Privacy Notice

1. Who We Are

Go Languages Worldwide is the Data Controller for personal data processed in connection with UK operations delivered under the MLA framework.

Personal data is handled in accordance with:

• UK General Data Protection Regulation (UK GDPR), as amended by the Data (Use and Access) Act 2024
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Guidance issued by the Information Commissioner’s Office (ICO)

MLA operates as an international group. This Privacy Notice applies only to personal data processed for UK operations by Go Languages Worldwide.

2. The Personal Data We Collect

We process personal data relating to:

• Staff
• Students and programme participants (including minors)
• Parents or guardians
• Contractors and suppliers
• Visitors

This may include:

• Identification and contact details
• Right-to-work documentation
• DBS/PVG checks and safeguarding clearances
• Training, payroll, contractual and performance information
• Student personal details and parent/guardian contact details
• Medical and dietary information
• Accommodation and welfare records
• Safeguarding and incident records
• CCTV footage and visitor logs
• Accident and incident reports
• Email communications
• Photographs and video (subject to appropriate consent)

Where we process Special Category Data (for example health data), we do so only where a lawful condition under Article 9 UK GDPR applies.

3. Lawful Bases for Processing

We process personal data only where a lawful basis applies under UK GDPR. These include:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

Where Special Category Data is processed, this is carried out under permitted conditions including explicit consent, safeguarding obligations, employment law requirements, or protection of vital interests.

4. Sharing Personal Data

We may share personal data with:

• Emergency services
• Local authorities or LADO (where safeguarding concerns arise)
• Police and statutory bodies
• Host campuses and accommodation providers
• Travel operators (where required for student transfers)
• External service providers acting as Data Processors

Where required, appropriate contractual arrangements are in place.

We do not sell personal data.

Where processing is jointly determined with another organisation, arrangements are in place to allocate responsibilities in accordance with UK GDPR.

5. International Access and Transfers

Personal data processed for UK operations is primarily handled within the UK.

Where UK personal data is accessed from, or transferred outside the UK, including within the MLA framework:

• Transfers to the EEA rely on UK adequacy regulations.
• Transfers to other jurisdictions (including the United States) are subject to appropriate safeguards recognised under UK law.

International transfers and access arrangements are kept under review.

6. Data Retention

Personal data is retained only as long as necessary. Typical retention periods include:

• Staff files – 10 years after employment ends
• Interview notes – up to 6 months
• Student enrolment data – up to 10 years
• Safeguarding records – 25 years from creation
• Accident/incident logs – minimum 3–6 years
• Financial/contractual records – 10 years

Retention periods may be extended where required for safeguarding, investigations, or legal proceedings.

At the end of the retention period, data is securely deleted or anonymised unless continued retention is required by law.

7. Your Rights

Under UK data protection law, individuals have the right to:

• Be informed
• Access their personal data
• Request rectification
• Request erasure
• Restrict processing
• Data portability
• Object to processing
• Rights relating to automated decision-making

Requests will be acknowledged within one month.

8. Complaints

We operate an internal data protection complaints process and encourage concerns to be raised directly with us in the first instance.

Individuals also have the right to raise concerns with the Information Commissioner’s Office (ICO).