Privacy Policy
Emerald Cultural Institute is committed to protecting personal data. This Privacy Policy explains how ECI collects, uses, shares, stores and protects information relating to students, guardians, host families, employees and other stakeholders, and describes your rights under the General Data Protection Regulation (GDPR).
Purpose and scope
Data Protection Policy — reviewed annually.
This notice applies to all personal data processed by Emerald Cultural Institute (ECI). ECI is an English-language college based in Palmerston Park, Rathgar, Dublin 6. It provides academic programmes, activities and student accommodation services.
The policy covers current and prospective students, parents and guardians, host families, teachers, employees, contractors, job applicants, partners, agents, suppliers and associated entities. Personal data means information that identifies a person, directly or indirectly.
Data controller and protection responsibilities
Emerald Cultural Institute is the data controller and decides how and why personal data is collected, used and retained. All employees share responsibility for following GDPR principles in their work.
The live policy names David Ferguson as Data Protection Officer (also described as GDPR Officer), reporting to Managing Director Mauro Biondi. Contact details are provided at the end of this notice.
- Keep personal data accurate and up to date.
- Collect and retain only the information that is necessary.
- Store and dispose of personal data securely.
- Protect personal data from loss, misuse, unauthorised access and disclosure.
- Use appropriate technical and organisational safeguards.
Personal information ECI collects
ECI collects information that people provide through booking and enquiry forms, email and other direct communications. Website usage information may also be collected automatically where relevant technologies are active. Where a field is marked optional, it may be left blank without affecting the availability of the relevant service; otherwise, ECI may be unable to provide the requested service.
- Name, date of birth, nationality, gender, country and contact details.
- Emergency contact and emergency medical contact details.
- Payment, invoice, banking and transaction information.
- Passport, visa and immigration information where required.
- Medical conditions, allergies, special educational needs, dietary needs and stated accommodation or study requirements.
- Enrolment, attendance, academic, test and examination records.
- Employment, payroll, personnel, work-permit and health-and-safety records where relevant.
- Virtual-class recordings, school photographs and videos.
- Information submitted in enquiries, feedback, forms and other communications.
Students, parents and guardians
When a course is booked, ECI may request the student information needed to provide teaching, activities, welfare support and accommodation. For minors, parent or guardian details and a minor consent form may also be required.
Student information may be used to enrol students, select an appropriate class level, arrange examinations and accommodation, process transactions, assist with visa applications, support the opening of an Irish bank account, arrange insurance, meet immigration and accreditation requirements, maintain attendance and health-and-safety records, and respond to emergencies.
Photographs, videos and class recordings may be used for educational purposes, student or teacher portfolios, teacher self-reflection and official ECI promotion where the required permission has been obtained.
How ECI uses personal information
ECI uses personal information only for relevant school, accommodation, employment, business and legal purposes, including:
- providing courses, activities, accommodation and related services;
- personalising the course, social programme and accommodation experience;
- processing payments and maintaining financial, academic and operational records;
- responding to enquiries, requests and emergencies;
- improving programmes and services using feedback;
- meeting legal, tax, immigration, accreditation, insurance, health-and-safety and safeguarding obligations; and
- communicating school news, events and marketing updates where permitted.
ECI states that it does not sell or rent personal information. It does not exchange, transfer or share information with another organisation except to provide the requested service, fulfil a stated purpose, meet a legal obligation or where the required consent has been obtained.
Host-family information
ECI may use host-family information to assess an application, consider a student’s suitability for a placement, arrange accommodation, contact hosts about services or emergencies, respond to requests, seek feedback and improve service levels.
The live policy also states that ECI may send updates about host-family vacancies and share relevant host information with prospective students or their ETO to help arrange a suitable placement.
Employees, agents, suppliers and other stakeholders
This policy also applies to teachers, employees, contractors, job applicants, partners, agents, suppliers and associated entities. ECI may process contact, employment, payroll, personnel, work-permit, financial and health-and-safety information where necessary to manage these relationships, maintain records, communicate, deliver services and meet legal, tax, accreditation and workplace obligations.
Legal bases for processing
ECI identifies the following legal bases under Article 6 GDPR. The basis used depends on the purpose and the circumstances.
Article 6 — personal data
- Consent for a specified purpose.
- Performance of a contract, or steps requested before entering a contract.
- Compliance with a legal obligation, including tax, immigration and accreditation record-keeping.
- Protection of the vital interests of the person or another person, including health-and-safety needs.
- A task carried out in the public interest or under an official responsibility, where applicable.
- ECI’s or a third party’s legitimate interests, unless overridden by the person’s interests, rights or freedoms; examples given by ECI include promoting the school and communicating with students.
Article 9 — special-category personal data
Special-category data may include health, medical, allergy and special educational needs information. The live policy identifies explicit consent; the establishment, exercise or defence of legal claims; substantial public interest under EU or Member State law; administration of student insurance; and archiving, research or statistical purposes as conditions relevant to this processing.
Sharing and third-party processors
Personal data is handled confidentially and is available to authorised ECI staff only where they need it for their role. Where necessary, ECI may share relevant information with trusted partners providing social-programme activities, medical care, insurance, visa support, bank-account assistance or immigration services.
Selected IT, hosting, communications, legal, marketing, administration or mail-service providers may process data on ECI’s behalf. ECI states that these providers are selected carefully and appointed as data processors where required. An up-to-date list may be requested from ECI.
Information is shared outside ECI only as needed to provide a requested service, with consent where required, or to meet a legal obligation.
Location and international transfers
Personal data is processed at ECI’s offices and at other locations where authorised staff or service providers operate. Depending on the provider and the person’s location, data may be processed in another country.
The live policy states that personal data will be transferred outside the European Union only where required and with express consent, and that ECI will use an appropriate legal basis and safeguards for any such transfer. Further information may be requested using the contact details below.
How long ECI keeps personal data
ECI keeps personal data only for as long as necessary for the purpose for which it was collected. Contract data may be retained until the contract has been completed; legitimate-interest data for as long as the relevant purpose continues; and consent-based data until consent is withdrawn. Legal duties or official orders may require longer retention. Data is securely deleted or anonymised when its retention period ends.
The live policy currently gives the following indicative periods:
- Student attendance records: minimum 5 years.
- Enrolment and academic records: typically 7 years; it also suggests that key records may be anonymised and kept permanently where appropriate.
- Student visa and immigration documents: at least 5 years after the student leaves.
- Payroll and employee records: 6 years.
- Invoices, receipts, accounting records, bank statements and financial reports: 6 years.
- Employee contracts and personnel files: 7 years after employment ends.
- Work permits and visas: at least 5 years after expiry.
- Health-and-safety records: 10 years, with some accident records retained for up to 20 years.
- Student and employee personal data where no specific legal period applies: the live policy suggests 5–7 years after last contact.
Data security
ECI takes technical and organisational measures to protect personal data against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration and deletion. Data is processed through controlled IT systems and procedures, and access is limited to staff and providers who need it for an authorised purpose.
Your data-protection rights
Under GDPR, and subject to applicable exemptions, you may exercise the following rights:
- Access — request a copy of the personal data ECI holds about you.
- Correction — ask ECI to correct inaccurate or outdated information.
- Deletion — ask ECI to erase information that is no longer necessary.
- Withdrawal of consent — withdraw consent at any time where processing relies on consent.
- Data portability — receive your data or, where possible, have it transferred to another controller.
- Restriction — ask ECI to restrict processing where accuracy or lawfulness is disputed.
- Objection — object to processing unless ECI demonstrates a legitimate or legal reason to continue.
- Complaint — lodge a complaint with the Data Protection Commission if you believe your rights have been infringed.
You may also opt out of future marketing communications at any time. To exercise a right or raise a concern, use the contact details below.
Further processing and changes of purpose
If ECI intends to use personal data for a purpose not covered by this notice, it will provide a new notice before that processing begins. The notice will explain the intended purpose and processing conditions, and ECI will obtain consent where it is required.
Cookies and website technologies
The website may collect information submitted through forms and communications, together with cookies or usage data generated when the site is used. Cookies and similar technologies may be used to provide requested website services. Full details of cookie purposes and available choices should be maintained in ECI’s Cookie Policy.
Verified external service
The supplied staging pages load Google Fonts, provided by Google Ireland Limited, to display custom typefaces. Technical or usage data may be processed when font resources are requested; see Google’s Privacy Policy.
Analytics, advertising and tracking
No analytics, advertising, tag-management, CRM, CAPTCHA, cookie-consent or embedded-video service is named here because none was verified in the supplied staging project or the returned HTML for the staging home and privacy-policy pages. If any such service is enabled, ECI must update this notice and its cookie controls before publication or activation.
Contact and complaints
To exercise your rights or ask a question about this policy, contact David Ferguson, Data Protection Officer / GDPR Officer:
Emerald Cultural Institute
10 Palmerston Park
Rathgar, Dublin 6, Ireland
Phone: +353 1 497 3361
Email: info@eci.ie
If you believe your data-protection rights have been infringed, you also have the right to lodge a complaint with the Data Protection Commission.
Changes to this policy
ECI may update this Privacy Policy and may post a notice when a change is material. Please review this page periodically for current information about how ECI protects personal data.
Live ECI Privacy Statement revision date: 19 December 2024.
General Documents
ECI Quality Assurance Framework Manual
ECI Inclusive and Neuroaffirmative Practice Policy
ECI Marketing & Sales Policy
ECI Gender Pay Gap
ECI Student Complaint and Grievance Policy
ECI Child Safeguarding Statement
ECI Data Management and Protection Policy
ECI Child Protection and Safeguarding Policy