Privacy & cookies
This page explains which personal data this website processes, why, for how long, and what your rights are.
1. Who is responsible
This website is run by the Student Council (European School Varese). Responsible for the processing of personal data (controller) is:
Marten Krause
Via Giacomo Matteotti 230/2, Barza (VA), Italy
We have not appointed a data protection officer. For all questions about data protection, please contact the Student Council at the address above.
2. Visiting the website
You can read the calendar, news, archive and Organisation pages without an account.
- We do not use analytics, tracking, advertising or social media plug-ins. We do not create user profiles and make no automated decisions about you.
- All files, including fonts and scripts, are loaded from this website. We do not pass data on to other companies, except the service providers named in section 6, which process it on our behalf.
- Like every web server, the server of our hosting provider records technical data (IP address, date and time, page requested, browser) in server logs, to deliver the website and protect it against attacks.
3. Cookies and local storage
We only use what is technically necessary for the website to work. No consent is required for this, so there is no cookie banner.
| Name | Purpose | Stored for |
|---|---|---|
varese_session | Session: keeps you logged in and protects forms against misuse (security token). | Until you close the browser |
lang | Remembers the language you chose. | 1 year |
theme (localStorage) | Remembers the colour theme (light/dark) you chose, only in your browser. | Until you delete it in your browser |
__cf_bm | Cloudflare: tells people and bots apart (set by the hosting provider) | 30 minutes |
cf_clearance | Cloudflare: security check passed (set by the hosting provider) | up to 1 year |
4. Accounts of the Student Council
Only the groups and positions of the Student Council and the IT Representatives have accounts. An account can be shared by the members of a group. We store:
- The account name, the name of the group, the password (only as an encrypted hash, never readable) and the time of the last login.
- An activity log of logins and changes (who, what, when) with the IP address, to protect the website against misuse. IP addresses are shortened after 30 days so that they no longer identify anyone; entries are deleted after 365 days.
- The optional field “Your name” in forms, which shows which member of a group made a change. It is only visible to the IT Representatives and is deleted with the log after 365 days.
- Login attempts (account and IP address) for the protection against password guessing; deleted after 1 day. Names that are not an account are not stored.
- Room bookings are only visible after login. You are logged out automatically after 60 minutes without activity.
Legal basis: our legitimate interest in organising the activities of the Student Council and in keeping the website secure (Art. 6(1)(f) GDPR); for names and photos of individual people, their consent (Art. 6(1)(a) GDPR).
5. Published content
Events, news, documents and the profiles on the Organisation page are published on the internet and can be read by anyone.
- Personal data of other people (names, photos, contact details) is only published with their consent; for minors, the school's rules on parental consent apply.
- Hidden data in uploaded photos (e.g. GPS location, camera model) is removed automatically.
- If you find content about you that should not be online, contact us and it will be removed as soon as possible.
6. Hosting: where the data is stored
This website is not run on the school's servers. The website and all data are stored by our hosting provider:
CoSup (netcup GmbH, Germany)
Location of the servers: Germany
The data is stored within the European Union / European Economic Area.
The hosting provider processes the data only to provide the hosting, according to its terms of service and privacy policy (processing on our behalf, Art. 28 GDPR).
Every visit first passes through the network of this service provider, which protects the website against attacks. For this it processes the IP address and the technical data of each request, also outside the European Union:
Cloudflare, Inc., USA (https://www.cloudflare.com/privacypolicy/)
Legal basis for transfers outside the EU: EU-US Data Privacy Framework and standard contractual clauses.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to its processing (Art. 15–21 GDPR). Contact the Student Council (section 1).
Where we process data based on your consent (e.g. a photo), you can withdraw it at any time; this does not affect the processing done before.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or where the alleged infringement took place.
The supervisory authority for this school: Garante per la protezione dei dati personali, Italy (www.garanteprivacy.it)
Last updated: 21 October 2026