Purpose of the Policy
1.1 The Singapore Personal Data Protection Act 2012 (PDPA) established a data protection law that comprises various rules governing the collection, use, disclosure, and care of personal data. It recognizes both the rights of individuals to protect their personal data, including rights of access and correction, and the needs of organizations to collect, use, or disclose personal data for legitimate and reasonable purposes.

The PDPA takes into account the following concepts:

Consent – Organisations may collect, use, or disclose personal data only with the individual’s knowledge and consent (with some exceptions);
Purpose – Organisations may collect, use, or disclose personal data in an appropriate manner for the circumstances, and only if they have informed the individual of purposes for the collection, use, or disclosure; and
Reasonableness – Organisations may collect, use, or disclose personal data only for purposes that would be considered appropriate to a reasonable person in the given circumstances.
The purpose of this policy is to ensure that NLCS(Singapore) collects and uses personal data about staff, students, and families in accordance with the Singapore Personal Data Protection Act, 2012 (PDPA) and other relevant laws and requirements on private education institutions in Singapore

THE POLICY

1. CONSENT

1.1 For the purposes of school students under the age of 13, it is reasonable and accepted that parental consent is sufficient. In addition to parents, we will also obtain explicit permission from staff in order to use their data as an employer..

1.2 The school will collect and use personal data from parents and guardians as well as their child(ren) in accordance with the Singapore Personal Data Protection Act (2012). Parents and Guardians consent to NLCS (Singapore) using such personal data as set out in the school’s ‘Data Protection Policy’ which is available on the school’s website and may be amended from time to time and where otherwise reasonably necessary for the school to provide appropriate services. Consent is confirmed through the signing of the annual student contract.

1.3 The school will collect and use personal data about our Staff in accordance with the Singapore Personal Data Protection Act (2012). Staff consent to us using such personal data as set out in the school’s ‘Data Protection Policy’ which is available on the school’s website and may be amended from time to time and where otherwise reasonably necessary for the school to provide you employment. Staff who have children enrolled at the school must provide permission twice, once for themselves as an employee and once as a parent. Consent is confirmed by the signing of the individual employment contract.

1.4 Where a person has made a free decision to opt in to a process or situation where the collection or use of personal data can be reasonably expected, then implied permission can be assumed.This includes:

• Employment Applications (when applications are submitted)
• Student Applications (the admissions process prior to acceptance)
• Event Sign Up

2. PURPOSES FOR WHICH PERSONAL DATA IS COLLECTED, USED AND DISCLOSED

2.1 NLCS (Singapore) The school holds personal data on its students, including: contact details, assessment/examination results, attendance information, behaviour, and characteristics such as ethnic group, special educational needs, any relevant medical information, photographs, videos, and/or sound recordings of students. The data is used in order to support the education of the students, to monitor and report on their progress, to provide appropriate personal and social care, and to assess the performance of the school as a whole, together with any other uses normally associated with this provision in an independent school environment.
The School may collect, use and disclose any personal data provided for the following purposes, including, but not limited to:

2.1.1 Employment-related purposes (appointment administration, human resource management including payroll, leave and benefits administration,review and disciplinary matters and staff development);

2.1.2 Enrolment-related purposes (admission assessment, registration, planning of curricula, communication with student and parents, provision of references, pastoral care, meal planning, disciplinary matters, extracurricular activities and provision of healthcare services);

2.1.3 Alumni Communications;

2.1.4 Conducting of Statistical Studies and Analyses;

2.1.5 Promotional and marketing purposes relating to NLCS (Singapore) and carefully selected third parties (including related entities and affiliates) and their activities and events;

2.1.6 Outreach and engagement in support of NLCS (Singapore), its mission and community, whether conducted by the School, its related entities or appointees; and

2.1.7 In school publications, the school website, school social media channels, and other official school communication channels.

2.1.8 Make personal data, including sensitive personal data, available to staff for planning activities and trips, both in and outside of Singapore.

2.1.9 All other matters relating to the mission, function or operation of the School as NLCS (Singapore) may consider to be necessary or appropriate.

2.2 Data is shared as necessary with third party companies to provide extended services; examples include transport, medical, catering, insurance, travel services, and online services such as email. NLCS (Singapore) may disclose personal data to the following organisations:

2.2.1 Any third party participating in engagement activities in support of the School, its mission and community, whether conducted by NLCS (Singapore), its related entities, affiliates or appointees; For example parent satisfaction surveys.

2.2.2 Any third party to whom NLCS (Singapore) is compelled or required to do so under law or in response to a request by a government agency, or where the public interest or NLCS (Singapore)’s interests so require; In particular, with respect to any disclosure requirements for Child Safeguarding purposes.

2.2.3 Any third party service or product provider providing services to the School or seeking academic references, in each case whether in Singapore or overseas and as NLCS (Singapore) may determine to be necessary or appropriate;

2.2.4 Any person as considered by NLCS (Singapore) to be necessary or appropriate in order to support the enrolment and education of students as well as for the operation of the School.

2.2.5 Any internal organization or society set up for the purpose of maintaining contact with students or for administration, fundraising, marketing, or promotional purposes relating to the school, e.g. alumni.The school will remain as the data controller and this policy will govern data usage.

2.2.6 The school will only share data for the purposes of eliciting a necessary service from these third party organizations and not for commercial gain.

2.2.7 Where the school signs explicit contracts with these organizations it will include clauses from Appendix A: Contracts with Third Parties to ensure that the organisation is using the data purely for the intended purpose of providing the required service and that it is taking appropriate precautions to safeguard the data.

2.2.8 In some instances, for example for online services provided by companies outside of Singapore, explicit signed contracts do not exist. In these instances the school will ensure that the terms and conditions of the service include clauses that:

• The school remains the owner of the data.
• The service provider is not entitled to use any data held on its service for any purpose other than to provide the required service.
• The service provider is taking reasonable precautions to ensure the security of the data.
• Once the school terminates its agreement with the service provider, any and all data held will be deleted and not used for any other purpose.

Photography and Videography
NLCS (Singapore) routinely captures photos and live or taped video of its students, employees and visitors to campus and uses these images on its website and social media channels and in the school magazine, fundraising materials, marketing materials (print, video, and digital ads), and student publications. The school reserves the right to reproduce these images and files. Faculty members are encouraged to share the work happening within their classrooms through photos and videos on their own social media channels. By studying at, working at, or visiting NLCS (Singapore), an individual acknowledges this right of the school. We do not post, or permit constituents to post images that might be deemed inappropriate (vulgar, discriminatory, pornographic, explicit).

We will honor all requests by users who wish to have images of themselves removed from the website or social media sites.To make such a request, please contact [email protected] and your child’s teacher. When external individuals or organizations request to use photographs of our campus or students, explicit permission must be sought from parents if students are identifiable. The communications office must be copied on permission requests and when permission is granted.
The school has no control over materials once they are posted online, and these can be copied or sent without our knowledge or permission. All materials on our website are copyrighted by NLCS (Singapore) unless otherwise indicated. The school will not post copyrighted material without written permission from the appropriate parties. NLCS (Singapore) provides links to other websites or resources. We do not control these sites and resources, do not endorse them, and are not responsible for their availability, content, or delivery of services. In particular, external sites are not bound by our privacy policy.

3. DATA SECURITY

3.1 The school undertakes all reasonably practicable steps to ensure that personal data held by NLCS (Singapore) is protected against unauthorized or accidental access, collection, use, disclosure, copying, modification, disposal or similar risks. The School will ensure that clear and robust safeguards are in place to protect personal data, irrespective of the format in which it is recorded. In addition, it shall notify data subjects about any accidental or unauthorized access of their data that may lead to damage or harm.

4. ACCURACY AND DURATION ON RETENTION OF PERSONAL DATA

4.1 All reasonably practicable steps will be taken to ensure that personal data held by NLCS (Singapore) is accurate.
4.2 The school undertakes that it shall only keep the data collected as long as is necessary to provide the services outlined above.

5. ACCESS AND CORRECTION

5.1 An individual or family has the right to make a request to access and/or correct the personal data held about them by NLCS (Singapore), please write to:: [email protected] The school will consider the request and respond within three working days. The response may be to decline the request with reasons or to provide a time scale in which the data will be supplied. The PDPA does not provide the right of access to any and all information held by an organization. Therefore, the school retains the right to refuse access to:

• Opinion data kept for evaluative purposes.
• Examination papers or the results of examinations.
• Confidential references written to support a student’s application to other educational institutions or courses.
• Data or material that provides personal data about other individuals in contravention of this policy or the PDPA.

6. WITHDRAWAL AND CONSENT

6.1 On giving reasonable notice to NLCS (Singapore), an individual may at any time withdraw any consent given, or deemed to have been given under the Personal Data Protection Act 2012.

6.2 Within reasonable time from receipt of notice from the individual, NLCS (Singapore) will inform the individual of the likely consequences of withdrawing their consent.

6.3 NLCS (Singapore) will not prohibit an individual from withdrawing his/her consent to the collection, use or disclosure of personal data about the individual, although this does not affect any legal consequences arising from such withdrawal.

6.4 Upon withdrawal of consent, NLCS (Singapore) will cease and cause its data intermediaries and agents to cease collecting, using or disclosing the personal data, as the case may be, unless the collection, use or disclosure of the personal data without the consent of the individual is required or authorised under the Data Protection Act 2012 or any written law.

Appendix A: Contracts withThird Parties
When signing contracts with any third party organizations that the school will share personal data with, the contract should include the following clauses or entries to the same effect. The school collects and uses personal data about staff, students, and families in accordance with the Singapore Data Protection Act (2012) and other relevant laws and requirements on private education institutions in Singapore.

As a result of the provision of your obligations under this agreement, you may have access to personal data about the school’s employees, students, parents, and/or other contacts. You must (and must ensure that your employees, agents, sub-contractors, and representatives will) keep all such data secure and protected against improper disclosure or use as detailed in this agreement.

Definitions:

• ‘Personal data’ shall refer to data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organization has or is likely to have access and all other data deemed protected under the Personal Data Protection Act 2012
• ‘PDPA’ shall mean the personal Data Protection Act (2012)
• ‘The school’ shall mean the entity who transfers the data to be used
• ‘The company’ shall mean the processor who agrees to accept the school’s personal data intended for processing and use in accordance with this agreement

7. DATA USE

4.1 All reasonably practicable steps will be taken to ensure that personal data held by NLCS (Singapore) is The company agrees and warrants:

• That any personal data shared by the school or collected by the company as a result of providing the services covered in this agreement will be used solely for the purposes of providing the service detailed in this agreement
• That no personal data collected or shared will be used to offer or solicit further services from the individuals concerned
• To process the personal data only on behalf of the school and in compliance with its instructions
• That the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law and do not violate the relevant laws of the Republic of Singapore in which the school resides
• That it shall promptly notify the school about any request for disclosure received directly from any authority or individual.

8. DATA SECURITY

The company agrees and warrants:

• To implement appropriate security measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure, or access, in particular when the processing of data involves the transmission or storage on or within a network
• That it shall promptly notify the school about any accidental or unauthorised access of the data, or any loss of the data whether leading to unauthorised access or not.

9. DATA RETENTION – OBLIGATIONS AFTER THE TERMINATION OF CONTRACT OR SERVICES

The company agrees and warrants:

That on the termination of the contract or services that required data processing services, that the company shall at the request of the school transfer all the data transferred and copies thereof to the data exporter or shall destroy all the personal data and certify that he has done so, unless legislation imposed on the data importer prevents him from returning or destroying all or part of the data transferred. In that case the company warrants that he will guarantee the confidentiality of the personal data and will not actively process the personal data transferred anymore. Once the legal requirement for retention has passed the company warrants that it will destroy all data retained.

10. DATA CORRECTNESS AND RIGHT OF CORRECTION

The company agrees and warrants:

• To provide the school on request all the personal details of individuals that have been collected as the result of this agreement and to amend or delete such data on request within the lifetime of the agreement.

11. LIABILITY

• The parties agree that if one party is held liable for a violation of the clauses committed by the other party in contravention of the PDPA, the latter will, to the extent he is liable, indemnify the first party from any cost, charge, damages, expenses, or losses it has incurred.