Privacy policy

This is a technical template, not legal advice. The school must adapt it with the DPO and, where needed, a lawyer.

Data controller: [full name of the school], [address]. Data protection contact: [DPO / GDPR e-mail].

We process personal data to run the website, answer requests, handle contact forms, administer accounts and meet legal duties. Legal bases follow the GDPR (consent, legitimate interest, legal obligation, public task).

Form data and technical logs are kept according to internal policy and system settings (e.g. contact message retention). We do not sell data or use advertising trackers.

You have GDPR rights (information, access, rectification, erasure, restriction, objection, portability, complaint to the supervisory authority). Send requests to the DPO contact above.

Data may be accessed by authorised school staff and, under contract, IT providers (e.g. maintenance) acting as processors.

Transfers outside the EEA only occur with appropriate safeguards and documentation.

Last updated: [date]. Earlier versions are available from the controller.