Who we are and what this notice covers
This notice explains how InterGreat Education Group (IEG) uses personal information to arrange and provide UK educational guardianship, welfare support, homestays, travel and school liaison. It covers students, parents and carers, homestays and school contacts. It should be read with our general website privacy information and our Data Protection Policy.
The data controller is IEG Hong Kong Ltd, registration number 3016883. Our UK contact office is 25 Southampton Buildings, London WC2A 1AL. Contact our privacy team at dpo@intergreat.com, or write to the Data Protection Officer at our UK contact office.
Information we use and where it comes from
Depending on the service and the individual’s role, we may use names, contact details, dates of birth, identity and immigration documents, parent and emergency contacts, school and attendance information, travel plans, accommodation arrangements, permissions, correspondence, payment and service records, welfare reports and safeguarding records. Where needed to care for a student safely, this may include health, disability, additional support, dietary or religious information.
We receive information directly from students, parents and carers, and where appropriate from schools, homestays, authorised representatives, staff, travel providers and statutory or safeguarding agencies. We request only information relevant to the service or safeguarding purpose.
Why we use information and our lawful bases
- Providing agreed services: organising guardianship, communicating with parents and schools, arranging accommodation and travel, and administering bookings and payments. We use contractual necessity where the individual is a party to the contract, and legitimate interests in delivering the service and supporting the student where appropriate.
- Student welfare and safeguarding: assessing needs and risks, responding to concerns, coordinating care and making appropriate referrals. Depending on the circumstances, we rely on legitimate interests, an applicable legal obligation, or vital interests in a serious emergency.
- Managing the service: maintaining secure records, resolving complaints, quality assurance and accreditation inspections. We rely on legitimate interests or an applicable legal obligation, taking particular account of children’s rights and interests.
- Optional uses: where we ask for consent, for example for an optional identifiable photograph, we explain that purpose separately. Consent can be withdrawn for future use without affecting processing already lawfully undertaken.
Health and other special-category information requires an additional legal condition under Article 9 of the UK GDPR. This may include explicit consent or an applicable safeguarding condition where its legal requirements are met. Criminal-offence information is processed only where legally authorised and subject to the applicable safeguards. A service agreement alone does not authorise every use of sensitive information.
Who may receive information
We share relevant information on a need-to-know basis with the student’s school, parents or authorised carers, vetted homestays, agreed transport and travel providers, healthcare professionals, safeguarding partners, local authorities and police where appropriate. We also use service providers for secure administration, communications, records and payments, subject to appropriate controls. We consider the student’s privacy, understanding and best interests when deciding what to share with others.
For AEGIS accreditation or re-accreditation, we may securely provide the AEGIS office or appointed inspectors with limited contact and service information about students, parents, homestays, schools, staff or coordinators. We explain the inspection purpose, provide notice, obtain permission where required, and share the minimum necessary. Inspection contact information held by AEGIS is handled under AEGIS’s own retention arrangements.
International access and transfers
Delivery of international services can require communication with parents overseas and authorised access or processing outside the UK, including by relevant IEG teams or providers. Where a transfer is restricted by UK data-protection law, it must have a lawful transfer basis: for example, an adequacy regulation, appropriate contractual safeguards and any required transfer assessment, or a permitted exception. A confidentiality agreement alone is not a substitute for a lawful transfer mechanism. Contact our privacy team for information about relevant destinations and safeguards.
How long we keep information
We keep information only as long as needed for the purpose for which it was collected and any relevant legal, regulatory, safeguarding, insurance or claims requirements. The period depends on the record type, the student’s age, the nature of any welfare concern, the end of the service and any unresolved complaint, investigation or claim. Safeguarding records may need to be retained for longer than routine administrative records. We securely delete or anonymise information when retention is no longer justified. Contact our privacy team for the period or retention criteria applicable to a particular record.
Your rights and choices
Depending on the circumstances, you can request access to your information, correction, erasure, restriction, portability, or object to processing based on legitimate interests. These rights are subject to legal limits, including safeguarding needs and the rights of other people. Where processing relies on consent, you may withdraw it. Children have their own information rights; requests made on their behalf are assessed with regard to their understanding and any authority to act for them.
Contact dpo@intergreat.com to exercise a right or raise a privacy concern. We may ask for proportionate identity or authority checks and will respond within the applicable legal timescale, normally one month. If essential information for a service is not provided, we will explain how this affects our ability to arrange that service safely.
Privacy complaints
You can raise a concern with our privacy team or use our Complaints Policy. You also have the right to complain directly to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint. You do not have to complete our internal complaints process before contacting the ICO.