Privacy Policy

Last updated: 1 October 2026

1. About this policy

This policy explains how we collect and use personal information about students, parents and guardians, agents, host families, teachers and anyone who contacts us. It covers our website at www.roseworthinternational.com, our online accounts and our mobile app.

Roseworth International School Ltd, a company registered in England and Wales, whose registered office is at Torgersens Chartered Accountants, 8 Causey Buildings, Causey Street, Gosforth, Tyne & Wear, England, NE3 4DL (“we”, “us”) is responsible for your personal information as its controller. We trade as Roseworth International School. If you have any questions about this policy or your information, email us at info@roseworthinternational.com.

2. The information we collect

When you contact us. If you send us an enquiry, ask for a brochure or offer to host a student, we receive what you enter on the form. This is usually your name, email address, telephone number and country, the student’s name and date of birth, and your message. An offer to host also includes your town and how many rooms you have.

When you book a course. We collect:

  • the student’s name, date of birth, nationality and gender, and the names and contact details of their parents or guardians;
  • passport or national identity card details: the type of document, its number, expiry date and issuing country, and the name as printed;
  • emergency contact details;
  • the course, dates and accommodation you choose, the student’s level of English and goals, and how you heard about us;
  • health information: medical conditions, allergies, medication, dietary needs and any accessibility or support needs, and any medical forms you send us;
  • travel insurance details you give us, flight and transfer details, and luggage information for airport transfers;
  • the consents and choices you give us, such as parental consent, consent to photographs and your marketing preferences, with the date you gave them.

Payments. We keep a record of what you owe and what you have paid. If you pay by bank transfer, we keep the payment details and any proof of payment you send us. If you pay online, you pay on our payment provider’s own website and we never see your full card number. If we refund you by bank transfer, we ask for the account details to send the money to.

During the course. Attendance records, where the student is staying, records of any incidents or concerns, and photographs and short videos taken during lessons and activities.

If you work with us. If you are a host family, teacher, group leader, guide or agent, we keep your identity and contact details and your bank details so that we can pay you. Where the role involves children, we also keep the results of criminal record (DBS) and other safeguarding checks. For host families, this includes checks on other adults who live in the home, and details of the home itself.

Online accounts and our app. Your sign-in details, any documents and photographs you choose to upload, and a notification token so that the app can send you updates about the course. If you turn on Face ID or fingerprint sign-in, the check takes place on your device and we never receive your biometric data. Our security logs record IP addresses and browser details, for example when someone fails to sign in.

Where the information comes from. Most of it comes from you. If a parent, guardian or agent books for a student, the student’s details come from them. Our staff add information during the booking and the course, such as flight details and attendance.

3. Why we use it, and our legal basis

  • To carry out our contract with you: to handle your booking, arrange teaching, accommodation and transfers, take payments and keep in touch with you about the course. If you do not give us the information we need for this, we may not be able to accept the booking.
  • To meet our legal obligations: for safeguarding, visa support, and accounting and tax records.
  • For our legitimate interests: to reply to enquiries, keep our systems secure, prevent fraud and misuse, and improve our services. We rely on this only where our interests are not outweighed by yours.
  • With your consent: for website analytics, marketing emails, and using photographs of students in our marketing. You can withdraw your consent at any time. This does not affect anything we did before you withdrew it.

Health information is a special category of personal information. We use it to keep the student safe, with the explicit consent of the student or their parent or guardian, or where it is needed to protect someone’s life or health in an emergency. We use the results of criminal record checks to safeguard children, as UK data protection law allows.

4. Who we share it with

We do not sell personal information. We share it only where we need to:

  • People involved in the course. Host families, teachers and group leaders receive only what they need to look after the student, such as dietary needs or relevant medical information. If an agent made the booking, the agent can see that booking.
  • Our service providers, who act on our instructions under contracts that require them to protect your information:
    • Supabase, which stores our database and manages account sign-in;
    • Vercel, which hosts our website and, if you accept analytics, counts visits and measures page speed;
    • Resend, which sends our emails;
    • Cloudflare, which checks that our forms are sent by a person, to stop spam;
    • Google, which shows the map on our contact page;
    • Sentry, which tells us when something goes wrong on our website or app;
    • Expo, Apple and Google, which deliver notifications from our app;
    • OpenAI, which produces the replies in our AI chat assistants, where we offer them (see section 9);
    • PostHog, for website analytics, where we use it and only if you accept analytics.
  • Payment providers. Revolut, our bank, receives payments made by bank transfer. Flywire processes online payments on its own website, and its own privacy policy applies to what you enter there. Where we offer card payment on our own website, it is processed by Stripe.
  • Authorities. Visa authorities, safeguarding agencies, the police or other public bodies, where the law requires it or to protect someone from harm.

5. Information sent outside the UK

Our database is stored in London. Some of our service providers are based in the United States or elsewhere, or their staff can access information from outside the UK. When personal information leaves the UK, we make sure it is protected, either because the UK government has approved the country or arrangement (including the UK Extension to the EU-US Data Privacy Framework) or by contract terms approved for that purpose. Email us if you would like more detail.

6. How long we keep it

We keep personal information only for as long as we need it for the reason we collected it, and for as long as the law requires. In particular:

  • passport and identity document details are deleted 90 days after the course ends;
  • bank details you give us for a refund are deleted 30 days after the refund is paid;
  • copies of criminal record check certificates are deleted 90 days after the check is decided, and we keep a record of the outcome;
  • a host family’s personal details are removed 24 months after their last student stays with them;
  • AI chat conversations are deleted 12 months after they take place;
  • security and audit records are generally kept for 2 years;
  • financial records are kept for at least six years, as UK tax law requires;
  • booking and student records are kept for as long as we need them to run the course and to meet our safeguarding and legal obligations, and are then deleted or anonymised;
  • enquiries are kept until we no longer need them to deal with your enquiry.

7. Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete your information, unless we have to keep it by law;
  • ask us to limit how we use your information, or object to how we use it;
  • ask us to give you information you have provided to us in a common electronic format, where the law gives you that right;
  • withdraw your consent at any time, where we rely on consent.

Children can exercise these rights themselves once they are old enough to understand them. In England and Wales this is usually from about the age of 12.

To use any of these rights, email info@roseworthinternational.com. We will reply within one month, and there is normally no charge. If you are unhappy with how we have used your information, please tell us first so that we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

8. Cookies and analytics

We use a small number of cookies that our website needs to work. We use analytics only if you accept it on our cookie banner, and never if your browser sends a Do Not Track or Global Privacy Control signal. Our Cookie Policy gives the details.

9. Our AI chat assistants

Where we offer them, the chat on our website and the chat for signed-in parents in our app are answered by an AI assistant, not by a member of staff, and they are labelled as such. The answers can be wrong, so please check anything important with our team.

Before the website assistant answers, we ask for your name and email address and send you a code to confirm the address. Nothing is sent to the assistant until the address is confirmed, and you can contact us directly instead. If you then ask our team to get in touch, we also ask for the student’s name and date of birth and the places and dates you are interested in, so that we can check which courses suit them.

The chat in our app can see your own family’s booking details, such as your child’s name, course, dates, booking reference and payments, so that it can answer questions about your booking. It cannot see anyone else’s information, and it cannot change a booking or take a payment.

To produce a reply, the conversation is sent to OpenAI, which processes it on our instructions and does not use it to train its models. We keep conversations for 12 months so that our team can follow up and check the quality of the answers.

No decision about you is made by the AI. Whether a student can join a course, what it costs and whether a booking is accepted are decided by our rules and our staff. If you ask to speak to a person, our team will reply by email.

10. Children

Our courses are for students aged 9 and over in the UK and Toronto, and 12 and over elsewhere. Adult courses are for people aged 16 and over. For any student under 18, a parent or guardian makes the booking and manages it. We keep safeguarding records for students who stay with host families.

11. Keeping your information safe

We encrypt information when it is sent and when it is stored. Staff can see only what their role needs, and we keep a record of changes made in our administration system. If a data breach is likely to put people at risk, we report it to the Information Commissioner’s Office within 72 hours, and we tell anyone affected without undue delay if the risk to them is high.

12. Changes to this policy

We update this policy when the way we use personal information changes. The date at the top shows when it last changed. If we make an important change, we will tell the people it affects.

13. Contact us

Roseworth International School Ltd
INTO Newcastle University
Newcastle upon Tyne
NE1 7RU
United Kingdom
Email: info@roseworthinternational.com
Telephone: +44 7386 371570