Privacy Policy

1. Who We Are

This Privacy Policy applies to Phoenix Language and Education Centre Ltd. (Company Registration No. C112739), operating as Phoenix Language School Malta, located at:

• Phoenix Business Centre, Old Railway Track, Santa Venera, Malta
• Email: info@phoenixenglishmalta.com
• Phone: +356 9908 4500
• Website: www.phoenixenglishmalta.com

We are the Data Controller responsible for your personal data. We are committed to protecting your privacy and handling your personal data in accordance with the General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).

2. What Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Data You Provide Directly

• Enquiry form: First name, last name, email address, phone number, country of residence, course of interest, preferred start date, duration and message
• Application form: Full name, date of birth, nationality, passport details, emergency contact, health information (where relevant), educational background
• Accommodation booking: Dietary requirements, special needs, arrival/departure details
• Payment information: Billing details (processed securely — we do not store card numbers)
• Communications: Emails, WhatsApp messages and other correspondence with our team

2.2 Data We Collect Automatically

• Website usage data: IP address, browser type, pages visited, time spent on site (via analytics tools)
• Cookies: See our Cookie section below

2.3 Special Category Data

In some circumstances, we may collect health-related information (e.g. dietary requirements, medical conditions) when necessary for your safety or accommodation. This data is processed only with your explicit consent and handled with the highest level of care.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• Course administration: Processing your enrolment, managing attendance, issuing certificates and academic records
• Responding to enquiries: Replying to your questions about courses, pricing, accommodation and dates
• Accommodation placement: Arranging host families, student residences or hotel bookings
• Airport transfers: Coordinating your arrival and departure logistics
• Visa support: Providing enrolment letters and supporting documentation for visa applications
• Welfare and student support: Ensuring your safety and wellbeing during your stay in Malta
• Marketing communications: Sending course information, offers and news (only with your consent)
• Legal compliance: Meeting our obligations under Maltese and EU law, including immigration reporting requirements
• Photography and video: Using images or footage taken during your stay for promotional purposes (only with your explicit consent — you may opt out on your application form)

4. Legal Basis for Processing

We process your personal data on the following legal grounds under GDPR Article 6:

• Contractual necessity: Processing required to fulfil our contract with you (e.g. course enrolment, accommodation, transfers)
• Legal obligation: Processing required by Maltese law (e.g. immigration authority reporting for students with visas who fall below 80% attendance)
• Legitimate interests: Processing for our legitimate business interests (e.g. fraud prevention, website security, improving our services)
• Consent: Processing for marketing communications and photography/filming (you may withdraw consent at any time)

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary:

• Student records: 7 years after course completion (for legal and accreditation purposes)
• Enquiry data (non-enrolled): 12 months from last contact
• Financial records: 10 years (Maltese tax law requirements)
• Marketing consent records: Until you withdraw consent
• Website analytics: 26 months

6. Who We Share Your Data With

We may share your personal data with the following third parties, only where necessary:

• Accommodation providers: Host families, student residences and partner hotels (for your placement)
• Transfer companies: Airport transfer providers (for your arrival/departure logistics)
• Partner agents: Education agents who referred you to us (only your enrolment status)
• Maltese authorities: Immigration authorities, as required by law (e.g. attendance reporting for visa holders)
• ELT Council Malta: Our accrediting body, as required for compliance
• IT service providers: Hosting, email and form processing services (bound by data processing agreements)

We do not sell your personal data to third parties. We do not share your data for commercial purposes without your explicit consent.

7. International Data Transfers

Phoenix Language School Malta is based in Malta (EU). If you are located outside the EU/EEA and provide us with personal data, please note that your data will be transferred to and processed in Malta, which is subject to GDPR and offers the same level of protection as all EU member states.

Where we use any service providers outside the EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) to protect your data.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your data where there is no lawful reason to continue processing it
• Right to restrict processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent at any time for consent-based processing (without affecting prior processing)

To exercise any of these rights, please contact us at info@phoenixenglishmalta.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Maltese Information and Data Protection Commissioner (IDPC) at idpc.org.mt if you believe your data has been handled unlawfully.

9. Cookies

Our website uses cookies to improve your browsing experience. Cookies are small text files stored on your device.

Types of cookies we use:

• Essential cookies: Necessary for the website to function correctly (cannot be disabled)
• Analytics cookies: Help us understand how visitors use our site (e.g. pages visited, time spent). We use anonymised data only.
• Functional cookies: Remember your preferences to improve your experience

You can control cookies through your browser settings at any time. Disabling certain cookies may affect website functionality.

10. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These include:

• SSL encryption on our website (HTTPS)
• Secure password-protected systems for staff access
• Limited access to personal data on a need-to-know basis
• Regular review of our data security practices

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the IDPC within 72 hours and inform affected individuals without undue delay.

11. Photography, Filming & Social Media

During your course, Phoenix Language School Malta may arrange photographs or video recordings for promotional purposes (printed materials, website, social media). We will always seek your consent before using identifiable images of you.

If you do not wish to be photographed or filmed, please indicate this on your application form or inform a member of staff at any time. Your choice will not affect your course or the services you receive.

12. Students Under 18

We are committed to protecting the privacy of minors. For students under 18 years of age enrolled on any Phoenix course:

• A notarised letter of consent from a parent or legal guardian is required before the course start date
• Students under 18 are subject to a curfew of 12 midnight within their accommodation
• Certain activities involving alcohol are not available to students under 18
• We apply additional data protection safeguards to all personal data relating to minors

13. Changes to This Privacy Policy

We review and update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements or other factors. When we make significant changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes acceptance of the updated policy.