EiT Privacy Policy

English in Totnes is committed to respecting and protecting the privacy of our customers, agents, staff and contractors. This policy applies where we are acting as a data controller with respect to your personal data or as a co-controller (including collection, use, transfer, storage and deletion) of personally identifiable information. This policy applies to all data captured across all channels actively as well as passively from people throughout the world. Please contact margie@englishintotnes.com if you have any questions about how we process your personal data.

Please read the following policy carefully to understand our views and practices regarding your personal data and how we will treat it.

What are our basic principles?

We only ask for data where it is required for a specific and specified purpose. The reason why we need the data will be made clear to you when we request the information.
We will only collect the minimum data that we need to deliver the service requested.
We will only use personal information about you if we have a valid business reason for doing so. For example; you are booking a course, joining our staff or becoming an agent/partner, homestay provider or work experience provider.
We will not use your data for other reasons unless with prior consent and we will not store it longer than is necessary or as is required by law.
We try to keep our data current, so we will contact you from time to time to check this and if you want to change any information we hold about you please let us know.
We keep all data secure by using password protected systems.

When do we collect personal data?

If you book a course at English in Totnes
If you make an enquiry through our website, via email or on the phone or via all forms of social media
When you choose to work with us as an agent or partner offering extra services
If you want to be a homestay host
If you apply to work at English in Totnes and are then employed

If you book a course or placement at English in Totnes – we will ask you for the following information:

Full Name
Address
Contact telephone numbers
Contact email address
Date of birth
Passport number
Visa details if visa necessary for booking
Emergency contact details for next of kin, including their English level
Course booked
Language level
Medical details or allergies
Homestay requirements
Flight details

If you are under 18 we need additional permissions from your parents regarding the school’s arrangement of:

Your transfer
Your school social activities and classes
Your homestay accommodation
Marketing materials especially images of you

We also require your parent’s permission to store the above information as well as:

Your local doctor’s name and contact details in case of emergency
Any other important personal information contained in the booking form and reply pack signed by your parents before you travel giving their consent.

Who has access to this personal data inside the school?

Our full-time office staff through a password protected database.
Your class teacher and activity leader

Who has access to this personal data outside the school?

We pass on necessary information to your homestay provider, transfer provider or work placement providers. They delete your information when you leave the school and commit to never passing it on to others and to protecting its security. We may also share your data with other organisations that we work with, for example with standards organisations such as the British Council, IALC and English UK. We may also have to share your data with law enforcement and fraud prevention agencies so that we can help tackle fraud or where it is necessary for legal compliance.

How long do we keep your data?
We will keep your personal data for the duration of your course. Once you have finished your course we will keep your data for an additional 7 years to make it easy for you to book again and to keep in contact with you with news about English in Totnes that you might find useful. We will delete all records after 7 years, but you can opt in to our Alumni service if you wish to keep getting updates.

If you work as a Homestay Provider for us

In order to be a homestay provider, we need to collect, store and process the following personal information about you and your family:

Full Name
Address
Contact telephone numbers
Contact email address
Bank details
Passport number to apply for DBS – destroyed on application of DBS
Signed English in Totnes homestay contract
Signed English UK agreement
General and Fire risk assessment for your home
Dates of birth for everyone living in your home
DBS number and issue date if you are hosting under 18’s
Gas Safety Certificate and renewal date
Description of your family
Opt in form
Prevent and safeguarding certificates
Your gender
Number of children
Nationality
Job title

Who has access to this personal data inside the school?

Our full time office staff through a password protected database.
School activity leader

Who has access to this personal data outside the school?

We pass on necessary information to any students you are hosting and to their agency when appropriate. We ask all agents and students to delete your information when the student leaves the school unless you have chosen to stay in contact with them. If a student is coming directly to your home via taxi we pass on your name, phone number and address to the taxi firm through a secure online booking portal. The taxi firm are committed to protecting this information and not sharing it with anyone not directly involved with delivering the student.

Whilst we do have to pass your details on to the above third parties, we are committed to only passing on the necessary data required to fulfil our service to you and our students. We take your privacy extremely seriously and will never sell your personal details to anyone and we take steps to keep it secure.

Other parties we may have to share your data with are, and we would notify you if this were the case are; our governing bodies such as IALC and the British Council, Government enforcement agencies and Civil and Corporate (the service provider we use for DBS checks).

How long do we keep your data?

We keep your data for the duration of the time you work with us as a homestay provider. For legal purposes once you terminate your host family contract we keep the data for a further two years.

Our Agents and Partners:

On application to work with us we will require the following data:

Full Name
Company Address
Contact telephone numbers
Contact email address
Two business references (for a new agent)
Bank details (if an agent that requires commission payments)

Who has access to this personal data inside the school?

Our full time office staff through a password protected database.

Who do we share your personal data with outside of the school?

Other parties we may have to share your data with are our governing bodies such as IALC and the British Council, Government enforcement agencies.

How long do we keep your data?

We keep your data for the duration of the time you work with us as an agent provider. For legal purposes once you terminate your agent agreement we keep the data for a further two years.

Legal bases for processing your data
The General Data Protection Regulation (GDPR) establishes 6 legal bases on which we can process your data: these are Consent, Contract, Legal Obligation, Vital Interests, Public Task and Legitimate Interests. For further information about these legal bases and fuller definitions, please refer to the ICO website.

We use different legal bases for processing your data depending on the purpose for collecting your data in the first instance:

For all data collected as part of the process from enquiry to booking, either of a course or other related service (e.g. homestay, airport transfer, social programme ) we process using Contract or Legitimate Interests, namely we carry out the service booked. This may include sending your data to our agent partners, homestay providers, work experience companies. Where required by law to do so, we may also process your data under Legal Obligation.

Any processing of customer data not directly related to your booking or related services, such as booking additional social activities that require a consent form such as surfing, is managed under Consent. From time to time we may use your information to invite you to events happening at English in Totnes. We may also take photographs or videos of you whilst you are at the school, subject to you or your parents signing our Student Reply Pack and therefore giving consent, and the use and processing of these is also managed through Consent.

For all data collected to manage commercial partners, for example agents, we process your data on the basis of our Contract with you, Legitimate Interest and Legal Obligation, namely the maintaining of the commercial relationship.
We collect staff data through employment documentation and a staff contract. Staff data is also processed through Legal Obligation and Legitimate Interests, namely employment. Data held on staff includes information required for HMRC, pensions and insurance. If we contact our staff by email, for example regarding an event, this is managed under Legitimate Interest.

Homestay providers complete homestay forms and sign a contract to be a homestay provider. If an event is taking place at the school, we may provide information to our homestay hosts through email and this is covered by Legal Obligation and Legitimate Interests.

Any personal data identified in this policy may be required to exercise or defend legal or insurance claims. If required, the data will be shared on the basis of Legitimate Interest in order to protect our legal rights, your legal rights and the legal rights of others.
Any client, contractor or employee of English in Totnes can opt out of unwanted processing under Consent as long as it does not stop us from providing your and our students with the service contracted.
As data is collected for such a wide range of uses, we ensure that it is deleted when it is no longer needed for the purpose it was originally collected for or for legal or insurance reasons.

Working with data outside the European Economic Area (EEA)

As we are an organisation committed to working with agent partners and schools around the world, not just within the EEA, we are responsible as co-processors of information in relation to bookings from agents and schools outside the EEA. As such, we may transfer some data outside of the EU, but this will only be information necessary to the booking of the individual (which is an exemption to the 8th principle of the GDPR legislation). This may include homestay provider description and information or transfer provider contact details, for example.

Whilst we are responsible for sending this data, we are not responsible for its security and processing outside of our systems. For example, we may send homestay details via a time-limited encrypted Dropbox link, but we cannot control how it is used by our partners, except that we require all of our partners overseas to confirm that they will process data securely in line with the requirements of GDPR or the equivalent in their country. We do not sell your data at any time.

Special Category Personal Data
We may request health data from potential students and employees if we consider that something they have disclosed prior to arrival or employment may affect their ability to study at the school or work at English in Totnes. This data has special protection under the GDPR under the specific conditions listed in Article 9 (2) of the GDPR that processing is necessary either to protect the vital interests of the data subject, (or of another natural person where the data subject is physically or legally incapable of giving consent), or where processing is necessary for the purposes of preventive or occupational medicine or the assessment of the working capacity of an employee.

English in Totnes carries out DBS checks on all staff, homestay providers and others who have direct contact with under 18 students. If a DBS disclosure comes back with any potentially adverse information, we reserve the right to carry out a Risk Assessment. If this shows that a person is unsuitable to work with under 18s, we reserve the right not to employ All risk assessments of these DBS checks will be deleted on termination of the individual’s contract.

Children under 18
Health data is requested for all under 18 students coming to English in Totnes to maintain the highest level of safeguarding. Permission is given for this by the responsible adult through our Junior Reply Pack or Group Reply Pack which must be signed by the legal guardian, parent or responsible adult in charge of a group travelling together. Any specialist health data required for an under age student is managed through Vital Interest.

We also ask for consent from parents for the use of photos or video taken during their child’s stay at English in Totnes through the Junior Reply Pack or Group Reply Pack. Any student not participating in film or video wears an identifying wristband which they receive on arrival at the school.

Information collected via our website

How we will use information collected by our website:

We will use information collected from our website to process any bookings or enquires requested directly through www.englishintotnes.com. If you book through our website, we will manage your data in the same way student data is said to be managed above. Any enquires through our website will be managed as an email response and then if the enquiry turns into a booking we will process it again in the same way as above.

If an enquiry is sent through our website to apply for a teaching role or to become an agent/partner or home stay host we will respond via email and then process the data as previously outlined.

Links from our website
If you make a booking through our website, you will be directed to a payment site that we have no direct control over. If you choose to pay through this website, you must note that this website has their own privacy policy and that we do not accept any responsibility or liability for these policies. We advise you to check these policies before you submit any personal data to these websites.

There are also links to our social media pages and other third parties we work with. Again, these sites have their own privacy policies and we do not accept any responsibility or liability for these policies. We advise you to check these policies before you submit any personal data to these websites.

Cookies are small pieces of data stored on a site visitor's browser, usually used to keep track of your movements and actions on a site.

Our service providers use cookies and those cookies may be stored on your computer when you visit our website. These cookies do not contain any information that is personally identifiable to you.

Google Analytics - used to analyse the usage of our website.
Facebook - used to offer "like" and "share" buttons to like/share pages from our website on Facebook.
Twitter - used to offer "follow" buttons to follow English in Totnes on Twitter.
YouTube - used to embed videos on our website.

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version.

What if you think we have the incorrect information about you?
To provide you with the best service possible, it is vital that the information we have about you is accurate and up to date. Because of this we will be checking the data we hold on you each year. If you think we have any data on you that is not correct or if you change any details for example your email address, please let us know asap by emailing info@englishintotnes.com

If you no longer want us to hold your data, you can withdraw consent to us processing your data at any time.

If you would like to see the data we hold of you, you will be required to supply two forms of identity and we have 28 days to supply you with this information.

We may withhold personal information that you request to the extent permitted by the law.

To request your personal data please email margie@englishintotnes.com, call +44 1803 865722 or come into our office at Gate House, 2 High Street, Totnes, TQ9 5RZ.

What to do if you have a concern or complaint about how we store, use or share your personal data?
If you have a concern about how we hold your data please speak to the appropriate department, for example homestay. If you are not happy with the response you receive please write to our management team at Gate House, 2 High Street, Totnes, TQ9 5RZ UK.

In the unlikely event that we have been unable to address your concern internally, you may call the Information Commissioner’s Office helpline on 0303 123 1113.

Updates to our policy:

Any update to our privacy policy will be put onto our website. Please check it from time to time. The policy can also be found in the footer of our emails.