How we acquire data
Student information is given to us by parents/guardians or educational agencies that are instructed by parents/guardians of each student.
Information we hold includes, but is not limited to:
- Full names or parents/guardians & students
- Home Address
- School Address
- Contact Details
- Medical Information
- Passport Information
- Image of student ID (Photo page of passport)
Host Family information is supplied to us by host family themselves during the online application.
Information we hold, includes but it not limited to:
- Full names of all household members
- Full names of all regular household guests
- Home Address
- Contact Details
- Medical Information (if a medical request is submitted by social services)
- Enhanced DBS Information
- Proof of ID as required for Enhanced DBS application
- Photos of family members
- Photos of the homestay property
The primary member of the host family maintained visibility and control of their data at all times via MyWHG portal.
Sharing your data
Students data is shared with schools and potential host families only, except in the event of a safeguarding risk or medical emergency where it may be shared with local services such as medical or social care.
Host Family data is sent to prospective students’ parents/agents where the student is expected to stay with the host family.
WHG does not share any data with any 3rd party, without permission and no data is ever sold.
Storing your data
Our office is completely paperless. Any physical documents that arrive are scanned into our network storage and the originals are shredded immediately.
Any original documents that need to be returned to their owner are sent on the day of receipt. If the post collection has been missed, then they are securely stored until the next working day.
All scanned documents are stored in our dedicated servers.
Any other information not stored in the form of a document image eg. information given during online application, is stored in our database.
All hardware is owned, built, maintained and managed by WHG.
WHG Servers and their drives are all encrypted with 256bit AES encryption. The WHG networks are housed behind hardware firewalls connected by VPN encrypted with 256 AES encryption.
Retention period of information
For students, our retention period is the length of time a student is under our guardianship plus 7 years from leaving as all records are integrated within our accounts information.
For host families, all supplied information is stored on our network. Host families manage their information on our system through the MyWHG Portal.
If the host family are no longer hosting, their information is removed from public view and only visible to the data protection handler.
The host family information is also integrated in the same way as students and therefore needs to be held for a minimum of 7 years.
After 7 years of inactivity, the data held for students and host families is automatically deleted.
WHG servers including the data stored on them, are backed up to offsite storage owned and maintained by WHG. The backup storage is held at an undisclosed secure location, on encrypted drives inaccessible to anyone except the Technical Partner in the case of a disaster recovery.
Your rights - The GDPR includes the following rights for individuals:
- the right to be informed: WHG is committed to fair processing of information, this is through our privacy notice on how your data will be kept and stored.
- the right of access: At any time, anyone may request the data that we store and how it is processed. Information will be shared without delay and within one month. This can be extended if agreed by both parties and the request(s) are complex or numerous.
- the right to rectification: If there are any inaccuracies in the information we are given, we shall let all parties’ privy to the information know of the mistake and update them accordingly.
- the right to erasure: Once a contract has ended with WHG, students and host families have the ‘right to be forgotten’, and all data will be deleted in accordance with the above policy. This means that we would erase all their data from our records, after 7 years of inactivity. Once a student becomes 16, they have the ‘right to be forgotten’ and can request this themselves.
- the right to restrict processing: If data appears to be inaccurate, it will not be processed until verified. If processing the data becomes unlawful, processing will be restricted but not erased.
- the right to data portability: WHG does not fall under this category and data is not used commercially.
- the right to object: WHG may use data internally for marketing purposes, both text and photos. Everyone has the right to object to their information being used in this way. Simply let us know by emailing email@example.com
- the right not to be subject to automated decision-making including profiling: This does not apply as no decision is made electronically and all data is handled by someone from WHG.
Charges – There are no charges to store or have access to your data.
Infringement – WHG has a duty to protect your data. If you believe there has been a breach of data protection, we suggest first contact our Data Protection Officer James Hume by calling +44 8458 686 688. If you are unsatisfied with the outcome of our internal investigation, please contact the Information Commissioner’s Office (ICO) +44 303 123 1113