Data Protection and Privacy

General Principle

WEQSC processes personal data in accordance with the Swiss Federal Act on Data Protection (Swiss DPA) and, where applicable, the General Data Protection Regulation (GDPR) of the European Union.

Accredited schools are required to process personal data in accordance with the same standards. This page sets out the obligations of the school and the rights of data subjects.

Lawful Basis for Processing

Personal data is processed on the basis of:

• Contract — The accreditation relationship and the enrolment of candidates in the WISE programme;
• Legal Obligation — Compliance with applicable law;
• Legitimate Interest — The operation of the credential system, the conduct of audits, and the maintenance of the verification service;
• Consent — Where consent is required for a specific purpose, such as the publication of the name of a candidate in association with an award.

Categories of Personal Data

WEQSC processes the following categories of personal data:

Student Data:

• Full legal name, date of birth, gender, nationality, residential address;
• Unique student identifier;
• Parent/guardian details;
• Enrolment details;
• Academic records;
• Attendance records;
• Examination results;
• Welfare records;
• Recognition data.

Teacher Data:

• Full name, subjects taught, qualifications, teaching experience;
• Employment details;
• Professional development records;
• Induction status.

School Administrator Data:

• Full name, position, contact details;
• Role within the Portal;
• Access records.

Applicant Data:

• Information provided in accreditation applications, including institutional, financial, governance, and staffing information.

Parent/Guardian Data:

• Name, contact telephone number, contact email address;
• Records of communications.

Portal User Data:

• Login credentials, access logs, and records of transactions conducted through the Portal.

Data Subject Rights

Data subjects have the right to:

• Access — To obtain confirmation of whether their personal data is being processed, and to obtain a copy of the data;
• Rectification — To obtain the correction of inaccurate personal data;
• Erasure — To obtain the deletion of personal data where there is no lawful basis for its retention;
• Restriction — To obtain the restriction of processing in specified circumstances;
• Portability — To receive their personal data in a structured, commonly used, machine-readable format;
• Objection — To object to processing based on legitimate interests or for direct marketing purposes.

To exercise these rights, data subjects should contact the Data Protection Officer of WEQSC, or the designated data protection officer of the accredited school.

Special-Category Data

Records relating to the mental health, disability, or safeguarding of a student are treated as special-category data and are subject to heightened protections.

Access to special-category data must be limited to those members of staff who require access in order to discharge their responsibilities. Access must be logged.

Data Protection Officer

WEQSC has designated a Data Protection Officer responsible for monitoring compliance with data protection law and with the WEQSC framework.

Accredited schools are required to designate a senior officer responsible for data protection, or to commit in writing to designate one within ninety days of the effective date of accreditation.

Data Breach Notification

Where a data breach occurs and is likely to result in a risk to the rights and freedoms of the data subjects affected, the school must:

• Notify WEQSC within twenty-four hours of becoming aware of the breach;
• Notify the competent data protection authority in its jurisdiction without undue delay, and in any event within seventy-two hours, where required by applicable law;
• Notify the affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• Record the breach in the register maintained for that purpose.

The notification must describe:

• The nature of the breach;
• The categories and approximate number of data subjects concerned;
• The categories and approximate number of records concerned;
• The name and contact details of the Data Protection Officer or of the person who may be contacted for further information;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and to mitigate its adverse effects.

Data Retention

Personal data is retained in accordance with the retention periods set out in the Document and Database Management page of this portal. Digital Records are retained for an unlimited period in order to ensure the permanent verifiability of credentials.

Where personal data is no longer required for the purposes for which it was collected, and no legal obligation requires its retention, it is securely deleted or anonymised.

International Transfers

Where personal data is transferred outside Switzerland or the European Economic Area, WEQSC ensures that appropriate safeguards are in place, including Standard Contractual Clauses or equivalent mechanisms.

Breach — Consequences

The following are classified as indicated:

Conclusion

The data protection and privacy requirements set out in this page ensure that the personal data of students, teachers, and other data subjects is protected in accordance with the highest international standards. All data protection procedures not expressly set out in this portal must follow the Secretariat's official bylaws.