UK Bebras decides on purpose and means for processing of data; this makes us the Data Processor.
UK Bebras has a data processing agreement with Eljakim Information Technology BV who handle our data.
There is no need for an agreement with schools (because the schools do not order us to organise a competition). This is different from the external learning systems that schools hire; here the school is the Data Processor.
As with most other web servers, when you access these web pages certain information you provide will automatically be recorded. This will include your IP address, browser type, and information relating to the page you last visited. This information is processed to estimate how much usage of the server is made by different categories of users and in the event of a breach of security may be used to aid detection.
The website www.tcsocc.uk will not ask you for any personal data. The competition website https://challenge.tcsocc.uk will require teachers who wish to register to give their names and schools, and to specify name and gender of each competing student. Name and school information will be used only for the purposes of the competition and follow-up activities (e.g. further rounds of the competition, invitations to participate in prize givings or related outreach events), and will be provided only to those involved in the organisation of such activities.; Relevant invitations will be issued via teachers, and students will not be contacted directly. No contact information of students will be collected. Gender information will be used only for anonymised statistical analysis of results. The latter analysis may involve passing of performance and gender statistics (but not names) to our international partners.
The databases used for the administration of the student data, teacher data and the administration of the competition are stored on secure distributed servers in the Netherlands owned and managed by Eljakim Information Technology BV. Oxford has a data-processing agreement with this company to ensure that they follow the required procedures so as to be compliant with UK and European law and the full requirements of GDPR legislation. Eljakim Information Technology BV holds a ISO 27001 certificate, no. NL 217.1.1 which demonstrates that an organisation has defined and put in place best-practice information security processes. More information can be found here: https://www.itgovernance.eu/blog/en/why-iso-27001-is-the-standard-for-information-security
Minimal personal information relating to students will remain on the website while they are eligible to take part, to enable checking of results by the participants and to enable students to login in future years while of school age. Thereafter, all such information will be deleted and results will become inaccessible. Should a student wish to be removed from the database, they should ask their school coordinator to contact us to have their account and all personal information deleted. Contact information for teachers may be retained, to facilitate communication about future competitions. The publication of students names in the the Roll of Honour page on this website without first asking permisiion from the teachers of the students. Any student wishing to be removed can, at a later date, be ask to be removed by getting their teacher to send an email to firstname.lastname@example.org. (This is inline with our non-communication with students policy and avoids other students impersonating their friends for malicious purposes.)
To ensure that we do not send out spam emails, teachers' email addresses, first name and second name are added to a MailChimp mailing list group controlled by us. Emails sent out from this mailing list always have an unsubscribe link that, if clicked, automatically stop MailChimp from sending out mailings to this address again from this list. It also notifies the UK Bebras Administrator about this request who will then remove this teacher's details from the TCS Oxford Computing Challenge database.
In particular, but without limitation, you have the following rights under applicable European data protection law:
Right of access: You have the right to obtain confirmation from us as to whether or not we process personal data from you and you also have the right to at any time obtain access to your personal data stored by us.
Right to rectification of your personal data: If we process your personal data, we shall endeavour to ensure by implementing suitable measures that your personal data is accurate and up-to-date. If your personal data is inaccurate or incomplete, you have the right to obtain the rectification of such data, however, we also provide an interface to teachers to allow them to rectify their own data and that of their students.
Right to erasure of your personal data or right to restriction of processing: You may have the right to obtain the erasure of your personal data or the restriction of processing of your personal data.
Right to withdraw your consent: If you have given your consent to the processing of your personal data or of the personal data of children below the age of 16 years, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal.
Right to data portability: You may have the right to receive the personal data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit those data to another controller.
To exercise these rights you may at any time contact us at email@example.com (A small administration fee may be charged.)
Policy last amended: 18th May 2018