Website Privacy Notice

How we collect and use personal information through caspianschool.ac.uk

Effective date: 24 July 2026 | Review date: 24 July 2027

1. Who we are

Caspian School of Academics Ltd (“CSA”, “we”, “us” or “our”) is the controller of personal information collected through https://caspianschool.ac.uk unless a notice presented at the time of collection says otherwise. We are registered in England and Wales under company number 12677904. Our registered office is Olympic House, 28–42 Clements Road, Ilford, England IG1 1BA.

This notice concerns the public website, online enquiries, newsletter subscriptions, event registrations, applications started through the website and related communications. Additional privacy notices may apply to enrolled students, staff, applicants, alumni, CCTV, safeguarding, complaints, assessment and regulatory reporting.

2. How to contact us

Questions about this notice or requests concerning your information should be sent to the Data Protection Lead at info@caspianschool.ac.uk, by telephone on +44 (0) 20 3576 3423, or by post to the registered office above.

3. Information we collect

identity and contact details, such as name, postal address, email address and telephone number;
enquiry, application and course-interest information, including messages, preferred programme, qualifications and communication history;
account and authentication information where a website account is created;
event, newsletter and marketing preferences, including consent records and unsubscribe requests;
technical information, such as IP address, browser, device, approximate location, referral source, pages viewed, timestamps and security logs;
information supplied in attachments or free-text fields; and
special-category or criminal-offence information only where necessary, lawful and clearly explained at collection—for example, for accessibility support, safeguarding or admissions requirements.

Please do not include medical, safeguarding, financial, identity-document or other sensitive information in a general enquiry unless we have requested it through an appropriate secure channel.

4. How we obtain information

We obtain information directly from you when you browse, contact us, subscribe, register, apply or create an account. We may also receive it from your authorised representative, an education agent, a partner or awarding organisation, a previous institution, UCAS, a funding body, a government authority, or technical and analytics providers. Where information comes from another source, we provide additional privacy information when required.

5. Purposes and lawful bases

Purpose	Information used	Lawful basis
Respond to enquiries and provide requested information	Contact details, message, course interest	Steps at your request before a contract; legitimate interests in providing admissions and support services
Process applications and enrolment steps	Identity, contact, qualifications, application and eligibility details	Steps before a contract; contract; legal obligation where applicable
Operate accounts and online services	Account, authentication and activity records	Contract; legitimate interests in secure service delivery
Send newsletters or electronic marketing	Name, email and preferences	Consent where PECR requires it; otherwise legitimate interests where lawfully available
Deliver events and requested services	Registration, contact and accessibility information	Contract; legitimate interests; explicit consent or another Article 9 condition for special-category data
Secure, troubleshoot and improve the website	Technical, usage, security and diagnostic information	Legitimate interests in security and service improvement; consent for non-essential cookies
Meet legal, safeguarding and regulatory duties	Relevant identity, application, communication and incident information	Legal obligation; substantial public interest or other applicable condition
Establish or defend legal claims	Relevant records and communications	Legitimate interests; legal claims condition where special-category data is involved

Where we rely on legitimate interests, we assess the necessity and balance our interests against your rights. You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

6. Special-category and criminal-offence information

We use this information only where an Article 6 lawful basis and an additional UK GDPR Article 9 condition apply, and where required by the Data Protection Act 2018. Criminal-offence information is processed only with official authority or another lawful condition and appropriate safeguards. The relevant point-of-collection notice will explain the basis.

7. Cookies and similar technologies

We use essential technologies to operate and secure the website. We use analytics, advertising or other non-essential technologies only after valid consent where required. See the Cookie Policy and use the “Cookie Settings” control to change or withdraw consent.

8. Who receives information

Access is limited to staff and authorised personnel who need it. Depending on the service, we may share information with:

website hosting, cloud, email, customer relationship management, form, payment, analytics, security and IT-support providers acting under contract;
awarding organisations, delivery partners, universities, funding bodies and regulators where relevant to an application or programme;
professional advisers, insurers, auditors and debt-recovery providers where necessary;
police, courts, safeguarding bodies, government departments or other authorities where law requires or permits disclosure; and
another organisation involved in a merger, restructuring or transfer, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information.

9. International transfers

Some suppliers may process information outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an approved transfer safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism, and carry out a transfer risk assessment where required. Contact us for information about the safeguard relevant to your data.

10. Retention

Record	Typical retention approach
General enquiries that do not proceed	Up to 24 months after the last meaningful contact
Prospective-student/application records	In accordance with the admissions and student-record retention schedule; unsuccessful application records normally no longer than necessary for audit, complaints and legal claims
Newsletter consent and suppression records	While subscribed; minimal suppression evidence retained after opt-out to respect the request
Account and security logs	Normally 12 months unless needed longer to investigate a security or legal matter
Cookie consent records	For the period needed to demonstrate consent and honour preferences, normally no longer than 24 months
Legal, complaint or safeguarding records	According to the applicable statutory, regulatory and institutional retention schedule

11. Security

We use proportionate technical and organisational measures designed to protect information, including access controls, authentication, encryption where appropriate, supplier due diligence, patching, backups, logging and staff training. No online service is completely secure. If you believe information has been compromised, contact info@caspianschool.ac.uk promptly. We will assess personal-data breaches and notify the ICO and affected people where the law requires.

12. Your rights

Depending on the circumstances, you may ask us to provide access to your information, correct it, erase it, restrict its use, transfer it, or stop using it. You may object to direct marketing at any time and may object to processing based on legitimate interests. You may withdraw consent at any time. You also have safeguards concerning solely automated decisions that produce legal or similarly significant effects.

To exercise a right, email info@caspianschool.ac.uk. We may request proportionate proof of identity. We normally respond within one month, although the law allows an extension for complex or numerous requests. Rights are not absolute, and we will explain any lawful limitation.

13. Complaints

Please contact us first so we can try to resolve the issue. You may also complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; https://ico.org.uk/make-a-complaint/.

14. Children and young people

The website may be used by prospective students under 18. We write privacy information in clear language and collect only what is necessary. A parent or guardian may assist a young person, but the young person’s own data-protection rights remain relevant. We do not use information from children for behavioural advertising.

15. External links and changes

External websites have their own privacy practices. We are not responsible for their content or handling of information. We may update this notice when our services, suppliers or legal duties change. Material changes will be highlighted on the website, and the effective date will be revised.