InTuition Languages Ltd — Privacy Policy

Supersedes: October 2024 version, as revised December 2025.

This notice explains how InTuition Languages Ltd (“InTuition”, “we”, “us”) collects, uses, stores and shares personal information. It applies to prospective and current students, parents and guardians, tutors and host families, suppliers, agents and educational tour operators, employees and applicants, and people using our website. Section 5 also sets out internal expectations for staff.

1. General

1.1 Our privacy principles and lawful bases

1.1.1 We are committed to treating personal information lawfully, fairly and transparently and protecting it through security measures appropriate to its sensitivity and the risks involved.

1.1.2 We collect only information reasonably needed to respond to enquiries; assess and arrange courses and accommodation; fulfil contracts; manage our tutoring and supplier network; comply with legal, safeguarding, financial and accreditation requirements; maintain appropriate records; and evaluate and improve our services.

1.1.3 Processing may rely, as appropriate to the activity, on contractual necessity, steps requested before entering a contract, compliance with legal obligations, legitimate interests that are not overridden by individuals' rights, consent, or another lawful basis recognised by applicable law. Where special-category information is processed, we also identify an applicable additional condition. Consent is obtained where legally required, including for relevant marketing activities; it is not our universal basis for administering enquiries, bookings or employment.

1.1.4 Our legitimate interests may include organising and improving courses, communicating with business contacts, protecting our systems and users, maintaining appropriate business records, preventing fraud and analysing service performance, subject to an assessment of individuals' interests and rights.

1.1.5 We use information for disclosed purposes and compatible further purposes. Before undertaking a materially different purpose, we will assess its lawfulness and give further notice or seek consent when required.

1.1.6 We disclose data only when needed for these purposes and subject to appropriate legal, contractual, organisational and technical arrangements. Special safeguards apply to children's information, safeguarding records, health-related requirements, identification documents and information about household members.

1.1.7 Where personal information is transferred to a country without a relevant adequacy arrangement, we use a lawful transfer mechanism and applicable supplementary safeguards. Rules differ between UK and EEA-originating information; we assess each applicable regime.

1.1.8 In this notice, “you” refers to the individuals covered by the relevant section. An organisation's status as Controller or Processor depends on the particular processing activity and does not change merely because a commercial contract labels it in a certain way.

1.2 Your privacy rights

1.2.1 Depending on the circumstances and applicable law, you may request access to your personal data, correction, erasure, restriction, portability, and information about its use; you may also object to certain processing and withdraw consent where consent is the basis used. You may have rights concerning automated decisions with legal or similarly significant effects.

1.2.2 Rights are not absolute. For example, we may need to retain information to comply with legal requirements, protect safeguarding interests, or establish or defend legal claims. If you withdraw consent, this does not retrospectively invalidate processing already carried out lawfully.

1.2.3 Please submit requests to our Data Protection Manager using the details in Section 1.3. We normally respond within one month, subject to extensions and exceptions permitted by law. We may request reasonable identity verification before disclosing personal data.

1.2.4 You may complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk. Where EU GDPR applies, you may also have the right to contact the relevant European supervisory authority.

1.3 Contact and organisation details

1.3.1 Controller: InTuition Languages Ltd. For privacy correspondence, contact Data Protection Manager, InTuition Languages Ltd, Business Central, 2 Union Square, Central Park, Darlington, DL1 1GL, United Kingdom. Email learn@intuitionlang.com or teach@intuitionlang.com; telephone +44 (0)20 7739 4411.

1.3.2 The currently published notice also gives an earlier postal address in its General section. The address above is taken from its later contact clause and must be confirmed before publication.

1.3.3 The existing policy lists data protection registration reference ZB628652. Confirm the registration details before publishing this replacement.

1.4 European Economic Area representative

1.4.1 The representative named in our published policy is Rickert Rechtsanwaltsgesellschaft mbH, Colmantstraße 15, 53115 Bonn, Germany, email art-27-rep-intuition@rickert.law. Confirm that this appointment and contact information remain current before publication.

1.5 Policy history

1.5.1 This draft consolidates the published policy and proposed CRM arrangements as at 22 October 2026. Earlier documented reviews include May and December 2018; October 2019; June 2021; January, March, June and November 2022; January and November 2023; October 2024; and December 2025.

1.6 Systems, security and CRM service providers

1.6.1 We protect personal information using access controls, staff authorisation, multi-factor authentication where supported, security monitoring and other proportionate measures. Access is limited according to business need.

1.6.2 We primarily maintain operational records digitally, including within Microsoft 365 and our CRM platform. We may hold some information temporarily in other secure systems or formats where necessary; records are handled under our retention and security arrangements.

1.6.3 We use Lernexa, a customer relationship management (CRM) provider established in the United Kingdom, to support enquiries, bookings, student and tutor administration, agent relationships and related business activities. When changing systems, relevant information may be securely migrated and, where necessary, temporarily held in existing systems under appropriate contractual and security arrangements.

1.6.4 For ordinary CRM hosting, storage, organisation, communications and other services carried out on InTuition's documented instructions, InTuition is the Controller and Lernexa is its Processor. We require an appropriate written data-processing agreement, security measures and controls on sub-processors, retention and deletion.

1.6.5 Lernexa may also undertake the separate activity of anonymising personal data held within the CRM so that it can produce and use aggregated, non-identifying information for service delivery, performance analysis, benchmarking, maintenance, development and improvement of its services. The anonymisation activity is itself processing of personal data. Where Lernexa independently determines the purposes and essential means of that activity, it acts as an independent Controller for that activity; it does not thereby become Controller for InTuition's ordinary CRM operations. The respective responsibilities and lawful bases must be documented in an appropriate written arrangement.

1.6.6 All categories of personal information lawfully held in Lernexa are potentially within the scope of the anonymisation process, including data originally received from agents and tour operators, subject in every case to purpose limitation, data minimisation, an applicable lawful basis and additional legal conditions and controls for special-category or criminal-offence information, children's data, safeguarding records and other high-risk information. In-scope does not mean that all information must be processed, or that unrestricted access or use is permitted. We and Lernexa will apply risk-based safeguards appropriate to the information involved.

1.6.7 Data will be considered anonymous only if individuals are not identifiable by means reasonably likely to be used, including by combining, singling out or inferring information from published or internal outputs. Merely removing names or replacing identifiers, or producing small-group statistics, does not necessarily make information anonymous. Until effective anonymisation has occurred, the information remains subject to applicable data-protection law.

1.6.8 Once information has been effectively and irreversibly anonymised for the intended use, so that it no longer constitutes personal data, Lernexa may use the resulting aggregate information to provide, assess and improve its services, including statistical analysis and benchmarking. It must not seek to re-identify individuals. We require appropriate technical and contractual controls, such as minimum group sizes, suppression of small cells, restricted access, output testing, retention controls and restrictions on onward disclosure, proportionate to the re-identification risk.

1.6.9 We do not authorise Lernexa to use identifiable or pseudonymised information for unrelated advertising, resale of personal data, or general-purpose AI-model training merely by virtue of this provision. Any materially different use of personal data requires a separate assessment and, where legally necessary, additional transparency, safeguards and consent. Information must not be described as anonymous while an individual remains reasonably identifiable.

1.6.10 InTuition remains responsible for the lawfulness and transparency of its own collection, use and disclosure of personal data to Lernexa. Where Lernexa independently acts as Controller for anonymisation, it is responsible for the obligations applicable to that activity, including its lawful basis, security and responses to relevant rights requests. Individuals may contact InTuition using Section 1.3 for assistance concerning information held in the CRM. Lernexa's own applicable privacy information should also be made available where legally required.

1.6.11 We assess and document the arrangement before processing starts, including whether an appropriate legitimate interests assessment, data protection impact assessment, data-sharing agreement, additional special-category condition or enhanced child-protection safeguards are required. Access and use will be restricted to what is necessary for the documented anonymisation purposes.

1.6.12 InTuition does not supply personal information for third parties' unrelated direct marketing merely because those third parties provide CRM services. Any direct marketing must satisfy applicable data-protection and electronic-communications rules and the commitments elsewhere in this policy.

1.6.13 Lernexa is established in the United Kingdom, but this does not by itself establish where all data is stored, accessed or supported. We verify relevant hosting, sub-processor and support arrangements and put in place appropriate safeguards for any restricted international transfers as required by UK law and, where relevant, EU law.

1.6.14 The arrangements above also apply to student data supplied by educational agents and tour operators where InTuition acts as an independent Controller, as described in Section 4. An agent or tour operator may remain a separate Controller for its own processing. Where any specific processing is instead carried out solely as a Processor for an agent, InTuition will not authorise Lernexa's independent-Controller anonymisation activity in relation to that processing without an appropriate lawful and contractual basis, including any necessary authorisation from the relevant Controller.

1.7 Incidents and personal-data breaches

1.7.1 We investigate suspected data breaches and report qualifying personal-data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of them, where they are likely to present a risk to individuals' rights and freedoms. Where a breach is not reportable, we still document and assess it as required.

1.7.2 Where a breach is likely to result in a high risk to affected individuals, we notify them without undue delay unless a lawful exception applies. Our service providers are required to support incident reporting and response in line with their roles and our contracts.

2. Students, parents and guardians

2.1 Information we collect and why

2.1.1 When you or an appointed agent enquire about or apply for a course, we may collect names, email addresses, telephone numbers and enquiry details. Applications may also require address, age or date of birth, nationality, language level, learning objectives, course dates, preferences, hobbies and relevant accommodation or educational requirements.

2.1.2 Once a course is being arranged, we may request travel plans, emergency contacts, next-of-kin information and other practical details necessary for a safe and suitable placement. We will tell you which fields are required and why.

2.1.3 We generally process enquiry and booking information to take steps towards, or perform, a contract; to meet our legal, safety and accreditation duties; and for appropriately balanced legitimate interests. Where special-category information is required, we identify an applicable condition and limit its use to those who need it.

2.1.4 We send optional marketing messages where we have the necessary consent or another lawful basis permitted by the applicable rules. Messages may reflect your expressed course interests. You may unsubscribe or object at any time.

2.1.5 Lesson recordings made for teaching observation may include your image or voice. We use these recordings for academic management, assessment and feedback, subject to appropriate notices and safeguards. They are not used by us for general advertising or unrelated commercial training; any approved transcription, annotation or analysis supplier must be governed by suitable arrangements.

2.1.6 We require identity checks before a course starts. We or an appointed agent may verify an identification document. Images or copies of identification documents should be deleted once verification is completed unless a documented legal requirement justifies longer retention.

2.1.7 Where students are under 18, we may receive information from their parent or guardian and process it for contractual, safeguarding and welfare purposes. Such information receives enhanced protections.

2.2 How long we keep information

2.2.1 We retain transaction, invoice and payment records for applicable accounting and tax periods. We maintain records required for British Council accreditation and other mandatory obligations for as long as necessary under the relevant requirements.

2.2.2 Enquiry, course and marketing records are retained according to their purpose and our documented retention schedule; consent-based marketing preferences are reviewed and can be withdrawn. We do not keep data indefinitely solely because it is held in a CRM.

2.2.3 Data may be hosted or accessed within or outside the UK or EEA in accordance with Section 1.6.13. The exact locations depend on the contracted service arrangements.

2.3 Who receives information

2.3.1 We disclose relevant information to shortlisted or confirmed tutors, hosts and local organisers so they can assess a placement and deliver the course. Before confirmation this may include name, age, language level, proposed programme, dates and relevant requirements; emergency-contact information is restricted to those who genuinely need it.

2.3.2 Once a placement is confirmed, we may give the tutor appropriate contact details, address and travel arrangements. For shared or joint programmes, the participating student or other appropriate participant may receive limited contact details needed to coordinate the programme.

2.3.3 Tutors and hosts must use student information for the course and related obligations, not for unrelated purposes. Cross-border disclosures are made with relevant legal safeguards.

2.3.4 We do not supply identifiable student details to unrelated organisations for their own direct marketing without the consent required by applicable law.

2.3.5 We use suppliers for administration, hosting, CRM, email, payment coordination, security and business management. Lernexa’s processing role and its separate anonymisation of in-scope data for anonymous aggregated outputs are described in Section 1.6. Any independent-Controller activity must satisfy the conditions described there.

2.3.6 Our website may use third-party content and analytics technologies. Such providers may collect usage information subject to our cookie choices and their own privacy notices. Consult the website's cookie notice for current tools and settings.

2.4 Tutor information given to students

2.4.1 We share a suitable tutor's profile with you so you can consider the proposed placement. This may contain general location, professional qualifications, experience and voluntarily provided information about the home and household.

2.4.2 After booking confirmation, we may disclose the tutor's direct contact information and accommodation address for course arrangements. Recipients should protect this information and use it only for the booking and related safety or travel needs.

2.5 Website analytics

2.5.1 Our published policy identifies Google Analytics as a website analytics tool. Any continuing use must be reflected accurately in our cookie notice and consent settings. Google's opt-out browser add-on is available at https://tools.google.com/dlpage/gaoptout/ .

3. Tutors, host families and suppliers

3.1 Information we collect and why

3.1.1 On enquiry, we collect contact information and details of the services you may supply. For tutor or host registration, we may require address, birth date, work eligibility, professional history, qualifications, references, bank details, home facilities and suitability information.

3.1.2 Where relevant to a homestay placement, profiles may also include information about household members, their interests and ages, and photographs supplied with the appropriate permission. We expect applicants to ensure other individuals are informed before their personal information is provided to us.

3.1.3 Hosting students under 18 may require safeguarding checks, criminal-record documentation or other suitability information. Such records are restricted and processed only under appropriate legal grounds and additional safeguards.

3.1.4 We may record tutor observations for assessment, feedback, professional development and academic quality assurance. Only authorised personnel and appropriately contracted specialists may access such recordings for these purposes. Any anonymisation involving these recordings must meet the conditions, safeguards and purpose limitations in Section 1.6.

3.1.5 We process registration and engagement data for pre-contractual steps, contract management, compliance, safeguarding and relevant legitimate interests. Optional promotional uses and newsletters are subject to applicable consent and marketing rules.

3.1.6 Student feedback and quality assessments may be kept for accreditation, service improvement and, where appropriate, marketing with suitable permissions and fairness safeguards.

3.2 Retention and withdrawal

3.2.1 Payment and financial records are retained as required by tax and accounting law. Other records are reviewed under our retention schedule.

3.2.2 Where a tutor has been inactive for five years, we may contact them to confirm whether they want to remain registered. If no longer registered, we delete information that is no longer necessary, while keeping limited historical course records where accreditation or legal obligations justify this.

3.2.3 You may ask to end your registration. We will assess deletion against any continuing legal, safety, accreditation or contractual retention obligations.

3.3 Disclosures about tutors and suppliers

3.3.1 Profiles shared through our website, direct communications or agent portal may include first name and surname initial, photographs, general location, professional background, home facilities, household descriptions and permitted feedback. Profiles should not publicly display private phone numbers, full residential addresses or bank details.

3.3.2 Where practicable, we check tutor availability and willingness before sending a detailed profile to a particular prospective student or agent.

3.3.3 After a course is confirmed, we share the tutor's full name, contact details and location as needed for the placement. Agent and student recipients are expected to use those details only for the course.

3.3.4 For programmes shared between tutors, limited contact information may be exchanged so tutors can coordinate teaching, arrivals and handovers.

3.3.5 We do not provide tutors' identifiable data to unrelated organisations for those organisations' own direct marketing without the necessary consent.

3.3.6 CRM, hosting, technology and other suppliers may receive information for our legitimate operations. Their roles, including Lernexa’s separately governed anonymisation activity, are described in Section 1.6. Sensitive and children’s records require proportionate safeguards and any applicable additional lawful conditions.

3.3.7 External website tools may process information concerning visits to our online services; see the cookie notice and applicable third-party information.

3.4 Information tutors receive

3.4.1 We provide tutors with student names, ages and relevant requirements when proposing an assignment, and with further contact, travel and scheduling information after confirmation.

3.4.2 Tutors must protect student information, share it only where lawfully permitted and necessary for the course, and promptly report any suspected unauthorised access or loss. Their legal role is assessed for each processing activity and may be addressed in their written agreement.

3.5 Website analytics and contact

3.5.1 Section 2.5 explains our website analytics approach. To exercise privacy rights or raise concerns, use the Data Protection Manager contact information in Section 1.3.

4. Agents and educational tour operators

4.1 Agent account information

4.1.1 We collect agents' organisation names, trading and contact details, and relevant employees' names, positions, business email addresses and phone numbers. We use these details to manage our commercial relationship, referrals, invoicing and communications. We normally act as Controller for our own agent-business contact records.

4.2 Retention

4.2.1 Payment and invoicing records remain subject to applicable financial recordkeeping requirements. Other agent contact records are erased or anonymised when no longer needed for a lawful purpose, including following termination of the relationship where appropriate.

4.3 Student information received from agents

4.3.1 Agents may provide a student's name, age or birth date, language ability, destination, intended dates, course preferences and relevant educational or hosting requirements. Following confirmation, contact details, emergency contacts and travel information may also be provided.

4.3.2 When an educational agent or tour operator refers or books a student with us, InTuition ordinarily acts as an independent Data Controller for the personal data it receives and processes to evaluate and deliver courses, select and manage tutors or accommodation, communicate with the student or family, administer bookings and payments, meet safeguarding requirements, handle complaints, maintain records and comply with legal or accreditation obligations. We decide the purposes and essential means of these processing activities. The agent or tour operator ordinarily acts as a separate independent Controller for its own collection, customer relationships, referral, booking administration and other purposes. Sharing the same student's data does not of itself make us joint Controllers.

4.3.3 Our Controller role does not depend on whether the information is provided directly by a student, parent or guardian, or indirectly by an agent or tour operator. We rely on the appropriate lawful bases described in Section 1.1, provide relevant privacy information under applicable law, and give effect to individuals' rights in relation to our processing. Where information comes indirectly from an agent, we may provide our notice through the agent or directly to the individual, as appropriate, while meeting our own transparency obligations.

4.3.4 We may share information with tutors, host households, relevant educational and safeguarding professionals, payment or administrative providers and Lernexa where necessary and lawful to arrange and deliver services. As described in Section 1.6, Lernexa may process information on our instructions and may separately act as Controller for the lawful anonymisation process that produces non-identifying aggregate statistics. This arrangement can cover agent-supplied records where InTuition is their independent Controller.

4.3.5 Agents and tour operators are responsible for their own lawful collection and disclosure of information to us, including any necessary transparency towards students, parents or guardians. We are responsible for our own subsequent Controller activities. The parties should reflect these separate roles and any required data-sharing, security, international-transfer and cooperation arrangements in their contracts. If they genuinely determine purposes and essential means jointly for a particular activity, they must establish an appropriate joint-Controller arrangement instead.

4.3.6 Exceptionally, if a specific service is performed solely on an agent's documented instructions, without InTuition determining a purpose of its own, InTuition may be a Processor for that discrete activity. This must be assessed and recorded rather than presumed from the referral relationship; appropriate Article 28 contractual terms and sub-processor controls apply.

4.4 Tutor information provided to agents

4.4.1 We may give agents tutor profiles, professional details, general home and family descriptions and, after confirmation, practical contact and address information needed to arrange the course.

4.4.2 Agents must safeguard tutor data and use it only as needed for the legitimate referral and course arrangements. Any onward disclosure to the student or other authorised person must be lawful and proportionate.

4.4.3 Transfers outside the UK or EEA are assessed under applicable UK and EU transfer rules, as relevant. A suitable adequacy decision, contractual transfer instrument or other lawful mechanism is used where required.

5. Employees, applicants and other staff

5.1 Scope and responsibility

5.1.1 This section explains our handling of staff personal information and the privacy obligations of personnel who access information in the course of work. It applies, where appropriate, to employees, directors, job applicants, agency workers, consultants, volunteers and contractors.

5.1.2 InTuition generally acts as Controller for information used in recruiting and managing its staff. The obligations set out in this section supplement, but do not replace, relevant employment policies or contracts.

5.2 Data-protection principles

5.2.1 Staff must process personal information lawfully, fairly and transparently, only for legitimate stated purposes, with data minimisation, appropriate accuracy and retention, and suitable confidentiality and security. They must follow authorised instructions and report concerns promptly.

5.3 Responsibilities and accountability

5.3.1 Each member of staff is responsible for protecting information they handle. Managers must support compliance and the Data Protection Manager oversees privacy questions, rights requests and incidents.

5.3.2 Unauthorised access, disclosure, transfer or misuse may give rise to disciplinary action and, where applicable, legal consequences.

5.4 Types and sources of staff records

5.4.1 We receive information directly from staff and applicants, references, recruitment partners, other service providers and legitimate public sources. Records may include identities, addresses, contacts, next of kin, CVs, qualifications, references, work eligibility, remuneration and tax details, benefits, attendance, leave, health or sickness information, performance and disciplinary matters, and use of company systems.

5.4.2 We use records to recruit, administer engagement and pay, provide benefits, meet legal requirements, safeguard people and premises, maintain information security, resolve disputes and manage business operations. The relevant basis depends on the activity and may include contract, legal obligation, legitimate interests and other applicable bases.

5.5 Special-category and criminal-offence data

5.5.1 Health, sickness and other special-category information is restricted to appropriate purposes and processed only where a lawful basis and an additional legal condition apply. Criminal-offence information is processed only where authorised under applicable law, including safeguarding requirements.

5.5.2 Staff must consult the Data Protection Manager before starting any new activity involving such information. It must not be uploaded to a system or used for anonymisation without the required lawful basis, additional conditions, approvals and safeguards under Section 1.6.

5.6 Staff communications, monitoring and assessment

5.6.1 We may maintain business contact directories, administer leave and absence, conduct reviews, handle grievances or legal matters and monitor corporate IT systems where proportionate and transparently disclosed. Reporting may use de-identified or anonymous summaries where feasible.

5.6.2 We do not repurpose identifiable staff information for unrelated purposes without establishing lawfulness and providing any required additional notice.

5.7 Accuracy, storage and retention

5.7.1 Staff should notify us of relevant changes, including address and payment details. We correct inaccurate records and retain information only as necessary to meet operational, legal and evidential requirements under an appropriate schedule.

5.7.2 Staff records are held in approved systems and are subject to role-based access, technical controls and secure disposal.

5.8 Information-security rules for staff

5.8.1 Staff must use approved accounts and devices, strong authentication and secure storage. Personal data must not be copied to personal accounts or unapproved local or removable storage.

5.8.2 Before disclosure, staff must verify identity, authority and need to know. Cloud services, new integrations and external recipients must be approved through the appropriate internal process.

5.8.3 Personal information must be protected against casual observation, insecure transmission, accidental destruction and unauthorised access. Records and any permitted physical copies must be disposed of securely when no longer required.

5.9 Breach reporting

5.9.1 Staff must report any suspected loss, unauthorised access or disclosure promptly to the Data Protection Manager. The organisation assesses notification duties under Section 1.7 and takes appropriate remedial action.

5.10 Training and compliance

5.10.1 We provide privacy and security training during induction and periodically thereafter, with additional guidance for staff handling sensitive information or responding to individual rights requests.

5.10.2 Staff must cooperate with legitimate investigations, audits, retention processes and rights requests. Managers and the Data Protection Manager review compliance and update procedures as needed.

6. Changes to this notice

6.1 We may update this notice to reflect new services, systems, legal requirements or processing arrangements. We will post the revised version with an updated date and provide additional direct notice, or seek consent, where required. Lernexa’s independent-Controller anonymisation activities must be assessed, documented and lawfully authorised before they commence; this notice does not itself establish a lawful basis.