- Introduction. 1
- Definitions. 1
- Principles of processing. 2
- Purpose of collection. 2
- The most common data and purposes of processing. 3
- Data disclosure. 4
- Keeping data. 5
- Data security. 5
- Rights of the data subject 6
- Subscribe to the Newsletter. 7
- Personal data transfer. 8
- Modifications to this policy. 8
- Contact 8
The main purpose of the European regulation 2016/679 on the protection of individuals with regard to the processing of personal data and the free movement of such data („Regulation”) is to increase the level of protection of personal data and to create a trustworthy climate that allows each person to control on its own data.
Acorns processes the personal data of potential learners, current and former learners as well as their parents and/or their legal representatives as part of the daily work required for providing educational services.
Acorns processes the personal data in accordance with the European Regulation.
Consent - of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action (excluding inaction, so that it cannot be interpreted as consent), signifies agreement to the processing of personal data relating to him or her.
Personal data – means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Controller – means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data subject – represents any natural person whose personal data are processed within Acorns’ activity development.
Processor – means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Processing – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as: collection, registration, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
The processing of personal data is performed in strict compliance with the legal provisions and the principle of the superior interest of the minor in a legal, correct and transparent manner.
Collection of personal data is performed only for specified, explicit and legitimate purposes and the data shall not be further processed in a manner incompatible with those purposes.
The collection of personal data will be appropriate, relevant and limited to the information required for the purposes of the processing.
Personal data will be accurate and, where necessary, updated.
All necessary measures shall be taken to ensure that incorrect data is erased or corrected without delay.
Personal data will be stored in a form that permits identification of the data subject and for a period no longer than the one in which the personal data are processed, except for the circumstances imposed by the law where the storage may be subsequently necessary.
All personal data will be kept confidential and stored in a manner that provides the necessary security.
Personal data will not be shared with third parties unless it is requited for the purpose of providing services under agreements.
Data subject has the right to request access to personal data, rectification and erasure, oppose or restriction of data processing and the right to data portability.
Personal data may also be processed on the basis of the consent granted before the processing of:
- Using photos and video clips of learners in different school publications, Acorns website and Acorns social media pages;
- Using contact details for direct marketing communications in fundraising activities;
- Providing educational services, starting with the process of enrolment of learners, administration of courses, educational activities;
- Providing ancillary educational services: emotional support, extracurricular activities, excursions, creative workshops, establishing a virtual environment for communication with parents;
- Ensure the headquarters security: access monitoring, video surveillance;
- Providing/ensuring medical services;
- Management and organization of the activity: administration of student enrolments and other educational documents, tax administration, internal audits and inspections, preparation of reports and statistics, implementation of school/educational policies, archiving, evaluation of services` quality, preparing the evaluation sheets;
- Communication: maintaining contact with parents and/or legal representatives;
- Organization of fundraising and/or other school events (e.g. shows, concerts, etc), including marketing communication on such activities;
- Solving disputes;
- For the purposes of collecting debts and recovering debts both amicably and through court actions;
- In order to carry out campaigns/surveys with the main objective to measure customer satisfaction with Acorns. Such campaigns can be managed internally by Acorns` employees, but also by third-party companies specialized in collecting feedback from customers.
- Personal data regarding identification and contact: name, surname, phone number, serial number, number and validity of the identity card, passport or temporary residence card in Romania, PIN, domicile address, e-mail address, bank data;
- Health related data: medical history, allergies, medical examination results, medical certificates and other medical data of the learners;
- Data related to the educational environment and the school performance of the learners: academic records, disciplinary or other educational materials, references, hobbies, educational test results, feed-back, evaluations, etc;
- Behavioural data, data on learners` preferences/interests;
- Family information: family history, known language, parents` profession and workplace, etc;
- Authentication and access data: e-mail, identity cards, location data, other online identifiers, etc;
- Photos and video clips;
- Technical information (IP address, device used to visit the site);
- Demographics data (date of birth, postal address);
- Login data (username and password);
- Data about your online behaviour and your preferences: the IP address of your mobile device and/or your computer, the pages you visit on our site;
- Data about your interest and needs: for example, when you complete a poll or call our customer services center.
Personal data collected by Acorns are generally provided directly by parents and/or legal representatives. In other cases, they may be collected from third parties such as: the doctor, the educational units where the leaners were previously enrolled, public authorities, etc.
We mention that there are certain categories of personal data that are absolutely necessary for enrolment within Acorns` educational system, as well as to provide adequate educational services to the learners.
Such categories of data are included within the enrolment form and within the educational contract. All the mandatory data categories for enrolling in Acorns` courses are brought to your attention.
Personal data can also be processed as a result of a legal obligation of Acorns (e.g.: guarding, video monitoring).
Personal data can be processed to perform a task in the public interest; considering that Acorns provides educational services that, in accordance with the applicable law, are considered to be a service of public interest, a significant part of the processing of personal data is strictly related to the educational purposes (for example: preparation and storage of academic records, performance evaluation of learners, etc).
Personal data may be processed having as scope the legitimate interest of Acorns, in order to provide educational services at the highest standards, always protecting the child`s best interest, without violating the rights and freedoms of the parents/legal representatives and minors.
For the same purpose, namely the legitimate interest, Acorns can also process personal data in the following situations: monitoring of the online communication channels; manage, control and achieve statistics on the activity of the education unit, ensure security, maintain close relationships with graduates and the Acorns community; collaborating with other educational units; executing contracts with suppliers, including insurance brokers.
Regarding the processing of special categories of personal data, respectively data related to health, Acorns processes such data based on the following grounds:
- The need to protect the learners for preventive medicine, diagnosis and health care or treatment;
- Processing is required for reasons of major public interest under European and/or national law, especially in situations where Acorns needs to assess the learner`s ability to learn and to adjust teaching to a learner`s special needs;
- Explicit consent of the parents/legal representatives of minors to disclose the personal data of the learners about their health status.
We will share the required part of your personal data only to the extent that such is necessary and only to the following third-party categories:
(a) companies that offer us products and services (empowered) such as: (i) media agencies, such as those that organize promotional campaigns and those who administrate the internet page; (ii) internet services: analysis, advertising; (iii) infrastructure agencies (third-parties which administrate the newsletter received by email, SMS marketing or other types of marketing, customer support or sale on our behalf); (iv) IT system suppliers and suppliers of related support service, including email archiving, telecommunication services suppliers, backup and disaster recovery, IT security services, on-line tools, server hosting suppliers;
(b) companies involved in the operation of our internet page;
(c) other parties such as public authorities and institutions, accountants, auditors, lawyers and other external professional counsellors, if their activity requires the disclosure or where the law requires us to disclose such data, courier service providers.
Acorns discloses personal data only to those members, staff and collaborators who are authorized to access personal data, mainly for ensuring the provision of educational and ancillary services. Thus, certain departments of Acorns personnel will have access to data on the health of learners in order to protect the minor`s best interest.
We will also disclose your personal data to third parties:
(a) if you request so or give us the permission to do so;
(b) to the persons who can prove they have the legal authority to act on your behalf;
(c) if it is our legitimate interest to do so in order to manage, expand or develop commercial activity (i) in the case of a business transfer (we sell part of the business or certain goods) linked to the website you subscribe to, we may disclose your data to the potential buyer of those commercial activities or goods to ensure that the business continues; (ii) if Acorns (or a substantial part of its assets) is acquired by a third party, in which case the personal data held by Acorns will constitute one of the transferred assets;
(d) In the event that we have the obligation to disclose your personal data in order to comply with the legal obligation, any legal request from governmental or executive authorities and as may be necessary to comply with certain national security or law requirements or to prevent certain illegal activities;
(e) To respond to any claim, to protect our rights or a third party, to protect the safety of any person or to prevent any illegal activity;
(f) To protect the rights, property or safety of Acorns, its employees, its customers, suppliers or any other person.
The criteria for determining the period for keeping the personal data is:
(a) Acorns will keep copies of your personal data in a form that permits identification only as long as:
(i) we maintain an ongoing relationship with you (for example, if you are included in our email list and have not unsubscribed);
(b) In addition, if relevant legal actions are lodged, we may continue processing your personal data for such an additional period of time related to the claim/action in question;
After the elapsing of the periods indicated at points (a), (b) above, each to the extent it is applicable, we will (i) erase or definitively destroy the relevant personal data, or (ii) we will anonymize the relevant personal data.
Acorns uses appropriate technical and organizational measures to maintain the confidentiality and security of your personal data. However, please be aware that these safeguards measures do not apply to the information you choose to share in the public space, such as social networks belonging to third parties.
Your personal data will be processed by our authorized personnel or agents only to the extent they are required to have access to such, depending on the specific purposes for which your personal data was collected.
We store your personal data in operating environments that use reasonable security measures to prevent unauthorized access. We respect reasonable standards for the protection of personal data.
The right to be informed, of access (the data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data)
This right may be limited or denied, the reason of denial of limitation following to be communicated to the data subject.
The right to rectification (the data subject shall have the right to obtain without undue delay, the rectification of inaccurate personal data concerning him or her) Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
The right to erasure (in the situations when (1) the personal data are no longer necessary for the fulfilment of the purposes, (2) the data subject withdraws consent and there is no other legal ground for the processing, (3) the data subject objects to the processing and there are no overriding legitimate grounds for the processing or (4) the personal data have been unlawfully processed, the data subject has the right to obtain the erasure of the data concerning him or her, without undue delay).
This right may be limited or denied, the reason of denial of limitation following to be communicated to the data subject.
The right to restriction of the processing - the data subject shall have the right to obtain the restriction of processing in the following situations:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
The Client has the right to object at any time to processing of personal data for direct marketing purposes, has the right not to be subject to a decision based solely on automated processing, including profiling – shall not have this right if the decision:
- is necessary for entering into, or performance of, a contract between the data subject and Acorns;
- is authorised by Union or Member State law to which Acorns is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests;
- is based on the data subject’s explicit consent.
The right to data portability - the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided, in a structured, commonly used and machine-readable format and have the right to request Acorns to transmit those data to another controller without hindrance from Acorns, if the following terms are cumulatively met:
- the processing is based on consent or on a contract and
- the processing is carried out by automated means, in the case that such shall be technically possible.
The right to lodge a complaint to Acorns – the data subject may lodge a complaint in the case that is not satisfied of the processing method of his or her personal data or of the answer provided to his or her requests.
The right to lodge a complaint with a Supervisory Authority – data subject shall have the right to lodge a complaint with the National Supervisory Authority of Personal Data Processing if is not satisfied of the processing method of his or her personal data.
Name: National Supervisory Authority of Personal Data Processing
Address: 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, postal code 010336, Bucharest, Romania
Phone no.: +40.318.059.211
Fax no.: +40.318.059.602
The right to file in court – the data subject has the right to address to competent courts of law if is not satisfied of the processing method of his or her personal data.
The data subject has these rights, regardless the grounds of his or her personal data processing.
Acorns Newsletters are transmitted with the insurance of the confidentiality and security of the information. Your consent represents the legal ground for data processing for the purpose of sending the newsletter, according to article 6 paragraph (1) letter (a) of the European Regulation.
Your option regarding the consent issued to Acorns may be changed at any time:
- by contacting Acorns in this sense
- by accessing the unsubscribe link displayed in the commercial messages received from Acorns.
The purpose of data processing is to inform the subscribers about the services, campaigns, contests and other events created or organized by Acorns, as well as information on offers, but not limited to the aforementioned.
Furthermore, you agree that we can save information about the modality you subscribed to the newsletter (for example, from the subscription form or from a contest form) in order to optimize the subscription possibilities. If, during your registration, you provide us from your initiative, optional data about your person (address, first name, name), you agree that we use this data in order to use a personal addressing in the newsletter.
Your data will be stored for a period of 2 years from the time of collection, or until the date of your consent withdrawal, whichever comes first. Your data will be used by us for other purposes, only if you have agreed to such uses. If you unsubscribe from the Acorns newsletter, your subscriber profile data is deleted. Consequently, you will not receive the newsletter anymore.
The storage and processing of your personal data, as described above, may require the transfer of your personal data and/or their storage to a destination outside your country of residence to states within the European Union (“EU”) or the European Economic Area (“EEA”).
Before such transfer, we will take the necessary measures to ensure that the personal data is properly protected, in accordance with the relevant privacy of data laws and internal policies of Acorns.
If the transfer of personal data will also be made to countries outside the European Economic Area and none of the following situations apply: you have expressly given your consent regarding the transfer of data, the transfer is necessary for the execution of a contract between you and the operator, the transfer is necessary for the conclusion of a contract or the execution of a contract concluded in your interest, it is important for reasons of public interest, necessary for the establishment, exercise or defence of a right in the court of law, necessary to protect your vital interests or of other persons when you do not have the legal capacity to express your consent, the transfer is made from a register that is intended to provide information to the public, the transfers may take place either on the basis of appropriateness/adequacy decisions issued by the Commission, or if the state in which they will be transferred offers adequate safeguards.
We reserve the right to make modifications to our practices and to this policy at any time. Please check the website regularly to see any updates or modifications of our confidentiality policy.
For any questions/remarks/clarifications regarding the processing of personal data, please contact us at: firstname.lastname@example.org phone no.: 0720064917
25th of May 2018