NOVA Privacy Notice

1. Introduction

Nova International Schools, having its address at Prashka 27, 1000 Skopje, Republic of North Macedonia (hereinafter “NOVA” or “we” or “our”), collects, processes and stores the personal data of its prospective, current and former students and their parents or guardians, potential, current, and former employees, potential or current contractors or service providers and their employees, visitors and other natural persons in relation to the normal educational activities we conduct and in relation to the websites operated by us or on our behalf for such educational activities (https://nova.edu.mk/https://nova.openapply.comhttps://www.plusportals.com/NOVA) (hereinafter: “our websites”). With regard to such processing, NOVA acts as a data controller.

This NOVA Privacy Notice (hereinafter “Notice”) explains how we collect and use personal data, who we share it with, the ways in which we protect your privacy while doing so, as well as what rights do you have with respect to such processing of personal data. This Notice applies to all personal data collected for and on behalf of NOVA. This pertains to both data collected in paper form (forms, documents, in writing) and in electronic form through technological means, such as local and cloud-based information systems and email.

We may inform you when we require additional personal data for these or other processing activities through a separate privacy notice or otherwise, as applicable.

NOVA reserves the right to make changes to this Notice, for example in the light of new developments or new legislation. NOVA will always inform you of such changes in advance.  In any event, it is recommended that you consult this Notice regularly.  

2. How we collect your personal data

We may collect your personal data in a variety of ways:

  • Personal data relating to our potential, current and former students and their parents or guardians can be obtained: (i) directly from our students and their parents or guardians, including through forms that we use in our operations, which are available on our websites or at our premises, through contracts for our services and through meetings with our personnel; (ii) via other information channels, such as previous schools, health professionals, etc. and (iii) by actions of NOVA itself or its data processors, e.g. through evaluations, camera surveillance, access control measures, etc.

  • Personal data relating to our employees can be obtained (i) directly from our employees, including through forms that we use in our operations, which are available on our websites or at our premises, or through employment contracts; and (ii) by actions of NOVA itself or its data processors, e.g. through evaluations, camera surveillance, access control measures, etc. 

  • Personal data relating to candidates for employment with NOVA can be obtained: (i) directly from the candidates for employment, including through forms that we use in our operations, which are available on our websites or at our premises, and through job interviews with our personnel and (ii) from third parties, if necessary, for which we will inform you.

  • Personal data relating to our contractors or service providers and their employees can be obtained: (i) from our contractors or service providers and/or their employees and (ii) by actions of NOVA itself or its data processors, e.g. through camera surveillance, etc.

  • Personal data relating to persons making enquiries through our websites (including potential students or their parents or guardians) can be obtained directly from such persons through our websites.

  • Personal data relating to persons making payments through our websites can be obtained directly from such persons through our websites.

  • Personal data relating to visitors to our premises can be obtained: (i) directly from such visitors and (ii) by actions of NOVA itself or its data processors, e.g. through camera surveillance, etc.

3. The categories of personal data being processed

The personal data that NOVA collects and processes, individually or in combination, include: 

  • For potential students (for which enquiries are submitted through our websites): general identification information (name and surname, gender, date of birth); contact information (home address, e-mail address); native languages; citizenship; potential application for enrolling in a specific grade in a specific academic year; current school. 

  • For the parents or guardians of potential students (for which enquiries are submitted through our websites): general identification information (name and surname, gender); contact information (home address, e-mail address, Skype address, home phone, mobile phone); occupational information (occupation; organization of employment);relationship to potential student.

  • For applicant students: general identification information (name, surname, middle name, nickname, gender, date of birth, place and country of birth, country of citizenship, unique identification number (for Macedonian citizens), passport number (for foreign citizens), photo), contact information (home address, address of place of stay, e-mail address, home phone, mobile phone); native languages; are both parents living; marital status of parents (separated or divorced), custody rights and living arrangements with parents or guardians; current grade, current school information (name of school, address of school, language of instruction, grades attended), application for enrolling in a specific grade in specific quarter of academic year. Special categories of personal data: health related data about the applicant student (special educational needs due to disability status or health condition).

  • For the parents or guardians of applicant students: general identification information (name, surname, middle name, gender); contact information (home address, e-mail address, home phone, mobile phone); occupational information (occupation, job title, organization of employment, business address, business phone); relationship to applicant student; marital status of parents (separated or divorced), custody rights and living arrangements with student; information about other children in the family (name, surname, middle name, date of birth, current school, current grade).

  • For our current or former students: general identification information (name, surname, middle name, nickname, gender, date of birth, place and country of birth, country of citizenship, unique identification number (for Macedonian citizens), passport number (for foreign citizens), photo), contact information (home address, address of place of stay, e-mail address, home phone, mobile phone); native languages; are both parents living; marital status of parents (separated or divorced), custody rights and living arrangements with parents or guardians; pedagogical records data (educational performances, behavior, class attendance and absences); information relating to IT systems used by NOVA and physical access control (username, password, logs, badge number); video recordings. Special categories of personal data: community affiliation, health related data about the student (data on mandatory immunization, special educational needs due to disability status, data in medical notes for absences, results from medical examinations and psychological evaluationsany special health condition or therapy we may be informed about).

  • For the parents or guardians of our current or former students: general identification information (name, surname, middle name, gender, unique identification number, date and place of birth); contact information (home address, e-mail address, home phone, mobile phone); occupational information (occupation, job title, organization of employment, business address, business phone); degree in education; relationship to student; marital status of parents (separated or divorced), custody rights and living arrangements with student; information relating to IT systems used by NOVA (username, password, logs). Special categories of personal data: community affiliation.

  • For our employees: general identification information (name, parent name, surname, gender, unique identification number, date and place of birth, citizenship, pension insurance number, health fund unit of registration); contact information (address, place of residence municipality, temporary address and place of residence, e-mail address, home phone, mobile phone, business phone); work related information (job position, employee category, employee status (for undetermined or determined period of time), date of employment, date of termination of employment, grounds for termination of employment, information about salary and related levies, working time, evaluations), financial information (bank account number); information about education and qualifications (type and degree in education, last completed school / faculty, prior work experience),  information relating to IT systems used by NOVA and physical access control (username, password, logs, photo, badge, car registration number). Special categories of personal data: community affiliation, disability. 

  • For candidates for employments with NOVA: identification and contact information (name and surname, address, phone, email); qualifications; work experience; other information that the candidates for employment voluntarily provide. 

  • For contractors or service providers and their employees: general identification information (name and surname, vendor ID number); contact information (contact phone, email, address), financial information (bank account number), work related information (job position, organization,  business addresses); authentication and physical access data (photo, badge).

  • For persons making payments through our websites: identification information about payer (name, surname, email); information about the student for whom the payment is made (name, surname, grade, academic year); payment details (amount, date of payment, purpose of payment).

  • For visitors to our premises: identification information (name, surname, organization the visitor represents, if applicable); data on camera surveillance records.

 

4. Why we use your personal data

NOVA collects and processes personal data generally about the above described categories of data subjects to provide a safe and caring environment for teaching, learning and general educational purposes and for other purposes compatible with such purpose. More specifically, NOVA processes personal data for the following purposes:

  • to respond to inquiries for the provision of our educational services and our educational ancillary services; 

  • to provide educational services, starting with the application process, enrolling students, administration of classes and timetable, teaching activities, administration of internal and public examinations, assistance regarding the application process to various universities, issuance of academic records;

  • to provide educational ancillary services: library services, extracurricular activities, school trips, school events, managing school’s publications, setting up the virtual learning environment and granting access to our websites as well as monitoring the use of our websites;

  • to implement our contract with the parents or guardians or our students for the provision of the educational and educational ancillary services we provide;

  • to conduct school administration: handling student records and other academic documentation, administration of fees and accounts, internal audits and controls, reporting and statistics creation, implementing school policies, archiving, assessing the quality of our services, facilitating research activities, including for forecasting and planning for education service provision; 

  • for school related communications: conveying various messages related to the students and our services, news, events and activities that are undertaken at or in association with NOVA by any communication means.  

  • to comply with statutory requirements for keeping pedagogical records; 

  • to comply with statutory requirements arising from the essential pubic interest for child protection, for collecting information and covering special educational needs of our students arising from a disability status or specific health condition, including for providing medical care and support and care for emotional and psychological wellbeing of our students,  

  • to provide a tailored learning environment and make evidence-based education decisions for our students, including to support and enable the academic, extracurricular and personal objectives of children, including the monitoring and reporting of progress, and to enable our students to continue or progress their education at other educational organizations;

  • for organizing fundraising activities and other school events (e.g., concerts, theatre productions, talent shows), including marketing communications related to the fundraising activities organized by NOVA;

  • for financial planning to help in the future planning and resource investment purposes;

  • to meet our statutory reporting requirements to the education and other authorities, and to collaboration with other schools and educational institutions;

  • to respond to requests for employment with NOVA, and to conclude and implement employment contracts with qualified teachers and other staff at NOVA; 

  • to support and develop our employees in the performance of their duties;

  • to respond to requests of our staff and (former) students regarding historic information pertaining to their time at NOVA;

  • to conclude and implement contracts with independent contractors and services providers; 

  • to facilitate payments to NOVA made for different purposes, including tuition fees;

  • to provide a safe and secure learning and working environment at our campus (to ensure the safety and security of students, parents / guardians, staff, services providers), through monitoring access on campus and performance of video surveillance (for the protection of the life and health of people and of the staff due to the nature of their work, for protection of property and to control entry and exit from campus for security purposes);   

  • for other legitimate purposes such as for the operation, maintenance and security of our websites and IT systems, to investigate any concerns or complaints, and to protect our legitimate interests including dispute resolution and litigation. 


5. On which basis NOVA processes your personal data

We collect, process and use personal data for the purposes described above, based on one of the following grounds: 

  • For the performance of the enrollment contract (and provision of our educational and ancillary services), as well as in order to take steps at your request for entering into the enrollment contract and to further provide such our educational and ancillary services;

  • To comply with NOVA’s statutory requirements to collect and retain data, including special categories of data, (especially, pedagogical records for students and data about their parents or guardians in accordance with the Law on the Protection of Children, the Law on Primary Education and the Law on Secondary Education, and employment records about its employees, under the Law on Records in the Field of Labor and the Law on Holidays), as well as to comply with statutory duties to share relevant information with educational, tax or other competent authorities;

  • For the protection of the vital interests of our potential, current and former students, their parents or guardians, and our potential, current and former employees, including the protection of their life and health;   

  • For the performance of the employment contract, as well as in order to take steps at your request for entering into the employment contract and to further provide employment;

  • For the performance of the service contract, as well as in order to take steps at your request for entering into the service contract and to further provide the related services;

  • Based on the consent for the use of students’ and employees’ photographs and videos in various school publications, on NOVA’s website and social media pages, and for various other processing activities from time to time; 

  • Based on the legitimate interest pursued by NOVA, namely our interests such as providing a safe learning environment, maintaining the school community, fundraising, etc. NOVA may especially invoke the legitimate interest legal ground in the following cases:

    • safeguarding the protection of our students and the wellbeing of those within our care;

    • monitoring use of NOVA’s virtual learning environment and network, including monitoring the use of e-mail accounts provided by NOVA;

    • conducting fundraising activities, including marketing of such activities;

    • enforcement of legal claims, addressing complaints and third party controls;

    • management, control, reporting and performing statistics on schools activity;

    • ensuring security;

    • maintaining close relationships with alumni and the NOVA community;

    • collaboration with other schools and educational institutions;

    • performance of agreements with suppliers, including insurance suppliers;

    • access to grants and other funding sources.

 6. Retention of personal data

NOVA will retain personal data for as long as required by law or for as long as necessary with regard to the purposes described in section 4 of this Notice or for any other purposes that may be communicated to you. In any case where a legal provision imposes a mandatory retention period, NOVA will keep the Personal Data for that mandatory period. Subject to appropriate safeguards, NOVA may keep some information during a longer period if needed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

NOVA will retain personal data about unsuccessful candidates for employment with NOVA for a period of up to one year following the completion of the relevant job application process.    

NOVA keeps your personal data in paper form in its premises, and in electronic form on its own servers. 

Regarding transfers outside the European Union, see section 8 of this Notice.

 

7. Disclosure of personal data

NOVA discloses personal data about its potential, current and former students and their parents or guardians only to those members of NOVA, staff and collaborators, who need access to the personal Data, mainly to ensure the provision of the educational, employment and ancillary services, to comply with legal requirements or protect the vital interest of the individuals.

For the purposes described in section 4 of this Notice, NOVA may need to disclose personal data it holds externally to certain recipients, as well as with third parties processing such data on behalf of NOVA. More specifically, this includes the following categories of recipients:

  • Providers of information systems, including educational applications, on-line tools, that are necessary for NOVA to deliver the admissions, administration, teaching and learning, development, and child protection services, including providers of IT hosting and maintenance services;

  • Schools, colleges or universities that the students attend after leaving NOVA; Other international schools (amongst others for the purposes of trips, sports and activities);

  • Local education authorities, tax authorities, law enforcement authorities or other competent public authorities (where we are required to do so by law, or where we have obtained your consent to do so);

  • Health care professionals, health care organizations or social service organizations (amongst others where sharing is in the vital interests of the individual);

  • Travel agencies, catering and transportation providers;

  • Photographers and videographers contracted by NOVA;

  • Third-party services providers (tax, legal and accounting consultants, payroll and financial service providers).

 8. Transfers of personal data abroad

Personal data may also be transferred to organizations outside North Macedonia and outside the European Union (EU) and/or the European Economic Area (EEA). This may, for example, occur for the purposes of student application for college or university. Some teaching and learning applications of providers that are based outside the EU and /or the EEA are also used. For such transfers of personal data outside the EU and/or the EEA, NOVA has implemented suitable safeguards, including in the form of appropriate contractual clauses for protection of personal data, where required under applicable data protection legislation.  More information on these transfers and suitable safeguards can be requested from the NOVA Privacy Officer (see section 13 below).  

9. Cookies

We may use cookies on our websites only for statistical purposes, therefore not collecting and storing any personal data. 


10. Camera surveillance

We implemented a video surveillance system on the campus to ensure the security of its students, staff and other persons that enter our premises. The security and wellbeing of our students is our primary concern and these video cameras allow us to offer real time protection. Areas covered by a video camera or cameras on campus are identified through specific signage. We retain these video recordings for no more than 30 days after which they are deleted, unless we need to retain the images for further investigation or law enforcement purposes. Access to these images can be requested through the NOVA Privacy Officer (see section 13 below).

11. Photographs and videos

Non-targeted photographs and videos of our current or former students and/or their parents or guardians and other visitors of our premises may be used for educational or other purposes where we have a legitimate interest to do so, for example, to document the broader learning environment at NOVA, within marketing and promotional activities, or for their identification for security purposes.

There are other occasions, however, where NOVA may wish to publish your image, for example, as a way of documenting and sharing learning at NOVA. In such instances, NOVA staff and students may, where applicable with permission, take photographs and videos throughout the school year to record and share everyday life at NOVA. 

The making and usage of non-targeted images (i.e. images that reproduce a more general and rather spontaneous, non-posed image, without focusing on one or more persons, such as general atmospheric pictures or group pictures) is based on NOVA’s legitimate interests. Individuals have the right to demand we stop processing such images at any time. 

For the making and using of individual or targeted images the consent of the data subject is required and collected via a relevant contract (e.g. the enrollment contract for the student) or a specific consent form, as applicable. Targeted images refer to individual photographs or videos whereby specific persons constitute the main subject or when one or a few people are highlighted during a group activity or when posing for an image. 

11.1 Use of personal devices 

Where personal devices are used to take a photograph and/or video images of learning at NOVA, the holder of the device becomes the ‘data controller’ for them and accepts liability liable for their use and/or distribution including in the event of a data breach, or any other requests made by the data subjects contained within the images, including for amending, removing or deleting any personal data pertaining to any data subject affiliated to NOVA, without undue delay upon their request, including where such data may have been uploaded to your social media accounts.

11.2 ControlPanel/Uploading of photographs and videos

NOVA strives to enable NOVA staff and students to embrace developments in educational applications for learning purposes and to achieve this within a framework designed to guarantee the highest levels of data protection for all members of our community. Where images, videos and personal data of students may be uploaded to online resources or storage systems, this shall be carried out only where appropriate contracts have been established with such vendors according to applicable legislation on personal data protection, if required, and under the following conditions:

  • where we have a legitimate interest to do so, (for example marketing and print publications including school promotional literature, and promotional images on school-managed websites).

  • on the basis of our contract with you to deliver educational services, (for example through the creation of necessary online accounts for learning, or through the uploading of data to educational services providers);

  • after you have granted your explicit consent via collected via a relevant contract (e.g. the enrollment contract for the student) or a specific consent form, as applicable. 

11.2.1 Internal secure digital platforms

NOVA uses secure digital platforms to process personal data internally and to share student learning with their parents or guardians, as well as with our relevant staff. These platforms are not accessible to a wider external community and are founded on a contract with the service provider, which includes a guarantee to protect the data processed within it.  The use of such secure platforms is based upon a legitimate interest in the course of delivering education services.

11.2.2 External digital platforms

NOVA also manages official school social media accounts including, but not limited to Facebook, YouTube, Twitter, Instagram, and LinkedIn. These accounts are created in the absence of a formal data processing agreement with the service provider, and as such, a high level of data privacy cannot be guaranteed.

Faculty and Staff at NOVA may also have personal social media accounts, created either through their nova.edu.mk email account, or an alternative personal email address, which they use to document day to day learning at NOVA. NOVA does not manage these accounts. For any processing of personal data via these accounts, the person holding the relevant account qualifies as the data controller.

11.3 Performing arts, sporting events and live streaming

Significant events within the school calendar such as graduations, public events, or sports and academic competitions may include live streaming. Where such events are NOVA hosted, live streaming occurs through unlisted or password protected online resources such as YouTube, Google Hangouts Meet or ZOOM.

Furthermore, where performing arts or sporting events are held externally, such events may also be live streamed according to conditions agreed upon by the external host, who will then qualify as the data controller.


12. Your rights

The data subjects whose personal data are collected and processed by NOVA as described in this Notice (potential, current and former students and their parents or guardians, candidates for employment with NOVA, current and former employees, independent contractors and service providers and/or their employees, persons making payments via our websites, visitors of our premises) may exercise a number of rights with regard to the processing of their personal data by NOVA under the conditions of the Law on Personal Data Protection in effect in the Republic of North Macedonia, as may be amended from time to time. Students that have reached a certain age and an appropriate level of understanding may themselves exercise the rights listed in this section.

The rights which you may have under applicable data protection legislation are:

  • Right to information and access – to request access to and a copy of the personal data NOVA holds on you, as well as the right to information about relevant aspects of the data processing by NOVA. The right of access entails your possibility to obtain the confirmation from NOVA whether your personal data is being processed by NOVA, and, in cases where it is, to solicit access to this data, as well as additional information regarding that personal data, such as: the purposes of processing, the categories of recipients the personal data are being disclosed to and the envisaged retention period. This Notice serves to inform you thereon, but in the situations where you may need to exercise the right of access, please contact the NOVA Privacy Officer (see section 13 below) for further questions and request confirmation or access to your Personal Data by completing and submitting our Access to Personal Data Request Form. Please note that there might be specific situations that are exempted from the right of access, such as information that identifies other individuals or which is subject to confidentiality obligations.

  • Right to rectification – the right to request NOVA correct inaccurate personal data or to complete incomplete personal data that it holds. 

  • Right to erasure – the right to request the deletion or removal of personal data in specific circumstances, for example if your personal data are no longer necessary for the purposes pursued by NOVA or where the processing is based on your consent, and you have withdrawn such consent.

  • Right to restriction of the processing – the right to obtain restrictions on the processing of your personal data by NOVA. Please bear in mind that this right can be exercised only in specific situations laid down by the applicable law, for example, where you have told us the data is inaccurate and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate. 

  • Right to data portability – to right to receive your personal data in a structured, commonly used format and machine-readable format and further to transmit such data to another controller. This right to data portability shall be applicable only to the personal data you have provided to us and where the processing is carried out by automated means based on your consent or for the performance of the contract you have concluded with NOVA.

  • Right to object – the right to object on grounds relating to your situation to the processing of your personal data by NOVA based on the legitimate interests of NOVA or for direct marketing purposes. 

  • Right not to be subject to automated individual decision-making – the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Please note that this right is excluded in certain situations regulated by the applicable law on personal data protection.

  • Right to withdraw your consent - the right to withdraw your consent given for various processing operations by NOVA, in cases where the consent represents the lawful basis for processing.  The processing will end from the moment the withdrawal takes place, but such withdrawal of consent shall not affect the lawfulness of the processing based on consent that took place prior such withdrawal.

  • Right to lodge a complaint - the right to challenge the manner in which NOVA performs processing of your personal data with the Agency for Personal Data Protection of the Republic of North Macedonia, having address at Blvd. "Goce Delcev" 18 (Building of the Macedonian Radio Television - 14th floor, Post Office box 417 1000 Skopje. 

There may be instances where you may not want us to process or share your personal data. In these cases, we may not be able to fulfil the service you need, or do so in a limited way, or conclude an employment contract or a service contract with you, or be able to comply with a statutory obligation. In those instances, we will not be able to comply with your request and we will tell you if this is the case.


13. NOVA Privacy Officer & Contact

For any questions or concerns relating to this Notice or the processing of your personal data by or on behalf of NOVA, as well as for the exercise of any of the rights described this Notice, please contact the NOVA Data Protection Officer (arta.kjato@nova.edu.mk).

NOVA shall respond to requests and may or may not act upon them, in principle within a period of one month, all in accordance with applicable data protection legislation.


14. Applicable law and jurisdiction

This Notice and any disputes arising out of in relation to this notice shall be exclusively governed by and construed in accordance with the laws of the Republic of North Macedonia. The courts in Skopje, North Macedonia, shall be exclusively competent for any disputes arising out of or in relation to this Notice.

This Privacy Notice has last been updated on May 12, 2020.