Two people reading a bochure
©

British Council

We apply the UK Data Protection Act (incorporating the EU General Data Protection Regulation (GDPR)) to all of our global operations unless the local equivalent law is stronger.

The UK Data Protection Act (and GDPR) works in two main ways. It gives individuals rights over how their personal information is used and sets out rules for organisations that process personal information.

Our Information Security and Privacy Policy describes how we treat personal information.

Our Cookies policy describes what cookies we use on our website and there purpose.  

Contact Details

British Council collects and processes personal information for a variety of reasons. If you wish to communicate with us about this privacy notice, or any issue relating to information governance or data protection, please contact us using the following details:

By post:

Information Governance & Risk Management Team
British Council
10 Spring Gardens
London

SW1A 2BN

Telephone: +44 (0)20 7389 4385

Email: InfoGovernance@britishcouncil.org

The British Council’s Data Protection Officer is our Director of Information Governance & Risk Management 

Telephone: (0)20 7389 4385

International transfers

British Council shares personal information within the wider British Council group of entities situated both within and outside the EU. We do this under a data sharing agreement that includes the appropriate EU model international data transfer clauses to make sure your personal information is protected, no matter which entity in the British Council group holds that information.

Where British Council makes transfers of personal information outside the British Council Group to another organisation we rely on the use of the EU model international data transfer clauses where the country the organisation is situated in is not listed as ‘adequate’ by the European Commission. 

Recipients 

We also use other organisations to process your personal information in order to carry out services on our behalf. We use them to:

  • Provide customer service, surveys and marketing
  • Personalise our services
  • Process payments
  • Carry out fraud and other legal investigations

Where we use another organisation, we make sure that your personal information is protected and remains in our control.

We also, in certain situations, share personal information to government bodies and law enforcement bodies. Where we do share personal information with these types of organisations we’ll make sure it’s protected, as far as it is reasonably possible.

Marketing

We’ll use your personal information to send you direct marketing and to better identify products and services that interest you. We do that if you’re one of our customers or if you’ve been in touch with us another way (such as registering to attend a British Council event or entering a competition).

This means we’ll:

  • create a profile about you to better understand you as a customer and tailor the communications we send you (including our marketing messages);
  • tell you about other products and services you might be interested in;
  • try to identify products and services you’re interested in; and

We use the following for marketing and to identify the products and services you’re interested in.

  • Your contact details. This includes your name, gender, address, phone number, date of birth and email address.
  • Information from cookies and tags placed on your connected devices.
  • Information from other organisations such as aggregated demographic data and publicly available sources like the electoral roll and business directories.
  • Details of the products and services you’ve bought and how you use them 

We’ll send you information (about the products and services we provide) by phone, post, email, text message, online banner advertising. We also use the information we have about you to personalise these messages wherever we can as we believe it is important to make them relevant to you.  We do this because we have a legitimate business interest in keeping you up to date with our products and services. We also check that you are happy for us to send you marketing messages before we do so. In each message we send, you also have the option to opt out.

We’ll only market other organisations’ products and services if you have said it is OK for us to do so.

You can ask us to stop sending you marketing information or withdraw your permission at any time.

Retention

British Council retains personal information in line with our corporate retention requirements.  Further details of our corporate retention schedule is available on request via the contact details above. 

Right to access personal information

Under the law any individual has a right to ask for a copy of the personal information held about them. This means that you can ask for the information that the British Council holds about you. This is known as the right of ‘subject access’.

When making a request you will need to give us: 

• a request in writing (by post or by email)

We may need to ask you to provide:

• proof of your identity

• proof of your home address

• any information that we reasonably need to locate the information you have requested (for example details of the British Council offices or staff that you have had contact with and when)

We will not start looking for your information until we receive all of the above. In order to submit your request, or for help making a request, please contact the Information Governance Advisor (Disclosures) at our Manchester office (details below). 

Although you should submit a request in writing, if you would like to speak to someone in person, you can contact the Information Governance Advisor using the following details:

Information Governance Advisor (Disclosures)
British Council
58 Whitworth Street
Manchester
M1 6BB

United Kingdom

Phone: +44(0) 161 957 7624

Email: IGDisclosures@britishcouncil.org

Rights concerning the processing of your personal information

Right to restrict processing of personal information

In some situations, you have the right to require us to restrict the processing of your personal information. We may restrict your personal information by temporarily moving the information to another processing system, making the information unavailable to users, or temporarily removing published information from a website. We may also use technical methods to ensure the personal information is not subject to further processing and cannot be changed. When we have restricted processing of personal information, this will be clearly indicated on our systems.

You can require us to restrict processing in the following circumstances:

  1. You are concerned that the information we hold about you is inaccurate. You can ask us to restrict the information until we are able to determine whether the information is accurate or inaccurate;
  2. We are processing your personal data unlawfully and you do not want us to delete the information but restrict it instead.
  3. We no longer need the information for the purposes for which we collected it, but they are needed by you for the establishment, exercise or defence of legal claims;
  4. You have objected to the processing (see below), and we need to decide whether the legitimate grounds we have to process the information override your legitimate interests.

Processing you think is unlawful

If you tell us that you think we are processing your personal information unlawfully, but you do not want the information to be erased, you have the right to require us to restrict the processing of that information.

We will ask you for an explanation about why you think the processing is unlawful, and may also ask that you provide evidence to support this view.

Processing of personal information you think is inaccurate

You can tell us if you think the personal information we are processing about you is factually inaccurate. You can require us to restrict how we use your personal information until we can verify the accuracy of the information. We will ask you for an explanation about why you think the information is inaccurate, and may also ask that you provide some supporting evidence of the alleged inaccuracy.

If we find that personal information we are processing about you is inaccurate, we will take appropriate steps to correct the information.

Personal information no longer needed by British Council, but needed by you in connection with a legal claim

In most circumstances, we will securely delete or dispose of personal information when we no longer need it for our legitimate business purposes. Our approach to retention is outlined in our corporate retention schedules. 

However, if personal information we no longer need would assist you in establishing, exercising or defending a legal claim, you can require us to keep the information for as long as necessary. We may ask you to provide an explanation and any available supporting evidence that a legal claim is on-going or contemplated. 

Right to erasure of personal data (“the right to be forgotten”)

In the following circumstances, you have the right to require that British Council securely deletes or destroys your personal information:

  • If the personal information we hold about you is no longer necessary for the purposes for which we originally collected it.
  • The processing is based on consent - if you have previously given your consent to British Council collecting and processing your personal information, and you notify us that you withdraw your consent. Please note: withdrawing your consent does not mean the processing of your personal data which occurred before the withdrawal was unlawful.
  • We are processing your personal information for direct marketing purposes, and you want us to stop.
  • If you think British Council has processed your personal information unlawfully.

If you think any of the above situations apply, we may ask you for an explanation and further information to verify this.

Right to object to processing

You have the right to object to the British Council processing your personal data in the following circumstances:

Personal information used for direct marketing

If we are using your personal information to send you direct marketing, you have the right to object at any time. If you exercise this right, we will stop processing your personal information for direct marketing purposes. However, we may keep your information on a “suppression list” to ensure your information is not added to any marketing lists at some point in the future.

Automated decision making and profiling

‘Profiling’ is automated use of personal data held on computer to analyse or predict things which have a legal effect, or other similarly significant effect, on the individual. Examples would include economic situation, health, personal preferences or interests and location. You have the right not to be subject to a solely automated decision (that is, a decision made electronically, with no human intervention), and this may include profiling (although there is no general right to object to profiling). If you are concerned the British Council has made a solely automated decision about you, you can object.

Please note, British Council is allowed to carry out automated decisions with no human intervention where you have given your explicit consent to this processing (although you have the right to withdraw your consent).

We are also permitted to make automated decisions with no human intervention in the following circumstances:

  • The automated decision is necessary to enter into, or perform a contract, or complete a contract involving you and the British Council.
  • The automated decision is allowed under a law passed at European Union level, or at the level of European  Union or EEA member state level (i.e., is allowed under a national law) or UK level. The law will provide safeguards to protect your rights and freedoms.

However, you still have a general right to object in both of the above circumstances, providing reasons why you think the processing is having a negative effect on you. If you do object, we will carefully consider your reasons, and decide whether to review the decision making process in your specific case.

Right to data portability

If you have provided your information to British Council, you have the right to request and receive a copy of that information in a structured, commonly-used and machine-readable format. 

You also have the right to ask us to send the information we hold about you to another organisation.

There are some situations in which the right to data portability does not apply. For further information, please contact: IGDisclosures@britishcouncil.org

Exercising your rights concerning the processing of your personal information

If you wish to exercise any of the above rights concerning the way in which we process your personal information, please contact:

Information Governance Advisor (Disclosures)
British Council
58 Whitworth Street
Manchester
M1 6BB

United Kingdom

Phone: +44(0) 161 957 7624

Email: IGDisclosures@britishcouncil.org

Your right to complain to a national data protection regulator (data protection supervisory authority)

If you think we have processed your personal information unfairly or unlawfully, or we have not complied with your rights under GDPR, you have the right to complain to a national data protection regulator. 

Complaints about how we process your personal information can be considered by the UK data protection regulator, the Information Commissioner’s Office (ICO). The ICO can be contacted using the following details:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

UNITED KINGDOM

Email: casework@ico.org.uk

If you live in a country or territory located in the European Union (EU) or European Economic Area (EEA), and you think that some, or all, of the issues you are concerned about have taken place in your country of residence, you can complain to your national data protection regulator. For contact details of national data protection regulators in the EU and EEA, please use the following link:

http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en....

You should be aware that from 25 May 2018 onwards, the EU or EEA regulator you first contact may not be the regulator that deals with your complaint. They may refer your complaint to another data protection regulator, and a number of regulators may work together to determine the outcome of your complaint. The overall handling of your complaint will be dealt with by a “lead supervisory authority”, which will be allocated during the complaint handling process.

If you live outside the EU or EEA, and the data protection issue you are concerned about relates to the processing of personal data in the country you live in, you may be able to complain to your national data protection or privacy regulator. Details of some national data protection or privacy regulators are detailed in the above link. Alternatively, you may be able to find details of your national privacy or data protection regulator by searching the internet.

If you have a concern about how we have processed your personal data, many data protection/privacy regulators will ask that you contact us first, outlining your concerns, allowing us to try and put the issue right, prior to contacting them with your complaint or concern.

Bulletin and commercial electronic communications

The British Council offers the service of sending regular newsletters which include news, activities and information to users who have requested them through subscription forms provided for this purpose. Users may unsubscribe or change their subscription to this newsletter by using the forms provided for that purpose (baja.lssi@britishcouncil.es / data.protection@britishcouncil.es).

Cookie policy

Our website uses cookies to differentiate between distinct users who access it. A cookie is a small alpha-numeric archive which is stored on the hard drive or in the browser of a computer, tablet, smartphone or similar device when it browses the internet. Cookies allow us to offer relevant information on our products and services and to provide you with a good experience when you browse our website.

The majority of the cookies we use are of the analytic type, which count number of users, help us to understand how they navigate our site and improve the way it works, for instance by making search results more accurate. We also use certain cookies for publicity purposes, so that we can more efficiently manage the presentation of our products on other platforms where users may request services, such as Facebook.

None of our cookies store any personal information such as your name or address Please be aware that restricting cookies may impact on the functionality of the British Council website(s).

What kind of cookies do we use?

  • According to the type of organisation which administers them:

First party cookies: installed by our own website.

Third party cookies: installed by websites which don’t belong to us. For instance, where we include content from Youtube or Flickr on our own website or buttons which users can use to share content on social networks, a user accessing such content from our own website may have cookies added from these third parties. The British Council doesn’t control these third party cookies and so the user must review the cookie policies of these other websites for further information. 

  • According to the length of time they remain active in the user’s system:

Session cookies: collect and store data only whilst the user is visiting the website.

Persistent cookies: remain stored in a computer and may be accessed and managed by the organisation responsible for the cookie for a specific length of time, or until the user deletes it.

  • According to the purpose for which data are collected through the cookies:

Technical cookies: allow the user to make use of the different options they facilitate: for example controlling data traffic and communication, identifying a session, accessing restricted areas, carrying out a purchase, requesting a subscription or participating in an event etc.

Personalisation cookies: allow the user to access services with certain personalised characteristics such as language, browser type, configuration for the region from which the user accesses services etc

Analytical cookies: allow website managers to follow and analyse the behaviour of users on a website so that they can make improvements informed by data analysis on the use of the website by users of its services.

Advertising cookies: help with the management of advertising spaces which a web editor has included on a website where services are offered, based on criteria such as the type of content or the frequency with which the content is shown.

In the table below we detail the type of cookies that we use on our website along with their purpose:

Type of cookie (name) Description
British Council [www-britishcouncil-org-eu-cookie]

A first party British Council cookie set by this site to record that a notice has been shown to site users stating the British Council's cookie policy. The cookie expires after 3 months.

British Council Level Test [QUIZ_LES_RESULT]

A first party British Council cookie used by a British Council level test to store the score of an English test as part of a course selection process. The cookie expires after 3 weeks.

British Council [SESS#####]

A first party British Council cookie used by the British Council's ecommerce platform to enable the sales journey for the user when undertaken. It expires fter the visit session ends.

Webtrends (WT_FPC) (ACOOKIE)

Third party cookies. Webtrends is an independent 3rd party analytics platform that we use on most of our websites to count visitors to our websites and analyse their usage of the site to help us determine the value of our content to our users. The cookies expiration date varies, some expire after the session ends, others after two years.

Akamai[akamai_geo]

A third party cookie used to determine the country in which the site is being accessed in order to serve content specific to the country. The cookie expires after the session ends.

Add This [di, dt, loc, psc,uid,uit, _atuvc]

Third party cookies. The Add This toolbar allows our users to share content from our sites with their friends and contacts through a social networking and bookmarking sites. This service is used on some of our websites and is provided by independent 3rd party suppliers and we do not access to or retain any information using these cookies. The cookies expiration date varies, some expire after the session ends, others after two years.

Google Analytics [_utma, _utmb, _utmc, _utmz, _ga, _dc_gtm_UA......]

Third party cookies. We use Google Analytics, a web analytics service provided by Google, Inc. that we use on some of our websites to count visitors to our websites and analyse their usage of the site to help us determine the value of our content to our users. The cookies expiration date varies, some expire after the session ends, others after two years.

Share This [_stid, _uset, _unam, _stacxiommap, _stamap, _stgmap] Third party cookies set by Share This to enable our users to share content from our sites with their friends and contacts through a social networking and bookmarking sites. This service is provided by independent 3rd party suppliers and we do not access or retain any information using these cookies. The cookies expiration date varies, some expire after the session ends, others after one year.
Double Click [DSID, id, IDE, _sm_au_c] Third party cookies set by Double Click and used on some of our websites to ensure that browsers are not served the same advert multiple times. They do not capture any personal information. The cookies expire after two years.
Optimizely [OptimizelyBuckets, OptimizelyEndUserId, ptimizelySegments, optimizelyPendingLogEvents] Third party cookies set by Optimizely on some of our websites to enable the British Council to display alternate content or presentations to users based on device type, previous interactions or randomly. This is used to test new designs and approaches to improve the experience for our users. The cookies expire after ten years.
KissInsights [ki_r, ki_t] Third party cookies set by KissInsights on some of our websites to enable our users to optionally partake in surveys on the site. The cookies expire after five years.
Disqus [_utmt, _insp_wid, _utmb, _utma, _utmc, _insp_norec_howoften, _utmz, _insp_norec_sess, _insp_nv, _sm_au_c, _insp_ref, csrftoken, disqus_unique, _insp_slim, _insp_targlpt, insp_targlpu, mp_ ... _mixpanel] Third party cookies set by Disqus on some of our websites to enable our users to publically comment on articles and content on British Council sites. The cookies expiration date varies, some expire after the session ends, others after one or two years.
Facebook (datr)

Third party cookies set by Facebook. The cookies expire after one year.

YouTube [Visitor_Info_1_live, APISID, CONSENT, HSID, LOGIN_INFO, PREF, SAPISID, SID, SSID, VISITOR_INFO1_LIVE, YSC] Third party cookies. Cookies are used by a third party, YouTube, to enable our users view Video on the website. The cookies expiration date varies, some expire after the session ends, others after twenty years.
British Council (has_js)

A third party cookie used by the site to detect whether javascript is enabled in order to provide a richer user experience using AJAX. The cookie expires after the session ends.

Facebook Pixels

Third party pixels help us to reach our existing audience on Facebook and supply them with relevant content. These are maintained for between 30 and 180 days.

Turning off Cookies

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. Below are links to the ‘Help’ pages of major browsers which explain how you can do this. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site or any other websites that you visit.

Internet Explorer | Firefox | Chrome | Safari OS X | Opera | Safari iOS (in English) | Windows mobile

You can opt out of Facebook Pixel cookies by visiting the Adverts tab in your Facebook profile settings. You can also sign out of Optimizely variant testing by following these instructions.

If you have any doubts or questions about our use of cookies, please contact: data.protection@britishcouncil.es

Arbitration

These terms are governed by the laws of Spain. Any disputes, controversies or conflicts arising from or relating to the subject matter of this Privacy Policy shall be settled by the Courts of Madrid.

Access to the Web pages of this site implies acceptance of all conditions stated in this legal information.