Privacy Notice

1. Who we are

Crystelle Languages Ltd provides premium language tuition and business language training to private clients, families, professionals, executives and organisations.

We are registered in England and Wales under company number 16867373. Our registered office is 167–169 Great Portland Street, London, England, W1W 5PF.

Crystelle Languages Ltd is the data controller responsible for the personal information described in this notice.

For questions about your personal information or to exercise your data protection rights, contact Ana Quénette, Director, at contact@crystellelanguages.com.

2. Whose information we collect

This notice applies to clients, prospective clients, students, parents and carers, tutors, tutor applicants, professional referees and people who contact us. It also applies to representatives of organisations that enquire about or purchase our business language training services.

3. Personal information we collect

Clients, students, parents and carers

Depending on the services requested, we may collect names, contact details, student age or school year, school, language studied, academic level, examination details, learning objectives, previous attainment, lesson records, progress reports, correspondence, booking information, invoices and payment records.

We may also receive information about a student's health, disability or additional educational needs where it is relevant to arranging or delivering appropriate tuition.

Tutors and applicants

We may collect names, contact details, CVs, employment history, teaching experience, qualifications, professional references, interview notes, identity and right-to-work evidence, relevant DBS or overseas criminal-record check information, professional insurance details, tax registration and payment details, professional photographs, biographies, invoices, timesheets and engagement records.

People making enquiries and website visitors

When you contact us, we may collect the information you provide, including your name, contact details and the nature of your enquiry. Our website may also process technical information through cookies or similar technologies, as explained in our cookie information where applicable.

We do not store full payment card details.

4. How we obtain information

We collect information directly from individuals, including clients, parents, students, tutors and applicants. We may also obtain relevant information from parents or carers, professional referees, tutors, organisations or authorities involved in appropriate recruitment and safeguarding checks, and other individuals involved in a safeguarding concern.

Where we obtain personal information from another source, we provide the information required by data protection law, subject to any applicable legal exceptions.

5. How and why we use personal information

We use personal information where necessary to:

• Respond to enquiries and provide information about our services.
• Arrange, deliver and administer tuition and language training.
• Match clients and students with suitable tutors.
• Communicate with parents, students, tutors and business clients.
• Assess tutor applications and verify relevant qualifications, references and suitability.
• Carry out appropriate safeguarding and recruitment checks.
• Maintain lesson, progress, booking and engagement records.
• Process invoices, payments, accounting and related administration.
• Handle complaints, disputes, insurance matters and legal claims.
• Protect students, clients, tutors and others where safeguarding concerns arise.
• Maintain the security and proper operation of our services and systems.

6. Our lawful bases for processing

UK data protection law requires us to have a lawful basis for processing personal information. Depending on the circumstances, we may rely on the following bases:

• Contract and pre-contractual steps: where processing is necessary to provide contracted services or to take steps requested before entering into a contract.
• Legal obligation: where processing is necessary to comply with a legal requirement.
• Legitimate interests: where processing is necessary for our legitimate business interests or those of another person, provided those interests are not overridden by the individual's rights and interests.
• Consent: where we rely on consent for a particular purpose. Where consent is the lawful basis, it can be withdrawn.
• Vital interests: where processing is necessary to protect someone's life in circumstances recognised by data protection law.

The appropriate lawful basis depends on the specific processing activity. We do not assume that one lawful basis applies to every type of information or every purpose.

7. Health, additional-needs and criminal-record information

Some information we handle requires additional protection. This may include information about a student's health, disability or additional educational needs, as well as criminal-record information processed in connection with tutor recruitment and safeguarding.

We process special-category and criminal-offence information only where the relevant requirements of UK data protection law are satisfied. This includes identifying an appropriate lawful basis and, where required, an additional legal condition for processing this information.

Access to such information is restricted to people who need it for legitimate professional, administrative or safeguarding purposes. We take account of applicable requirements concerning the handling, security and retention of DBS information.

Where a safeguarding concern arises, we may need to retain or share relevant information with appropriate authorities where this is lawful and necessary to protect a child or another individual at risk.

8. Who we share information with

We share personal information only where necessary, appropriate and lawful. Depending on the circumstances, recipients may include:

• Tutors delivering services, who receive information needed for their assigned teaching.
• Parents, carers or clients receiving appropriate lesson reports and progress information.
• Safeguarding authorities, including children's social care, the police, Local Authority Designated Officers and other relevant agencies where appropriate.
• The Disclosure and Barring Service or relevant overseas authorities where applicable.
• Accountants, insurers, insurance brokers, legal advisers and other professional advisers.
• Providers supporting our website, email, secure file storage, scheduling, administration and payment systems.
• Other organisations where disclosure is required by law or is otherwise lawful and necessary.

Where service providers process personal information on our behalf, we take appropriate steps to establish suitable data protection arrangements.

We do not sell personal information or share it with third parties for their own marketing purposes.

9. International transfers

Some tutors or service providers may be located outside the United Kingdom. Where personal information is transferred internationally, we assess the applicable legal requirements and implement an appropriate transfer mechanism where required.

Depending on the circumstances, this may involve an applicable adequacy regulation, approved contractual safeguards or another legally recognised transfer mechanism. We provide further information about relevant safeguards where required by law.

10. How long we retain information

We retain personal information only for as long as necessary for the relevant purpose, taking account of contractual, safeguarding, legal, accounting and insurance requirements.

• Client and student records: generally for the duration of the engagement and six years afterwards.
• Tutor records: generally for the duration of the engagement and six years afterwards, subject to specific retention rules for DBS and other sensitive information.
• Full DBS certificates: we do not normally retain a full certificate or copy for longer than six months following the relevant recruitment or suitability decision, unless a lawful and applicable requirement justifies a different approach.
• DBS check and suitability records: relevant details, such as certificate number, issue date, check date, Update Service status where applicable and the suitability decision, may be retained where necessary.
• Unsuccessful tutor applications: generally for six months, unless a longer period is appropriately agreed for future recruitment.
• Safeguarding records: for as long as necessary in accordance with applicable safeguarding, legal and record-retention requirements.
• Accounting records: generally for six years from the end of the relevant financial year, or for another period where required by law.

These periods are general retention rules. Information may be retained for a different period where necessary and lawful, for example to comply with a legal obligation or deal with a safeguarding matter or legal claim. We periodically review the information we hold and securely delete information that is no longer required.

11. How we protect information

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss, misuse or disclosure. Access to personal information is restricted according to legitimate business and professional needs.

Tutors are expected to maintain confidentiality, protect personal information received through their work and report suspected personal data breaches promptly in accordance with their contractual obligations and our procedures.

If a personal data breach occurs, we assess the circumstances and take appropriate action. Where the law requires notification to the Information Commissioner's Office or affected individuals, we will make that notification within the applicable timeframe.

12. Marketing communications

Crystelle Languages does not currently send routine promotional email campaigns or operate a marketing email mailing list.

We may contact you to respond to an enquiry, provide requested information, administer services or communicate about an existing client or professional relationship. If we introduce marketing communications in the future, we will comply with the applicable data protection and electronic marketing requirements.

13. Cookies and website technologies

Our website may use cookies or similar technologies. The technologies in use, their purposes and any choices available to visitors will be explained in our separate Cookie Notice once our website technologies have been reviewed.

Where consent is legally required, we will request consent before activating the relevant non-essential technologies. You will also be able to change or withdraw consent where applicable.

14. Your data protection rights

Depending on the circumstances and subject to applicable legal conditions, you may have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information where the law permits.
• Request restriction of certain processing activities.
• Object to processing based on legitimate interests.
• Receive or transfer certain personal information where the right to data portability applies.
• Withdraw consent where consent is the lawful basis for processing.
• Object to direct marketing at any time.

These rights are not absolute and may be subject to legal conditions and exemptions. The rights available to you depend on the circumstances and the lawful basis for processing.

Where information relates to a child, we will consider the child's age, maturity and circumstances when responding to requests from the child or their parent or carer.

To exercise your rights, email contact@crystellelanguages.com. We will respond within the period required by applicable law, normally one month.

15. Automated decision-making

If we use personal information for solely automated decisions that produce legal or similarly significant effects on an individual, we will provide the information and safeguards required by applicable data protection law.

16. Complaints

If you are concerned about how we handle your personal information, please contact us first so that we can investigate your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: ico.org.uk
Telephone: 0303 123 1113
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

17. Changes to this notice

We may update this Privacy Notice to reflect changes in our services, systems, legal obligations or data protection practices. The latest version will be available on our website, together with its most recent update date.