Privacy Policy

International Colleagues School of English Website Privacy Statement

The Purpose of this privacy statement is to explain how International Colleagues School of English processes personal data to fulfil our data protection responsibilities. This statement will be supplemented by ‘specific-to-client’ privacy notices when needed. The scope of this statement covers all related activities by the staff of International Colleagues School of English referred to as ICS for the remainder of this document.

The Role of ICS in data protection terms is that of a data controller wherein it determines the purpose and use of personal data collected. Once received it becomes the responsibility of the ICS privacy manager (PM) to ensure that it is processed in accordance with the latest UK data protection legislation. You can contact the PM using admin@icsenglish.com.

The personal data processed by ICS will amount to basic contact information for the purposes of responding to general enquiries, course enrolment, setting up invoices and to confirm eligibility to study in the UK when appropriate. In some cases, it will also be necessary to collect your financial data. We will also create certificates of education once you have successfully completed your course. If ICS is not given all the required personal data, it may result in an incomplete service being provided.

ICS will process your personal data on its UK-based office IT and on servers based in the European Union (EU). The only personal data that ICS need to transfer outside the EU, will be the personal data of the students who are resident outside the EU, either directly to the student concerned or a third party, when it is necessary for contractual reasons.

ICS’ duty of confidentiality means that ICS’ staff will treat your personal data with due respect and in confidence. We will only disclose it to those that need to know it. ICS uses reasonable organisational and technical measures to ensure personal data is kept secure. ICS also expects the same duty of confidentiality from all third parties with whom it shares personal data. Sharing is kept to a minimum and is reviewed regularly.

ICS processes personal data according to lawful bases as follows:

To respond to your general enquiries, to promote our services and to be able to stay in touch post studies (if applicable).
To fulfil our service contractual obligations, including their prior preparation.
When we need to act in your vital interests, but this will only apply when disclosure is necessary in an emergency.
When processing for a pre-defined purpose for which your consent has been sought prior to that processing commencing, this could include the processing of special category data such as health related information.

In all cases the processing of personal data by ICS shall be in accordance with the principles of data protection legislation.

ICS will share personal data, but only when absolutely necessary, with some or all of the following third parties:

Accountants appointed by
Third-party IT support company/web developers (maintenance periods only).
Local authorities for overseas students.
Accommodation providers for Norwich based students.
Other third parties when needed for legal reasons.

ICS follows a retention schedule to determine the length of time it holds different types of personal data. The retention schedule is shown below:

Routine correspondence for casual enquiries in hard copy or in emails will be stored for 6 months.
Course attendance related data, including certificates of achievement, will be retained for 5 years after the completion of the course.
Contact data is stored indefinitely unless a valid request for erasure is received from the interested data party.
By exception, documentation that includes personal data may be retained by ICS beyond the schedule, but only for a specific purpose and only when ICS believes there is a legitimate interest or a legal obligation to do so.

At the end of the retention schedule, ICS will either return, destroy, delete or anonymise your personal data and any associated emails or relevant documentation. If it is technically impractical to delete electronic copies of personal data, they will put it beyond operational use. It should be noted that ICS allows up to 3 months after the retention schedule to complete the action.

The ICS website uses cookies but visitors to the website are asked to consent to non-essential cookies before these are dropped – please see the separate cookie notice.

The ICS website links to appropriate business websites of interest. If these are used, you should be aware that the ICS has no responsibility for the handling of your personal data by these other website.

The General Data Protection Regulation defines the rights that you have (although these do not apply in all situations), For convenience, these rights are shown below:

Right to be informed as to how your personal data is being processed by us and this is done through this statement or specific-to-customer privacy notices.
Right to access your personal data held by us which is done by making a ‘Data Subject Access Request’ (DSAR) to the privacy manager.
Right to rectification of your personal data if you believe we have collected it incorrectly or it needs to be updated.
Right to the erasure of your personal data for which we no longer have a legitimate purpose to process.
Right to restrict processing under certain circumstances, during which time your personal data but will be out of operational use until the related matter is resolved.
Right to data portability of your personal data in a machine-readable version, as you have provided, but only applicable to data provided with your consent or under contract.
Right to object to our processing your personal data for which it does not have a legal or contractual obligation.
Rights related to automated decision making and profiling (however ICS does not use these techniques in its decision making).

Further details on data subjects’ rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.

Raising concerns, exercising rights or making queries about our processing of your personal data can be done by contacting the privacy manager. Please be aware that we will need to determine your identity before responding fully, therefore, you may be asked for proof of ID or other material that, in context, will enable us to confirm your identity. Alternatively, you may wish to contact the ICO directly, using the details provided above.