This privacy notice deals with information about students and their families.  

At Aprendizes, personal data treatment is dictated by the school's activities, exercise of its mission and legal requirements (Portuguese law Lei n.º 58/2019, de 8 de Agosto). 

Information and data provided to Aprendizes are confidential and digitally recorded, taking into account the legislation about the protection of personal data, claims and databases created for this effect. 

We have implemented the following security measures to protect personal data: 

• Physical Security: Restricted access to the premises where the data is physically stored. 

• Digital Security: Use of data encryption, user authentication and firewalls. 

• Regular Backups: Periodic backups of data to ensure recovery in the event of loss. 

• Employee Training: Ongoing training on good data protection and information security practices. 

When carrying out the student admission and/or enrolment renewal process (via the platform used for this purpose), the student's guardian gives consent to the school to use the student's data, whether biometric or academic in nature. Biometric data processed on the basis of explicit consent. 

We use our students' personal data to: 

• Support the learning process and monitor academic progress. 

• Manage administrative processes, such as enrolment and renewal of enrolment. 

• Comply with legal and regulatory obligations, including reporting to government bodies. 

• Improve the quality of our educational services. 

We collect and maintain personal information about students, families, and employees.  

We can receive information about students obtained from previous schools or other sources related to their schooling or staff development. It provides contact details, reports of results, attendance information, behavioural information, disciplinary and exclusion information, and other information.  

We collect and hold personal information about students, families and staff, including: 

• Personal Data: Name, address, contact details, date of birth. 

• Academic Data: Grades, progress reports, attendance, disciplinary information. 

• Sensitive Data: Biometric data (photographs), information about allergies or dietary restrictions, data about specific educational needs, relevant medical information. 

• Employee Data: Contracts, salary records, tax information. 

Biometric data will be deleted immediately after the end of the contractual relationship, unless legally obliged to do so. 

Students' academic data is stored securely in encrypted databases hosted on EU-certified servers. 

Information such as allergy details or dietary restrictions (which may reveal sensitive data, such as religious beliefs) is processed only when strictly necessary and with explicit consent. 

There are, together, information on personal characteristics (such as nationality, religion, ethnicity, family situation, specific educational needs, relevant medical information) and other information that may be relevant to those of us alone. 

This data will not be used by anyone else but for those who are legally entitled or for whom consent was given by the owner of the data. 

We do not provide information about our employees without the consent of the respondent, other than what is required by law or is required by the government. Employees data (such as contracts, salary records, etc.) must be kept for as long as necessary to comply with legal obligations, such as taxes and social security, Portuguese legislation requires the retention of this data for 10 years. Non-essential personal records, such as temporary contact details or interim reports, are deleted after their purpose is fulfilled, in line with the school's data retention policy. 

The personal data and final assessments of students are shared with the Ministry of Education as required by law, in accordance with the school's legal obligations. 

In addition to the Ministry of Education, student data is shared with the Portuguese tax authority as well as external entities such as digital education platforms which put in place measures to protect customer information. Student data shared with external entities, such as digital education platforms, is transferred under strict contractual agreements, ensuring compliance with GDPR standards, including Standard Contractual Clauses where applicable. 

The data controller ensures the rights of the data subjects, including access, verification, and updates to their data. These requests can be made through the designated channels or directly to Aprendizes. 

The framework of the RGPD allows the holder the right to remove, oppose the storage of data, verification, and data updates, which can be requested by email at rgpd@osaprendizes.pt. 

Data subjects (students, parents and staff) have the following rights, in accordance with the GDPR: 

• Right of Access: Request a copy of the personal data processed by the school. 

• Right to Rectification: Correct incorrect or incomplete data. 

• Right to be Forgotten: Request the deletion of data, where applicable. 

• Right to Restriction of Processing: Request restriction of the use of data. 

• Right to Data Portability: Receive data in a structured format and transfer it to another controller. 

• Right to Object: To object to the processing of data for specific purposes. 

All of these rights are subject to certain safeguards and limits or exemptions. To exercise any of these rights, you should contact rgpd@osaprendizes.pt.

Personal data collected and processed by the school will be stored based on the principles of necessity, minimization and adequacy, in accordance with the GDPR. The retention period is 5 years after completion of the school cycle, unless a longer period is required by legal obligation.” 

The data entered into the platforms used by the School with regard to students and staff is stored and protected in accordance with the privacy policy and GDPR.