GDPR

GDPR Policy for Goshen Christian Schools Portal

1. Introduction

Goshen Christian Schools (“the School”) is committed to protecting the privacy and personal data of individuals who use our portal. This GDPR policy outlines how we collect, store, process, and protect personal data in accordance with the General Data Protection Regulation (GDPR).

2. Data Controller and Data Protection Officer

The School acts as the data controller for the personal data collected and processed through the portal. We have appointed a Data Protection Officer (DPO) who can be contacted at [DPO’s contact details] for any queries or concerns related to data protection.

3. Personal Data Collection

We collect and process personal data from portal users for the following purposes:

• Registration and account management
• Communication with users
• Academic administration and record-keeping
• Providing access to educational resources and materials
• Monitoring user activity and portal security

4. Lawful Basis for Data Processing

We process personal data based on one or more lawful bases as defined by the GDPR, including the necessity of processing for the performance of a contract, compliance with legal obligations, and consent where applicable.

5. Types of Personal Data Collected

The School may collect the following types of personal data through the portal:

• User identification information (e.g., name, student ID)
• Contact details (e.g., email address, phone number)
• Academic and attendance records
• User-generated content (e.g., assignments, forum posts)
• Login credentials (encrypted and securely stored)
• IP addresses and device information for security and troubleshooting purposes

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. When data is no longer needed, it will be securely deleted or anonymized.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security audits, and staff training.

8. Data Sharing and Third Parties

We may share personal data with trusted third-party service providers who assist us in operating the portal, providing services, or fulfilling our obligations. We ensure that these third parties are GDPR-compliant and have appropriate data protection measures in place.

9. Individual Rights

Individuals whose personal data is processed through the portal have the following rights:

• The right to access and obtain a copy of their personal data
• The right to rectify inaccurate or incomplete data
• The right to erasure (under certain circumstances)
• The right to restrict processing (under certain circumstances)
• The right to data portability
• The right to object to processing (under certain circumstances)
• The right to withdraw consent (if processing is based on consent)

10. Data Breach Notification

In the event of a data breach that poses a risk to individuals’ rights and freedoms, we will promptly notify affected individuals and the relevant supervisory authority in accordance with our legal obligations.

11. Changes to the GDPR Policy

We may update this GDPR policy from time to time to reflect changes in legal or regulatory requirements or our data processing practices. Any updates will be communicated to portal users.