Clear information about how we collect, use, share, and protect personal information.

Organisation

Cultural Exchange Homestays

Contact

Info@culturalexchangehomestays.com| 07577065377  |  320 City Road, London EC1V 2NZ

​

1. Who we are

Cultural Exchange Homestays arrange homestay accommodation for students taking part in educational and cultural exchange activities. We also offer support for English exams in partnership with Trinity College London We are the data controller for the personal information described in this notice unless we explain otherwise.

We are committed to handling personal information lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK laws.

 

2. Who this notice applies to

• Host families and adult household members

• Students, including students under 18

• Parents, guardians and emergency contacts

• Schools, colleges, educational agents and programme partners

• People who contact us or use our website

​

3. Information we collect

We collect different types of personal information depending on your relationship with us. This may include the categories listed below, where relevant and necessary for the service we provide. We do not collect every category from every individual.

 

Hosts and household members

• Contact details, such as name, address, telephone number and email address

• Identity information and evidence, where needed to assess or verify a host or adult household member

• DBS check information and safer-placement information, where required for host assessment and placement suitability

• Household and accommodation information relevant to a placement, such as household occupants, pets, facilities, dietary arrangements and availability

• Payment information, such as bank details and payment records

• Operational records, such as host agreements, placement history, communications, feedback, complaints and incident records

• Photographs, where needed and where there is a suitable lawful basis

Students, parents and guardians

• Contact and identifying details, such as name, date of birth, nationality and contact information

• Travel and identity information, such as passport, visa or travel details, where needed for the programme

• School, college, agent and programme information

• Parent, guardian and emergency contact details

• Travel, arrival, departure and placement details

• Health, allergy, dietary, disability or accessibility information where necessary for a safe and suitable placement

• Communications, feedback, complaints and incident records

 

Schools, agents and partners

We may collect staff names, business contact details, organisation details, contracts, booking information, placement instructions, and programme communications.

We may also collect other information you choose to provide to us, or that we create while arranging, managing or reviewing a placement, where it is relevant to the purposes explained in this notice.

 

4. How we obtain information

We receive information directly from hosts, parents, or guardians. We may also receive it from schools, colleges, educational agents, programme partners, referees, DBS checking providers, public authorities, and service providers. We may create records when we assess hosts, arrange placements, or communicate about a programme.

 

5. Why we use information and our lawful bases

• Recruit, assess and manage hosts; arrange and administer homestay placements (Contract and legitimate interests)

• Communicate with hosts, students, parents, schools, agents and partners  (Contract and legitimate interests)

• Carry out identity, DBS and safer-placement checks; protect individuals and respond to incidents (Legal obligation, legitimate interests and, in urgent cases, vital interests)

• Process host payments, fees and accounting records (Contract and legal obligation)

• Manage complaints, disputes, insurance matters and legal claims (Legitimate interests and legal obligation)

​

6. Children’s information

Our services may involve students under 18. We use children’s personal information only where it is necessary to arrange and administer a suitable homestay placement, communicate with relevant parties, protect the student or others, and meet applicable legal or contractual requirements. We use clear language, limit collection to what is needed and apply appropriate access controls.

​

7. Who we share information with

• The relevant host, student, parent or guardian

• Schools, colleges, educational agents and programme partners

• DBS checking providers and other screening or verification providers

• IT, communications, payment, accounting and document-storage providers acting on our instructions

• Professional advisers, auditors and insurers

• Police, local authorities, regulators, courts or other bodies where disclosure is required or permitted by law

We share only the information reasonably required for the purpose. We do not sell personal information.

 

8. International transfers

Because our programmes involve overseas students, schools, agents or parents, personal information may be transferred outside the UK. Where UK data protection law requires safeguards, we will use an approved transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and apply additional measures where necessary. Contact us if you would like further information about the safeguards used for a particular transfer.

​

9. How long we keep information

We keep personal information only for as long as it is needed for the purpose collected, and to meet legal, accounting, contractual, insurance and safeguarding-related obligations or to establish, exercise or defend legal claims. Our standard periods are set out below and may be shortened or extended where a documented reason applies.

​

• Core host agreement, placement and relationship records (Up to 6 years after the hosting relationship ends)

• Core student placement records (Up to 6 years after the programme or placement ends)

• Financial and payment records(Normally 6 years, subject to applicable tax and accounting rules)

• Identity document copies (Deleted when verification is complete and no longer needed, unless retention is justified)

• DBS information (Only the minimum evidence needed and only for as long as justified under applicable DBS and data protection requirements)

• Complaints, incidents, disputes or legal claims (For the relevant limitation, investigation or claim period)

• Marketing preferences (Until consent is withdrawn, an objection is made, or the information is no longer needed)

 

Records scheduled for deletion may be retained for longer if they are subject to a legal hold, active complaint, investigation or claim. When records are no longer required, we securely delete or anonymise them

 

10. Security

We use appropriate technical and organisational measures to protect personal information from accidental or unlawful loss, misuse, alteration, disclosure, or access. Measures include access controls, secure storage and transfer methods, staff confidentiality requirements, supplier checks, and incident management arrangements appropriate to the risks involved.

​

11. Your data protection rights

Depending on the circumstances, you may have the right to:

• Ask for access to your personal information

• Ask us to correct inaccurate or incomplete information

• Ask us to erase information

• Ask us to restrict how information is used

• Object to processing based on legitimate interests or to direct marketing

• Receive certain information in a portable format

• Withdraw consent at any time where we rely on consent

• Ask for human review of a solely automated decision that has a legal or similarly significant effect

These rights are not absolute and legal exemptions may apply. We may need to confirm your identity before responding. To exercise a right, contact us using the details at the start of this notice.

​

12. Automated decision-making

We do not currently make decisions about individuals using solely automated processing that produces legal or similarly significant effects. If this changes, we will provide the information required by law.

​

13. Complaints

Please contact us first if you have a concern so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Visit www.ico.org.uk or telephone 0303 123 1113. If you are outside the UK, you may also have the right to contact your local data protection authority.

​

14. Updates to this notice

We may update this notice when our services, data use, or legal requirements change. The latest version will be published on our website or otherwise made available to the affected people.

​

Document control

Document owner

S Gay

Version

1.0

Approved

24/9/2026

Next review

24/09/2027