PRIVACY NOTICE

September 2025

 

Because we are considering the protection of personal data as a permanent commitment for AVENOR, we dedicate resources and efforts to process your data in full compliance with Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), as well as with any other applicable domestic or community legislation.

 

Who we are

For the purposes of data protection legislation, we are an educational consortium with the generic name of Avenor College, formed by the Avenor Foundation as representative of Avenor High School, Avenor Middle School and Avenor Kindergarten, hereinafter referred to as “AVENOR”, acting as the controller of personal data.

 

Our main office is in Bucharest, Drumul Pădurea Pustnicu no. 125A, sector 1, postal code 014042.

 

Within the framework of its current activities of providing educational services, AVENOR processes the personal data of its employees, candidates for vacant positions, potential, current and former students, but also of their parents or legal representatives, who have the status of data subjects.

 

The processing of personal data is carried out by mixed means (manual and automatic), in compliance with legal requirements and under conditions that ensure security, confidentiality, principles and respect for the rights of data subjects.

 

This Privacy Policy applies to all information processed by AVENOR, regardless of how it is collected, processed or stored and describes, among other things, the types of information processed, what we do with it, who we share it with, how long we retain it, how we protect it and what your rights are.

 

This Policy covers information collected by AVENOR through various means of communication, including but not limited to the website https://www.avenor.ro/

 

Why do we process personal data?

AVENOR processes the personal data of all categories of data subjects for the following purposes:

 

  • Provision of educational services: admission, student registration, class and timetable administration, teaching activities in our offices and online, administration of internal and public exams, guidance for university enrolment, issuance of enrolment registers and academic evaluation reports;

     

  • Providing complementary educational services: running the Virtual Learning program, personal development, personal counselling and career advice, access to the school library, co-curricular activities, excursions, management of school publications, creation of a virtual learning environment and granting access to the AVENOR network, including the assignment of email accounts with the AVENOR domain;

     

  • Ensuring campus security: monitoring campus access, permanent security and alarm services, video surveillance, ensuring security in online education sessions;

     

  • Providing medical assistance and psychological counselling in case of need;

     

  • School administration: management of student files and educational documents, management of student and parent contact lists (name, phone, email), management of invoices and payments, audits and internal controls, development of reports and statistics, implementation of school policies, ensuring collaboration with other educational institutions, physical and digital archiving of documents, evaluation of the quality of services provided, facilitation of research activities;

     

  • School communication: sending messages regarding students and AVENOR activities through accredited communication platforms for educational activities;

     

  • Communication with parents for the smooth running of extracurricular activities and the online school;

     

  • Organization of fundraising activities and other school events (concerts, theatre productions, talent shows, Avenor clubs, sports activities and competitions), including promotional messages associated with charitable activities organized by AVENOR;

     

  • Participation in domestic and international events and conferences where the organizer requests access to student registration and participation data (names, email addresses);

     

  • Resolving disputes and litigation.

     

What kind of personal data do we process?

As part of its current activities, AVENOR processes the following categories of personal data:

 

  • Contact information and data (surname and first name, citizenship, country of origin, address, information included in ID / passports, CNP, Birth certificates, telephone number, e-mail, etc.);

     

  • Bank details;

     

  • Medical documents: medical history, allergies, vaccination records, conditions, medical exam results and other medical documents of students;

     

  • Medical documents, medical records and files of employees;

     

  • Data about the educational environment and academic performance of students: academic results and semester evaluation reports, student discipline and conduct, hobbies, educational test results, teacher feedback, etc.;

     

  • Data about student discipline and conduct, as well as data regarding student preferences / interests;

     

  • Data regarding email addresses, IP addresses, connection devices and other personal elements associated with the online school;

     

  • Family data: information about siblings enrolled at AVENOR, household, linguistic history, profession and place of work of parents, etc.;

     
     

  • Authentication and identification data: holographic signature, passwords for email access and platforms used, campus access card, location data, IP addresses and other online identification details, personal car information for parking access, etc.;

     
     

  • Photos, voice recording and video images.

     

Currently personal data held by AVENOR is provided directly by parents, students, candidates and employees, as well as a result of the interaction between the school, students and parents. There are cases in which the data has been provided by third parties (transfer of school records or references from former employers).

 

What is the legal basis for the processing of personal data?

1. Consent granted by the data subject for the processing of personal data for one or more specific purposes. Examples of current activities requiring consent:

 
 

  • Use of photos and videos of students in various school publications, on the AVENOR website and on official social media pages;

     

  • Use of contact details of students and parents for communications regarding the organization of extracurricular activities, participation in camps, clubs, excursions, competitions and other external events;

     

  • Use of contact details of parents for messages promoting charitable actions organized by AVENOR;

     

  • Other agreements that may be necessary on a timely basis are requested whenever necessary, for activities for which the processing of personal data cannot be associated with another legal basis.

     

2. Processing is necessary for the performance of a contract.

 

  • Compliance with the provisions of the Employment Contract and all activities preceding its signing constitute the main legal basis for the processing activities associated with the employment process;

     

  • The schooling contract contains all the provisions necessary for the legal justification of the activities carried out during the education processes, in relations with parents, being reviewed and renewed at the beginning of each school year;

     

  • The regulations for organizing various events or competitions may have the role of a contractual provision, if they are well formulated and are brought to the attention of all those involved.

     

3. Processing is necessary for the fulfilment of a legal obligation.

 

  • Labor Code – Law 53/2003, Art.39 – covers the main rights and obligations of the employee;

     

  • Accounting Law, and all tax decisions and orders covers requirements related to invoicing, payments, settlement, supporting documents, as well as archiving conditions;

     

  • Ministry of Education legislation – imposes specific requirements for the conduct of activities in state and private educational institutions;

     

  • EU Regulation 679/2016 establishes mandatory elements but also recommendations regarding maintaining compliance in the processing of personal data;

     

  • Law 190/2018 establishes the conditions for the applicability of GDPR in Romania, with special chapters dedicated to the obligation to appoint a DPO and supervision at the workplace.

     

4. Processing is necessary to protect vital interests – was the reporting basis for all decisions taken during the state of emergency adopted in the Pandemic, measures that prevailed over other legal bases and individual freedoms.

 

5. Processing is necessary for the public interest – since AVENOR provides educational services considered services of public interest, there may be activities that can be related to this legal basis such as: issuing documents with academic results, assessing the learning capacity and performance of students, adapting teaching activities to individual needs, etc.

 

6. Processing is necessary for the purposes of the legitimate interests pursued by the operator – AVENOR refers to this legal basis in order to provide the educational services for which it has committed itself to the highest standards, always for the benefit of students and without violating the rights and freedoms of the data subjects:

 

  • Organizing the recruitment and selection process in order to hire the best candidates;

     

  • Activities to promote the school, college or kindergarten, as well as the results obtained by students;

     

  • Organizing charitable fundraising activities, including their promotion;

     

  • Executing legal claims, resolving complaints and controlling third parties;

     

  • Management, control, reporting and production of statistics on the school’s activity;

     

  • Monitoring the use of the virtual learning environment and the network, including the email account @avenor.ro;

     

  • Ensuring information security and the processing method;

     

  • Ensuring security at AVENOR headquarters, including through video monitoring systems;

     

  • Maintaining close relations with graduates and members of the AVENOR community;

     

  • Collaborating with other schools and educational institutions;

     

  • Collaborating with organizers of domestic and international events, including online events;

     

  • Organizing clubs for the development of students’ skills, including sports teams and competitions;

     

  • Access to grants and other sources of funding.

     

What are the mandatory data categories and the processing of critical data?

It is useful to note that there are a number of categories of personal data that are mandatory for specific activities carried out by AVENOR, such as concluding the Schooling Contract and to provide the best educational services in the interest of students.

 

In compliance with the GDPR principles of data adequacy and minimization, essential data are found appropriately marked in the Online Application Form, attached to the Schooling Contract. Failure to complete the information marked in the Form will prevent the process of registering the application and concluding a contract with you.

 

Since the GDPR expressly provides that data about children cannot be processed without parental consent, completing and sending these forms constitutes your implicit consent, as parents, to the processing of this data.

 

Also, the signing of Employment Contracts requires a series of absolutely necessary documents, stipulated by the Labor Code, without which good management of employee relations cannot be achieved.

 

We must clearly state that AVENOR does not process personal data considered critical, which reveal racial or ethnic origin, political opinions, religious confession, philosophical beliefs or trade union membership, as well as genetic, biometric, health data or data on life and sexual orientation.

 

Medical offices appropriately process data that can be considered special, only to ensure the vital interest and public interest in maintaining general health conditions in educational institutions, the proper implementation of prevention and occupational health programs, the diagnosis and provision of medical or social care or treatment based on European or national legislation.

 

Also, psychologist teachers may have access to a series of sensitive personal data related to a specific psychological profile, the existence of files on children and current psychological consultation activities.

 

With whom do we share personal data?

Personal data processed by AVENOR is accessible only to AVENOR staff in the administrative and educational teams, who are aware of their role and responsibility for ensuring their security and confidentiality. Student medical records and data are accessible only to medical staff, and the psychological profiles of some students are accessible only to psychologists specializing in individual counselling.

 

Depending on the programs run, other staff members may have access to specific medical information, such as the existence of allergies (only on the basis of consent) or some conditions that trigger special learning needs (public interest programs).

 

Sharing data with third parties (partners, suppliers, collaborators, event organizers, other schools and institutions) takes place within the framework of current processing activities, the records of which are kept rigorously and only on the basis of mutual data processing agreements. AVENOR does not share personal data with partners except for the purposes for which they were collected. The categories of recipients include the following:

 

  • IT service providers, including educational applications, online learning tools, email platforms or information management systems specific to schools;

     

  • AVENOR cafeteria staff, as an independent food service provider;

     

  • Staff of means of transport provided for students and staff;

     

  • Other kindergartens, schools or colleges by transferring school records;

     

  • Other educational institutions or organizations, not limited to other schools;

     

  • Organizers of extra-curricular events, including online events;

     

  • Providers of remote communication and collaboration platforms used in Virtual Learning sessions;

     

  • Travel agencies, service providers hotels;

     

  • Insurance agencies or legal services;

     

  • Professional photographers and cameramen, contracted by AVENOR;

     

  • Courier service providers;

     

  • Utility service providers;

     

  • Public authorities and institutions, courts, embassies or other diplomatic missions;

     

  • Tax, legal and accounting consultants;

     

  • GDPR consultancy through outsourced DPO services.

     

Who do we make international data transfers with?

AVENOR may transfer the personal data of students and parents to a third country only for the purpose of participating in school activities, excursions or international camps that are the subject of current activities. In addition, for the smooth running of the examination conditions, AVENOR transfers the personal contact data of students in the UK – to Cambridge International Examinations.

 

Starting from January 2020, all transfers of personal data to AVENOR partners in the UK are legally justified by the GDPR post-Brexit adequacy agreements between the EU and the UK.

 

For any other situation, in which a transfer of personal data may take place on a punctual basis, to the European Union, EU accredited countries or non-accredited countries, the consent of the data subjects (employees, students or parents) is requested.

 

The use of all applications and online platforms is regulated by means of specific licensing agreements and standard contractual conditions provided by all manufacturing or supplying companies.

 

How long do we retain personal data?

AVENOR retains personal data differently, for each type of activity, depending on the deadlines established by legislation or internal policies.

 

  • For employees, the retention period of personnel files is governed by the legislation specific to human resources management;

     

  • For candidates who have not gone through the recruitment process, the retention of CVs is done for a period of 6 months, according to an internal procedure and AVENOR’s policy for candidates;

     

  • For educational activities, the retention is done according to the validity period of the schooling contracts. AVENOR keeps student files and all data related to the student’s interaction with the school mainly for the evaluation of educational activities and the quality of the services offered, but also to respond to potential requests from students regarding their educational path within AVENOR, requests that usually arise after students finish their studies;

     

  • Enrolment records and other school documents related to study activities are kept for an indefinite period, in accordance with legal obligations;

     

  • For any other activity for which there is a legal provision requiring a minimum retention period, AVENOR will keep personal data for at least that mandatory period.

     

How we ensure the security of personal data

AVENOR takes reasonable steps to ensure the confidentiality and security of personal data, by adopting appropriate technical and organizational measures, to secure your information and to protect it against unauthorized or illegal use, loss or accidental destruction.

 

These measures include: using only authorized IT resources, managing and monitoring access to email accounts, applications and platforms, ensuring antivirus, antimalware protection measures and creating backup copies, encrypting data at the server level, password-protected transmission by email of files containing personal or confidential data, securing access to servers and network equipment, as well as periodic training of personnel on compliance with information security requirements.

 

Despite the measures taken to protect your personal data, we draw your attention to the fact that the transmission of information via the Internet, in general, or via other public networks, is not completely secure, there is a risk that the data will be seen and used by unauthorized third parties. We cannot be responsible for such vulnerabilities of systems that are not under our control.

 

What are your rights regarding access to information and processing of personal data?

The GDPR provides certain rights related to the processing of personal data, which benefit all categories of data subjects whose data are processed by AVENOR. College students, who due to their age are assumed to have an appropriate level of understanding, could exercise the rights presented in this section, individually. AVENOR respects all rights established by the GDPR and has all the necessary resources to resolve any request regarding the observance of these rights, adopting a special procedure for managing requests received from data subjects.

 

  • Right of access to personal data: implies the possibility of obtaining additional information from AVENOR regarding the types of personal data processed, the purpose of the processing, the categories of recipients, the envisaged retention period, as well as the withdrawal of consent. As an Applicant, you only need to fill out a specialized Form for access to personal data and send it by email to our contact addresses, or to the address dpo@avenor.ro

     

  • Right to rectification: allows the rectification of any incorrect personal data that AVENOR may hold, as well as to update your incomplete personal data.

     

  • Right to erasure of personal data: may apply for certain categories of data or in certain situations in which there are no regulations on retention and archiving regulated by law. Even if the data has been deleted, this does not fully guarantee the “right to be forgotten”, due to procedural regulations, which, among other things, oblige us to keep a record of all requests received and how to resolve them.

     

  • Right to restriction of processing: i.e. to obtain restrictions on the processing of AVENOR for certain categories of personal data, according to specific situations established by the GDPR, such as restricting processing during the period of rectification of contested data;

     

  • Right to data portability: implies the right to receive personal data in a structured, commonly used and machine-readable format and to transmit these data to another controller. You can also request AVENOR to transmit certain data sets, in a standardized format, to another controller;

     

  • Right to object to data processing: for reasons related to your particular situation;

     

  • Right to withdraw consent: represents a particular case of the right to object, when the given consent represents the only form of legal basis. AVENOR will cease processing the respective data starting from the moment the request for waiving consent was submitted, all previous processing activities being considered valid;

     

  • Rights related to automated decision-making and profiling: provide guarantees against the risk that a potentially harmful decision is made without human intervention. AVENOR does not use automated decision-making procedures or large-scale profiling activities that would contravene this right. AVENOR may create and use educational profiles to assess student performance, identify gaps in their development, or assess specific traits that characterize students’ personality, preferences, behaviour, or professional inclinations.

     

  • Right to file a complaint: if you are not satisfied with the way AVENOR processes your personal data or consider the response received to a specific request to be unsatisfactory, you can file a complaint via an online form with the Data Protection Authority, by accessing the dataprotection.ro website.

     

How we are using the video surveillance system

Through the video surveillance system installed in both locations, AVENOR processes personal data, namely the image and other information that allows the identification of a person data belonging to employees, collaborators, visitors and any other persons who enter the company’s territory.

 

The only legal basis for this video monitoring is to ensure legal obligations that include the guarding of objectives, goods, values and the protection of persons (Law 333/2003), as well as the protection of individuals with regard to the processing of personal data and the free movement of such data (GDPR and Law 190/2018).

 

Through the Video Surveillance Policy, AVENOR guarantees that it does not carry out special monitoring of persons recorded by video cameras and does not use video images for purposes other than those related to ensuring security elements and access control on campus premises, the security of goods and the safety of persons employees, students, parents or visitors, as well as of the property and information held.

 

How to contact us

Whenever you wish to contact us for clarifications regarding the processing of personal data or to send a request regarding the exercise of the aforementioned rights, you only need to complete the Request Form that can be downloaded from the website and send it to the Data Protection Officer at AVENOR at the email address: dpo@avenor.ro

 

What else might interest you

The provisions of the Privacy Policy apply together with those of other policies / procedures adopted by AVENOR, such as:

 

  • Video Surveillance Policy;

     

  • IT Security Policy;

     

  • GDPR Policy for Candidates;

     

  • Policy on the Storage and Deletion of Records;

     

  • Policy for the Processing of Personal Images;

     

  • Procedure for managing requests received from data subjects;

     

  • Procedure for withdrawing consent.

     

For visitors to the avenor.ro website, please also read:

 

Review and improvement

This policy has a 3 year review. This policy has been developed following Romanian legislation. If the case, any updates to the legislation will be sought and incorporated into the policy immediately after emergence.

popup