How this site handles personal data.

1. Who we are

The data controller for this site is Campus des Nations, part of the International School of Geneva (Ecolint), 62 Route de Chêne, 1208 Geneva, Switzerland.

For questions specific to this maths-department site — including requests to see, correct, or delete personal data published here — contact the Head of Mathematics, Katherine Northcott, at katherine.northcott@ecolint.ch.

For broader school-wide data-protection matters, Ecolint's Data Protection Officer can be reached at privacy@ecolint.ch.

2. What we collect, and why

We collect as little personal data as we can while still running a useful department website. There are three categories:

• Teacher profile data. Name, role, contact email, a short biography, a profile photo, and any personal professional links the teacher chooses to share. Published on the Teachers page so that students and parents know who teaches what. Legal basis: legitimate interests in the employment context — publishing staff information is a normal expectation of a school site.
• Server request logs. Our hosting provider records standard web-server logs for each request, which include the visitor's IP address, the page requested, the time, and the browser's user-agent string. These are generated automatically by the hosting platform and are used for security and to diagnose faults. Legal basis: legitimate interests in operating and protecting the site.

3. What we do NOT collect or do

Several things you might expect on a modern website are deliberately absent here. We commit to never doing any of the following on this site:

• No analytics. We do not run Google Analytics, Plausible, PostHog, Sentry, or any equivalent visitor-tracking tool.
• No third-party trackers or advertising. No embedded tracking pixels, no advertising tags, no third-party iframes. We never show advertising on this site.
• No behavioural profiling. We do not build profiles of visitors and we do not process any personal data for commercial profiling.
• No sale or sharing with third parties. We never sell personal data, and we never share it with any third party other than the sub-processor named in section 5, which acts on our instructions under a data-processing agreement.
• No cookies at all. This site sets no cookies whatsoever. There is nothing to consent to, which is why you are not shown a cookie banner.
• No AI training use. We do not use any personal data collected by this site to train artificial-intelligence or machine-learning models, our own or anyone else's.
• No student data. We do not collect students' names, surnames, account information, or progress data. The multiplications-practice tool stores progress only in the student's own browser (localStorage) and never transmits it. The Year 6 self-quiz keeps its results in the same way.
• No outbound email from the site. Mailto links open the visitor's own mail client. The site itself does not send email on your behalf, and there is no email-delivery sub-processor (such as SendGrid or Resend) involved.
• No runtime calls to Google Fonts. Fonts are self-hosted at build time via next/font/google, so loading a page does not trigger any request to Google.

4. Children and minors

This site is informational and intended for parents, prospective parents, current students, and staff. It does not require a login for any student-facing feature, and it does not collect, transmit, or store any personal data about students.

The two student-facing tools on the site — the multiplications-practice quiz and the Year 6 → Year 7 self-quiz — operate entirely client-side. No identifier, name, score, answer, or progress record is sent to our server. Progress is held only in the student's own browser and is cleared when they clear their browser data.

Because we do not collect personal data from children, no parental-consent mechanism is required at the technical level. The school's wider relationship with families (admissions, pupil records, school photography, fieldwork consents) is handled through Ecolint's main systems and is governed by Ecolint's school-wide privacy notice.

5. Sub-processors

We use one sub-processor to operate this site: Google. No further sub-processors are used: no analytics provider, no email-delivery provider, no AI provider, no third-party support-desk tool, and no database provider.

• Google — hosting. The public pages are plain files served by Google Firebase Hosting, part of Google Cloud. The hosting project belongs to the school's own Google Cloud organisation (ecolint.ch), not to an individual. Purpose: delivering the pages you are reading. No personal data is stored there by us; Google generates the server request logs described in section 2.
• Staff tools are separate. The staff area is a separate, sign-in-only application for teachers, reachable only with an ecolint.ch Google account. It stores its data in Google Cloud Firestore, in Google's Zurich region (europe-west6), inside the school's own Google Cloud organisation — the same project that hosts this site. What it holds is described in the compliance dossier: the staff directory, the list of who may sign in, and the review notes colleagues write about these pages. It holds no information about students or families, and visitors to this site never interact with it.

6. International data transfers

The public pages store no personal data of their own. The only personal data arising from your visit as a member of the public is contained in the server request logs described in section 2, which are generated and held by Google as our hosting provider. The staff area described in section 5 does hold personal data, about staff only, and keeps it in Switzerland.

Firebase Hosting delivers pages from Google's global content-delivery network, so a request may be served from, and logged at, an edge location outside Switzerland or the EU. Google acts as our processor under the Google Cloud data-processing terms, which incorporate the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Teacher profile data. Kept while the person is employed by the school, and removed on request (or when they leave). The admin tooling supports a one-click hard delete that removes the profile row and every associated avatar file at the same time.
• Server request logs. Retained by Google according to the Firebase Hosting and Google Cloud logging defaults for the project. We do not copy them elsewhere or keep our own record of them.
• Backups. The site is rebuilt from source and holds no database, so there is nothing to back up that contains personal data. Every past version of the site is recoverable from the source-code history.

8. Security measures

The site is built defensively. Concretely:

• Encryption in transit (TLS). All traffic to and from the site uses HTTPS with modern TLS, terminated by Google Firebase Hosting.
• No writable surface. The public site is a set of static files. It has no database, no login, no forms and no server-side code, so there is nothing on it for a visitor to write to, inject into, or extract data from.
• Authentication (staff area only). The separate staff area requires a Google sign-in with an ecolint.ch account, and access is further restricted to an allow-list of department staff. There is no shared password. Sessions are managed by Google, not by us.
• Logging and monitoring. Google records HTTP requests and errors for the hosting project. These are accessible to the site administrator for review.
• Disaster recovery. The site is generated from source held in version control, so any past version can be rebuilt and redeployed.
• Vulnerability management. Dependencies are tracked via package.json and Dependabot alerts. Security patches are applied promptly when GitHub flags them.
• Input sanitisation. Teacher biographies pass through HTML sanitisation on write and again on render, to defend against stored cross-site scripting.
• Environment segregation. Production and preview environments are isolated. Pull-request preview builds do not have access to the production service-role key.

9. Cookies

This site sets no cookies at all, and uses no local storage for any purpose that identifies you. The learning aids on the curriculum and quiz pages keep their state in your own browser, on your device, and that information is never sent to us. Because we set no cookies, no consent banner is required under ePrivacy or FADP rules, and there is nothing for you to accept or reject.

10. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects or similarly significant effects on any individual (GDPR Article 22, nLPD Article 21). The site does not profile visitors and does not analyse student performance to generate recommendations.

The unit-level objectives tick-box on each curriculum page is a private learning aid for the student, stored only in their own browser. It is not transmitted to us and is not used to make any decision about them.

11. Your rights and how to exercise them

Under the GDPR (Articles 15–22) and the Swiss nLPD (Articles 25–28), you have the following rights:

• Access. Ask what personal data we hold about you.
• Rectification. Ask us to correct anything that is wrong or out of date.
• Erasure. Ask us to delete your data, where we don't have an overriding reason to keep it. For teacher profiles this is implemented as a one-click hard delete that removes the database row and all associated avatar files.
• Restriction. Ask us to limit how we use your data while a question about it is resolved.
• Portability. Receive a copy of your data in a structured, machine-readable format (we will export to JSON on request).
• Objection. Object to processing we carry out under legitimate interests.
• Withdraw consent. Where any processing is based on consent, withdraw it at any time. (This site does not currently rely on consent for any processing.)

12. How to make a request or complain

To exercise any of the rights above, email katherine.northcott@ecolint.ch (for matters specific to this site) or privacy@ecolint.ch (for school-wide matters). We will respond within 30 days; if we need longer we will tell you why.

If you are not satisfied with our response, you can complain to a supervisory authority. In Switzerland the authority is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU you can complain to the data-protection authority in your country of residence; in the UK, to the Information Commissioner's Office (ico.org.uk).

13. Updates to this notice

We will update this notice when our practices change. The last-updated date is shown above. Material changes will be flagged on the site for a reasonable period.