Privacy policy

This page explains who is responsible for your personal data, how the school uses it and how you can exercise your rights. Information about education is based on the school document; the Open Day, classroom visit and rental sections describe this website’s forms.

Controller and DPO · Website forms · Retention · Recipients and services · Your rights · School document PDF

Controller and Data Protection Officer

1. IT Gymnázium, s.r.o.
K Cihelně 129, 190 15 Praha-Satalice, Czech Republic
Company ID: 06913491 · VAT ID: CZ06913491 · School register ID (IZO): 181105527
Commercial Register: Municipal Court in Prague, Section C, File 291205
Data box ID: wqa4hfk

Data protection contact: marketa.fibigerova@itgymnazium.cz, +420 604 250 201. School office: info@itgymnazium.cz, +420 771 278 111.

Data Protection Officer named in the school document: Mgr. Markéta Fibigerová, marketa.fibigerova@itgymnazium.cz, +420 604 250 201.

Website forms

Open Day and classroom visit registrations

These details are used to organise your chosen Open Day or classroom visit and related arrangements. Registration is not an application for admission and does not affect admission decisions.

• Required details: visit date, applicant’s full name and a parent’s contact email.
• Optional details: parent’s or companion’s full name, parent’s phone number and a note.
• Registration record: the selected event details as they were at submission, form language and submission time.

The online form cannot be submitted without the required details. Contact the school office to arrange another way to register. Do not include health or other sensitive data in the note. If you enter a companion’s details, share this information with them.

Venue hire enquiries

We use these details to handle your enquiry and discuss the space, date and rental terms. Submitting an enquiry does not by itself confirm a booking or conclude a contract.

• Required details: selected space, first name, last name, email and message.
• Optional details: phone number and preferred rental date.
• Enquiry record: form language and submission time.

The form cannot be submitted without the required fields; you can contact the school directly. Include only details needed to handle your enquiry.

Contacting the school

When you contact us by email or phone, we process the information you provide to handle your request. The scope depends on the communication. We obtain data directly from you; an applicant’s or companion’s details may also be provided by the person completing the form.

Legal bases for website forms

We process personal data on the following legal bases, according to the purpose:

• Open Days, classroom visits and general enquiries: the school’s legitimate interest in organising a requested visit and handling correspondence under Article 6(1)(f) GDPR. Processing is limited to the data needed for this purpose, taking account of individuals’ rights, particularly those of applicants who are minors.
• Rental enquiries by individuals: steps at the individual’s request before entering a contract under Article 6(1)(b) GDPR. Where someone represents a legal entity, we process that person’s business contact details on the basis of legitimate interest in business communication under point (f).
• Website security and protecting rights: legitimate interests in preventing abuse and protecting claims under point (f), limited to what is necessary. Processing required by a specific legal provision falls under point (c).

Submitting a form is not blanket consent to further uses of your data. Registrations and enquiries are not automatically sent to newsletters or advertising systems. The forms do not make automated admission decisions or profile applicants.

Retention and deletion

Retention periods for website forms: an authorised administrator manually deletes registrations, enquiries and their exports.

• Open Days and classroom visits: we delete registrations and organisational exports no later than 30 days after the selected event takes place or is cancelled. If a specific request remains unresolved, we retain only the information necessary to resolve it.
• Uncompleted rental enquiries: we delete the enquiry and its export within 90 days of the last communication if no contract is agreed and discussions are no longer ongoing. For an agreed rental, details needed for the contract and accounting are retained according to applicable obligations and the school’s records retention schedule.
• General enquiries: we delete correspondence within 90 days of resolution unless a contract, legal obligation or specific legal claim requires further retention.

In the current website, registrations and enquiries are deleted manually. Within the same retention periods, the assigned person also handles copies of data in confirmations, notifications and CSV attachments in school mailboxes, as well as downloaded CSV files. Backups have a separate retention cycle; their data should not be used for routine correspondence, and previous deletions must be reapplied after a restore. The school can provide details about backups and operational logs through the data protection contact above.

Access and recipients

Form records are stored in the website database. Only accounts with administrator permissions can manage and export them. Ordinary editors and visitors cannot access them. The school may download CSV exports to organise visits and handle enquiries. After registration for an Open Day or a classroom visit, we send a confirmation to the parent’s contact email and a blind copy to authorised school staff. We send a receipt confirmation to the person making the rental enquiry. Rental enquiry notifications go to the school staff handling the enquiry. An authorised staff member receives a weekly CSV summary of Open Day registrations to organise visits. We use the school’s Google Workspace email service to send these messages.

Where necessary, authorised school staff and contracted hosting, information system, maintenance, backup and email providers may have access to data. For school education, the original document also lists public authorities; accounting, tax, audit and legal services; and organisers of extracurricular activities. These categories apply only where relevant to the particular purpose.

Direct questions about specific recipients and any transfers outside the European Economic Area to the data protection contact above. Information about transfers by external video and map providers is also available in their policies linked below. The school being based in the Czech Republic does not mean that all external services process data only there.

Website operation, cookies and external services

Technical data is processed to deliver pages and protect forms. Form protection uses a random session identifier and short-lived derived markers to limit abuse and duplicate submissions. The IP address itself is not stored in registration or rental records; separate hosting logs may contain IP addresses.

Embedded YouTube players and Google maps send connection details, such as your IP address and browser information, to their provider. The Cookies page describes current loading and storage behaviour. See also Google’s privacy policy. Links to social networks and external documents open their operators’ services when clicked.

Google Analytics 4 (Google Ireland Limited) helps us measure website visits and completed registrations or enquiries. It uses cookie identifiers and device and visit information. We do not send names, contact details or form text. Data may also be processed outside the EEA. Measurement starts only with your consent.

We measure website visits and interactions. Successful Open Day registrations, classroom visit registrations and venue enquiries are recorded separately, without form contents. Analytics consent is optional and separate from videos and maps. You can withdraw it in Cookie settings; further measurement stops and the website’s analytics cookies are removed. Withdrawal does not itself remove aggregate statistics already created. This integration does not enable Google Signals or advertising personalisation.

Google privacy policy · How Google uses data from partner websites

Google Analytics retains detailed event data for 2 months and user-level data for 14 months. New user activity resets the user retention period. These periods do not apply to standard aggregate reports. Browser cookie lifetimes and the retention of your consent record are separate periods described on the Cookies page.

Recording cookie choices

We remember acceptance and rejection for 183 days. The website database retains a record of the choice, time, language, notice and a derived random browser key for 365 days. This record contains no IP address, name, contact details or browsing history. It is used to respect and demonstrate your choice and is accessible only to administrators. Expired records are removed by automatic daily cleanup.

Cookie settings let you change or withdraw permission at any time. Keeping the choice record supports respecting your preferences and demonstrating consent under Article 7(1) GDPR. Cookies and other browser storage are described on the Cookies page.

Your rights

• Access and information: you can ask whether and which personal data we process, receive information about processing and obtain a copy.
• Rectification: you can request correction of inaccurate data and completion of incomplete data.
• Erasure and restriction: subject to GDPR conditions, you can request deletion or restriction of the use of your data. Deletion does not automatically apply where a legal retention obligation remains.
• Portability: in the cases specified by the GDPR, you can receive data you have provided in a structured, machine-readable format or request its transfer.
• Objection: for reasons relating to your situation, you can object to processing based on legitimate or public interest. You can object to direct marketing at any time.
• Withdrawal of consent: where processing relies on consent, you can withdraw it at any time, without affecting the lawfulness of prior processing.
• Complaint: you can contact the Czech Data Protection Authority.

Send requests to marketa.fibigerova@itgymnazium.cz or the school’s postal address. Proportionate identity verification may be needed. We will inform you of action taken without undue delay, normally within one month. For complex or numerous requests, GDPR conditions allow an extension of up to two further months; we will explain the extension and its reasons within the first month.

Supervisory authority: Czech Data Protection Authority (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, posta@uoou.cz, +420 234 665 111, data box ID qkbaa2n.

Education records and the original school document

ITG’s original notice concerns secondary education, contracts, statutory records, communication and protection of the school’s rights. Depending on the purpose, this includes identification, address and contact data, identity document details, bank details and other data necessary for education. The document states that photographs, video and audio recordings are processed on the basis of consent. This scope is not a list of fields collected by the Open Day, classroom visit and rental forms.

The school document distinguishes legal obligations, contract performance, legitimate interests in protecting rights and consent. For contracts it refers to the school’s records retention schedule, for legal obligations to applicable legislation, and for photographs, audio and video recordings to the duration of consent. It also describes recipients and the rights of students and their legal guardians.

Information on personal data processing – original ITG document (PDF, Czech, 4 pages)

The document is reproduced unchanged from ITG’s current website. This page makes it accessible and adds information about the new website. Student records, admissions and other statutory activities have their own processing scope; the school can provide the relevant further information.

Related information

Cookies · Legal notice · About this website