This notice explains how ISCA Limited uses information about students, parents and guardians, school contacts, chaperones and other people involved in ISCA Global 2027. It covers preparation, booking, travel, the residential programme, safeguarding, genuine photographs and follow-up. ISCA does not currently put identifiable student or family information into generative AI tools.

1. Who is responsible and how to contact us

ISCA Limited (company number 01605416) is responsible for the personal information it uses to organise and deliver its programme. Our registered office is c/o George Hay & Company, 83 Cambridge Street, Pimlico, London SW1V 4PS. Website: www.iscaschools.com.

For privacy questions or to exercise your rights, families may contact ISCA through their school or group organiser, or email ISCA directly at info@iscaschools.com. A school may be separately responsible for information it collects and decides to share with us; its own privacy notice also applies.

Our website may link to third-party sites, plug-ins or applications. Those services may collect information under their own privacy notices; please review them when leaving our site.

2. Whose information we use and what we collect

• Students: identity, date of birth, nationality, passport and travel-document details, school and group, contact details, rooming and activity arrangements, attendance, photographs and recordings, and information needed to support wellbeing and participation.
• Parents and guardians: identity, contact details, relationship to the student, emergency contacts, booking and payment records, communications and preferences about photography and publicity.
• School staff, chaperones and other adults: identity, contact and role details, travel and accommodation arrangements, professional communications, and information needed for safer recruitment or programme duties where applicable.
• Sensitive information where necessary: health, disability, accessibility, dietary and allergy information; prescribed medication arrangements; and safeguarding or conduct information. We restrict access to these records.
• Website and online services: technical information such as IP address, device and browser details, and cookies where collected.

Our website uses cookies for functions such as the booking and payment process. It may also use analytics and cookies set by embedded content or social media services. You can find more information on our cookies page. Blocking essential cookies may prevent parts of the website from working.

We ask for information that is reasonably needed for the stated purpose. Please tell us through the agreed registration route if information changes. If essential information is not provided, we may be unable to confirm or safely deliver a place.

3. Where information comes from

We receive booking and contact information from parents, students, nominating schools, group organisers and chaperones. Before the residential programme, the School collects relevant dietary and medical information about its students and accompanying chaperones and sends ISCA the details needed to deliver the programme safely. This may include allergies, prescribed medication and medical conditions. The School’s chaperones also hold the information they need during the Trip. We may also receive relevant information from travel, accommodation, medical and other programme providers or public authorities, and create attendance, incident and photographic records.

4. Why we use information and our legal bases

The appropriate legal basis depends on the particular use. We do not treat acceptance of programme terms as blanket consent to every use of personal information.

Booking and programme delivery

We confirm eligibility and price, and administer registration, payments, travel, accommodation, activities and family communication. Basis for processing: our contract with the parent or guardian; legitimate interests in coordinating with schools and protecting students where the contract does not apply.

Health and accessibility

We plan safe participation, adjustments, meals, medication and emergency care using relevant details supplied by each School before the residential programme. Access is limited to ISCA team members who need the information for their role, and relevant details may be shared with medical professionals where necessary. Basis for processing: contract or legitimate interests as relevant; vital interests may apply in an emergency.

Safeguarding and welfare

We record and respond to concerns about a student’s safety or welfare, manage serious conduct incidents, and share relevant information with the School, safeguarding professionals or authorities when needed. We use this information to protect students and meet our safeguarding responsibilities. Our legal basis for routine safeguarding work is our legitimate interest in protecting students and others. We may also process or share information to comply with a specific legal duty, or to protect someone’s vital interests in an emergency.

Payments and records

We receive payments, keep accounting records and handle complaints or claims. Basis for processing: contract, legal obligation and legitimate interests in establishing or defending claims.

Genuine photos and recordings

We use genuine photographs and recordings to identify students, document programme activities and share appropriate updates with participating families and schools. We may also use suitable images in brochures and other publicity to show prospective families and schools what ISCA programmes are like. Families can opt out of publicity use through the School as explained in section 6 and clause 7 of our Terms.

Basis for processing: our contract with parents where images are needed to deliver the programme; otherwise, our legitimate interests in documenting the programme and explaining it to prospective families. For publicity, we consider the privacy and interests of the children shown and follow any written opt-out received through the School.

We may occasionally use parent or guardian contact details to share information about future ISCA programmes where they have agreed to receive it, or where the law permits us to contact existing customers about similar programmes. Every promotional message will explain how to opt out.

Basis for processing: consent where required; otherwise our legitimate interest in informing existing families about similar programmes, subject to their right to object.

Service improvement and security

We maintain secure systems, understand programme performance and respond to misuse. Basis for processing: legitimate interests in keeping our systems secure, improving the programme and responding to misuse, subject to the rights of the people whose information we use and the rules on cookies.

If we propose a new use that is compatible with the original purpose, we will assess and document it. We will explain an unrelated new purpose and its legal basis before beginning that use, unless the law permits or requires otherwise.

5. Children and sensitive information

Our students are usually aged 12 to 15. We take particular care with their information. Health, safeguarding, conduct and private family information is shared only with those who need it for a defined purpose. Safeguarding records follow ISCA’s Safeguarding and Child Protection Policy and are not placed into generative AI tools. Child-related AI incidents must be referred to Freya Liddle, ISCA’s Designated Safeguarding Lead, under that policy; concerns about staff follow its staff-allegation route. Where an urgent situation makes sharing necessary to protect a child, we may share relevant information with medical professionals, safeguarding agencies or police.

6. Photographs, video and artificial intelligence

ISCA may take and conventionally edit genuine photographs and recordings for the purposes described above. Under clause 7 of the 2027 Terms, parents who do not want their child’s images used for marketing must tell ISCA in writing via the School before the Trip. The School passes that choice to ISCA, which records and follows it. Parents may later use the same route to request that future use stops and images are removed from ISCA-controlled materials where practicable.

ISCA does not supply an identifiable child’s photograph, video, voice or likeness to a generative AI system to create, alter, animate or synthesise that child. Photography or publicity permission does not override this rule. ISCA may use non-identifying AI assistance for drafting, research and design. ISCA does not currently enter identifiable student or family information into generative AI tools. Approval of an AI tool alone does not permit such use: any future proposal requires a documented purpose, lawful basis, data minimisation, provider and transfer review, security controls, an updated privacy notice where necessary, and human oversight before processing begins. ISCA does not make safeguarding decisions about a student solely by AI.

7. Who receives information

We share only what is necessary with the nominating school and group organiser; accompanying chaperones and ISCA staff; airlines, coaches, accommodation, venues and activity providers; payment and IT providers acting under appropriate arrangements; insurers and professional advisers; and medical professionals, safeguarding partners, law enforcement or regulators where needed. A school and ISCA may each have their own responsibilities for the information they decide to collect and share. We do not sell personal information.

8. International handling

ISCA works with schools and families outside the UK. To arrange and deliver a student’s participation, we may share necessary information with their school, accompanying chaperones, airlines and other travel providers outside the UK.

We use IONOS to host our website, Axlr8 for email, Google Drive for file storage, and Protected Payment Services to process card payments through our WooCommerce checkout. Some of these providers may process or allow access to information outside the UK.

Where we transfer personal information outside the UK, we will use an arrangement permitted by UK data protection law. You can contact us at info@iscaschools.com for information about the arrangement used for a particular transfer.

9. Security and retention

We limit access by role, use appropriate technical and organisational security, and require service providers to protect information and maintain confidentiality. Staff must promptly report a suspected loss or disclosure. We will notify affected people and the regulator where legally required.

We set retention periods by considering the purpose, sensitivity, risks and legal requirements. Our standard periods, measured from the end of the relevant programme unless otherwise stated, are:

• Passport details and routine travel documents: 6 months.
• Routine registration, rooming, attendance, medical and parent communications: 12 months.
• Unsuccessful enquiries or registrations: 12 months after last contact.
• Payment and accounting records: 6 years from the end of the relevant financial year.
• Complaints and significant incidents: 6 years after closure.
• Child protection and safeguarding files: at least until the student’s 25th birthday.
• Records concerning child sexual abuse: until the student’s 75th birthday, subject to safeguarding retention review.
• Promotional photographs and film: while actively used, reviewed at least every 3 years.

Records may be kept longer for an active safeguarding matter, complaint, claim or legal duty. At the end of the applicable period, we securely delete or anonymise them.

10. Your rights

Depending on the circumstances, you and your child may request a copy of your information, correction of inaccurate information, erasure, restriction of use, or transfer of eligible information in a commonly used format. You may object to processing based on legitimate interests, including any direct marketing, and withdraw consent for future use where consent is the basis.

These rights have legal exceptions, particularly for safeguarding, legal duties and claims; we will explain if an exception applies. Requests are normally free, although a reasonable fee or refusal may apply to manifestly unfounded or excessive requests. We may ask for proof of identity and further details to protect your information. We normally respond within one month and will explain any lawful extension. Contact us using section 1. You may complain to the Information Commissioner’s Office at ico.org.uk.

11. Changes to this notice

We will review this notice when our programme, suppliers, AI use or legal obligations materially change. The version supplied to families at registration should explain the processing then in use. A material new use of personal information should be explained before it starts.

ISCA Limited 29/09/26