibit the

consenting by data subjects to the processing of special categories of personal data and

where there is no other legal ground for the processing;

situation, at any time to processing of personal data concerning him or her based on the

grounds that processing is necessary for the performance of a task carried out in the public

interest or in the exercise of official authority vested in the controller or processing is

necessary for the purposes of the legitimate interests pursued by the controller or by a third

party, except where such interests are overridden by the interests or fundamental rights and

freedoms of the data subject which require protection of personal data, in particular where

the data subject is a child (except where processing is carried out by public authorities in the

performance of their tasks) and there are no overriding legitimate grounds for the

processing, or the data subject objects to the processing of their personal data for direct

marketing purposes including profiling for direct marketing purposes .

(d) the personal data has been unlawfully processed;

(e) the personal data has to be erased for compliance with a legal obligation in Union or

Member State law to which the controller is subject;

(f) the personal data has been collected in relation to the offer of information society

services from a child under the age of 16 years of age and the consent for the processing of

that child’s personal information has not been given or authorised by the holder of parental

responsibility over the child .

The above requirements in relation to the right to erasure shall not apply to the extent that

processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing by Union or Member

State law to which the controller is subject or for the performance of a task carried out in

the public interest or in the exercise of official authority vested in the controller;

religious or philosophical beliefs, or trade union membership, and the processing of genetic

Glenstal Abbey School

Privacy Notice Page | 6

data, biometric data for the purpose of uniquely identifying a natural person, data

concerning health or data concerning a natural person's sex life or sexual orientation is for

reasons of public interest in the area of public health or where such data is processed by or

under the responsibility of a professional subject to the obligation of professional secrecy

under Union or Member State law or rules established by national competent bodies or by

another person also subject to an obligation of secrecy under Union or Member State law or

rules established by national competent bodies.

(d) for archiving purposes in the public interest, scientific or historical research purposes or

statistical purposes subjected to the appropriate safeguards being put in place in accordance

with this regulation, protecting the rights and freedoms of the data subject by the putting in

place technical and organisational measures to ensure respect for the principle of data

minimisation, which may include pseudonymisation; provided such purposes can be fulfilled

in that manner or where further purposes for processing of such data does not permit or no

longer permits the identification of data subjects, then those purposes shall be fulfilled in

that manner so as to render impossible or seriously impair the achievements of the

objectives of that processing or

(e) for the establishment, exercise or defence of legal claims.

Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing

where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling

the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the personal data

and requests the restriction of their use instead;

they are required by the data subject for the establishment, exercise or defence of legal

claims;

(d) the data subject has objected to processing on grounds relating to his or her particular

situation, to processing of personal data concerning him or her which is based on the fact

that processing is necessary for the performance of a task carried out in the public interest

or in the exercise of official authority vested in the controller or where processing is

necessary for the purposes of the legitimate interests pursued by the controller or by a third

party, except where such interests are overridden by the interests or fundamental rights and

freedoms of the data subject which require protection of personal data, in particular where

the data subject is a child, with the exception of processing carried out by public authorities

in the performance of their tasks; pending the verification whether the legitimate grounds of

the controller override those of the data subject.

Glenstal Abbey School

Privacy Notice Page | 7

Where processing has been restricted under the above conditions, such personal data shall,

with the exception of storage, only be processed with the data subject's consent or for the

establishment, exercise or defence of legal claims or for the protection of the rights of

another natural or legal person or for reasons of important public interest of the Union or of

a Member State.

A data subject who has obtained restriction of processing pursuant to the above-mentioned

conditions shall be informed by the controller before the restriction of processing is lifted.

Right to notification obligation regarding rectification or erasure of personal data or

restriction of processing. The controller shall communicate any rectification or erasure of

personal data or restriction of processing carried out in accordance with their right to

rectification, erasure, and restriction of processing to each recipient to whom the personal

data have been disclosed, unless this proves impossible or involves disproportionate effort.

The controller shall inform the data subject about those recipients if the data subject

requests it.

Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her,

which he or she has provided to a controller, in a structured, commonly used and

machine-readable format and have the right to transmit those data to another controller

without hindrance from the controller to which the personal data have been provided,

where:

(a) the data subject has given consent to the processing of his or her personal data for one

or more specific purposes or the data subject has given explicit consent to the processing of

personal data for one or more specified purposes, except where Union or Member State law

provide that the prohibition the processing of personal data revealing racial or ethnic origin,

political opinions, religious or philosophical beliefs, or trade union membership, and the

processing of genetic data, biometric data for the purpose of uniquely identifying a natural

person, data concerning health or data concerning a natural person's sex life or sexual

orientation may not be lifted by the data subject; if the data subject has given explicit

consent to the processing of those personal data for one or more specified purposes, except

where Union or Member State law provide that the prohibition referred to above may not

be lifted by the data subject or on a contract where the processing is necessary for the

performance of a contract to which the data subject is party or in order to take steps at the

request of the data subject prior to entering into a contract ; and

(b) the processing is carried out by automated means.

2. In exercising his or her right to data portability, the data subject shall have the right to

have the personal data transmitted directly from one controller to another, where

technically feasible.

3. The exercise of the right to data portability shall be without prejudice to the data subject’s

Glenstal Abbey School

Privacy Notice Page | 8

right to erasure Article 17. which shall not apply to processing necessary for the

performance of a task carried out in the public interest or in the exercise of official authority

vested in the controller.

4. provided that the right of data portability of a data subject shall not adversely affect the

rights and freedoms of others.

Right to object

1. The data subject shall have the right to object, on grounds relating to his or her particular

situation, at any time to processing of personal data concerning him or her is necessary for

the performance of a task carried out in the public interest or in the exercise of official

authority vested in the controller; or where processing is necessary for the purposes of the

legitimate interests pursued by the controller or by a third party, except where such interests

are overridden by the interests or fundamental rights and freedoms of the data subject

which require protection of personal data, in particular where the data subject is a child or

(processing carried out by public authorities in the performance of their tasks) including

profiling based on those provisions. The controller shall no longer process the personal data

unless the controller demonstrates compelling legitimate grounds for the processing which

override the interests, rights and freedoms of the data subject or for the establishment,

exercise or defence of legal claims.

2. Where personal data are processed for direct marketing purposes, the data subject shall

have the right to object at any time to processing of personal data concerning him or her for

such marketing, which includes profiling to the extent that it is related to such direct

marketing.

3. Where the data subject objects to processing for direct marketing purposes, the personal

data shall no longer be processed for such purposes.

4. This right to object should be brought to the notice of the data subject at the very first

communication and shall be presented clearly and separately from any other information.

5. In the context of the use of information society services, and notwithstanding Directive

2002/58/EC, the data subject may exercise his or her right to object by automated means

using technical specifications.

6. Where personal data are processed for scientific or historical research purposes or

statistical purposes Article 89(1), the data subject, on grounds relating to his or her

particular situation, shall have the right to object to processing of personal data concerning

him or her, unless the processing is necessary for the performance of a task carried out for

reasons of public interest.

Glenstal Abbey School

Privacy Notice Page | 9

Right to withdraw consent

Where the processing is based on the data subject having given consent to the processing of

his or her personal data for one or more specific purposes except where Union or Member

State law provide that the prohibition the right to withdraw his or her consent may not be

lifted by the data subject; or where consent to processing of his or her personal data

revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade

union membership, and the processing of genetic data, biometric data for the purpose of

uniquely identifying a natural person, data concerning health or data concerning a natural

person's sex life or sexual orientation the data subject has the right to withdraw the consent

at any time, without affecting the lawfulness of processing based on consent before its

withdrawal;

Time frame to respond to requests

If you exercise any of your rights under the General Data Protection Regulations such as

access to and rectification or erasure of personal data or the exercise of the right to object,

Glenstal Abbey School (the Controller) is obliged to respond to requests without undue

delay and at the latest within one month and if Glenstal Abbey School failed to comply with

your requests, Glenstal Abbey School must give you reasons why.

Mechanisms for the right to request from the controller, access to and rectification or

erasure of personal data or restriction of processing concerning the data subject or to object

to processing as well as the right to data portability are available through Glenstal Abbey

School.

How a Data Subjects may verify the accuracy or request to amend their personal data?

A data subject may verify that their personal data submitted to Glenstal Abbey School is

accurate by double checking their data that they entered before submitting the details to

Glenstal Abbey School In the event of any inaccuracy being discovered in any e-mails or

other communications the data subject may send an e-mail to Glenstal Abbey School at

info@glenstal.com informing us of the inaccuracy and the relevant corrections required.

Glenstal Abbey School will rectify any inaccurate data highlighted.

How to exercise your data subject rights?

Similarly, if a data subject wishes to request their personal data to be deleted, or wishes to

request the portability of their personal data or to access their personal data, withdraw their

consent to the processing of same, the data subject may e-mail Glenstal Abbey School at

info@glenstal.com and request it. However, the data subject should note that the personal

data that is processed under ‘legal obligation’ cannot be deleted until the required period of

retention has expired, which is seven (7) years after the student reaches the age of 18 years

of age. Regarding the consent withdraw, if the data subject consented to more than one

form of processing, the data subject should clarify if the withdrawal is in respect of all

Glenstal Abbey School

Privacy Notice Page | 10

processing of their personal data or in respect of one or more purposes of processing their

personal data.

The controller is obliged to respond to a data subject request without undue delay and in

any event within one month and where the controller does not comply with the request the

controller is required to give reasons for such non-compliance.

Right of Data Subject to lodge a complaint with the Supervisory Authority

The data subject has the right to lodge a complaint with the supervisory if he or she feel that

any of their rights under the General Data Protection Regulations have been infringed and

the data subject also has a right to seek judicial remedy to any such infringement.

The Data Commissioner in Ireland may be contacted by

Telephone

+353 57 8684800 +353 (0)761 104 800

Fax

+353 57 868 4757

E-mail

info@dataprotection.ie

Postal

Address

Data Protection Commission Canal House Station Road

Portarlington R32 AP23 Co. Laois.

Dublin Office 21 Fitzwilliam Square Dublin 2 D02 RD28 Ireland.

Security of Personal Data

Glenstal Abbey School endeavour to hold all personal data securely in accordance with our

internal security procedures and applicable laws. Glenstal Abbey School will encrypt all

personal data received through Compass and PPOD Applications as well as through

ProtectorApp Encryption Program as applicable to ensure the protection of your personal

data and to prevent any unauthorised access to your personal data or the unauthorised use

of your personal data.

Unfortunately, no data transmission over the Internet or any other network can be

guaranteed as 100% secure. As a result, while we strive to protect your personal data, we

cannot ensure and do not warrant the security of any information you transmit to us, and

this information is transmitted at your own risk.

Risks & Safeguard

The greatest risk to personal data is that of unlawful access. Glenstal Abbey School has

addressed and mitigated such potential risk by regulation of access, provision of access

controls, encryption of personal data through Compass, PPOD, E-mail attachment encryption

application and ProtectorApp Encryption Program as applicable.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63