The first college in Switzerland to offer an English Year 10 programme.

Data Protection Policy Hull's School

Version: January 2024

With this Data Protection Statement we, the Hull’s School Ltd. (hereinafter «we», «us» or the «school»), describe how we collect and further process personal data about students, parents, legal guardians, visitors to our website, participants in events, school camps and courses, business partners and their officers, recipients of newsletters, and other persons (hereinafter «you»). This Data Protection Statement is not necessarily a comprehensive description of our data processing. It is possible that other data protection statements are applicable to specific circumstances.

The term «personal data» in this Data Protection Statement shall mean any information that identifies or could reasonably be used to identify a person.

If you provide us with personal data of other persons (such as family members, legal guardians), please make sure the respective persons are aware of this Data Protection Statement and only provide us with their data if you are allowed to do so and such personal data is correct.

This Privacy Notice is aligned with the Swiss Data Protection Act («DPA»), and also takes into account the EU General Data Protection Regulation («GDPR») insofar as applicable. However, the application of these laws depends on each individual case.

1. Controller

The «controller» of the processing of personal data as described in this Data Protection Statement (i.e. the responsible person) is:

Hull’s School Ltd
Falkenstrasse 28a
CH-8008 Zürich
Email: college@hullschool.ch

You may contact us for data protection concerns or to exercise your rights in accordance with Section 9.

2. Collection and Processing of Your Personal Data

We process various categories of data about you. The main categories of data are the following:

Master data: By master data, we mean the basic information we need to fulfill our educational, contractual, or business relationships, and for marketing and promotional purposes, including, as applicable, your name, contact information, gender, date of birth, nationality, photographs, copies of ID cards or passports, bank information, information about your role and function, and information about third parties (e.g. family members, legal guardians, representatives).
Registration data: When you register for a college year, summer camp, information evening or an event with us, we process the information you provide to us, including, as applicable, the school year for which you are registering, the entry date, your gender, native language, social security number, educational history, medical information, information contained in your applicable materials, and information about third parties (e.g., family doctor). This may include health data.
Educational data: As a student at our school, we process information related to your education, including the courses, camps and other events you attend, the papers and projects you submit, your academic progress, attendance records, disciplinary records, student ID, grades, information about special education needs, and any other information relevant to our educational relationship with you.
Contract data: By contract data, we mean the data we collect in connection with a contract entered into by us or the provision or delivery of our educational services, such as information about the type of contract, the date the contract was entered into, the term of the contract, the contractual services, information collected during the period leading up to the conclusion of the contract, information required or used for processing (e.g. billing information), information about reactions (e.g. complaints, feedback, etc.), financial data, and information about third parties. This may also include health data.
Account data: By account data, we mean the information that we collect and store about you to allow you to login to our systems, access our buildings, identify and authenticate yourself to third parties, and have your «personal» space within our computer systems (such as your student mailbox). Account data will typically include your name, potentially contact information, access rights, and information in connection with access control systems.
Communication data: When you communicate with us or third parties (e.g. via the contact form, e- mail, telephone, letter or other means of communication), we collect the data exchanged between you and us (e.g. the content of e-mails or letters), including your contact details and the metadata of the communication and, where applicable, the copy of an ID document. This may include audio and video recordings of calls.
Technical data: When you use our digital offerings (e.g. website), we collect technical information, including your IP address, information about your device’s operating system, location, and access time. Technical data in itself does not permit us to draw conclusions about your identity. However, technical data might be linked with other categories of data and thus possibly with your person.
Behavioral and preference data: By behavioral and preference data, we mean data about your behavior and your preferences (e.g. your response to electronic communications, navigation of our website, interactions with our social media pages, etc.). We may also supplement this information with information from third parties, including from public sources. We describe how tracking works on our website in Section 10.
Other data: We may also collect other data, including data necessary for health protection measures, photographs, videos or audio recordings that we produce or receive from third parties and in which you are recognizable (e.g. at events, during our online summer school, through security cameras, etc.), access data or rights (e.g. visitor list, when you enter certain buildings or what access rights you have), and your participation in events and school camp

3. Source of the Personal Data

The source of the personal data is as follows:

From you: Much of the data set out in Section 2 is provided to us by you (e.g. when you communicate with us, in connection with contracts and our educational services, when you use the website, etc.). You are not obliged or required to disclose data to us except in certain cases (e.g. due to legal requirements). If you wish to become a student at our school or enter into a contract with us, you must also provide us with certain data, in particular master data, contract data, registration data, educational data, as part of your enrollment or contract with us. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must also provide us with registration data. In the case of behavioral and preference data, however, you generally have the opportunity to object.
From third parties: To the extent permitted by law, we may also collect data from public sources (e.g. the Internet, including social media) or receive data from public authorities and from other third parties (e.g. credit agencies, address brokers, contractors, internet analytics services, etc.). This includes the following categories of data: master data, contract data, educational data, and other data according to Section 2, as well as data from correspondence and discussions with third parties. If you work for an employer, client or someone else who has a business relationship or other relationship with us, they may also provide us with information about you.

4. Purpose of Processing

We process your data for the following purposes:

Communication: We process your data for the purpose of communicating with you, e.g. to respond to your requests, to contact you in case of questions. For this purpose, we use in particular communication data and master data. Our communication with you usually takes place in connection with other processing purposes, for example so that we can provide our education services or perform a contract.
Education: We process your information for educational purposes, such as determining whether you meet our admission requirements, administering our school program, projects and activities, providing and administering our school platforms, systems and tools, and managing other school matters. For this purpose, we use master data, registration data, educational data, account data, communication data, and other data.
Performance of contracts: We process your data in connection with the conclusion, administration and performance of contracts, e.g. to decide whether we conclude a contract with you, to perform our contractual obligations and, if necessary, to assert claims arising from the contracts (e.g. legal proceedings). For this purpose, we use master data, contract data, communication data, and behavioral and preference data.
Marketing and relationship management: We process your data for marketing and relationship management purposes, for example to send you written or electronic communications and offers, and to send some promotional materials. For this purpose, we use in particular master data, contract data, communication data, and behavioral and preference data.
Compliance with legal requirements: We want to lay the foundations for compliance with legal requirements. We therefore also process personal data to comply with legal requirements, and to prevent and detect violations. This includes, for example, receiving and processing complaints, complying with judicial or administrative decisions, and detecting and investigating abuse. This may involve all categories of personal data mentioned in Section 2.
Other purposes: We may process your data for other purposes, for example for security, access control purposes, for quality assurance and training purpose, as well as for the purposes of our risk management and as part of our corporate governance, including business organization and development. We may also process your data to protect our rights and defend ourselves against third parties claims. This may involve all categories of personal data mentioned in Section 2.

To the extent that the GDPR applies and we need a legal basis to process personal data, we generally rely on one or more of the following legal bases depending on the purpose of the processing:

5. Legal Basis for Processing Your Personal Data

Initiation or performance of a contract: Processing is necessary to initiate or perform a contract with you or the entity you represent.
Legitimate Interests: Processing is necessary for our or a third party’s legitimate interests, including to carry out processing for the purposes described in Section 4 and to disclose data in accordance with Sections 6, as well as to carry out the purposes related to them. Our legitimate interests also include compliance with legal regulations, insofar as this is not already recognized as a legal basis by applicable data protection legislation (e.g. laws in the EEA). This also includes the marketing of our school and services, and to manage and develop our school, including its operations, safely and efficiently.
Consent: The processing is based on your consent. In these cases, we will inform you separately about the purposes of the processing at issue. You may withdraw your consent at any time with effect for the future by sending us written notice; you will find our contact details in Section 1. Once we receive notice of withdrawal of consent, we will no longer process your information for the purpose(s) to which you consented, unless we have another legal basis for doing so. Withdrawal of consent does not, however, affect the lawfulness of the processing based on the consent prior to the withdrawal.

In some cases, other legal bases may apply and, if so, we will inform you separately.

6. Sharing of Your Personal Data with Third Parties and Abroad

In the context of our school activities and in line with the processing purposes set out in Section 4, we may transfer data to third parties, insofar as such a transfer is permitted and we deem it appropriate, in order for them to process data for us or, as the case may be, for their own purposes. In particular, the following categories of recipients may be concerned:

our service providers such as e.g. IT providers;
suppliers, subcontractors and other contractual partners;
domestic and foreign authorities or courts;
the media;
the public, including users of our websites and social media.

We process and store your personal data primarily in Switzerland and the European Economic Area (EEA). In some cases, however, we may also disclose personal data to service providers and other recipients (see above) who are located outside this area or who process personal data outside this area, potentially in any country in the world. These countries may not have laws that protect your personal data to the same extent as in Switzerland or the EEA. If we transfer your personal data to such a country, we will ensure the protection of your personal data in an appropriate manner. In particular, we use the European Commission’s standard contractual clauses for this purpose, available at https://eurlex.europa.eu/eli/dec_impl/2021/914/oj? unless the recipient is already subject to a legally accepted set of rules to ensure data protection or we can invoke an exception. We would like to emphasize that these contractual measures partly compensate for less or no legal protection, but do not completely exclude all risks (e.g. the risk of data being ac-essed by governments abroad). In exceptional cases, we may allow the transfer of your personal data to countries without adequate protection in other cases, for example if you consent, in the context of legal proceedings abroad or if it is necessary for the performance of a contract.

Please note that data exchanged via the internet is often routed through third countries. Your data may therefore be sent abroad even if the sender and recipient are in the same country.

7. Retention Periods for Your Personal Data

We process and retain your personal data as long as required for the performance of our contractual obligation and compliance with legal obligations or other purposes pursued with the processing, i.e. for the duration of the entire educational, contractual or business relationship (from the initiation, during the performance of the contract until it is terminated) as well as beyond this duration in accordance with legal retention and documentation obligations. Personal data may be retained for the period during which claims can be asserted against our company or insofar as we are otherwise legally obliged to do so or if legitimate business interests require further retention (e.g., for evidence and documentation purposes). As soon as your personal data are no longer required for the above-mentioned purposes, they will be deleted or anonymized, to the extent possible. In general, shorter retention periods of no more than twelve months apply for operational data (e.g., system logs).

8. Data Security

We take appropriate technical and organizational security measures to maintain the required security of your data and to ensure the confidentiality, integrity and availability of your data, to protect it against unjustified or unlawful processing and to mitigate the risk of loss, accidental alteration, unauthorized disclosure or access. Like all companies, however, we cannot exclude with certainty any data protection breach; some residual risks are unavoidable.

9. Your Rights

In accordance with and as far as provided by applicable law (as is the case where the GDPR is applicable), you have the right to access, rectification and erasure of your personal data, the right to restriction of processing or to object to our data processing, in particular for direct marketing purposes, for profiling carried out for direct marketing purposes and for other legitimate interests in processing in addition to right to receive certain personal data for transfer to another controller (data portability). Please note, however, that we reserve the right to enforce statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest (insofar as we may invoke such interests) or need the data for asserting claims. If exercising certain rights will incur costs on you, we will notify you thereof in advance. We have already informed you of the possibility to withdraw consent in Section 3 above. Please further note that the exercise of these rights may be in conflict with your contractual obligations, and this may result in consequences such as premature contract termination or involve costs. If this is the case, we will inform you in advance unless it has already been contractually agreed upon.

In general, exercising these rights requires that you are able to prove your identity (e.g., by a copy of identification documents where your identity is not evident otherwise or can be verified in another way). In order to assert these rights, please contact us at the addresses provided in Section 1 above.

In addition, every data subject has the right to enforce their rights in court or to lodge a complaint with the competent data protection authority. The competent data protection authority of Switzerland is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).

10. Cookies and Similar Technologies

We use various techniques on our website that allow us or third parties we hire to recognize you when you visit our website and potentially track you over multiple visits. This section informs you about these techniques.

Cookies are files that your browser automatically stores on your device when you visit our website. Cookies contain a unique identifier (ID) that allows us to distinguish individual visitors from others, generally without identifying them. Depending on their intended use, cookies may contain further information, such as the pages visited and the time spent on the pages. We use both session cookies, which are deleted as soon as the browser is closed, and persistent cookies, which remain stored for a certain period of time after the browser is closed (usually from a few days to three years) and are used to recognize visitors on subsequent visits.

We may also use similar technologies such as pixel tags, fingerprints and other technologies to store data in the browser. Pixel tags are small, usually invisible images or program codes uploaded by a server that provide the server operator with specific information such as whether and when a website was visited. Fingerprints are information about the configuration of your device or browser that are collected when you visit a website and that can be used to differentiate your device from other devices. Most browsers also use other data storage technologies in browsers that are similar to cookies and that we may also use (e.g. web storage).

We use the following types of cookies and similar technologies:

Strictly necessary cookies: Some cookies are essential to the use of the website and its features. These cookies ensure the essential functionality of the website. These cookies have an expiration period of up to 12 months.
Performance cookies: Performance cookies collect information about how our website is used and allow us to perform analyses of its use, such as which pages are viewed most often and how visitors navigate our website. These cookies are used to make visiting the website easier and faster and, in general, to improve the user experience and comfort. We use third-party analytics services for this purpose. These cookies have an expiration period of up to 24 months.
Marketing cookies: Marketing cookies help us and our advertising partners to provide you with advertisements on our website for offers or services that may be of interest to you or to display our advertisements when you continue to browse the Internet after leaving our website, i.e., to provide you with targeted advertising. These cookies have an expiration period ranging from a few days to three years, depending on the circumstances.

Browsers may accept or reject cookies automatically but allow you to change these settings. You can also disable or delete cookies you have previously accepted if you wish to. Be aware that any preference set will be lost if you delete all cookies, including your preference to opt-out from cookies as this itself requires an opt-out cookie to have been set. The settings must be made separately for each browser you use. To find out how to manage cookies on your browser, you can visit your browser’s help menu for more information (see e.g. Chrome, Edge, Firefox, Internet Explorer, or Safari).

You can change your cookie choice at any time by changing your browser settings as described above. If you choose to reject cookies, you may still use our website through your access to some functionality and areas of our website may be restricted.

11. Processing of Your Personal Data on Our Social Media Pages

We may operate pages and other online presences («fan pages», «channels», «profiles», etc.) on social media and other platforms operated by third parties and process the data about you described in Section 2 and below. We receive this data from you and the platforms when you when you interact with us through our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms’ providers may analyze your use of our online presence (e.g. how you interact with us, how you use our online presence, what you view, comment on, or «like») and process this data along with other data they have about you (e.g. information about your age and gender and other demographic information). In this way, they create profiles about you and statistics about the use of our online presences. They use this data and profiles to display our or other advertisements and other personalized content on the platform and to drive behavior on the platform, but also for market and user research and to provide us and other parties with information about you and the use of our online presence. To the extent that we are jointly responsible with the provider for certain types of processing, we will enter into a corresponding contract with the provider. You can find out about the main content of this contract from the provider. They also process this data for their own purposes, in particular for marketing and market research purposes (e.g. to personalize advertising) and to manage their platforms (e.g. to decide what content to show you), and act as separate controllers for this purpose.

We are entitled, but not obliged, to review content before or after it is published on our online presences, to delete content without notice and, if necessary, to report it to the provider of the relevant platform. In the event of violations of decency and conduct rules, we may also notify the provider of the platform on which the user account in question is located for blocking or deletion.
For further information on processing by the platform providers, please refer to the data protection statements of the respective platforms. There you can also find out in which countries your data is processed, what rights of access and deletion you have and how you can exercise these or obtain further information. We currently use the following platforms:

Facebook: On Facebook we operate the page https://www.facebook.com/HullsSchoolZuerich/. The controller for the operation of the platform for users from Europe is Meta Platforms Ireland Limited, Dublin, Ireland. Its privacy notice is available at www.facebook.com/privacy/policy. Some of your data will be transferred to the United States. You can object to advertising here: www.facebook.com/settings?tab=ads. With regard to the data collected and processed when visiting our site for «page insights», we are joint controllers with Facebook Ireland Ltd., Dublin, Ireland. As part of page insights, statistics are created about the actions visitors perform on our site (comment on posts, share content, etc.). This is explained at www.facebook.com/legal/terms/information_about_page_insights_data. It helps us understand how our page is used and how to improve it. We receive only anonymous, aggregated data. We have agreed our data protection responsibilities according to the information on www.facebook.com/legal/terms/page_controller_addendum.
X: On X we operate the profile https://twitter.com/HullZurich. The controller for the operation of the platform for users from Europe is Twitter International Unlimited Company, Dublin, Ireland. Its privacy notice is available at https://twitter.com/en/privacy. Some of your data will be transferred to the United States. You can object to advertising here: https://twitter.com/settings/ads_preferences.
LinkedIn: On LinkedIn we operate the pages https://ch.linkedin.com/company/hullschool. The controller for the operation of the platform for users from Europe is LinkedIn Ireland Unlimited Company, Dublin, Ireland. Its privacy notice is available at www.linkedin.com/legal/privacy-policy. Some of your data will be transferred to the United States. You can object to advertising here: www.linkedin.com/psettings/advertising-data. With regard to the data collected and processed when visiting our site for «page insights», we are joint controllers with LinkedIn Ireland Unlimited Company, Dublin, Ireland. As part of page insights, statistics are created about the actions visitors perform on our site (comment on posts, share content, etc.). This is explained at: https://www.linkedin.com/legal/privacy-policy. It helps us understand how our page is used and how to improve it. We receive only anonymous, aggregated data. We have agreed our data protection responsibilities according to the information on https://legal.linkedin.com/pages-joint-controller-addendum.
Instagram: On Instagram we operate the profile https://www.instagram.com/hullsschoolofficial/. The controller for the operation of the platform for users from Europe is Meta Platforms Ireland Limited, Dublin, Ireland. Its privacy notice is available at https://privacycenter.instagram.com/policy.
TikTok: On TikTok we operate the account https://www.tiktok.com/discover/hull-school-zurich. The controllers for the operation of the platform for users from Europe are TikTok Technology Limited, Dublin, Ireland and TikTok Information Technologies UK Limited, London, United Kingdom. Their privacy notice is available at is https://www.tiktok.com/legal/page/eea/privacy-policy/en.
Youtube: On YouTube we operate the channel https://www.youtube.com/@hullsschoolvideo1887/featured. Google LLC is the provider of the service «Youtube». The controller for users from Europe is Google Ireland Ltd. Its privacy notice is available at https://policies.google.com/privacy. Some of your data will be transferred to the United States. You can object to advertising here: https://adssettings.google.com.

12. Amendments of this Data Protection Statement

We may amend this Data Protection Statement at any time without prior notice. The current version published on our website shall apply.