1. IT Gymnázium

Privacy policy

How the school handles the personal data of website visitors, applicants, parents and people enquiring about venue hire.

This page explains who is responsible for your personal data, how the school uses it and how you can exercise your rights. Information about education is based on the school document; the Open Day, classroom visit and rental sections describe this website’s forms.

Controller and DPO · Website forms · Retention · Recipients and services · Your rights · School document PDF

Controller and Data Protection Officer

1. IT Gymnázium, s.r.o.
K Cihelně 129, 190 15 Praha-Satalice, Czech Republic
Company ID: 06913491 · VAT ID: CZ06913491 · School register ID (IZO): 181105527
Commercial Register: Municipal Court in Prague, Section C, File 291205
Data box ID: wqa4hfk

Data protection contact: marketa.fibigerova@itgymnazium.cz, +420 604 250 201. School office: info@itgymnazium.cz, +420 771 278 111.

Data Protection Officer named in the school document: Mgr. Markéta Fibigerová, marketa.fibigerova@itgymnazium.cz, +420 604 250 201.

Website forms

Open Day and classroom visit registrations

These details are used to organise your chosen Open Day or classroom visit and related arrangements. Registration is not an application for admission and does not affect admission decisions.

  • Required details: visit date, applicant’s full name and a parent’s contact email.
  • Optional details: parent’s or companion’s full name, parent’s phone number and a note.
  • Registration record: the selected event details as they were at submission, form language and submission time.

The online form cannot be submitted without the required details. Contact the school office to arrange another way to register. Do not include health or other sensitive data in the note. If you enter a companion’s details, share this information with them.

Venue hire enquiries

We use these details to handle your enquiry and discuss the space, date and rental terms. Submitting an enquiry does not by itself confirm a booking or conclude a contract.

  • Required details: selected space, first name, last name, email and message.
  • Optional details: phone number and preferred rental date.
  • Enquiry record: form language and submission time.

The form cannot be submitted without the required fields; you can contact the school directly. Include only details needed to handle your enquiry.

Contacting the school

When you contact us by email or phone, we process the information you provide to handle your request. The scope depends on the communication. We obtain data directly from you; an applicant’s or companion’s details may also be provided by the person completing the form.

We process personal data on the following legal bases, according to the purpose:

  • Open Days, classroom visits and general enquiries: the school’s legitimate interest in organising a requested visit and handling correspondence under Article 6(1)(f) GDPR. Processing is limited to the data needed for this purpose, taking account of individuals’ rights, particularly those of applicants who are minors.
  • Rental enquiries by individuals: steps at the individual’s request before entering a contract under Article 6(1)(b) GDPR. Where someone represents a legal entity, we process that person’s business contact details on the basis of legitimate interest in business communication under point (f).
  • Website security and protecting rights: legitimate interests in preventing abuse and protecting claims under point (f), limited to what is necessary. Processing required by a specific legal provision falls under point (c).

Submitting a form is not blanket consent to further uses of your data. Registrations and enquiries are not automatically sent to newsletters or advertising systems. The forms do not make automated admission decisions or profile applicants.

Retention and deletion

Retention periods for website forms: an authorised administrator manually deletes registrations, enquiries and their exports.

  • Open Days and classroom visits: we delete registrations and organisational exports no later than 30 days after the selected event takes place or is cancelled. If a specific request remains unresolved, we retain only the information necessary to resolve it.
  • Uncompleted rental enquiries: we delete the enquiry and its export within 90 days of the last communication if no contract is agreed and discussions are no longer ongoing. For an agreed rental, details needed for the contract and accounting are retained according to applicable obligations and the school’s records retention schedule.
  • General enquiries: we delete correspondence within 90 days of resolution unless a contract, legal obligation or specific legal claim requires further retention.

In the current website, registrations and enquiries are deleted manually. Within the same retention periods, the assigned person also handles copies of data in confirmations, notifications and CSV attachments in school mailboxes, as well as downloaded CSV files. Backups have a separate retention cycle; their data should not be used for routine correspondence, and previous deletions must be reapplied after a restore. The school can provide details about backups and operational logs through the data protection contact above.

Access and recipients

Form records are stored in the website database. Only accounts with administrator permissions can manage and export them. Ordinary editors and visitors cannot access them. The school may download CSV exports to organise visits and handle enquiries. After registration for an Open Day or a classroom visit, we send a confirmation to the parent’s contact email and a blind copy to authorised school staff. We send a receipt confirmation to the person making the rental enquiry. Rental enquiry notifications go to the school staff handling the enquiry. An authorised staff member receives a weekly CSV summary of Open Day registrations to organise visits. We use the school’s Google Workspace email service to send these messages.

Where necessary, authorised school staff and contracted hosting, information system, maintenance, backup and email providers may have access to data. For school education, the original document also lists public authorities; accounting, tax, audit and legal services; and organisers of extracurricular activities. These categories apply only where relevant to the particular purpose.

Direct questions about specific recipients and any transfers outside the European Economic Area to the data protection contact above. Information about transfers by external video and map providers is also available in their policies linked below. The school being based in the Czech Republic does not mean that all external services process data only there.

Website operation, cookies and external services

Technical data is processed to deliver pages and protect forms. Form protection uses a random session identifier and short-lived derived markers to limit abuse and duplicate submissions. The IP address itself is not stored in registration or rental records; separate hosting logs may contain IP addresses.

Embedded YouTube players and Google maps send connection details, such as your IP address and browser information, to their provider. The Cookies page describes current loading and storage behaviour. See also Google’s privacy policy. Links to social networks and external documents open their operators’ services when clicked.

Google Analytics 4 (Google Ireland Limited) helps us measure website visits and completed registrations or enquiries. It uses cookie identifiers and device and visit information. We do not send names, contact details or form text. Data may also be processed outside the EEA. Measurement starts only with your consent.

We measure website visits and interactions. Successful Open Day registrations, classroom visit registrations and venue enquiries are recorded separately, without form contents. Analytics consent is optional and separate from videos and maps. You can withdraw it in Cookie settings; further measurement stops and the website’s analytics cookies are removed. Withdrawal does not itself remove aggregate statistics already created. This integration does not enable Google Signals or advertising personalisation.

Google privacy policy · How Google uses data from partner websites

Google Analytics retains detailed event data for 2 months and user-level data for 14 months. New user activity resets the user retention period. These periods do not apply to standard aggregate reports. Browser cookie lifetimes and the retention of your consent record are separate periods described on the Cookies page.

We remember acceptance and rejection for 183 days. The website database retains a record of the choice, time, language, notice and a derived random browser key for 365 days. This record contains no IP address, name, contact details or browsing history. It is used to respect and demonstrate your choice and is accessible only to administrators. Expired records are removed by automatic daily cleanup.

Cookie settings let you change or withdraw permission at any time. Keeping the choice record supports respecting your preferences and demonstrating consent under Article 7(1) GDPR. Cookies and other browser storage are described on the Cookies page.

Your rights

  • Access and information: you can ask whether and which personal data we process, receive information about processing and obtain a copy.
  • Rectification: you can request correction of inaccurate data and completion of incomplete data.
  • Erasure and restriction: subject to GDPR conditions, you can request deletion or restriction of the use of your data. Deletion does not automatically apply where a legal retention obligation remains.
  • Portability: in the cases specified by the GDPR, you can receive data you have provided in a structured, machine-readable format or request its transfer.
  • Objection: for reasons relating to your situation, you can object to processing based on legitimate or public interest. You can object to direct marketing at any time.
  • Withdrawal of consent: where processing relies on consent, you can withdraw it at any time, without affecting the lawfulness of prior processing.
  • Complaint: you can contact the Czech Data Protection Authority.

Send requests to marketa.fibigerova@itgymnazium.cz or the school’s postal address. Proportionate identity verification may be needed. We will inform you of action taken without undue delay, normally within one month. For complex or numerous requests, GDPR conditions allow an extension of up to two further months; we will explain the extension and its reasons within the first month.

Supervisory authority: Czech Data Protection Authority (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, posta@uoou.cz, +420 234 665 111, data box ID qkbaa2n.

Education records and the original school document

ITG’s original notice concerns secondary education, contracts, statutory records, communication and protection of the school’s rights. Depending on the purpose, this includes identification, address and contact data, identity document details, bank details and other data necessary for education. The document states that photographs, video and audio recordings are processed on the basis of consent. This scope is not a list of fields collected by the Open Day, classroom visit and rental forms.

The school document distinguishes legal obligations, contract performance, legitimate interests in protecting rights and consent. For contracts it refers to the school’s records retention schedule, for legal obligations to applicable legislation, and for photographs, audio and video recordings to the duration of consent. It also describes recipients and the rights of students and their legal guardians.

Information on personal data processing – original ITG document (PDF, Czech, 4 pages)

The document is reproduced unchanged from ITG’s current website. This page makes it accessible and adds information about the new website. Student records, admissions and other statutory activities have their own processing scope; the school can provide the relevant further information.

Cookies · Legal notice · About this website

Advertising measurement

Helps us measure ad effectiveness: website visits and completed open day or classroom visit registrations. With your consent, we use cookies, advertising pixels and server-side measurement, sharing ad-click and browser identifiers and information about visits and completed registrations with advertising services. We do not send names, contact details or form contents and do not enable personalised ads. See our cookie information for the services involved and further details. Consent is optional and can be withdrawn at any time.

With advertising consent, our server sends ChatGPT Ads (OpenAI) a page visit or completed registration event and an ad click identifier when available. We do not send names, emails, phone numbers, form contents or the visitor’s IP address to OpenAI. We also load Google Tag Manager (Google Ireland Limited) to manage measurement tags; Google receives connection details including the IP address when it loads. The browser OpenAI Pixel, Meta Ads and Google Ads are not currently connected. Data may be transferred outside the EEA.

You can withdraw consent at any time in Cookie settings. Forms and reservations work without it. This is not consent to email reminders. Before adding another provider, we update this notice and request a new choice.

OpenAI – Privacy policy · Google – Privacy policy

Optional visit reminders

I agree to receive an email reminder and practical information from 1. IT Gymnázium, s.r.o. for this selected visit only. My choice must be confirmed by email and expires when the event starts. I can withdraw using the link in each reminder email. My registration is already saved; this does not subscribe me to school news.

After email confirmation, we send one reminder about a day before the visit, or shortly after confirmation if the visit is sooner. We use the guardian contact from the saved registration and the selected event. The basis is your separate consent. We do not use this for school newsletters or ads. Confirmations expire after 48 hours or at the event start, whichever comes first. We retain evidence of the choice (time, notice, event and a keyed email digest) for 365 days after the event; it is then automatically deleted. School administrators can access it. Our school email provider delivers the messages. Withdrawing does not cancel the reservation.

Manually prepared applicant emails

The school may prepare individual messages about an upcoming Open Day, follow-up information after a visit and information about applying to study. Authorised staff select the contacts from the school’s own records and supply a current CSV for each mailing. The tool processes the email address and an individual visit time or short personalised text. Importing a contact is not consent to promotional messages. Before sending, the school must verify the source and its entitlement to contact each recipient for the specific purpose; promotional communication requires a valid basis under the rules for electronic commercial communications.

Recipient lists, personalised text, import reports and the note about the contact source are temporary. They expire 30 days after import. Sending stops at expiry and the next daily cleanup removes those details; if scheduled processing is unavailable, cleanup runs on the next administrator visit. Only the message and aggregate counts without recipients remain. Staff also handle exported or saved copies within this period. The tool does not maintain a permanent address book of active recipients.

Every message includes an unsubscribe link. Simply opening the link does not unsubscribe you: the web page asks for confirmation. Supported email clients can also submit a standard one-click unsubscribe request. The email address and the date and method of opting out are retained in a separate suppression list for as long as this mailing tool is used, so that a later import cannot override your choice. This list is accessible only to administrators and is used to respect and document the opt-out, not for sending messages.

Unsubscribing from these mailings does not cancel an Open Day or escape-game booking and does not stop essential form confirmations. Messages use the school’s existing email service. For questions or to exercise your rights, use the school contacts listed above.