Privacy Policy

01.Identity of the Data Controller

Panama Heights International Academy (hereinafter, "PHIA," "the School," "we") is the controller of the personal data collected through the website colegiophia.com and its subdomains (hereinafter, the "Site").

Legal name

PANAMA HEIGHTS INTERNATIONAL ACADEMY INC

Tax ID (RUC)

670791-1-462755 DV 70

Address

Arraiján #14, La Cruz de Oro, Panamá Oeste, Republic of Panama

Phone

(507) 345-9344 / (507) 345-9346

Contact channel

contact form available on this website

02.Legal Framework

This Privacy Policy is governed by Law 81 of March 26, 2019 on Personal Data Protection of the Republic of Panama, its Implementing Executive Decree 285 of May 28, 2021, and other applicable regulations. PHIA acknowledges every person's fundamental right to the protection of their personal data and is committed to processing such data in accordance with the principles of legality, fairness, transparency, purpose limitation, proportionality, quality, security, confidentiality, and portability established in such legislation.

03.Personal Data We Collect

PHIA collects only the personal data strictly necessary for the purposes described in this Policy. The categories of data we may process include:

3.1 Identification and contact data

• Full names of the parent, legal guardian, or applicant.
• Identification numbers (national ID, passport, or other legal document).
• Email address, phone number, and physical address.
• Country of residence and nationality.

3.2 Admissions-related data

• Prospective student information: full name, date of birth, grade level applied for, mother tongue, and academic background.
• Supporting documentation uploaded by the applicant (when applicable).

3.3 Browsing data

• IP address, browser type and version, operating system, and device.
• Pages visited, time spent, and source of the visit.
• Information collected through cookies and similar technologies (see Cookies Policy).

3.4 Sensitive data

PHIA does not request or process sensitive data (health, racial origin, religion, political opinions, sexual life, genetic or biometric data) through the Site, unless strictly necessary for a specific process (for example, a request for reasonable accommodations) and the express, explicit, and written consent of the data subject or person exercising parental authority is obtained.

04.Purposes of Processing

The personal data collected will be used for the following purposes:

• Respond to information, contact, admissions, campus visits, and institutional inquiries.
• Manage the student admissions and enrollment process.
• Send institutional communications, newsletters, and relevant news (when consent has been given).
• Improve the browsing experience and the quality of the Site.
• Comply with applicable legal, regulatory, and contractual obligations.
• Generate anonymized statistics for internal analytical purposes.

05.Legal Basis for Processing

PHIA processes personal data on the basis of one or more of the following legal grounds, as applicable:

• Consent of the data subject: for sending promotional communications or for the use of non-essential cookies.
• Performance of pre-contractual or contractual measures: to manage admissions requests and the subsequent educational relationship.
• Compliance with a legal obligation: when required by Panamanian law or competent authority.
• Legitimate interest: for security, Site improvement, and fraud prevention, provided that the rights of the data subject do not override such interest.

06.Processing of Minors' Data

PHIA recognizes the particular sensitivity of data concerning children and adolescents. The Site is not intended to collect data directly from minors. Any information related to a minor (prospective student, enrolled student, son or daughter of the user) must be provided exclusively by the parent, legal guardian, or legal representative, who declares to have the authority to do so and grants informed consent for the processing in accordance with this Policy.

Should PHIA detect the submission of data by a minor without due authorization, such data will be promptly deleted, except where a legal retention obligation applies.

07.Disclosure and Transfer of Data

Personal data may be disclosed or transferred, within or outside Panamanian territory, to the following categories of recipients, always with the safeguards required by Law 81 of 2019:

• Competent public authorities, when a legal obligation exists (for example, MEDUCA).
• Technology service providers contracted by PHIA under confidentiality and data processing agreements (web hosting, email, analytics, communications).
• Auditors, legal and accounting advisors, within the scope of their functions.

PHIA uses technology infrastructure that may involve the storage or processing of data on servers located outside Panama (for example, in the United States of America). In all cases, PHIA verifies that the provider maintains protection standards equal to or higher than those required by Panamanian legislation.

08.Data Retention

Personal data will be retained for the time strictly necessary to fulfill the described purposes and, subsequently, for the periods required by applicable legislation (for example, tax, regulatory, or claim-defense purposes). Once such periods have elapsed, the data will be securely blocked, deleted, or anonymized.

09.Email Communications and Newsletter

PHIA sends an email newsletter only to people who have asked to receive it. This section describes how we handle the data involved in that service.

9.1 Voluntary subscription and double confirmation

Subscription requests originate through the form published on our website or through an individual invitation sent by authorized PHIA staff. We do not buy, rent or import mailing lists from third parties. In both cases you receive a verification email, and your address does not become active — and receives no newsletter — until you confirm by clicking the link in that message.

9.2 Data we process for this purpose

• Email address.
• Preferred language and the content categories you selected.
• Proof of consent: the date, time, IP address and browser from which the request was made, together with the date, time and IP address of the confirmation.
• Operational records of sending attempts and the feedback received, such as acceptance for sending, bounces, or reports that a message was unwanted.

Proof of consent is retained for the sole purpose of being able to demonstrate that the subscription was requested by the data subject.

9.3 Legal basis

Processing is based on the data subject's free, specific, informed and unambiguous consent, given through the acceptance checkbox on the form and reaffirmed at the confirmation step. The checkbox is never pre-ticked.

9.4 Delivery provider

Emails are delivered through Amazon Simple Email Service (Amazon SES), a service of Amazon Web Services, Inc. This means your email address and the technical data required for delivery are processed on servers located in the United States of America. See the Communication and Transfer of Data section for further detail on international transfers.

9.5 How to unsubscribe

You may cancel your subscription at any time, without giving a reason, by any of these means:

• The “Unsubscribe” link included in the footer of every newsletter we send.
• The preference centre linked from those same emails, where you can also adjust which categories you wish to receive.
• Writing to the address given in the Contact section.

Unsubscribing takes effect immediately and requires no login or additional steps. We also automatically and permanently suppress addresses that prove to be non-existent and any address from which our message is reported as unwanted.

9.6 Retention

Subscription data and proof of consent are retained while the subscription is active and, after an opt-out, for as long as necessary to honor the no-contact request, maintain the security and traceability of the service, and handle complaints or legal requests. You may request access, correction or deletion as described in the Rights of the Data Subject section.

10.Rights of the Data Subject

In accordance with Law 81 of 2019, the data subject may exercise the following rights at any time:

• Access: to know what data PHIA processes about you and the purpose of the processing.
• Rectification: to request the correction or update of inaccurate or incomplete data.
• Cancellation or deletion: to request the deletion of data when no longer necessary.
• Objection: to object to processing on legitimate grounds.
• Portability: to obtain a structured copy of your data in the cases provided for by Law.
• Withdrawal of consent: to withdraw the consent given, without retroactive effects.

To exercise these rights, the data subject must submit their request through the contact form available on this website, selecting the "Personal Data Protection" category, properly identifying themselves and specifying the right they wish to exercise. PHIA will respond within the time periods established by current regulations.

The data subject also has the right to file a complaint with the National Authority for Transparency and Access to Information (ANTAI), as the supervisory authority.

11.Information Security

PHIA implements reasonable technical, organizational, and administrative measures to protect personal data against unauthorized access, alteration, loss, disclosure, or accidental or unlawful destruction. These measures include, among others, encryption in transit (HTTPS/TLS), role-based access control, periodic backups, and training of personnel with access to data.

12.Links to Third-Party Sites

The Site may contain links to third-party websites over which PHIA has no control. This Policy does not apply to such sites, and the user is advised to review the corresponding privacy policies before providing any information.

13.Modifications to this Policy

PHIA reserves the right to modify this Privacy Policy at any time, in order to adapt it to legislative, jurisprudential, or institutional practice changes. Modifications will be published on the Site with the date of update. The user is advised to periodically review this section.

14.Contact

For any inquiries related to this Privacy Policy or the processing of your personal data, you may contact us through:

Contact form

Contact form on this website ("Personal Data Protection" category)

Phone

(507) 345-9344 / (507) 345-9346

Address

Arraiján #14, La Cruz de Oro, Panamá Oeste, Republic of Panama