Your Privacy and Data Protection

Who We Are

Language Link International Limited (company number 10505018), 33 Mizpah Grove, Manchester, BL8 2SD, is responsible for the personal information described in this policy.

Personal Information

We collect the following personal information when you use our services:

• Student Information: Name, age, date of birth, nationality, passport details, medical information, dietary requirements, allergies, interests, and personality traits
• Family Information: Parent/guardian names, contact details, address, emergency contacts, family composition
• Contact Details: Email addresses, phone numbers, WhatsApp numbers, postal addresses
• Programme Information: Programme preferences, dates, duration, special requirements
• Communication Data: Records of calls, emails, messages, and other communications

Technical Information

When you visit our website, we may automatically collect:

• IP address and browser type
• Device information and operating system
• Page visit counts, through Vercel Web Analytics, which uses no cookies and does not identify you
• Essential sign-in cookies only, when you sign in to your family account (see our Cookie Policy)

We use your personal information for the following purposes:

Programme Services

• Processing programme applications and bookings
• Matching students with suitable host families
• Coordinating programme logistics and activities
• Providing ongoing support and emergency assistance
• Facilitating communication between families and students

Legal and Safety Requirements

• Conducting background checks and safety assessments
• Complying with child protection and safeguarding requirements
• Meeting regulatory and legal obligations
• Emergency response and medical care coordination

Business Operations

• Processing payments and managing accounts
• Customer service and support
• Improving our services and website
• Marketing communications (with your consent)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfil our programme services contract with you
• Legitimate Interests: For business operations, fraud prevention, and service improvement (where balanced against your privacy rights)
• Legal Obligations: Compliance with child protection laws, tax requirements, and regulatory obligations
• Vital Interests: Emergency situations and medical care coordination
• Consent: Marketing communications (you can withdraw consent at any time)

For children under 16, we obtain consent from parents or guardians where required by law.

With Host Families

We share relevant student information with matched host families to ensure proper care and programme delivery. This includes:

• Student name, age, and background information
• Medical information, allergies, and dietary requirements
• Emergency contact details
• Interests, personality traits, and preferences

Service Providers

We may share data with trusted third parties who help us provide our services:

• Our bank, for payments made by bank transfer
• Background check and verification services
• Travel insurance providers
• Supabase: our database, file storage and account sign-in
• Vercel: website hosting
• Resend: sending our emails
• Emergency response services

Legal Requirements

We may disclose information when required by law or to:

• Comply with legal obligations or court orders
• Protect child welfare and safety
• Respond to emergency situations
• Cooperate with law enforcement or regulatory authorities

We never sell your personal data to third parties.

We implement comprehensive security measures to protect your personal information:

Technical Safeguards

• Industry-standard encryption for data in transit and at rest
• Secure cloud storage with regular backups
• Regular security audits and vulnerability assessments
• Firewalls and intrusion detection systems

Organizational Measures

• Staff training on data protection and privacy
• Access controls and role-based permissions
• Regular policy reviews and updates
• Incident response procedures
• Confidentiality agreements with all personnel

Data Breach Response

In the unlikely event of a data breach, we will:

• Notify relevant authorities within 72 hours (as required by GDPR)
• Inform affected individuals promptly
• Take immediate action to contain and remedy the breach
• Provide support and guidance on protective measures

Under GDPR and UK data protection law, you have the following rights:

Your Data Rights

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal requirements)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data in certain circumstances
• Objection: Object to processing based on legitimate interests or for marketing
• Withdraw Consent: Withdraw consent for processing (where consent is the legal basis)

How to Exercise Your Rights

To exercise any of these rights, please contact us:

• Email: haydn@languagelinkintl.com
• Phone: +44 7836 346290
• Post: Language Link International Limited, 33 Mizpah Grove, Manchester, BL8 2SD

We will respond to your request within one month. For complex requests, we may extend this by up to two months.

Right to Complain

If you're not satisfied with how we handle your data, you can complain to:

• UK Information Commissioner's Office (ICO): www.ico.org.uk
• Spanish Data Protection Authority (AEPD): www.aepd.es

Retention Periods

We retain your personal data only as long as necessary:

• Programme Data: 7 years after programme completion (for insurance and liability purposes)
• Financial Records: 7 years (for tax and legal compliance)
• Medical Information: 25 years (for child protection and medical history)
• Marketing Data: Until you opt out or 3 years of inactivity

Secure Deletion

When data is no longer needed, we ensure secure deletion by:

• Overwriting digital files multiple times
• Physical destruction of paper documents
• Secure disposal of electronic devices
• Confirmation of deletion from backup systems

Legal Hold Exceptions

We may retain data beyond normal periods if:

• Legal proceedings are ongoing or anticipated
• Regulatory investigation is active
• Child protection concerns exist
• You have specifically requested extended retention

As we operate between Spain and the UK, some data transfers occur across borders:

UK-EU Data Transfers

Post-Brexit, we ensure adequate protection through:

• UK adequacy decision for GDPR compliance
• Standard Contractual Clauses (SCCs) with service providers
• Regular monitoring of data protection standards
• Additional safeguards for sensitive data

Third Country Transfers

For services outside UK/EU, we ensure protection through:

• Adequacy decisions or appropriate safeguards
• Binding corporate rules for multinational providers
• Certification schemes and codes of conduct
• Regular assessment of third country privacy laws

Your Rights for International Transfers

You have the right to:

• Request information about international transfers
• Obtain copies of safeguards in place
• Object to transfers in certain circumstances
• Seek local remedies in destination countries

We take special care to protect children's personal information:

Parental Consent

• We obtain explicit parental consent for children under 16
• Parents can review, modify, or delete their child's information
• We verify parental identity before providing access
• Regular consent renewal for ongoing services

Enhanced Protection

• Extra security measures for children's data
• Limited data collection to programme essentials only
• Regular review of child data processing activities
• Staff training on children's privacy rights

Child-Friendly Communication

• Age-appropriate privacy explanations
• Clear communication about data use
• Easy opt-out procedures
• Regular privacy check-ins during programmes

Safeguarding Integration

Our privacy practices align with child protection requirements:

• Background checks for all adults with access to children's data
• Incident reporting procedures
• Coordination with child protection authorities when needed
• Regular safeguarding policy reviews

Notification of Changes

We may update this privacy policy from time to time. When we do:

• We'll update the "last updated" date at the top
• Email notification for significant changes
• Option to review changes before accepting

Your Choices After Updates

After policy updates, you can:

• Continue using our services (implied acceptance)
• Contact us with questions or concerns
• Exercise your right to withdraw consent
• Request data deletion if you disagree with changes

Version History

Previous versions of this policy are available upon request for:

• Legal compliance purposes
• Transparency and accountability
• Understanding how our practices have evolved
• Regulatory review requirements

Questions about this Privacy Policy?
Contact us at haydn@languagelinkintl.com or call +44 7836 346290