German School Nairobi (“German School”, “We” “Us” “Our”) is committed to ensuring that your personal data is collected and used lawfully and transparently.

German School processes personal data relating to you and your children. With regard to such processing, the School qualifies as a “Data Controller”. In this capacity, German School strives to comply with applicable Data Protection Laws.

German School Nairobi is a bilingual, multicultural, modern school in the heart of Nairobi offering primary and secondary education following a German curriculum. We nurture every child in the values of worldwide cosmopolitanism, interest and respect to fulfil their individual goals and aspirations. We are committed to protecting your privacy and that of your child(ren) when dealing with your personal data.

We are located along Limuru Road, Gigiri (across Village Market).

To perform our functions, we need to collect certain types of information from various people including pupils, parents/guardians, employees (administrative and support staff teaching staff, casual employees, interns and consultants), visitors to the school, alumni, suppliers, members of the public or any other relevant individuals (referred to as “you” or “your” in this Privacy Policy).

This Privacy Policy:

• sets out the types of personal data that we collect about you
• explains how and why we collect and use your personal data
• explains how long we keep your personal data for
• explains when, why and with who we will share your personal data
• sets out the legal basis we have for using your personal data
• explains the effect of refusing to provide the personal data collected
• explains the different rights and choices you have when it comes to your personal data
• explains how we may contact you and how you can contact us

This Privacy Policy applies to the personal data of:

• Parents/Guardians
• Pupils
• Persons visiting the school
• Alumni
• Tennis Club participants
• Members of the public
• Website users

To be clear, if you are a School employee, you should refer to the Employee Privacy Policy which is available in the School’s Intranet. If you are a Job Applicant, refer to our Job Applicant Privacy Policy available on this Website.

It is important to point out that we may amend this Privacy Policy from time to time. Please visit this page if you want to stay up to date, as we will post any changes here.

• We collect and use personal data to carry out the education services as prescribed above. We do so under the lawful basis that the processing is necessary for the performance of a contract in which you are entering or have entered.
• In some circumstances, we may have to process data for other purposes that are not necessary for the performance of the contract. In such cases, the processing may be based upon: -
o our legitimate interests, such as providing a safe learning environment
o the protection of you or your children’s vital interests
o the compliance with our legal obligations: and
o on the consent you or your children may have provided to us. Where processing of your personal data is based on consent, you have the right to withdraw consent at any time. Such withdrawal of consent shall not affect the lawfulness of the processing based on consent before the withdrawal.

• Your personal data will be shared internally within the school to allow us provide you and your child appropriate services.
• We may need to share your personal data externally with certain recipients, as well as with third parties processing your data on behalf of the School. More specifically, this includes the following categories of recipients:
o Schools that pupils join after leaving German School
o Other international schools (amongst others for the purposes of trips, sports and activities).
o Medical health providers, social service organisations (amongst others where sharing is in the vital interests, or where not sharing could have a negative impact on the individual).
o Providers of information systems that are necessary for the School to deliver the admissions, administration, teaching and learning, pastoral development, and child protection services;
o The Department for Education in Germany. The Department for Education (DfE) collects personal data from German Schools around the world pursuant to statutory provisions for quality control and assurance purposes
o Government organisations, police, health and social workers (where we are required to do so by law, or where we have obtained your consent to do so).
o Other third-party service providers we may engage from time to time.

Your children’s photographs and videos may be taken by staff and pupils throughout the school year to record and share everyday life at German School. Your child may be identifiable in these photographs or videos. Identifiable photographs of your child may be used for:
• educational and informational purposes (such as keeping records of lessons, field trips, sports, events, staff training), as we have a legitimate interest to do so
• the identification of your child for health-related purposes, such as allergies, as it is in the vital interest of your child to do so; and
• marketing and publication purposes, if and to the extent we have obtained your consent where required under applicable data protection legislation to do so.
The School holds copyright to such photographs and videos and infringement of the same may result to legal action being taken by the School.

German School has taken appropriate technical, administrative, and procedural security measures, consistent with local and international information practices and regulations, to protect personal data from misuse, unauthorised access or disclosure, loss, alteration, or destruction. These measures include:
• Technology safeguards, such as use of anti-virus and firewall, passwords, encryption, and monitoring of our systems to ensure compliance with our security policies
• Organizational safeguards, through secure physical storage facilities, CCTV cameras and efficient back-up and log procedures, training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through data protection and security policies and Policy standards that govern how the School treats personal data.
• If you suspect any misuse or loss of or unauthorized access to your personal data, please let us know immediately by sending us an email on dpo@germanschool.co.ke.

• Like most websites, this site uses Google Analytics (GA) to track user interaction.
• We use this data to determine the number of people using our site, to better understand how they find and use our web pages and to track their journey through the website.
• Although Google Analytics records data such as your approximate geographical location, device, internet browser and operating system, none of this information personally identifies you to us.
• Google Analytics makes use of cookies. So, what exactly is a ‘cookie’ and how is it used? A cookie is a small file of letters and numbers downloaded on to your web browser when you access most websites. Cookies allow a website to recognise your preferences when you return to a site (language, shopping basket contents etc). A cookie itself does not contain or collect information. However, when it is read by a web server it can help a website deliver a more user-friendly service.
• The website server which sends the cookie uses this number to recognise you when you return to a site or browse from page to page. Only the server that sent a cookie can read, and therefore use, that cookie. Cookies are important for the internet to provide a more customised experience.
• This website does not store any information that would, on its own, allow us to identify individual users of this service without their permission. Any cookies that may be used by this website are used either solely on a per session basis or to maintain user preferences. Cookies are not shared with any third parties.
• Disabling cookies on your internet browser will stop Google Analytics from tracking any part of your visit to pages within this website. Information on deleting or controlling cookies is available at www.AboutCookies.org
• By using our website, you agree that we can place these types of cookies on your device.

• Our ability to perform our obligations is derived from your business relationship with us and our ability to comply with our legal and contractual obligations sometimes depends on the School accessing and being able to use certain personal data.

• Therefore, and depending on the circumstances, if you do not provide us with personal data we request or if you ask that we stop processing your personal data, we may not be able to perform our contractual obligations, we may be in breach of one or more legal obligations applicable to us. In some cases, if we are not allowed to process your personal data, this may result in us being required to terminate our work relationship with you.

• The Data Protection Act, 2019 accords you with several rights over your data.

o right to information: you have a right to be informed of how The School will use your personal data.

o right of access: you are entitled to access your personal data that is in our possession or custody.

o right to object: you can object to the processing of all part of your personal data, unless we can demonstrate a compelling legitimate interest for the processing which overrides your interests or for the establishment, exercise or defence of a legal claim.

o right to rectification: you have the right to request us to rectify or correct, without undue delay, personal data in our possession or under our control that is inaccurate, outdated, incomplete or misleading

o right to erasure: you can request us to delete or destroy, without undue delay personal data that we are no longer authorized to retain, or which is irrelevant, excessive, or obtained unlawfully.

o right to data portability: you have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format and to transmit the data to another data controller without hindrance. You also have the right, where technically possible, to have personal data transmitted directly from us to another data controller or data processor.

o automated decision making you have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning or that significantly affects you. The School may from time to time make decisions based on the automated processing of your personal data. In such instances, you will be informed, in writing, whenever a decision based on automated processing is taken. In addition, you can request us to reconsider any decisions made based on automated processing or to take a new decision that is not based solely on automated processing.

o right of restriction: You have the right to request us to restrict the processing of personal data where: -
• you contest the accuracy of the personal data
• the personal data is no longer required for the purpose of the processing
• the processing is unlawful of you have opposed the erasure of the personal data and requested for restriction of its use instead.
• you have objected to the processing of personal data, pending verification as to whether our legitimate interests override your interests over the data.

o right to raise a complaint: You can raise a complaint about our processing with the Regulator i.e., the Data Commissioner in Kenya. You may also seek a remedy through the courts if you believe that your rights have been breached.

• If you wish to exercise any of the rights outlined above, please draft an email to the Data Protection Officer (DPO) on dpo@germanschool.co.ke.
• We will endeavor to answer all questions via email within the timelines stipulated in law.
• If the provision of the data involves the data of third parties, these third parties can be asked in advance whether they have objections to the provisions.
• We may ask for identification, because we need to know for certain whether we are issuing the data to the right person.
• In some cases, we will not be able to comply with your request. If this happens, you will be duly notified.

• To carry out the purposes outlined in Clause 6 of this Privacy Policy, your data may be transferred to:
o our cloud-based system service providers
o other third parties as stated in clause 8 of this Privacy Policy who may utilize servers located outside Kenya.

• We will only transfer your personal data outside Kenya where such transfer is compliant with the provisions of the Data Protection Act 2019 and the Data Protection (General) Regulations,2021

• To ensure that your personal data receives adequate levels of protection, we shall put in place appropriate procedures with our third-party service providers whom we share your personal data with to ensure that your personal information is treated by those third parties in a way that is consistent with, and which respects data protection laws.

• You are responsible for the information you make available to the School, and you must ensure it is accurate, honest, truthful, and not misleading in any way. You must ensure that the information does not contain material that is obscene, defamatory, or infringing on any rights of any third party.
• Further, if you provide any information concerning any other person, such as individuals you provide as emergency contacts and family doctor(s), you are responsible for providing any Policy and obtaining any consents necessary for the School to collect and use that information.

If you have any questions or complaints about the processing of personal data, you can contact our Data Protection Officer on the following email address dpo@germanschool.co.ke.

You can also write a letter addressed to:

The DPO,
German School
P.O. Box 978 - 00621
Nairobi, Kenya