KENSINGTON SCHOOL, C.B., as Data Controller, informs you that your personal data will be processed in accordance with the provisions of Regulation (EU) 2016/679, on Data Protection (GDPR), in Organic Law 3/2018, on the protection of personal data and guarantee of digital rights (LOPDGDD) and in Law 2/2023, of 20 February, regulatory protection of persons who report regulatory and anti-corruption infringements, for which the following information on the processing is provided:
Purpose of processing: Management of the internal information system, processing the communications received through it, analysing the facts reported and deciding on the appropriateness of initiating an investigation, in order to detect possible crimes and prevent the imposition of any type of liability on the Data Controller, as well as to avoid any type of conduct contrary to the internal or external regulations applicable to the entity.
Legitimation of processing: compliance with a legal obligation, in accordance with article 6.1.c GDPR, derived from Law 2/2023, of 20 February.
Anonymous nature and confidentiality of your identity: Communications may even be submitted anonymously. In the event that the informant identifies himself, his identity will be reserved in any case and will not be communicated to the persons to whom the facts reported refer or to third parties, except in cases where there is a legal obligation.
Communication of data: Access to personal data will be limited exclusively to the persons and bodies legally authorised to manage the internal information system.
Your data will only be communicated to third parties when there is a legal obligation or when it is necessary for the processing of disciplinary, administrative or judicial proceedings that may be appropriate, and may be communicated, among others, to Courts and Tribunals, the Public Prosecutor's Office, the Security Forces and Corps and the competent administrative authority.
No international data transfers are planned.
Retention period: Personal data will be kept for the period essential to decide on the appropriateness of initiating an investigation. In any case, three months after receipt of the communication without any investigation actions having been initiated , it must be deleted, unless the purpose of the conservation is to leave evidence of the operation of the system. In the latter case, the information may only be stored in anonymized form. If investigation actions are initiated or judicial, disciplinary or administrative proceedings are derived, the data may be kept for as long as they are necessary for the processing of such procedures and for the formulation, exercise or defence of claims.
Rights of the interested party: You can exercise your rights of access, rectification, deletion, opposition and limitation of processing, by sending a communication to [email protected]. Youalso have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your rights are not being met.
The Data Protection Officer has a Data Protection Officer, to whom you may contact, to request more information or raise any question related to the processing of your data, at the following address: [email protected]