Legal
Privacy Policy
Last updated: 20 July 2026
Who we are
The data controller for the personal data described in this Policy is RTL English Ltd (“we”, “us”, “our”). The Site is intended for use by adults representing organisations. We do not knowingly collect personal data from children.
We have assessed our processing activities and determined that the appointment of a Data Protection Officer is not required under Article 37 of the GDPR. If you have questions about how we handle your data, contact us using the details in the “Contact” section below.
Personal data we collect
When you submit an application through the Site, we collect the fields you fill in: name, email, organisation, country, organisation type, website, current reach, motivation, plus the territory region selected from the map. We also collect standard HTTP metadata: hashed IP address (SHA256, salted), user agent, referrer URL, and UTM parameters.
We do not collect payment data on this Site (no transactions occur here), and we do not collect health data on this Site (the curriculum is delivered in English at v1 and we do not ask health questions during recruitment).
How and why we use your data
| Purpose | Legal basis |
|---|---|
| Evaluate your application | Pre-contractual steps (GDPR Art. 6(1)(b)) |
| Respond to your enquiry | Pre-contractual steps (GDPR Art. 6(1)(b)) |
| Operate the Site and prevent abuse | Legitimate interest (GDPR Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (GDPR Art. 6(1)(c)) |
Your privacy rights
Depending on your location, you may have the following rights:
- Right to access (Art. 15 GDPR): request a copy of the personal data we hold about you.
- Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR): request deletion of your personal data (subject to legal exceptions).
- Right to restriction of processing (Art. 18 GDPR): limit how we use your data.
- Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format.
- Right to object (Art. 21 GDPR): object to processing based on legitimate interests.
- Right to lodge a complaint: with the Information Commissioner’s Office (ICO) at ico.org.uk, or with the supervisory authority in your country of habitual residence.
US state privacy rights: California residents have rights under the CCPA/CPRA to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information. Several other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Delaware, and others) have similar rights to the extent required by applicable law.
International data transfers
Application data is stored in a Supabase Postgres database hosted in the United States. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards (Standard Contractual Clauses or equivalent) for the transfer.
Data retention
We retain application data for 24 months from the date of submission unless you ask us to delete it sooner, or unless we enter into a master-licence agreement with you (in which case retention follows that agreement).
Data security
We protect your data with industry-standard safeguards: TLS in transit, RLS (Row-Level Security) on the database, hashed IP addresses (we never store raw IPs), and access controls limited to operators with a business need. No system is perfectly secure; if a breach affects your data, we will notify you where required by applicable law.
Cookies and tracking
This Site does not set marketing cookies and does not load third-party advertising pixels. We may load Google Tag Manager and Google Analytics in a future release; this Policy will be updated before any such load and a consent banner will be shown where required by law.
Changes to this Policy
We may update this Policy from time to time. The “Last updated” date at the top of this page will reflect any change. Material changes will be communicated to active applicants by email.
Contact
Privacy questions or data-subject requests: partners@rtlenglish.com. We acknowledge data-protection requests within 3 business days and provide a substantive response within 30 calendar days, as required by UK GDPR and CCPA/CPRA.