Privacy notice

Annex 9. COMMON PRIVACY NOTICE

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details of the School and the designated data protection contact are provided at the end of this Notice, in accordance with the Swiss Federal Act on Data Protection (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data in a transparent manner in accordance with the Swiss Federal Act on Data Protection (revFADP).
It describes processing activities and data protection principles that apply generally across the School, regardless of the individual’s specific relationship with the School.
Separate, audience-specific privacy notices are issued for different categories of individuals and describe processing activities relevant to those specific contexts.

3. Categories of Personal Data

Depending on context, the School processes personal data including:
• identification and contact details;
• contractual and administrative information;
• communications with the School;
• IT, access control, and security data;
• financial and billing data;
• CCTV images;
• information required to meet legal, educational, safeguarding, and operational obligations.

Sensitive personal data is processed only where necessary and subject to enhanced technical and organisational safeguards, in line with the principles of proportionality and data minimisation (revFADP Art. 6).

4. Purposes of Processing

Personal data is processed for the following overarching purposes:

delivery of education and boarding services;
safeguarding and child protection;
student welfare and wellbeing;
administration, governance, and internal management;
communication with individuals and competent authorities;
compliance with legal, regulatory, and accreditation obligations;
safety and security of people, premises, and systems.

More detailed and context-specific purposes are described in the relevant audience-specific privacy notices.

5. Legal Bases for Processing

The School processes personal data on one or more of the following legal bases:
• performance of a contract or pre-contractual measures;
• compliance with legal obligations;
• the legitimate interests of the School, including safeguarding, security, and effective administration;
• consent, where required by law;
• protection of vital interests, particularly in safeguarding or medical emergencies.

(revFADP Art. 6)

6. Recipients of Personal Data

Personal data may be shared strictly on a lawful, necessary, and proportionate basis with public authorities, service providers, insurers, auditors, educational partners, and professional advisers.
Recipients act either as independent controllers or as processors subject to appropriate contractual, technical, and organisational safeguards (revFADP Arts. 6, 9 and 19).

7. International Transfers

Due to the international nature of the School community, personal data may be transferred outside Switzerland, including to the European Union and European Economic Area, countries of residence of students or families, and jurisdictions where service providers, educational partners, or accreditation bodies are located.
Such transfers are carried out in compliance with Swiss data protection law and subject to appropriate safeguards ensuring an adequate level of protection (revFADP Arts. 16 and 17).

8. Data Retention

Personal data is retained only for as long as necessary and proportionate to fulfil the purpose for which it was collected and to comply with applicable legal, educational, safeguarding, and contractual obligations.
Retention periods vary depending on the category of data and the context of processing and are defined in accordance with the School’s documented retention rules and described in the relevant audience-specific privacy notices.

9. Rights of Individuals

Individuals have the following rights under the Swiss Federal Act on Data Protection (revFADP Arts. 19–28), subject to the conditions and limitations set out in law:
• the right to be informed;
• the right of access;
• the right to rectification;
• the right to object to certain processing;
• the right to request deletion where legal conditions are met;
• the right to withdraw consent where processing is based on consent.

Requests may be refused or limited where permitted by law. Requests may be submitted to the School’s designated data protection contact.
Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.

10. Data Security

The School implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access, taking into account the nature of the data and the risks involved (revFADP Arts. 8 and 30).

11. CCTV and Monitoring

Where CCTV systems are operated, recordings are retained for a maximum of 30 days unless required for the investigation of a specific incident. Further information on CCTV processing, access controls, and individual rights is provided in the School’s CCTV and Monitoring Policy.

12. Availability of Additional Privacy Notices

In addition to this Privacy Notice, the School issues audience-specific privacy notices describing personal data processing relevant to particular relationships with the School.
These notices are made available through appropriate School communication channels or provided directly at the point of data collection. Copies may also be obtained from the School upon request.

13. Contact

Questions, requests, or concerns relating to data protection may be addressed to the School’s designated data protection contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.1 – PRIVACY NOTICE – STUDENTS (INCLUDING BOARDERS)

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to students in a transparent manner and in accordance with applicable data protection law.

3. Purposes of Processing

The School processes student personal data for the delivery of education and boarding services, supervision and pastoral care, safeguarding and child protection, health and wellbeing support, behaviour and discipline management, school administration, regulatory reporting, and preparation for further education.

4. Categories of Personal Data

Student personal data may include identification and contact details, academic records, assessments and reports, attendance information, boarding and supervision records, pastoral notes, safeguarding and child protection records, health and medical information, behavioural and disciplinary records, IT usage data, access control data, and CCTV images.

5. Legal Bases for Processing

Personal data is processed on one or more of the following legal bases: performance of an education or boarding contract, compliance with legal and regulatory obligations, the legitimate interests of the School, protection of vital interests, and consent where required (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared, where lawful and necessary, with examination boards, universities and higher education institutions, other schools (including those to which a student transfers), accreditation bodies, competent authorities, insurers, and service providers acting on behalf of the School.
Due to the international nature of the School community, personal data may be transferred outside Switzerland, subject to appropriate safeguards ensuring an adequate level of protection (revFADP Arts. 16 and 17).

7. Data Retention

Personal data is retained only for as long as necessary and proportionate, in accordance with the School’s documented retention rules. In particular:

academic and administrative records are retained for 10 years after the student leaves the School;
final transcripts and diplomas are retained permanently;
boarding records are retained for 5 years after leaving;
safeguarding records are retained until the individual reaches 25 years of age;
health records are retained for 10 years after leaving;
CCTV recordings are retained for a maximum of 30 days, unless required for the investigation of a specific incident.

8. Rights of Individuals

Individuals have the following rights under the Swiss Federal Act on Data Protection (revFADP Arts. 19–28), subject to the conditions and limitations set out in law:

the right to be informed about the processing of their personal data;
the right to request access to their personal data;
the right to request rectification of inaccurate or incomplete personal data;
the right to object to certain processing activities, where applicable;
the right to request deletion of personal data, where the legal conditions are met;
the right to withdraw consent at any time, where processing is based on consent.

Where the data subject is a minor, rights may be exercised by parents or legal guardians in accordance with applicable law and taking into account the best interests of the child.
Requests may be refused or limited where permitted by law.
Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.2 – PRIVACY NOTICE – PARENTS AND LEGAL GUARDIANS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to parents and legal guardians.

3. Purposes of Processing

Personal data is processed for admissions, contractual management, billing and payments, communications, safeguarding coordination, regulatory reporting, and general administration.

4. Categories of Personal Data

Identification and contact details, contractual information, billing and payment data, correspondence, and limited access or security-related data.

5. Legal Bases for Processing

Contract performance, compliance with legal obligations, the legitimate interests of the School, and consent where required (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with competent authorities, insurers, auditors, banks, payment service providers, and service providers acting on behalf of the School.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Personal data is retained in accordance with the School’s documented retention rules. Contractual, communication, and financial records are generally retained for 10 years after the end of the contractual relationship.

8. Rights of Individuals

Individuals have the rights listed under revFADP Arts. 19–28, including the right to access, rectification, objection, deletion where legally permitted, withdrawal of consent where applicable, and the right to lodge a complaint with the competent supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.3 – PRIVACY NOTICE – STAFF (EMPLOYEES)

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to employment.

3. Purposes of Processing

Recruitment, employment administration, payroll, tax and social security compliance, safeguarding checks, performance management, disciplinary processes, training, IT access management, and security.

4. Categories of Personal Data

Identification data, employment and payroll records, safeguarding checks, performance and disciplinary records, IT access data, and CCTV images.

5. Legal Bases for Processing

Employment contract, legal obligations, the legitimate interests of the School, and consent where required (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with authorities, insurers, pension providers, auditors, and service providers. International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Employment and payroll data is retained in accordance with legal requirements, generally for 10 years after termination.
CCTV recordings are retained for a maximum of 30 days unless required for a specific incident.

8. Rights of Individuals

Individuals have the rights set out in revFADP Arts. 19–28, including access, rectification, objection where applicable, deletion where legally permitted, withdrawal of consent where applicable, and the right to lodge a complaint with the competent supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.4 – PRIVACY NOTICE – JOB APPLICANTS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to job applicants.

3. Purposes of Processing

Personal data is processed for recruitment and selection purposes, including assessment of suitability, verification of qualifications and references, safeguarding checks where applicable, and communication with applicants.

4. Categories of Personal Data

Personal data may include identification and contact details, curriculum vitae, application forms, interview notes, references, safeguarding and background checks where required, and recruitment-related correspondence.

5. Legal Bases for Processing

Processing is based on pre-contractual measures, compliance with legal obligations, and the legitimate interests of the School in conducting a fair and effective recruitment process (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with internal recruitment decision-makers, reference providers, safeguarding authorities where required, and service providers supporting recruitment processes.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Personal data relating to unsuccessful applicants is retained for 12 months after the conclusion of the recruitment process.
For successful applicants, relevant data becomes part of the employment record and is retained in accordance with applicable employment retention rules.

8. Rights of Individuals

Individuals have the following rights under revFADP Arts. 19–28, subject to legal conditions and limitations:

the right to be informed;
the right of access;
the right to rectification;
the right to object to certain processing;
the right to request deletion where legally permitted;
the right to withdraw consent where applicable.

Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.5 – PRIVACY NOTICE – CONTRACTORS AND SERVICE PROVIDERS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to contractors and service providers.

3. Purposes of Processing

Personal data is processed for contractual management, service delivery, access management, safeguarding assurances where applicable, security, billing, and compliance with legal and regulatory obligations.

4. Categories of Personal Data

Identification and contact details, contractual information, payment and invoicing data, access permissions, safeguarding confirmations where applicable, and CCTV images.

5. Legal Bases for Processing

Processing is based on contract performance, compliance with legal obligations, and the legitimate interests of the School (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with internal operational teams, auditors, authorities, insurers, and professional advisers where lawful and necessary.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Contractual and financial data is retained for the duration of the contractual relationship plus 10 years.
Access and security-related logs are retained for 6 to 12 months.
CCTV recordings are retained for a maximum of 30 days unless required for a specific incident.

8. Rights of Individuals

Individuals have the rights listed under revFADP Arts. 19–28, including access, rectification, objection where applicable, deletion where legally permitted, withdrawal of consent where applicable, and the right to lodge a complaint with the competent supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.6 – PRIVACY NOTICE – ALUMNI

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to alumni.

3. Purposes of Processing

Personal data is processed for verification of academic records, provision of references, alumni relations, institutional record-keeping, and maintenance of historical academic records.

4. Categories of Personal Data

Identification and contact details, academic history, final transcripts and diplomas, correspondence, and alumni engagement information.

5. Legal Bases for Processing

Processing is based on the legitimate interests of the School, compliance with legal obligations, and consent where required (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with universities, employers, authorities, and service providers where verification or references are requested.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Final academic records and diplomas are retained permanently.
Other alumni data is retained for as long as the individual remains engaged with the School, subject to periodic review, or until a valid deletion request is made, subject to legal constraints.

8. Rights of Individuals

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.7 – PRIVACY NOTICE – PROSPECTIVE FAMILIES

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to prospective families.

3. Purposes of Processing

Personal data is processed to manage enquiries, campus visits, admissions assessments, communications prior to enrolment, and related administrative activities.

4. Categories of Personal Data

Identification and contact details, enquiry and admissions information, correspondence, and visit-related information.

5. Legal Bases for Processing

Processing is based on pre-contractual measures, the legitimate interests of the School, and consent where required (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared internally with admissions staff and externally with service providers supporting admissions processes.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Personal data relating to prospective families who do not enrol is retained for up to 24 months from the last substantive interaction, unless a shorter period is requested.

Where enquiries relate to long-term or early-stage admissions planning, particularly for prospective students several years prior to intended entry, limited enquiry data may be retained for up to 60 months, subject to periodic review and unless a shorter retention period is requested by the data subject.

8. Rights of Individuals

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.8 – PRIVACY NOTICE – WEBSITE VISITORS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to visitors to its website.

3. Purposes of Processing

Personal data is processed for website security, technical operation, analytics, and handling of enquiries submitted via the website.

4. Categories of Personal Data

IP addresses, device and browser data, cookies and analytics data, and information submitted through online forms.

5. Legal Bases for Processing

Processing is based on the legitimate interests of the School, compliance with legal obligations, and consent where required for cookies or analytics (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with IT and hosting providers and analytics service providers.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Security and technical logs are retained for 6 to 12 months.
Enquiry data is retained for the duration of the admissions process and, where no enrolment occurs, for up to 24 months from the last substantive interaction.

Where enquiries relate to long-term or early-stage admissions planning, particularly for prospective students several years prior to intended entry, limited enquiry data may be retained for up to 60 months, subject to periodic review and unless a shorter retention period is requested by the data subject.

8. Rights of Individuals

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.9 – PRIVACY NOTICE – CAMPUS VISITORS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data relating to campus visitors.

3. Purposes of Processing

Personal data is processed for access management, visitor registration, safety, security, and protection of people and premises.

4. Categories of Personal Data

Identification details, visitor logs, access records, Wi-Fi usage data, and CCTV images.

5. Legal Bases for Processing

Processing is based on the legitimate interests of the School, compliance with legal obligations, and protection of vital interests where applicable (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with security service providers, authorities, and insurers where lawful and necessary.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Visitor logs and Wi-Fi data are retained for 6 to 12 months.
CCTV recordings are retained for a maximum of 30 days unless required for the investigation of a specific incident.

8. Rights of Individuals

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.10 – PRIVACY NOTICE – SAFEGUARDING AND CHILD PROTECTION

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data in connection with safeguarding and child protection activities.

3. Purposes of Processing

Personal data is processed for the identification, management, investigation, and reporting of safeguarding and child protection concerns, and to protect the vital interests of children and young people.

4. Categories of Personal Data

Identification data, safeguarding and child protection records, wellbeing and pastoral information, and related correspondence.

5. Legal Bases for Processing

Processing is based on compliance with legal obligations, protection of vital interests, and the legitimate interests of the School in safeguarding children (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with safeguarding authorities, law enforcement, medical professionals, and other competent bodies where lawful and necessary.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Safeguarding records are retained until the individual reaches 25 years of age, or longer where required by law.

8. Rights of Individuals

Individuals have the rights set out in revFADP Arts. 19–28.
Where the data subject is a minor, rights may be exercised by parents or legal guardians, taking into account the best interests of the child.
Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland

ANNEX 9.11 – PRIVACY NOTICE – MARKETING AND COMMUNICATIONS

La Garenne School
Version 1.0
Approved by Senior Management on 27.01.2026
Next review: 31.01.2027

1. Identity of the Data Controller

La Garenne School (“the School”) is the data controller responsible for the processing of personal data described in this Privacy Notice.
The School processes personal data in connection with its educational, boarding, safeguarding and child protection, administrative, and operational activities.
Contact details are provided at the end of this Notice (revFADP Art. 19).

2. Purpose of this Privacy Notice

This Privacy Notice explains how the School processes personal data for marketing and communications purposes.

3. Purposes of Processing

Personal data is processed for newsletters, event communications, photography, video, publications, media relations, and promotional activities.

4. Categories of Personal Data

Identification and contact details, images, video recordings, correspondence, and communication preferences.

5. Legal Bases for Processing

Processing is based on consent, the legitimate interests of the School, and compliance with legal obligations (revFADP Art. 6).

6. Recipients of Personal Data and International Transfers

Personal data may be shared with communication service providers, media partners, and platform providers where lawful and necessary.
International transfers may occur subject to appropriate safeguards (revFADP Arts. 16 and 17).

7. Data Retention

Personal data is retained until consent is withdrawn or the data is no longer relevant for the stated purpose, subject to legal constraints.

8. Rights of Individuals

Individuals have the rights listed under revFADP Arts. 19–28, including access, rectification, objection where applicable, deletion where legally permitted, withdrawal of consent at any time, and the right to lodge a complaint with the competent supervisory authority.

9. Contact

Designated Data Protection Contact:

Alexey Filatov
dpo@la-garenne.ch
Chemin des Chavasses 23,
Chesieres,
1885, Switzerland