Data Protection, Use of Information and
Student Confidentiality


The aims of this policy are to ensure:

  • legal compliance
  • good internal practice
  • the protection of staff, students and providers
  • all staff, clients and providers are assured that such a policy exists


In accordance with The Data Protection Act, Imagine English Language Academy complies with the following principles that personal information about staff, clients and providers is:

  • obtained and used fairly and lawfully
  • used for limited, specific and relevant purposes
  • used in a way that is adequate, relevant and not excessive
  • accurate and up to date
  •  kept for no longer than necessary
  • handled according to people’s data protection rights
  • stored safely and securely
  • not transferred outside the UK without adequate protection

This policy must be observed by all Imagine English Language staff and contractors.

This policy applies to all data and information held by Imagine English Language, relating to identifiable individuals – including staff, clients and providers. Such information includes, but
is not limited to:

    • Personal details: name, date of birth, nationality, employment history
    • Contact details: address, telephone numbers, email
    • Booking details: confirmation /denial of booking, course dates, course times, level,
    • progress, attendance, financial information
    • Personal issues: relating to health and welfare

Overall responsibilities:
Application of this policy is the responsibility of all individuals at Imagine English Language Academy. Overall implementation, monitoring and maintenance is the responsibility of the
Individual responsibility:
All individuals, including staff, clients and providers are responsible for: providing correct personal information
checking personal information in relation to their employment (staff) or enrolment (clients) are accurate and up to date

notifying Imagine English Language Academy of any changes to information they haveprovided (contact details, for example)

Code of Practice
1. Imagine English staff will not disclose identifiable information about any individual,
directly or indirectly, to any third party (including but not limited to family, colleagues,
friends or other students) who is not a member of Imagine English or relevant provider,
without the individual’s specific written or verbal consent to the disclosure of such
2. Imagine English recognises that information may need to be shared between Imagine
English staff members. Shared information must be relevant to its purpose, factual,
subject to a ‘need-to-know’ basis, and exchanged in an appropriate environment or via
appropriate medium.
3. Imagine English recognises that information may need to be shared between Imagine
English and their service providers. In such cases, only the information necessary for the
provider to fulfil the agreed service is to be shared.
4. Imagine English utilises statistical recording of service use to enable the monitoring of
demand and to identify any practical or policy issues related to the provision of
services. Imagine English ensures that all statistical records given to third parties are
produced in an anonymous form, so that individuals cannot be identified.
Exceptional cases and extenuating circumstances
In accordance with the Data Protection Act, personal information may be disclosed to law
enforcement agencies without the consent of the individual concerned. Imagine English
Language Academy will comply with such a request if it is legitimate. However, the Director
will ensure the request is legitimate, seeking assistance from the company’s legal advisers
where necessary.
Emergency Contacts
All staff and students provide the name and address of their Emergency Contact upon arrival
at Imagine English Language Academy.
The Welfare Officer (re students) or Business Manager/Director (re staff) may decide that
information may be disclosed the Emergency Contact without specific consent if, in their
judgment, there is a risk of physical danger or other serious harm to the individual or to
Circumstances in which the Emergency Contact may be contacted include, but is not limited
• three consecutive days of absence (where attempts at direct contact with the
individual has not been successful)
• serious issues pertaining to welfare, safeguarding, being asked to leave the course
or other emergency
Third parties acting on behalf of clients:
Imagine English may discuss the progress of the booking stages (enquiry to confirmation)
with verified third parties (including agents / family) acting on behalf of a student.
In the event that a third party provides information to Imagine English on behalf of an
individual, independent verification should also be sought.
Secure Storage
It is the responsibility of all Imagine English staff to ensure that all personal information is
stored in lockable storage units when not in use. Only authorised staff have access to the
keys of the lockable storage units.
July 2018
Papers containing confidential information are shredded when no longer required.
Personal data should never be transferred outside of the European Economic Area, with the
exception of Visa Letters – which are sent securely via a courier with a tracking service.
Financial records will be kept for 7 years in accordance with the HMRC for tax purposes.
It is the responsibility of Imagine English staff to ensure that all computer records are held
securely and appropriately protected.
Imagine English staff, with permitted access to electronically stored information, are issued
with a personal account and password. Computers should be locked when left unattended.
Notification of data held
All staff and clients have the right to know the following:
• what personal information Imagine English holds about you, the purpose for which it is
used and how to gain access to it
• how it is kept up to date;
• what Imagine English is doing to comply with its obligations under the 1998 Act.
For this information:
• students and staff should contact the Business Manger.