Privacy policy

This English translation is provided for convenience; the Spanish version governs in case of discrepancy.

Data controller: Colegio de Educación Técnica y Académica Célestin Freinet, hereinafter “the School” or “Colegio Célestin Freinet”.
Address: Calle 136 # 136-12, Bogotá D.C., Colombia (Administrativa Campus). Campuses: Norte (Km 6 Suba-Cota road, Chorrillos), Bilingüe (Km 7 Suba-Cota road, Chorrillos) and Ciudad Verde (Carrera 31 # 17-201, Soacha, Cundinamarca).
Phone: 601 743 7661
Website: https://celestinfreinet.edu.co

1. Purpose and scope

This policy describes how the School collects, uses, stores, shares and deletes personal data of applicants, students, parents and guardians, people who contact us through the website or other channels, and visitors to our campuses. It applies to all campuses, staff and data processors acting on behalf of the School.

2. Legal framework

Articles 15 and 20 of the Colombian Constitution; Law 1581 of 2012; Decree 1377 of 2013, compiled in Decree 1074 of 2015; Constitutional Court ruling C-748 of 2011; Law 1098 of 2006 (Code on Childhood and Adolescence) regarding the prevailing rights of children and adolescents; and any rules that amend or complement them. The data protection authority in Colombia is the Superintendence of Industry and Commerce (SIC).

3. Definitions

Personal data: any information linked to or that can be associated with an identified or identifiable natural person.
Sensitive data: data affecting the privacy of the data subject or whose misuse may lead to discrimination (for example health, ethnic origin, religious beliefs, biometric data).
Data subject: the natural person whose data is processed. For children and adolescents, their rights are exercised by their legal representatives.
Processing: any operation on personal data: collection, storage, use, sharing or deletion.
Controller: the School, which decides on the databases and their processing.
Processor: anyone who processes data on behalf of the School (for example a technology provider).
Authorization: the prior, express and informed consent of the data subject.

4. Principles

The School applies the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality set out in Article 4 of Law 1581 of 2012.

5. Data we process and data subjects

Data subjects	Data	When collected
Parents, guardians and interested families	Name, phone, email, campus and grade of interest, message, contact preferences	Website forms (admissions, contact, PQRS, Open Day registration), WhatsApp, calls, campus visits
Applicants and students (minors)	Name, date of birth, grade, identity and academic documents, health information strictly necessary for their care, image (photos and video)	Admission and enrollment process, school life, with the legal representative's authorization
Guardians and financially responsible persons	Identification and contact data, payment and account information	Enrollment and administration
Campus visitors	Images captured by security cameras, entry records	When entering a campus, with visible notice
Website users	Browsing data and cookies (IP address, pages visited, device)	While browsing, according to the cookie notice

The School does not request sensitive data through website forms. Health and other sensitive data required during enrollment are collected separately, with explicit authorization and only as strictly necessary for the student’s care.

6. Data of children and adolescents

The School processes minors’ data respecting their prevailing rights, their best interest and, according to their maturity, their opinion (Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013). Authorization is given by the father, mother or legal representative. Students’ data is used only for educational, administrative, safety and legal compliance purposes; it is not used for commercial purposes or shared with third parties for such purposes.

7. Purposes of processing

Responding to requests for information, visits, Open Day registrations and admission and enrollment processes.
Managing the academic and administrative relationship with students and families: enrollment, academic platform, institutional communications, payments and collections, transportation, cafeteria and uniforms.
Answering requests, complaints, claims and suggestions (PQRS).
Sending information about the School’s educational offer, events and news to those who authorize it, with the option to withdraw that authorization at any time.
Ensuring the safety of people and facilities through entry records and video surveillance, with notices at every campus.
Complying with legal obligations before education and oversight authorities (for example reports to the Ministry of National Education and the Secretariat of Education).
Measuring website use to improve it, through cookies and analytics tools, only with the user’s consent.
Publishing photos or videos of school activities on the website and social media, only with the prior, specific and written authorization of the student’s legal representative.

8. How we obtain authorization

Authorization is obtained before processing, in a prior, express and informed manner, through the acceptance checkbox on website forms, physical or digital forms signed during admission and enrollment, or any other means that allows proof to be kept. The School keeps proof of the authorization (date, time and channel) and provides it to the data subject on request. Authorization is not required in the cases of Article 10 of Law 1581 of 2012, for example when a public authority requests data in the exercise of its legal functions.

9. Rights of data subjects

Under Article 8 of Law 1581 of 2012, the data subject, or the legal representative in the case of minors, has the right to:

Know, update and rectify their personal data.
Request proof of the authorization given, except where the law does not require it.
Be informed about the use made of their data.
File complaints with the Superintendence of Industry and Commerce for violations of the law.
Revoke the authorization or request deletion of their data when no legal or contractual duty requires keeping it.
Access their personal data free of charge.

10. Procedure for inquiries and claims

Channel: the PQRS form on the website (celestinfreinet.edu.co/en/pqrs/) or a written communication filed at any campus.

Inquiries are answered within a maximum of ten (10) business days from receipt. If that is not possible, the School informs the data subject of the reason and the response date, which will not exceed five (5) business days after the first term (Article 14 of Law 1581 of 2012).

Claims must include the data subject’s identification, a description of the facts, a notification address and supporting documents. If a claim is incomplete, the School requests the missing information within five (5) days; after two (2) months without a response the claim is deemed withdrawn. If the School is not competent, it forwards the claim to the competent party within two (2) business days and informs the data subject. While the claim is pending, the record is marked “claim in process”. The maximum response term is fifteen (15) business days from the day after receipt; if that is not possible, the School informs the reason and the new date, which will not exceed eight (8) additional business days (Article 15 of Law 1581 of 2012).

The data subject may file a complaint with the Superintendence of Industry and Commerce only after completing this procedure with the School.

11. Processors, data sharing and international transfers

The School uses providers that process data on its behalf under contracts requiring confidentiality, security and use solely for the authorized purposes. They include HubSpot (family relationship management and website forms), Phidias (academic platform and payments) and Google Workspace (email and documents). Some of these providers store information on servers outside Colombia, mainly in the United States. In those cases the School transfers data only with the data subject’s authorization and under contractual guarantees of protection equivalent to Colombian law (Article 26 of Law 1581 of 2012). The School does not sell or share personal data with third parties for purposes other than those described here.

12. Security

The School adopts technical, human and administrative measures to protect information: role-based access control, passwords and authentication on platforms, encrypted website communications (HTTPS), backups, confidentiality agreements with staff and providers, and incident response procedures. In the event of a security incident affecting personal data, the School manages it and, where applicable, informs the Superintendence of Industry and Commerce and the data subjects.

13. Video surveillance, photos and video

Campuses have security cameras marked with visible notices; recordings are kept for a limited period and are only handed over to competent authorities. Photos and videos of students for the website, social media or institutional material are published only with the prior, specific and written authorization of the legal representative, which may be revoked at any time.

14. Cookies and website analytics

The website uses first-party and third-party cookies (HubSpot and Google tools, including the Google Maps maps of the campuses) for its operation, to measure use and, if the user accepts, for marketing purposes. On arrival, users can accept or reject non-essential cookies in the cookie notice and change their decision at any time. The cookie notice describes each cookie.

15. Validity

Databases are kept for as long as the relationship with the data subject lasts and for the periods required by education, accounting and records rules. Substantial changes to this policy are published on the website and, when they affect the purposes, communicated to data subjects before they apply.