ASB Privacy Policy

1. Data Controller

For personal data collected through the ASB admissions and enrollment process, the American School of Bulgaria acts as the Data Controller within the meaning of the GDPR.

American School of Bulgaria (ASB) Varna, Bulgaria Email: contact@americanschoolofbulgaria.com

Questions or requests concerning personal data and data-protection rights may be directed to ASB using the contact information above.

2. Personal Data We Collect

ASB collects personal data through its online admissions platform (ASB-SOS) and related school systems. The data collected depends on the stage of the admissions and enrollment process and the individual's role (student, parent/guardian, or staff member).

The categories of personal data we collect include:

• Student identity and contact: full name, middle name, date of birth, gender, passport/ID number, email address, phone number, and home address (city, country, postal code);
• Parent/guardian identity and contact (for each parent/guardian): full name, relationship to the student, date of birth, passport/ID number, phone number, email address, and home address;
• Previous school information: school name, address, phone, email, last grade completed, language of instruction, and current grade in progress;
• Application preferences: academic year, grade applying for, program option (full-year, Semester 1, Semester 2, or short-term), and interest in after-school programs;
• Enrollment data (Stage 2, collected after acceptance): medical summary, allergies, medications, dietary restrictions, doctor name and phone, immunization record, and learning support needs;
• Media and photo consent: handled as a separate, optional consent (see Section 5a). Agreeing to this Privacy Notice does NOT automatically grant ASB permission to publish photographs or recordings of your child;
• Financial and billing: payment method (cash or bank transfer), tuition plan selection, invoice records, deposits, payments received, and outstanding balances;
• Account and authentication: email address for login, encrypted password, assigned user role(s), campus assignment, and profile photograph;
• System activity: login history, data access logs, email communication records, and a record of actions performed within ASB-SOS for audit and security purposes;
• Technical session data: IP address and browser/device information collected during use of the platform.

ASB collects only information that is reasonably necessary for the admissions, enrollment, and educational purposes described in this notice. Sensitive identity documents (passports, birth certificates, IDs) are deleted once verification is complete, in accordance with our data-retention policy.

3. Purpose of Processing

Personal data collected through the application may be used to:

• Process and evaluate the student's application for admission;
• Verify the student's identity, age, academic history, qualifications, and eligibility for enrollment;
• Conduct admissions assessments, interviews, placement evaluations, and parent conferences;
• Determine appropriate grade, course, English-language, or academic placement;
• Determine whether ASB can appropriately meet a student's educational or support needs;
• Communicate with parents, guardians, applicants, and previous educational institutions where appropriate;
• Prepare enrollment contracts and related documentation;
• Administer application fees, deposits, tuition, invoicing, and other financial matters;
• Comply with safeguarding and child-protection responsibilities;
• Comply with applicable educational, accreditation, immigration, tax, accounting, regulatory, and legal requirements;
• Establish and maintain the student's educational record if the student enrolls at ASB;
• Protect the safety, security, rights, and legitimate interests of students, staff, families, and the School; and
• Establish, exercise, or defend legal claims where necessary.

Information submitted through the application will not be sold to third parties.

4. Legal Basis for Processing

Depending upon the information and purpose involved, ASB may process personal data under one or more lawful bases provided by the GDPR, including:

• Processing necessary to take steps at the request of the applicant or parent/guardian before entering into an enrollment contract;
• Processing necessary for the performance of an enrollment or educational contract;
• Processing necessary for compliance with a legal obligation;
• Processing necessary to protect the vital interests of a student or another individual;
• Processing necessary for ASB's legitimate interests, provided those interests do not override the fundamental rights and freedoms of the data subject; and
• Consent, where consent is the appropriate legal basis.

Where ASB relies specifically upon consent, that consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing performed before the withdrawal and does not prevent ASB from continuing processing where another lawful basis applies.

5. Special Categories of Personal Data

Certain information, including health, disability, medical, psychological, or other sensitive information, may constitute special-category personal data under the GDPR.

ASB will process such information only when there is an appropriate legal basis for doing so and when the information is reasonably necessary for admissions, student support, safeguarding, health and safety, accommodations, legal compliance, or the provision of educational services.

Access to such information will be limited to authorized individuals who have a legitimate need to access it.

5a. Photo & Media Consent (Separate Consent)

ASB may wish to use photographs, video recordings, or images of students in school publications, on the school website, on social media, or in promotional materials.

Consent to the use of your child's image is SEPARATE from your agreement to this Privacy Notice. Agreeing to the Privacy Notice does NOT automatically grant ASB permission to publish your child's photographs.

During onboarding, you will be asked separately whether you consent to the publication of your child's image. You may:

• Grant consent — ASB may use photographs and recordings of your child in the contexts described above;
• Decline consent — ASB will not publish photographs or recordings of your child in public-facing materials.

You may change your photo/media consent preference at any time from your Profile page or by contacting ASB. Declining photo/media consent does not affect your or your child's access to ASB-SOS or any school services.

6. Children's Personal Data

ASB recognizes that children are entitled to particular protection regarding their personal data. Where an application concerns a minor, the parent or legal guardian submitting the application confirms that:

• They are the student's parent or legal guardian, or are otherwise legally authorized to provide the information;
• They are authorized to provide the student's personal information to ASB for admissions and educational purposes; and
• To the best of their knowledge, the information supplied is accurate and lawful to provide.

ASB will take appropriate measures to protect children's personal data and limit access to individuals who require the information for legitimate educational, administrative, safeguarding, or legal purposes.

7. Accuracy of Information

The person submitting the application is responsible for ensuring that the information provided is accurate, complete, and not deliberately misleading.

Parents and guardians should inform ASB if relevant information changes during the admissions process or after enrollment.

Where information concerning another individual is provided, the person submitting the application should have appropriate authority or another lawful basis to provide that information.

8. Sharing of Personal Data

ASB may share personal information, where necessary and lawful, with:

• Authorized ASB administrators, teachers, counselors, admissions personnel, finance personnel, and other employees;
• Service providers that provide information technology, cloud storage, school-management, communications, payment, accounting, or other services to ASB;
• Educational institutions or previous schools where verification is required;
• Accreditation bodies where necessary;
• Government, immigration, educational, regulatory, judicial, or law-enforcement authorities where required or permitted by law;
• Medical, safeguarding, or emergency professionals where necessary to protect a student or another individual; and
• Professional advisers such as accountants, auditors, insurers, or legal counsel where necessary.

Third-party service providers processing personal information on ASB's behalf are required, where applicable, to process such information subject to appropriate contractual, confidentiality, security, and data-protection requirements.

9. International Data Transfers

Some technology or service providers used by ASB may process or store information outside Bulgaria or the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, ASB will take appropriate measures required under the GDPR to ensure that the information receives an adequate level of protection, including, where applicable, reliance upon an adequacy decision, appropriate contractual safeguards, or another legally recognized transfer mechanism.

10. Data Security

ASB takes reasonable and appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Access to personal information is restricted according to professional responsibilities and legitimate need.

Although ASB takes reasonable security measures, no electronic system or method of transmitting information over the Internet can be guaranteed to be completely secure.

11. Data Retention

ASB will retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable educational, safeguarding, accreditation, accounting, contractual, regulatory, and legal obligations.

For students who enroll at ASB, relevant application information may become part of the student's official educational or administrative record and may be retained in accordance with ASB's applicable record-retention policies.

12. Your Data Protection Rights

Under the GDPR, data subjects have certain rights regarding their personal data, including the right to access, rectify, erase, restrict processing, data portability, and object to processing.

To exercise any of these rights, please contact ASB using the contact information provided in Section 1.

ASB will respond to such requests in accordance with applicable data-protection legislation.

13. Changes to This Privacy Notice

ASB may update this Privacy Notice from time to time to reflect changes in its practices, legal requirements, or operational needs.

Users will be notified of material changes and may be required to accept the updated version.

14. Contact

For any questions, concerns, or requests regarding this Privacy Notice or the processing of personal data, please contact:

American School of Bulgaria (ASB) Varna, Bulgaria Email: contact@americanschoolofbulgaria.com