1. Who We Are
1.1 BridgeLang UK Ltd provides an online marketplace connecting independent teachers and students for language tuition delivered online and, where chosen by users, in person.
1.2 Company number: 16555217 • Registered address: The Apex, Derriford Business Park, Brest Road, Plymouth, PL6 5FL, United Kingdom • Contact: contact@bridgelang.co.uk
1.3 Role: BridgeLang UK Ltd is the data controller for personal data processed via the Platform.
2. Scope and Applicability
2.1 This Policy explains what personal data we collect, how and why we process it, the legal bases we rely on, how long we keep it, who we share it with, international transfers, your rights, and how to contact us.
2.2 We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where applicable, we also comply with the EU GDPR for individuals located in the EEA.
3. Personal Data We Collect
- 3.1 Account & Profile Data: name, email, password, language/region preferences, profile photo/bio.
- 3.2 Student Data: bookings, lesson history, communications, feedback/ratings.
- 3.3 Teacher Data: Application/Verification Details (e.g., identity/qualification information where lawful), availability, profile content, payout configuration (processed via our payment provider).
- 3.4 Payment & Transaction Data: payment status, timestamps, invoice/receipt data, limited card metadata (card brand/last four digits). Card details are processed by our payment provider (e.g., Stripe) and are not stored by BridgeLang.
- 3.5 Usage & Device Data: IP address, device/browser type, logs, diagnostics, and cookie data.
- 3.6 Content You Provide: lesson materials, messages, reviews/testimonials, and optional social‑media contributions.
- 3.7 In‑person Lesson Details: location information you choose to record for safety and any emergency contact details you store in your profile.
- 3.8 Support & Communications: emails and in‑app support messages.
- 3.9 Special Category Data: BridgeLang does not seek to collect special category data (e.g., health information, racial or ethnic origin, religious beliefs). Please do not submit such data through the Platform. If such data is inadvertently provided, we will handle it strictly in accordance with applicable law and minimise processing.
4. How We Collect Data
- 4.1 Directly from you when you register, book, message, or contact support.
- 4.2 Automatically through cookies and analytics when you use the Platform.
- 4.3 From third parties (e.g., payment processors, identity/verification providers where used).
5. Purposes of Processing
We use personal data to:
- 5.1 Deliver and operate the Platform (accounts, matching, bookings, lessons, Credits).
- 5.2 Process payments, refunds, chargebacks, and billing.
- 5.3 Maintain trust and safety (fraud prevention, misuse detection, policy enforcement).
- 5.4 Communicate with you (service notices, changes to terms, support).
- 5.5 Improve the platform (performance, diagnostics, feature development).
- 5.6 Conduct marketing with your consent where required.
6. Lawful Bases (UK GDPR)
Depending on the context, we rely on:
- 6.1 Contract (to provide the services you request).
- 6.2 Legitimate Interests (service safety and improvement, fraud prevention—balanced against your rights).
- 6.3 Consent (e.g., marketing, non‑essential cookies).
- 6.4 Legal Obligation (tax/accounting, AML/sanctions, lawful requests).
8. International Transfers
8.1 Where personal data is transferred outside the UK/EEA, we implement appropriate safeguards—such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), adequacy decisions, or other approved mechanisms—to ensure an adequate level of protection.
9. Retention
- 9.1 We keep personal data only as long as necessary for the purposes described above and to meet legal, accounting, or reporting duties, after which we securely delete or anonymise it.
- 9.2 Examples: Account data while active and for a reasonable period thereafter; Transaction records typically 6 years for accounting; Support communications per our retention schedule.
10. Security
- 10.1 We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
- 10.2 Data Breach Notification: In the unlikely event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner’s Office (ICO) and, where required, affected individuals, in accordance with applicable law.
11. Children and Young People
- 11.1 The Platform is intended for adults (18+).
- 11.2 Students aged 14–17 may use the Platform only with prior written consent of a parent or legal guardian.
- 11.3 We do not knowingly collect personal data from children under 14. If we learn we have collected such data without the required consent, we will delete it promptly.
12. Automated Decision‑Making
12.1 BridgeLang does not use personal data for automated decision‑making or profiling that produces legal or similarly significant effects.
13. Data Subject Rights
- 13.1 Right of Access – request confirmation and a copy of your data.
- 13.2 Right to Rectification – correct inaccurate or incomplete data.
- 13.3 Right to Erasure
- 13.3.1 Requests under this Section 13 will be processed within thirty (30) days of receipt. We may extend this period by up to two (2) further months where requests are complex or numerous; if so, we will inform you of the extension and reasons.
- 13.3.2 BridgeLang may require verification of identity before fulfilling such requests to ensure data security.
- 13.4 Right to Restrict Processing – in certain circumstances (e.g., while accuracy is contested).
- 13.5 Right to Object – to processing based on legitimate interests; and an absolute right to object to direct marketing.
- 13.6 Right to Data Portability – receive your data in a commonly used format and transmit it to another controller where technically feasible.
- 13.7 Right to Withdraw Consent – withdraw consent at any time (e.g., marketing or non‑essential cookies).
- 13.8 How to Exercise Your Rights – contact contact@bridgelang.co.uk; we may need to verify identity.
- 13.9 Complaints – you may lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local data protection authority in the EEA.
15. Changes to This Policy
15.1 We may update this Policy from time to time. The “Last updated” date will be revised accordingly. The latest version will be accessible via the Platform.
16. Contact, DPO and EU/EEA Representative
- 16.1 Contact: BridgeLang UK Ltd, The Apex, Derriford Business Park, Brest Road, Plymouth, PL6 5FL, United Kingdom • Email: contact@bridgelang.co.uk
- 16.2 Data Protection Officer (DPO): BridgeLang has not appointed a DPO as we are not legally required to do so. For all data protection enquiries, please contact contact@bridgelang.co.uk.
- 16.3 EU/EEA Representative (Article 27 GDPR): If and when BridgeLang offers services to individuals in the EEA in a manner that requires the appointment of an EU representative, we will designate such a representative and update this Policy with the relevant contact details.