Privacy Notice

ECOLE INTERNATIONALE DE NEW YORK DBA THE ÉCOLE

PRIVACY NOTICE

Last Updated: May 29, 2026

This Privacy Notice describes how and why The École (“we” or “us”) processes the personal data that we collect from or about you or your child in connection with our educational and business operations, and how we may share that personal data with third parties. This Privacy Notice also describes your rights in respect of our processing of your personal data.

I. Types of Personal Data We Process

We may collect, use, store, transfer and otherwise process various types of personal data about you, your child or your family, including:

Identity data, including a person’s full name, gender, date and place of birth and nationality;
Identity data regarding other members of a person’s family and of caretakers;
Contact data, including home and business mailing addresses, email addresses, telephone numbers and fax numbers;
Social security number or national identification number;
Financial account data in connection with payments or donations you make to us, including bank account information and credit card numbers;
Financial data that we obtain in connection with tuition payment obligations and in connection with any applications for financial aid, including salary and income information;
Medical and health data, including medical records, medications taken, drug allergies, immunization records, and health insurance information;
Data regarding food allergies and dietary restrictions;
Academic data, such as prior educational records, papers, projects, assessments, grades and attendance records;
Student disciplinary records, including a student’s disciplinary records at any previous schools;
Technical data, including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device identifiers, geolocation information, and other technology on the devices you use to access our website located at www.theEcole.org (the “Website”), and information about how you use our Website;
Your preferences in receiving communications from us and from third parties; and
Any other personal data that you may provide to us.

With respect to the personal data we collect from you, we will typically be the data controller. “Personal data” does not include anonymous data (i.e., information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous in such a manner that the individual is no longer identifiable.)

We may process aggregated data such as statistical or demographic data for any purpose. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific Website feature. If we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data that will be used in accordance with this Privacy Notice.

II. Our Purposes For Processing Personal Data

Below is a non-exhaustive list of our purposes and lawful bases for processing personal data.

A. Our Educational and Business Operations

We collect and maintain personal data for various purposes relating to our educational and business operations, such as:

Facilitating educational activities;
Facilitating co-curricular activities;
Facilitating application and enrollment processes;
Facilitating financial aid processes; and
Facilitating our other educational and business operations.

Our lawful basis for processing your personal data for this purpose are (a) performance of any contract we are about to enter into or have entered into with you, (b) it is necessary for our legitimate interests and (c) when we have obtained your consent.

B. Protecting Our Rights and Responding to Legal Requests

We may process and disclose any personal data without your consent if we believe in good faith that such action is necessary (i) to protect and defend the rights, property or safety of us or our employees, affiliates, or the public; or (ii) to satisfy any applicable law, regulation, legal process, court order, subpoena, or other governmental or regulatory (including law enforcement) request.

Our lawful basis for processing your personal data for this purpose are (a) it is necessary for our legitimate interests, and (b) we need to comply with a legal or regulatory obligation.

C. Job Recruitment

We may process your personal data to assess your suitability for any position of employment for which you may apply with us. Such data may include education history, employment history and professional designations, information regarding your work authorization status, and other information about your background and qualifications.

You may communicate with us or apply for a job with us via a third party service (e.g., LinkedIn or Indeed) or via recruiting firms or staffing firms. In these instances, such third parties will share your personal data with us.

D. Other Purposes

In addition to the above, we may use personal data for other purposes for which either we or our client(s) will provide notice to you at the time of collection.

Our lawful basis for processing your personal data for this purpose may include (a) it is necessary for our legitimate interests, (b) we need to perform the contract we are about to enter into or have entered into with you, (c) we need to comply with a legal or regulatory obligation, and (d) when we have obtained your consent.

III. If You Fail to Provide Personal Data to Us

If you fail to provide personal data to us when requested, we may not be able to provide services to you. We may also not be able to perform any contract we have (or are trying to enter into) with you.

IV. Our Sharing of Personal Data With Third Parties

We share certain information with the Agence pour l’enseignement français à l’étranger (Agency for French Education Abroad) (AEFE). The AEFE is a French government institution supervised by the French Ministry of Foreign Affairs. The AEFE is responsible for monitoring and managing the network of French schools abroad, including our school.

The AEFE has requested that we share with it certain information regarding our students and their families, including:

Child’s name, date of birth, address, and nationality.
Parent’s or caretaker’s name, date of birth, address and nationality.

The AEFE has also requested that we share with it certain information regarding our employees.

In addition, we use third party service providers (our “Service Providers”) to assist us in operating our school. Service Providers provide a variety of services to us, including legal and compliance, accountancy, data analytics, telecommunications (including telephone, text messaging, and video conferencing), website administration, information technology, courier, human resources, security services and catering services.

From time to time, we may share your personal data with our Service Providers, and those Service Providers may process your personal data on our behalf and at our direction in connection with the services they provide to us. The types of personal data we may share with our Service Providers include:

Your identity data;
Your contact data (including home and business mailing addresses, email address, telephone numbers and fax numbers);
Your financial data;
Technical data, including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device identifiers, geolocation information, and other technology on the devices you use to access our Website;
Your preferences in receiving communications from us and from third parties.

We may also share anonymous / aggregated information with third parties, including our Service Providers, to facilitate our educational or business operations.

We only permit our Service Providers to process your personal data for specified purposes and in accordance with our instructions. Our Service Providers are also required to treat personal data confidentially and to keep it secure.

We use several web-based applications operated by third party operators such as https://theecole.classe365.com/. Students’ personal data (such as their first name, last name, school email address, and a username) is provided to these third party operators with the understanding that this data will only be used to facilitate our educational programs.

Finally, we may also share personal data with third parties (including governmental or regulatory authorities) if we are legally required or authorized to do so. For example, we may share personal data in connection with a subpoena, search warrant or other court order, or pursuant to the requirements of any regulatory body having jurisdiction over us.

V. Cookies and Similar Technologies

Our Website and our emails contain cookies, pixels, beacons, log files and other technologies (collectively, “Tags”) that allow us to collect certain information by automated means. The information we collect in this manner includes your IP address, network location, browser characteristics, device characteristics, operating system, referring URLs, information on actions taken on our Website, and dates and times of visits to our Website. This information allows us to, among other things, track receipt of an email to you, to count users that have visited a web page or opened an email and collect other types of aggregate information.

Once you click on an email that contains a Tag, your contact information may subsequently be cross-referenced to the source email and the relevant Tag. In some of our email messages, we use a “click-through URL” linked to certain website administered by us or on our behalf.

“Cookies” are text files that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings on the device. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies allow a website to recognize a visitor’s device and to target the content displayed to the visitor’s interests. We use cookies to understand your preferences based on previous or current activity on our Website, which enables us to provide you with improved services, and allows us to compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

These technologies are used in analyzing trends, administering our Website, and tracking users’ movements around our Website. We may receive reports based on the use of these technologies by these companies on an individual as well as an aggregated basis.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. If you disable cookies, some features of our Website may become disabled, and some aspects of our Website may not function properly.

We also may use pixel tags to tell us what parts of our Website that you have visited, to measure the effectiveness of any searches you may do on our Website, or to interact with analytical tools or other marketing tools that gather data and customer usage information.

VI. “Do Not Track” Signals

Our Website does not respond to “do not track” signals or similar mechanisms – where a visitor to our Website would request that we disable the collection of information about the visitor’s online activities. We may also permit third parties to collect aggregate usage information on our Website, and they also may not respond to “do not track” signals.

VII. Retention of Personal Data

We may retain your personal data for as long as it is necessary to fulfill the purposes for which we have collected such data, including for the purposes of satisfying any legal, regulatory, accounting, reporting, insurance, professional indemnity, internal policy or other requirements. We may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes. In such cases, we may use this information indefinitely without further notice to you.

VIII. Personal Data of Children

We will process the personal data of a child under the age of 16 only if consent is given or authorized by the holder of parental responsibility over that child. We may request verification that the person who provides the consent actually holds parental responsibility over the child in question.

IX. Security Measures

We have implemented appropriate technical and organizational measures to ensure a level of security of personal data appropriate to the risk.

X. Specific Rights of Individuals in the European Economic Area (“EEA”)

This section applies only to individuals in the European Economic Area.

Under the General Data Protection Regulation (the “GDPR”), individuals in the European Economic Area (“EEA Individuals”) have certain rights in relation to their personal data, which are summarized below. These rights are subject to your exercising them in good faith and are subject to our legitimate interests or other valid basis to continue processing your personal data, in accordance with our policies and applicable law.

EEA Individuals who wish to exercise any of the rights they have under the GDPR should contact us in writing by mail or email. Our mailing and email addresses are shown at the end of this Privacy Notice. We may need to request specific information to help us confirm your identity, so that your personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

Generally, EEA Individuals will not have to pay a fee to exercise the rights described below. However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

EEA Individuals may lodge a complaint with the appropriate regulatory body or supervisory authority in the country where they reside, where they work, or in the place of the alleged infringement of the law.

A. Access

If asked by an EEA Individual and if we are obligated to do so under applicable law, we will inform that individual about whether we are processing his/her personal data. If we are processing such EEA Individual’s personal data, we will provide access to the personal data that we have about that individual. If you request additional copies of your personal data, we may charge you a reasonable fee.

B. Rectification (i.e., Correction)

If the personal data we hold about an EEA Individual is inaccurate or incomplete, that individual may ask us to have it corrected.

C. Erasure

EEA Individuals may request that we erase (i.e., delete or remove) their personal data in certain circumstances. If you are legally entitled to erasure, and if we have shared such personal data with third parties, we will take reasonable steps (taking into account available technology and the cost of implementation) to inform such third parties of your request, to the extent we are required to do so by applicable law.

D. Restriction of Processing

EEA Individuals have the right to restrict the processing of their personal data in certain circumstances, such as if they contest the accuracy of that personal data, if the processing of the personal data is unlawful, or if we no longer need the personal data for our business purposes. If you are legally entitled to restriction, and if we have shared your personal data with others, we will use reasonable efforts to inform such third parties of your request, if we are required to do so.

E. Data Portability

EEA Individuals may ask to receive their personal data from us, where the legal basis of our processing is their consent, and where we carry out the processing of their personal data by automated means. If EEA Individuals so request, we may transmit their personal information directly to another organization if it would be technically feasible to do so.

F. Objection to Processing

EEA Individuals may object to the processing of their personal data where we are relying on a legitimate interest (or those of a third party). As noted above, you also have the right to object (i.e., opt out of) our processing of your personal data for direct marketing purposes.

G. Automated Decision-Making and Profiling

EEA Individuals have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

We do not engage in decision-making based solely on automated processing, including profiling, which produces legal effects concerning an individual or similarly significantly affects an individual.

H. Processing of Special Categories of Personal Data and of Personal Data Relating to Criminal Convictions and Offenses

There are certain types of personal data that require a higher level of protection, known as “special categories” of personal data under the GDPR. Health data is included as a special category of personal data. We process health data as needed to ensure the health and safety of students, employees and others at our school, where we have obtained explicit consent, where such data has manifestly been made public by the individual, or where we are otherwise legally permitted to do so. We do not process other types of special categories of personal data unless we have obtained such individuals’ explicit consent or we are otherwise legally permitted to do so.

We do not collect personal data about criminal convictions and offenses, unless revealed by due diligence conducted to comply with a legal or regulatory obligation or unless we are authorized to do so under applicable law.

I. Withdrawing Consent

In certain circumstances, EEA Individuals have the right to withdraw their consent to our processing of their personal data. However, withdrawal of consent will not affect the lawfulness of any processing that had been carried out before consent is withdrawn. Moreover, if we rely on another legal basis (e.g., performance of a contract or legitimate interest) to process your personal data, we may continue to process your personal data in accordance with such other legal basis even after you withdraw your consent. If you decide to withdraw your consent, we may not be able to provide services to you.

XI. Information Regarding International Data Transfers

We are based in the United States and our computer servers are located in the United States. Accordingly, all personal data in our possession and control is collected and processed by us in the United States. Any party that provides personal data to us is thereby transferring such data to the United States, and is consenting to the transfer of their personal data to the United States. Individuals who access the Website from outside the United States do so on their own initiative and are responsible for compliance with local laws, rules and regulations.

XII. Change of Control

Personal data may be shared or transferred in connection with a sale, merger, acquisition, divestiture, reorganization or other disposition, or in the event of our bankruptcy or other insolvency proceeding.

XIII. Revisions to This Privacy Notice

This version of the Privacy Notice is effective as of the date set forth above, and supersedes all earlier versions. We may update this Privacy Notice from time to time, and any subsequent versions of this Privacy Notice will be posted on our Website. You are responsible for periodically visiting our Website to check for any updates to this Privacy Notice.

XIV. Text Message Communications

The École operates an optional SMS / text message service for parents and guardians of currently enrolled students. Text messages are used solely for operational purposes related to school life, after-school registration, payment confirmation, scheduling reminders, and operational notifications. No marketing or promotional content is sent through this service.

Program purpose. We may send the following categories of messages: (a) after-school activity registration confirmations and reminders; (b) secure payment links for after-school activities; (c) day-of activity reminders; (d) operational school life notifications (closures, schedule changes, urgent updates); (e) replies to parent inquiries; (f) opt-in, opt-out, and help confirmation messages required by law.

Consent (opt-in). We only send text messages to parents and guardians who have provided their express consent by self opt-in via SMS.

Parents and guardians opt in by texting the keyword JOIN (or the aliases ECOLE or AFTERSCHOOL) to our dedicated school SMS line +1 (980) 983-2653. An automatic confirmation reply is sent immediately. The full numeric school SMS number and the exact confirmation wording are publicly available at https://www.theecole.org/sms-consent/.

Message frequency. Message frequency varies based on the activities your child is enrolled in and the school calendar. You will not receive promotional or marketing messages.

Message and Data Rates. Standard message and data rates may apply depending on your mobile carrier and plan. The École does not charge any additional fees for this service. Carriers are not liable for delayed or undelivered messages.

Opt-out. You may unsubscribe at any time by replying any of the following keywords to a message received from our school SMS line +1 (980) 983-2653 : STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE. You will receive a single confirmation that you have been unsubscribed and no further messages will be sent.
To re-enroll, text START or JOIN to +1 (980) 983-2653 at any time to resume communications.

Help. Reply HELP or INFO to any message received from our school SMS line to receive assistance information. You may also contact us at bonjour@theEcole.org for any question or concern related to this service.

No marketing use — no third-party sharing. Mobile phone numbers and SMS opt-in data collected through this service are used solely for the operational purposes described above. We do not sell, rent, or share mobile phone numbers or SMS opt-in data with any third parties or affiliates for marketing or promotional purposes. Service providers that assist us in delivering SMS (e.g., Twilio, Inc.) process this data strictly on our behalf under contractual confidentiality, in accordance with Section IV of this Privacy Notice.

Effect on school services. Opting out of text message communications will not affect your child’s eligibility to participate in after-school programming or any other school services. Alternative communication channels (email, phone) remain available.

XV. Questions or Concerns

If you have any questions or concerns about our processing of your personal data, you may contact us using our contact information below.

The École
115 East 22nd Street
New York, New York 10010
Telephone: +1 (646) 410-2238
Email: bonjour@theEcole.org