Privacy Notice

1. Who we are

Verita International School I.K.E. (Verita International School, the School) is incorporated in Greece. Our registered seat is 13 Smirnis Street, Glyfada 165 62. We operate across four campuses in the Athens area, listed in Section 12 of this notice. We are the data controller for personal data processed in connection with this website, which means we decide what data is collected and how it is used.

2. What we collect, and why

Information you give us

When you fill in a form on this site, for example to request a brochure, register interest in a campus visit, subscribe to our newsletter, or enquire about admissions, we collect the information you provide. This typically includes your name, email address, telephone number, the age or year group of the child you are enquiring about, and any free-text message you choose to send us.

We use this information to respond to your enquiry, to send you the materials you have requested, and where you have given consent, to keep you informed about events and developments at the School.

Information collected automatically

When you visit the site, our systems and our analytics providers may automatically collect technical information about your visit, including your IP address, the type of device and browser you are using, the pages you visit, the time of your visit, and how you arrived at the site (for example, from a search engine or social media link). This information is used to operate the site securely and to understand how visitors engage with our content so we can improve it.

Information from cookies and similar technologies

This site uses cookies and similar technologies. Section 9 describes them in detail. You can accept, decline, or change your cookie preferences at any time through the consent banner that appears on your first visit, and through the cookie settings link in the site footer.

3. The lawful bases we rely on

Under GDPR Article 6, every use of personal data needs a lawful basis. For website processing, we rely on the following:

• Consent (Article 6(1)(a)) for non-essential cookies, for newsletter subscriptions, and for any optional communications you choose to receive. You can withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)) for responding to enquiries you initiate, for keeping the site secure, and for understanding aggregate usage of the site. We have considered the balance between our interests and your rights, and you have the right to object (see Section 5).
• Legal obligation (Article 6(1)(c)) where we are required to retain or disclose data, for example for tax purposes or in response to a lawful request from a competent authority.

We do not knowingly collect special category data through this website. If you submit health, religious, or other sensitive information in a free-text field (for example, to explain a child’s learning need when enquiring about admissions), we will handle that information under the explicit consent or vital interests bases set out in our full Data Protection Policy.

4. Who we share it with

We do not sell, rent, or trade personal data. We share it only with parties that help us operate the site and the School, and only under contracts that meet the GDPR Article 28 standard for data processors. These currently include:

• Our website hosting and email infrastructure providers, used to operate this site and to deliver our responses to your enquiries.
• Our email marketing provider, Mailchimp (a service of Intuit Inc.), used to deliver newsletters if you have subscribed.
• Our analytics providers, Google Analytics (a service of Google LLC) and, where in use, Hotjar (a service of Hotjar Ltd.), used to understand how visitors engage with the site.
• Meta Platforms, Inc., where we use Meta Pixel and you have consented to marketing cookies, used to measure the effectiveness of our advertising on Facebook and Instagram.
• The Council of British International Schools (COBIS), where data is required in connection with the School’s COBIS Patron’s Accreditation, in accordance with that programme’s data protection arrangements.
• Competent authorities (for example, the Greek Ministry of Education and Religious Affairs, the police, or a court), where we are required by law to do so.
• Professional advisors, such as our lawyers, accountants, and auditors, who are bound by professional confidentiality.

5. International transfers

Some of the providers named in Section 4 are based outside the European Economic Area (EEA), principally in the United States. Where personal data is transferred to a country outside the EEA, we rely on one of the transfer mechanisms permitted under Chapter V of GDPR, which may include an adequacy decision by the European Commission, Standard Contractual Clauses (SCCs), or other appropriate safeguards. You can ask the DPO for details of the specific mechanism in use for any provider listed above.

6. How long we keep it

We keep personal data only for as long as is necessary for the purpose for which we collected it, or as required by law. In summary:

• Enquiry correspondence (where the enquiry does not lead to enrolment): up to 24 months, unless we are asked to delete it sooner.
• Newsletter subscriptions: for as long as you remain subscribed, plus 3 years for evidence of your consent.
• Website analytics data: 26 months, after which it is anonymised.
• Cookies: as set out in the cookie table in Section 9. Most expire within 13 months; some are session-only.

Where you become an enrolled family or staff member, longer retention periods apply under our full Data Protection Policy and applicable Greek law, including Greek Law 4808/2021 (employment data) and educational law.

7. Your rights

Under GDPR, you have the following rights in relation to personal data we hold about you. To exercise any of them, contact the DPO using the details in Section 11. We will respond within one month, with the possibility of a two-month extension for complex requests, in which case we will tell you within the first month.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority. Contact details are in Section 11.

8. Children

Under Greek Law 4624/2019, the digital consent age in Greece is 15. If you are under 15, please ask a parent or guardian to give consent before subscribing to our newsletter or otherwise providing personal data through this website. For prospective and enrolled students, our full Data Protection Policy sets out the additional protections we apply to children’s data.

9. Cookies and similar technologies

Cookies are small text files placed on your device by websites you visit. They allow the site to recognise your device and to remember information about your visit. Some cookies are strictly necessary for the site to function and cannot be switched off. Others are optional, and we set them only with your consent.

When you first visit the site, a consent banner appears asking which categories of cookies you accept. You can change your choice at any time through the cookie settings link in the footer. The categories are:

• Strictly necessary cookies, which enable core functions like maintaining your session and recording your cookie preferences. These are always on.
• Preferences cookies, which remember choices you make, such as your preferred language.
• Statistics cookies, which help us understand how visitors use the site, in aggregate. Set only with consent.
• Marketing cookies, which allow us to measure the effectiveness of advertising on social platforms. Set only with consent.

The principal cookies in use on this site are listed below. The list is updated periodically and may not be exhaustive.

10. Security

This site is served over HTTPS with a valid TLS certificate, which means data sent between your browser and our servers is encrypted. We require our processors to apply appropriate security measures under written Data Processing Agreements, in line with GDPR Article 32. Despite reasonable precautions, no system can be entirely free of risk; if we become aware of a personal data breach affecting your rights, we will notify the Hellenic Data Protection Authority and, where required, you, in line with GDPR Articles 33 and 34.

11. How to contact us, and how to complain

12. Our campuses

For transparency about where personal data is processed, the School operates from four locations:

• Early Years Campus, 30 Irakliou Street, Glyfada 166 75 (Nursery, Reception, Year 1)
• Primary Campus, 13 Smirnis Street, Glyfada 165 62 (Years 2 to 6) — registered seat
• Middle Years Campus, 4 Marinou Antipa, Alimos 165 62 (Years 7 to 9)
• Secondary School, 4 Marinou Antipa, Alimos 165 62 (Years 10 to 13)

13. Changes to this notice

We review this notice regularly and may update it. Where any change materially affects how we use your personal data, we will give reasonable notice, for example through a banner on the site or a direct email where we have your contact details. The Effective date at the top of this notice indicates when the current version came into force. Earlier versions are available on request from the DPO.