UK contact office: 25 Southampton Buildings, London WC2A 1AL. Routine enquiries: guardian@intergreat.com.
General Statement
Terence Murray, our Director of Compliance and Safeguarding, serves as the Data Protection Officer and holds the ultimate responsibility for ensuring that:
Personal information related to individuals, including current, past, and potential students, their parents, office staff, and homestays, is processed in compliance with Education Regulations, the UK General Data Protection Regulation ("UK GDPR"), and the Data Protection Act 2018. Additionally, Terence ensures that all personnel involved in the collection, processing, and disclosure of personal data are aware of their duties and obligations.
Responsibility for Data Protection:
IEG maintains responsibility for data-control decisions and appropriate registration with the Information Commissioner’s Office. Contact dpo@intergreat.com for information about our registration. Our UK contact office is 25 Southampton Buildings, London WC2A 1AL. Read the Guardianship Privacy Notice for the controller identity and information about guardianship processing.
Terence Murray is responsible for notifying the Data Protection Commissioner.
Enquiries
Any enquiry should be addressed in writing to Terence Murray, who is the Data Protection Officer.
Fair Obtaining and Processing
InterGreat Education Group commits to processing data fairly and for the following specified lawful purposes:
- To comply with statutory duties and obligations related to education and administration.
- To maintain/secure the student’s health, safety, and welfare and to provide appropriate pastoral care.
- To provide parents, homestays, and those with parental responsibility with information regarding the student’s progress, achievements, attendance, attitude, aptitude, and/or general demeanour within or in the vicinity of the school or homestay.
- In respect of administrative/financial matters.
- To enable the company to provide references.
IEG will process personal information only where it has a valid lawful basis under the UK GDPR. Consent is used where appropriate; it is not the only possible basis for providing agreed services or protecting a child. See the Guardianship Privacy Notice for purposes, lawful bases, sharing, retention and rights.
- Name, date of birth, postal address, email, and telephone number(s).
- Next of kin.
- Racial/ethnic origin.
- Religious belief or other belief of a similar nature.
- Physical or mental health or condition.
- Special educational needs.
- The commission or alleged commission of any alleged disciplinary or criminal offence.
- Reports/evaluations.
- Exam results.
- Attendance information.
- Any relevant medical information.
- Student disciplinary information.
- Photographs.
IEG will process personal information only where it has a valid lawful basis under the UK GDPR. Consent is used where appropriate; it is not the only possible basis for providing agreed services or protecting a child. See the Guardianship Privacy Notice for purposes, lawful bases, sharing, retention and rights.
- Bank details such as bank information and other financial data, for instance, payments to homestays.
- Health-related information and emergency contact details for individuals.
- Vehicle details in instances where homestays offer transportation services to students.
Additionally, InterGreat Education Group obtains personal data directly from individuals or, in the case of students, from their parents. Nevertheless, there are scenarios where schools or other relevant authorities associated with an individual may also supply data.
Parental consent will endure until the destruction of the data as detailed below.
Sensitive Data
From time to time, InterGreat Education Group may find it necessary to handle sensitive personal information about individuals. This category of data includes details related to an individual's physical or mental health, sexual activity, criminal records and proceedings, race or ethnic origin, as well as political or religious beliefs. Sensitive personal data is subject to specific protection under UK GDPR and the Data Protection Act 2018. InterGreat Education Group will process such data only with the explicit consent of the relevant individual or as permitted by UK GDPR and the Data Protection Act 2018.
Practical Guide to Sharing of Information:
InterGreat Education Group is required to share specific information as part of our daily operations to maintain the highest standard of service for our students. This includes, but is not limited to:
- Details about travel and break/holiday plans
- Urgent welfare-related information
- School reports or other academic concerns
To provide a clear understanding of our procedures, we have outlined below the protocols that apply to each of these situations, including the staff or external individuals who may be consulted in these circumstances.
Student, Host & Staff Information – how it is stored & shared
Host Family or Staff Application (online) (UK)
Added onto encrypted system
(Safer recruitment checks include work with Checks-Direct for enhanced DBS )
Relevant information shared with School/Student/Parent(Host Family Profile)
Information Updated from UK to encrypted system
Guardianship Agreement provided to an Agent (outside UK)
uploaded to an encrypted system
Pertinent information shared with the School/Host (Student Care Folder)
updates from the UK to the encrypted system
Information on travel and half term/holiday plans
Travel and Holiday Plans
Communicate with the school to ensure all the arrangements are proportionate to each students
Communicate with Host Family or Boarding houses to make sure the dates are correct
Arrange transport accordingly also in line with UK safeguarding requirements
Obtain confirmation from students and parents about all the arrangements. Collect relevant parental authorisation if needed.
Information on Urgent Welfare Matters
Urgent Welfare Matters
Communicate with the DSL of that school
Communicate with Host Family/Accommodation if the situation may need to be monitored within a home environment.
Communicate via confidential Cause for Concern to the DSL who may communicate with Student Management or DDSL for additional information or support.
lf it is considered in the best interest of the child, information on urgent welfare matters may also be communicated to Parents Local Safeguarding Children Partnership or other Public
Services.
School Reports or other Academic Concerns
School Reports and Academic Concerns
Discuss with the School and appropriate teachers to gain a best understanding of School Reports.
lf additional tutoring or private lessons are booked, selected information from School Reports would be passed onto the tutor to ensure that lessons are tailored to the students needs
Translate the report and arising problems they will advise the Academic Director for further support. lf Safeguarding concerns are raised, they will inform the Designated Safeguarding Lead
Parents and Students will be sent a copy of the school report(either in English or Chinese as appropriate) and any Academic Concerns would be discussed with all parties to resolve.
Data Accuracy:
The retained information will be accurate and regularly updated to the best extent possible. If a data subject informs InterGreat Education Group about changes in their circumstances, their electronic record will be promptly updated.
In cases where a data subject questions the accuracy of their data, InterGreat Education Group will promptly label the record as potentially inaccurate or 'challenged'. The Data Protection Officer will attempt to resolve the matter informally, but if unsuccessful, the dispute will be handled through the organisation’s Complaints Procedure for resolution. If the issue remains unresolved, either party may seek independent arbitration via the Data Protection Information Commissioner.
The 'challenged' marker will persist until the matter is resolved, and any disclosures of the pertinent information will include both versions of the data.
Data Adequacy and Relevance:
Information about individuals will be sufficient, pertinent, and not disproportionate in relation to the reasons for which the data is being managed.
Length of Time:
Except for contact details and references, information about students will not be kept beyond the student’s 25th birthday, or later if necessary as per InterGreat Guardian’s insurers' requirements, and will then be securely destroyed.
With the exception of details needed by external authorities (e.g., HMRC), data about staff and homestays will not be maintained for more than 4 years after they depart from the InterGreat Guardian’s employ/service and will then be securely eradicated.
Information about unsuccessful job applicants will be retained for no longer than 12 months from the date of rejection.
Subject Access:
Students, parents, homestays, and staff have the right to access their personal data, unless specified otherwise by legislation.
To request access, students, parents, homestays, or staff should complete a ‘data subject access form’ available from the InterGreat Education Group office, and submit the completed forms to the Data Protection Officer.
If there is sufficient information provided to process the request, an entry will be made in the Subject Access log on InterGreat Education Group Internal website, detailing the date of receipt, the data subject's name, the name and address of the person requesting the information (if different), the type of data required (e.g., Student Record, Personnel Record), and the planned date by when the information will be supplied. If more information is necessary to establish either the identity of the data subject (or agent) or the type of data requested, the date of entry in the log will be the date when sufficient information has been provided.
Requests for information will be handled within 28 calendar days from the receipt of the request, except when legislation requires disclosure within a shorter timeline.
Students may access their personal data if InterGreat Education Group believes the student comprehends the nature of the request. It is assumed that most children have a sufficient understanding by the age of 12.
Disclosure to Third Parties:
Only authorised and properly trained personnel are permitted to disclose personal data to external parties. External disclosure may occur under various circumstances, including (but not limited to) the following:
- Adhering to legal obligations
- Safeguarding the health, safety, and welfare of students, staff, and homestay members
- Furnishing parents or those with parental responsibility with information pertaining to the student’s development, accomplishments, attendance, attitude, aptitude, and general behaviour within or around their school/homestay
- Addressing administrative/financial matters
- Providing references. Copies of references will not be shared with the individual who is the subject of the reference. The subject's explicit consent will be sought before any reference is provided.
- Acting in the best interests of InterGreat Education Group or the student in general
- Certain disclosures, such as to an engineer during computer system maintenance, may be unavoidable. In such cases, the engineer will be required to review and adhere to our Data Protection and Confidentiality and Information Sharing Policy.
Data accessed within InterGreat Education Group by administrative staff and management will only be provided to them if the person requesting the information is employed within the company and requires the information to fulfil their job responsibilities. All staff will be informed of this policy and their responsibilities under the Data Protection Act.
Use of Photographs:
Occasionally, InterGreat Education Group may seek to utilise student photographs or images for the following reasons:
- On their website
- For marketing or promotional material.
InterGreat Education Group will not post individual student photographs or images or identify students when using photographs [whether they are current or former students] without the explicit consent of the relevant individual, or parental consent if the student is under 18 years of age. Additionally, InterGreat Education Group will ensure that only photographs of students in appropriate attire will be used.
Student Confidentiality:
Students will be expected to honour each other’s privacy. A student has the option to request the InterGreat Education Group to refrain from sharing their personal information with third parties, including parents. InterGreat Education Group will uphold this confidentiality unless it is determined that the student may not comprehend the implications of withholding consent or it is not in the student's best interests to withhold such consent. Requests of this nature will be assessed in accordance with the Safeguarding and Child Protection Policy, as well as the Confidentiality and Information Sharing Policy, overseen by the Data Controller and Designated Safeguarding Lead.
Security:
InterGreat Education Group commits to taking all reasonable measures to safeguard personal data through the implementation of suitable organisational and technical methods.
Physical Security:
Suitable building security measures, including alarms, window bars, deadlocks, and computer hardware cable locks, have been implemented. Access to disks, tapes, and printouts is restricted to authorised individuals, and these items are securely locked when not in use. Office visitors are required to sign in and out, and in suitable circumstances, they are accompanied while on the premises.
Systems Security:
All records are stored on an encrypted central management system, which contains comprehensive details about encryption and safety features available. While staff may work on files stored on personal devices, these files should be removed from the device as soon as they are uploaded to the central system (preferably within 24 hours).
Data Breaches:
If IEG discovers that there has been a breach of personal data that poses a risk to the rights and freedoms of individuals, it will report it to the Information Commissioner within 72 hours of discovery. The organisation will record all data breaches regardless of their effect.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, it will tell affected individuals that there has been a breach and provide them with information about its likely consequences and the mitigation measures it has taken.
Exam Centre:
InterGreat Education Group, Global Head Office London is also functioning as Pearson Edexcel Exam Centre. Therefore, the exam candidates are required to provide the further relevant information (but not limited to) on the initial examination registration form (including the data mentioned under Fair Obtaining and Processing).
Information to be collected:
- UCI Number (Unique Candidate Identifier);
- Unique Learner Number (ULN);
- Qualification Type;
- Subject Details;
- Access Arrangements and Reasonable Adjustments.
International Data Transfer:
Personal data may be transferred to countries outside the EEA to offices in China, Vietnam and any other future region. Data is transferred outside the EEA on the basis that any region upholds the adequate safeguards e.g declaration of adequacy, binding corporate rules or other safeguards.
Training:
All staff will be trained about the need to maintain confidentiality and in relation to the legislative requirements.
Complaints:
If an individual feels that InterGreat Education Group has not adhered to this Policy or operated in line with GDPR and the Data Protection Act 2018, they should follow the company’s complaints process. If the individual remains dissatisfied, they can escalate their concerns to the Data Protection Information Commissioner.
Appendix 1: Data Subject Access Request
The enquirer should email the Data Protection Officer at dpo@intergreat.com with the following information.
Data Subject Access Form
- Enquirer's Surname
- Enquirer's First Name
- Enquirer's Address
- Enquirer's Postcode
- Home Phone Number
- Mobile Telephone Number
- Are you the person who is the subject of the records you are inquiring about (i.e., the Data Subject)? If 'No,' please contact the Director of InterGreat Education Group to determine whether or not we need to seek express written permission from the 'Data Subject' to divulge the requested information.
- Do you have parental responsibility for a child who is the 'Data Subject' of the records which you are inquiring about? If 'No,' please state your relationship with the 'Data Subject,' and note that InterGreat Education Group may ask for verification of your identity before disclosing any data.
- Name of 'Data Subject'
- Date of Birth of 'Data Subject'
- Description of information or topics requested
- Contact information of where information should be sent to (if different from those already given)
- Signature of Enquirer
- Data Subject Informed of request?
- Data Subjects should be made aware that they are able in law to withhold information from the enquirer.
- Consent given by Data Subject for Enquirer to access requested information
- Evidence of Data Subject's knowledge
- Signature of Data Subject
- Attachments
ICO registration, privacy information and AEGIS inspections
IEG will maintain the appropriate registration with the Information Commissioner’s Office, identify responsibility for data-control decisions and publish an accessible privacy notice. Where AEGIS requires information for accreditation or re-accreditation, only the minimum necessary personal information will be provided securely to the AEGIS office or appointed inspectors. Individuals will be informed and permission obtained where required. Records of the lawful basis, information shared, recipient and purpose will be retained.