The International Baccalaureate Organization, a Swiss foundation, with a registered address at Rue du Pré-de-la-Bichette 1, 1202 Geneva, Switzerland and/or its affiliates (the “IB” or “we” or “us”) owns and operates several websites, including www.ibo.org.
The IB is committed to protecting the privacy of students, parents, educators and others who use our websites services and products (the “Services”). The IB operates on a global basis and is subject to a variety of legal requirements which affect how we treat your personal data and information and respect your privacy. This Privacy Policy describes how your personal data and information may be collected through the IB’s Services and how it is used, disclosed and transferred.
For users based in the United States of America: By accessing or using this website or any of our Services, you are accepting the practices and policies outlined in this Privacy Policy.
Your use of any of the Services is governed by the Terms and Conditions, which includes this Privacy Policy. If you do not agree with any aspect of these documents or any of the Terms and Conditions, please do not access this website or use the Services.
If you are not of legal age to form a binding contract (in many jurisdictions, this age is 18, but you should check the age applicable to yours), you may only use the Services and disclose information to us with your parent’s (or guardian’s) express consent. Please review this Privacy Policy with your parent or guardian.
This Privacy Policy does not apply to websites, offerings or practices of companies that the IB does not own or control.
I. COLLECTION OF PERSONAL DATA
“Personal data” is any data or information that personally identifies a person or that, together with any other available data, makes any person identifiable to another.
Some of the IB’s Services do not require any personal data from you. However, in many cases, the IB may require personal data directly from you when accessing and/or using the Services. It is voluntary and up to you whether to provide the personal data requested by us. We will indicate whether the information we have requested is required. However, if you do choose not to give us certain information, you may be unable to access or use certain features or areas of our websites and Services or we may be unable to provide certain Services to you.
The type of personal data you will be asked to provide depends on the type of Service you use. Personal data may include, without limitation, your name, address, email address, phone numbers, exam/assessment results, language proficiency, date of birth, education records, and free and reduced-cost lunch eligibility status. In some cases, the IB may collect financial information, such as bank details and credit card information, as well as travel information (including passport or contact information for next of kin).
The IB may also collect sensitive personal data such as gender, race/ethnic origin, information related to criminal convictions, medical or other information regarding disabilities or other conditions requiring assessment accommodations. Sensitive personal data will not be collected unless it is for a legitimate purpose and unless you have given express and unambiguous consent.
Special Considerations for Children or Students who are Minors
The IB has special concerns about the privacy of all IB students or children who access our website, but in particular those who are under the age of 13 or who are over the age of 13 but are minors, i.e. under the age of majority (in many jurisdictions, this age is 18). Because the age of majority and consent can vary depending on a student user’s country of residence, the IB has adopted this age (18) as a uniform requirement. In other words, consent from both the student and parent or legal guardian may be required in order for users under 18 years of age to use some of the IB’s Services.
With respect to children under the age of 13: We do not knowingly collect, maintain or use personal data from anyone under the age of 13 through the Services. If you are under the age of 13, you are not allowed to subscribe to any of the Services or to create an account without the permission of your parent, guardian or teacher. Please do not submit any personal data or information about yourself to us. If a child whom we know to be under age 13 sends personal data or information to us online through the Services, we will only use that information to respond directly to that child, notify his or her parents, or seek parental consent.
With respect to children age 13 or older but under 18: For these users of certain Services, the IB may also require 1) additional affirmative, opt-in consent of the users and 2) parental consent if the users of those Services are under the age of 18. Parents/guardians may be asked to provide consent by email, text message or any other method permitted under local applicable law for their children to use the Services. Any personal data we collect from parents giving parental consent will be treated the same as personal data collected from any other user of the IB’s Services and in accordance with this privacy policy.
Special Considerations for Personal Data Provided by IB Teachers, Coordinators, School Administrators and Other Third Parties
For some Services, IB coordinators, teachers and school administrators may submit personal data about IB students to the IB’s Services (e.g. registration for IB diploma programme exams on the IBIS Service). For such Services, the IB does not have a direct relationship with the individuals (e.g. students) whose personal data may be processed in connection with providing the Services. In these circumstances, the IB coordinators, teachers, and/or school administrators are responsible for ensuring that any such sharing or transfer of personal data to the IB is done in accordance with applicable local law and without violating any privacy or data protection rights of any individuals, including, without limitation, providing appropriate notice to the individuals and obtaining any required consents. IB acknowledges that personal data and information provided to it by employees or agents of schools for certain Services may be protected under local applicable laws.
As a parent, you should consult your school's policy for more information about the ability of IB coordinators, teachers and school administrators to provide personal data or consent on behalf of parents and students.
As an IB coordinator, teacher or school administrator, you hereby confirm that you have authority to consent and/or provide personal data on behalf of your students and/or student’s parents (as the case may be) to the IB. If you submit personal data of anyone other than yourself to the IB’s Services, you represent and warrant to the IB, by using the Services, that you have authority to do so and have done so in accordance with all data protection and privacy laws applicable to you and without violating the individual’s privacy or data protection rights. This includes any requirements to notify individuals about the purposes, uses, transfers and sharing of their personal data by the IB as described in this Privacy Policy and to obtain consent from the person (and/or their legal guardian). In addition, when using certain Services, you may be required separately to affirmatively confirm your authority to the IB.
II. PURPOSES FOR PROCESSING AND USE OF PERSONAL DATA
Your personal data may be collected, processed and/or stored by the IB for the following purposes:
- To register you for IB examinations and assessments;
- To provide assessment accommodations and/or inclusive education arrangements;
- To deliver IB programmes and/or courses in on-line format;
- To upload coursework to the IB;
- To carry out on-line assessment of IB MYP and DP examinations;
- To investigate academic misconduct if suspected;
- To deliver IB diplomas;
- To transmit an IB Diploma Programme or IBCP student’s data or education records to universities, colleges, ministries of education and other institutes of higher education when such student specifically requests the IB to do so or the IB is requested by ministries of education or other governmental authorities;
- To facilitate connections between, and recruitment of, IB students by higher educational institutions on a registry service;
- To provide information on higher educational institutions’ policies on the recognition of IB programmes and facilitating connections with IB schools.
- To recruit IB educators and examiners;
- To assist with and respond to queries and requests submitted through the IB Answers online service;
- To register you for IB event(s) (such as workshops or conferences) that you have chosen and process any required payments; to provide you with information relating to the particular IB event(s) for which you have registered; to share with IB educators if necessary for the assignment;
- To make travel arrangements on your behalf (via travel services providers and online booking tools) and process expense claims and other requests for payment.
- To conduct IB run, IB-sponsored or IB supported research, including independent research or journalistic work, for legitimate purposes related to IB programmes, exam results, services and student outcomes, whether using personal data, individual-level data, aggregated data, anonymous data, or pseudonymized data;
- To conduct surveys about the Services and related activities to get feedback about the Services and related activities;
- To promote and market the IB and the Services (including IB events or topics that the IB believes would be of interest to you), 1) if you expressly agree and opt-in to receive IB promotional and marketing materials or 2) unless you expressly opt-out of receiving such materials, as may be required under local law.;
- To conduct internal IB reporting on Services and analysis of its Services and activities;
- To identify you when you apply for a password, access password-protected websites or areas of a website, post information to a website or when you send information to the IB in any form;
- To create your account, password and profile for a Service;
- To fulfill contractual duties toward you, for example, for billing and shipping purposes when processing purchase orders or requests for documents;
- To enforce contractual claims against (including those that might arise out of your breach of the terms and conditions);
- To conduct statistical analysis of the IB websites’ user structure, IB programmes, assessment results and other Services; and
- To carry out personality assessments as part of the recruitment and interviewing process, some of which may be automated.
- The IB processes your personal data with your consent, where such consent is required by applicable law and you agreed to the use at the time it was collected (or if we subsequently obtain your consent). You may withdraw your consent at any time (for example, for us to send you marketing communications) by contacting the IB at privacy@ibo.org. The IB also processes your personal data where this is necessary for the performance of a contract with you or where it is necessary for the IB’s legitimate interests of operating, protecting and improving the Services.
Accuracy of Personal Data – Self Reported
By using the Services, you agree to provide accurate, complete and up-to-date personal data. Each user of the Services is solely responsible for the personal data he or she provides and agrees that he or she conforms to all local data protection laws where required by applicable law.
Automated Decision Making (ADM)
The IB may use automatic decision-making for purely objective decisions only, i.e. where there are clear rules set by the business and there is no ambiguity on the answer.
The IB does not use automatic decision making in any other context. However we do use data and additional evidence to support human decision making.
For further details please contact privacy@ibo.org
Photography and videography at IB events
By virtue of Art 13 GDPR the IB is obligated to keep you informed about the IB’s intentions in respect of taking photos and videos. The following text relates to events organized by the IB and attended by IB staff, the wider IB Community and members of the public.
The IB will take appropriate measures to ensure that event participants have provided their consent to the IB to acquire images prior to the event.
To the extent possible, our official photographers position themselves in a transparent manner to indicate their intent of taking a picture of you and/or your group. When possible, they will turn the camera screen around to show you the resulting picture and ask if you are happy with it and get your consent on the spot.
When you participate at any of our events, you consent to any such filming, photography and/or live streaming. You also give rights to the IB in reproducing and publishing your words and/or likeness in any transcript of or publication relating to the event.
Having said as much, we understand that there are situations where you wish to participate in IB activities but still want to avoid being in any pictures or videos. In such circumstances, we would request that you make your wishes known to our staff upon entering the event.
The IB will introduce/make you known to our photographer/videographer and ask them to avoid taking pictures with you as one of the centre/main subjects. At larger events, we might ask you to wear a wristband or other form of sign that allows us to recognize you within a crowd.
However, be advised that when it comes to your rights, there is a difference between you being the centre/main subject of the photo or you being depicted incidentally, e.g., in the background of the picture or in a larger crowd (see Art. 14 Para. 5 GDPR). In real terms, this means that in the event of the IB receiving data erasure requests pursuant to Art. 17 the IB would be unlikely to erasure the data due to the disproportionate effort it might involve.
Also, the IB will endeavour to inform anyone entering our premises about best practices around taking pictures and videos, but we cannot be held responsible for third-party photo/video processing done by other guests and customers.
Your right to revoke consent
It’s very important for you to be aware that at any point you do have the right to revoke your consent provided you are the centre/main subject of the photograph. This could be because the photo/video of you was taken when you were not aware of it or it was taken within your “private sphere”, meaning you clearly positioned yourself away from the “action” for some privacy. But you can also revoke your consent if the resulting pictures clearly show you in an unflattering way.
Your right to know about the intent of the pictures/videos
In accordance with GDPR regulations, you must be informed ahead of time about how your data is intended to be used, how it is stored and for how long it will be stored.
Purpose: To showcase IB events, conferences and workshops.
Retention/ Erasure: one calendar year from the date of the event.
III. THIRD PARTIES, DISCLOSURE and CROSS-BORDER TRANSFERS
The IB will not share or transfer your personal data other than as described in the Privacy Policy.
The IB has databases in different countries and your personal data may be used and processed by IB staff, affiliates or contractors in any of the countries in which they are located, including without limitation, the United States. They are obligated to treat your personal data in accordance with IB’s internal global data protection policy.
In addition, as part of operating the Services, the IB may transfer your personal data to third parties who provide business-related services to the IB (such as providers of cloud hosting solutions; event management services; client relationship management services; travel booking services; expense and payment processing services; registry service providers; assessment service providers, such as examiners, moderators, eMarking service providers; and online course providers). In addition, your personal data and information may be transferred to synchronize and update between and among these systems in order to provide the Services more efficiently and effectively. Accordingly, your personal data may be transferred to, and further processed by and among, these third-party service providers in connection with their performance of such functions. However, these third parties may not use it for other purposes and have contractual arrangements with the IB that address the privacy and security of such information.
These parties, as well as the IB, may process your personal data outside Switzerland, the UK and the European Economic Area, including, without limitation, Argentina, Australia, Canada, Singapore, and the United States. These countries may have different privacy laws, which, in some cases the European or local Data Protection Authorities, may consider to be less adequate or protective, than the privacy laws in your home country. The IB will ensure, when required by applicable law, that adequate safeguards are in place to protect your personal data where it is transferred to territories outside the European Economic Area, Switzerland or the UK. If we share your personal data with third-party service providers, we contractually oblige them to comply with applicable data protection laws and to implement adequate safeguards to protect your personal data in accordance with the relevant governing legislation.
Your personal data will not be sold, rented or otherwise made available to third-party marketers or advertisers under any circumstances. IB will not engage in any targeted advertising based on any personal data or information of students acquired because of IB’s Services.
The IB may disclose personal data if it believes, in good faith, that such disclosure is necessary to comply with applicable law, regulatory investigation or inquiries (including economic sanction regulations), to enforce or apply the Terms and Conditions, or to protect the property, rights, or safety of the IB, users of Services, or other third parties.
IV. DATA SECURITY AND STORAGE
To ensure the security and confidentiality of personal data that we collect online, we use strong, industry-standard security controls throughout our infrastructure and continually monitor the security status of our systems. In the course of handling your personal data, we implement and maintain reasonable security procedures and practices, including organizational and technical measures that are appropriate to the nature of the personal data and information and protect it from unauthorized access, destruction, use, modification and disclosure. We also take measures reasonably designed to ensure the secure transmission of information from your computer to our servers. Although the IB endeavours to provide a safe environment, please be aware that no security measures are absolute and no data transmission over the Internet can be guaranteed secure.
V. USAGE DATA, INTERNET TAGS and GOOGLE ANALYTICS
For Services that are provided via websites, the IB will automatically collect certain data from users, including but not limited to the date and time of visit, type of browser used, type of Operating System used, Internet Protocol (IP) address, and aggregate information regarding which pages users of the site access or visit. By accepting this privacy policy and using the Services, you agree to this use of your data.
Cookies
The IB uses cookies on its websites to collect the information listed above. A cookie is a piece of information in the form of a very small text file that is placed on an internet user’s hard drive. It is generated by a web page server that is normally created and operated by the host computer of the website. Cookies can be controlled from your browser’s preference settings to control all cookies saved locally to a visitor’s browser, no third-party plug-ins are necessary.
Cookies are used to personalize the Services for you and make it easier to use. Cookies remember the language you choose when viewing the IB’s websites and make it easier for you to sign in to and navigate the sites. Cookies also allow the IB to record session information to provide better service to users. This information may be used to help improve the design and performance of the Services site and to help analyze and report on IB site usage.
The IB uses a web analytics tool, Google Analytics, to monitor and evaluate site usage.
When using the IB’s websites, you will be shown a cookie banner, which states that by continuing to use the IB websites you agree and consent to use of cookies for these purposes.
For information about the different cookies the IB uses and Google Analytics, including how to opt-out, you can read more here.
VI: RETENTION OF PERSONAL DATA
The IB keeps your personal data for only as long as is necessary for the purposes for which it was collected or as otherwise permitted under applicable law (for example, information relating to a contract with you may be kept for the lifetime of the contract and up to ten years after). After this period, it will be deleted or in some cases anonymised.
VII. NOTICE OF CHANGES IN PRIVACY POLICY
We reserve the right, at our discretion, to change, modify, add, or remove portions of our Privacy Policy at any time. Any changes we may make to our Privacy Policy in the future will be posted on this page with an updated revision date. Therefore, you should review this page for updates whenever you access this or any other IB website, and you may be requested to opt in to this Privacy Policy again even if you have visited the page before.
Your rights, questions or comments regarding the Privacy Policy, and how to edit, delete or access your personal data
We reserve the right, at our discretion, to change, modify, add, or remove portions of our Privacy Policy at any time. Any changes we make to our Privacy Policy in the future will be posted on this page with an updated revision date. Therefore, you should review this page for updates whenever you access this or any other IB website, and you may be requested to opt in to this Privacy Policy again even if you have visited the page before.
You may have the right to ask for access to any personal data that we hold about you (or your child) in our records. You may also have the right to object to the processing of your personal data. The IB will assist you with your request, including any request to edit, delete or restrict the use of your personal data and information, in accordance with the applicable law.
Please email privacy@ibo.org to submit a request about the personal data the IB holds about you (or your child). In order to respond to your request, we may require details by which the IB can identify you. Please submit some form of identification such as a passport or driver’s licence along with your email. Note that this is used exclusively for identification and will be immediately deleted after. Please specify the type of request you wish to make such as edit or delete data request. It would also help to advise us about the nature of your personal data that we process, including where and in which exact databases or systems we will find your data. This will enable us to conduct a targeted search for your personal data.
You may also have the right to complain to a European Data Protection Authority if you think we have processed your personal data in a manner which is unlawful or breaches your rights.
If you have any questions or comments about this Privacy Policy please contact the Data Protection Officer on privacy@ibo.org.
For more information about assessment sessions impacted by the COVID-19 pandemic please click here.
