Privacy Policy

Definitions

Personal data is taken to include any information relating to, and able to identify, a living individual. This includes information in digital and analog forms, such as text, images, audio and biometrics.

Although the collection and accessing of data seems to be all around us, this policy is primarily concerned with that information about individuals (known as data subjects), that is captured by YCA (known as a data user). It also deals with those external organisations from whom we obtain services (known as data processors). In this policy the term “parents” is taken to include parents, guardians and caregivers.

Legal Framework

In Hong Kong we are subject to the Personal Data (Privacy) Ordinance (PDPO), passed in 1995, amended in 2012. YCA is also subject to the standards of the Council of International Schools. Hong Kong’s PDPO enshrines 6 technology-neutral Data Protection Principles:

• Purpose & Manner of Collection – data should be lawfully collected, and adequate for the required task, without being excessive.
• Accuracy and Duration of Retention – data should be accurate, updated annually, and will be retained by the school for the purpose of future access requests. Upon withdrawal or graduation from the school, if parents request, the data will be removed from our systems and the school will no longer be responsible for these records.
• Use of Data – data should only be used for the purposes stated at the time of collection.
• Data Security – data should be protected, using all practicable steps, from improper access and deletion.
• Openness and Transparency – policies and practices need to be shared and accessible.

These are summarised, in Chinese and English, in the government’s Six Data Protection Principles publication.

Last Edited 18/11/2022

Personal Information Collection Statement

The following statements define YCA’s commitment to the privacy of your data.

1. YCA collects data only for purposes related to, and in the service of, the education of our existing and prospective students.
2. Our school’s Data Protection Officer (DPO) is responsible for oversight of data collection, processing and privacy. You can contact the DPO via email, data@yca.edu.hk, should you have any privacy- or data-related questions.
3. When using our school website, cookies are used to support website improvement, to serve our community better.
4. When using our other online services, including Hero, data collection is obligatory. Failure to provide the requested data may affect the Students’ ability to participate in certain events, activities and expeditions arranged by the School.
5. Through the act of submitting data through our online systems users give their consent for the collection of this data, and agree to this policy.
6. Parents and staff will be prompted to update personal, family, financial and medical data related to themselves and their families at the start of each academic year.
7. Parents will be offered a range of options to limit sharing of data (particularly photo/video/audio) relating to their children.
8. Data deemed essential to the long-term functioning of the school, such as employment records (name, email, job title) and voluntarily contributed alumni contacts, will be stored indefinitely. Other data, which is deemed non-essential, will be removed from our records according to the following schedule:
   • Staff – 7 years after ceasing employment
   • Students, Parents and Families – data will be retained for mutual benefit unless the parent specifically requests the removal of their data from our systems.
9. In general we will not transfer your data to third party services, except those that are required for the education of a student and routine school operations. When data is transferred, it will only be to services with whom we enter into an agreement which satisfies the requirements of this policy. Such compliance will be established through the use of terms of service and other contractual agreements. Such transfers may result in data being stored on servers outside Hong Kong.
10. Our data policies and practices are shared with the community, and data subjects will be notified upon any change.
11. Your right to correct and update data held about you is recognised under this policy. To exercise this right parents and other data subjects over the age of 18 can contact our Data Protection Officer. We reserve the right to retain or redact data in cases where the wellbeing or education of our students is deemed to be adversely impacted by its disclosure.
12. Our policies are subject to regular review, and staff are offered the professional development required to enact them.

Updated February, 2023