Privacy policy

Who the data controller is

Imagine1world Ltd, Piccadilly Business Centre, Blackett Street, Manchester M12 6AE, United Kingdom, company registration number 14577985. For any request concerning your data, including the exercise of the rights described below, the address is info@imagine1world.com.

What data we process

In providing our services we process the following categories of data, relating both to the person signing the contract — usually the parent or whoever holds parental responsibility — and to the participating minor.

• Personal and contact details: first name, surname, date and place of birth, tax code, address, telephone, email.
• Identification details contained in identity or travel documents: identity card, passport, visa where applicable.
• Family details and emergency contacts.
• Health data: food intolerances or allergies, particular dietary requirements, ongoing treatments, necessary to ensure the minor’s safety during the stay. These are a special category of data under Article 9 of the Regulation.
• Data on schooling and language level, used to place the student with the institution or the host family.
• Banking and payment details, necessary for the administrative and accounting management of the contract.
• Photographs and audiovisual recordings made during activities and stays, only where the relevant consent has been given.

Where the data comes from

Data is collected directly from the data subject or from whoever holds parental responsibility, at the time of the information request, the enrolment or the signing of the contract. We do not buy data from third parties and we do not gather it from other sources.

Why we process it, and on what legal basis

Providing the data needed to perform the contract and to comply with legal obligations is mandatory: without it, the enrolment cannot be accepted and the service cannot be delivered. Providing data for promotional purposes and for photographs and videos is optional, and withholding consent does not affect participation in the stay in any way.

Managing the enrolment, delivering the service and organisational communications with the family and the participant

Art. 6(1)(b) — performance of a contract or pre-contractual measures

Administrative, accounting, tax and insurance obligations connected to the contract

Art. 6(1)(c) — legal obligation

Processing of health data: allergies, intolerances, treatments, medical conditions relevant to the stay, and religious dietary requirements where indicated

Art. 9(2)(a) — explicit consent of whoever holds parental responsibility

Organising travel, accommodation with host families or in residences, and enrolment with partner schools and language providers

Art. 6(1)(b) — performance of the contract

Promotional communications about similar initiatives and programmes

Art. 6(1)(a) — freely given, optional consent

Taking and publishing photographs and videos of the stay for promotional purposes, on the website, in information materials and on social media

Art. 6(1)(a) — freely given, optional consent, withdrawable at any time

Handling any disputes and protecting the controller’s rights

Art. 6(1)(f) — legitimate interest of the controller

How we process it

Processing is carried out using manual, electronic and telematic tools, with logic strictly related to the stated purposes and in a way that ensures security and confidentiality, in accordance with the technical and organisational measures set out in Articles 5 and 32 of the Regulation. We do not carry out automated decision-making or profiling producing legal effects on the data subject within the meaning of Article 22.

Who else sees the data

For the purposes stated above, data may be disclosed, strictly as relevant, to the parties listed here, acting as separate controllers, processors or authorised persons. Data is not disseminated, except for photographs and videos where specific consent has been given. We do not sell data to anyone and we do not use it for third-party advertising.

• Partner schools, language institutes, colleges and universities, in Italy and abroad, where the stay takes place.
• Host families and accommodation providers — residences, campuses, hotels — hosting the participant.
• Air, rail and road transport companies, and travel agencies involved in the arrangements.
• Insurance companies, for medical cover, accidents and trip cancellation.
• Consultants, professionals and banks, for administrative, accounting and tax obligations.
• Public authorities and supervisory bodies, where required by law.
• IT and hosting providers, acting as processors under Article 28 of the Regulation. In particular Google, where enrolments are recorded, and Aruba, which handles the agency’s email.

Transfers outside the European Economic Area

Our stays also take place in countries outside the European Economic Area — the United Kingdom, the United States, Canada, the United Arab Emirates — so some data is transferred to host families, schools and partner organisations located there, strictly as needed to arrange and run the stay. The same applies to our IT providers. These transfers are made either to countries covered by an adequacy decision of the European Commission under Article 45, or, failing that, on the basis of the safeguards provided for in Article 46, in particular the Standard Contractual Clauses approved by the Commission. A copy of the documentation may be requested at the address given in the first section.

How long we keep it

Data is kept for as long as is strictly necessary for the purposes for which it was collected, and in particular:

• Data relating to the performance of the contract: for the duration of the relationship and, afterwards, for the period required by the applicable civil and tax law, normally ten years from the end of the relationship.
• Health data: solely for the duration of the stay and for the time needed to handle any administrative or insurance consequences, unless a different legal obligation applies.
• Data processed on the basis of consent, such as photographs and videos: until that consent is withdrawn.

Cookies and the saved draft

This site uses no profiling cookies, has no analytics and loads no third-party resources — not even the fonts, which are hosted here. While you fill in the enrolment form, however, your browser keeps a draft of what you have written, so that it is not lost if you close the page to go and fetch a passport. That draft stays on your device, is never sent to us, deletes itself after seven days and disappears once the enrolment is submitted. You can remove it at any time by clearing the site data in your browser.

Data relating to minors

Almost all our participants are under 18. Their data is processed on the basis of the consent and the information provided by whoever holds parental responsibility, who signs the contract and this notice on the child’s behalf too. We take particular care with this data, limiting its use to what is strictly necessary to ensure the safety, the support and the success of the stay. Consent to the publication of photographs and videos is separate and optional: the enrolment is valid without it, and it can be withdrawn at any time.

Your rights

As a data subject, or as the person holding parental responsibility for the child, you may exercise at any time, within the limits and conditions of Articles 15 to 22 of the Regulation, the rights listed here. Requests are sent to the address given in the first section: no form is needed, an email is enough. We reply without undue delay and in any case within one month of receipt, save for extensions in the cases provided for.

• Access to the personal data concerning you (Art. 15).
• Rectification of inaccurate data and completion of incomplete data (Art. 16).
• Erasure of data, in the cases provided for by law (Art. 17).
• Restriction of processing (Art. 18).
• Portability of data processed by automated means on the basis of consent or of the contract (Art. 20).
• Objection to processing based on legitimate interest (Art. 21).
• Withdrawal at any time of the consent given, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

Complaint to the supervisory authority

Without prejudice to the right to go to court, anyone who believes that the processing of their data breaches the law may lodge a complaint with the Garante per la protezione dei dati personali, the supervisory authority in Italy, in the manner set out at www.garanteprivacy.it, or with the corresponding authority of the country where they live or work, or where the alleged breach took place.

Changes to this notice

We may amend or update this notice, in whole or in part, including as a result of changes in the applicable law. Changes will be announced with reasonable notice, by publication on this site or by direct communication, and will take effect from the moment of publication. The date at the foot of the page always indicates the latest revision.