Privacy Policy
Last update: 08 April 2026
FlyingSponge™ (“we”, “us”, “our”) is committed to protecting your privacy and ensuring that your personal data is processed lawfully, fairly, and transparently. This Privacy Policy explains how we collect, use, share, and protect your personal information when you book or participate in our immersion programmes, or otherwise interact with us.
1. Data Controller
FlyingSponge Ltd
Company Number: 17113803
Email: hello@flyingsponge.com
We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.
2. Information we collect
Identity and contact details
Name, address, email address and phone number
Passport details including passport number
Professional details
Service-related information
Transaction details for services you've purchased from us or enquiries about our services
Your preferences for our services and your marketing preferences and where relevant information related to loyalty programmes
Booking and programme information including travel dates, destination preferences, language learning goals, current language proficiency, preferred start dates and duration, budget information, booking preferences and programme participation records
Host matching and preferences (including social preferences, activity preferences, meal requirements, accommodation preferences, specific requests regarding host characteristics), learning style preferences, tutor preferences, local friend preferences, interests and hobbies
Feedback, complaints and compliments and survey responses
Group traveller information
Where you book for a group, information about other travellers including their names, ages, contact details and preferences
Financial and payment information
Payment details for programmes and services you've purchased from us (processed via bank transfer), transaction records
Digital information
IP address and general location information derived from your IP address
Search and browsing behaviour and user journeys
Website usage patterns
Cookie preferences and tracking
Recordings
Call recordings including recordings, photos and video content taken during programmes
Records of meetings and decisions
Professional information (for job applicants and workers)
Employment history
Professional experience
Required authorisations and licences
Professional registrations
Information about your right to work in the UK
Special category data
This is special information that the law says is more sensitive (sometimes called “sensitive personal data”). We handle special category data with extra care and protection, and we only collect and use these where legally permitted. This includes:
Health information (including dietary requirements, allergies, health conditions, medical information relevant to your programme participation)
Information about disabilities or accessibility needs
Information that could identify aspects of your sex life or sexual orientation (only where you choose to provide this in relation to host matching preferences)
We collect health and disability information through our curiosity form to ensure your safety, wellbeing and appropriate support during our language immersion programmes. This information is processed confidentially and shared only with relevant staff, hosts, tutors, local friends or medical professionals as necessary for your care and programme delivery.
3. How we collect information
Directly from you when you: interact with us, contact us, fill out our curiosity form, book a programme, communicate via email or WhatsApp, participate in our programmes or provide feedback
Automatically when you: visit our website or interact with our online services
From third parties: service providers, hosts, tutors, local friends, payment processors, insurers, previous employers, government organisations and organisations or people authorised by you
4. How we use your information
Data protection law requires us to have proper legal reasons for using your personal data. We can only use your information when we have one or more of these legal bases.
Consent - You have clearly agreed to us using your personal data for a specific purpose.
Performance of a contract - We need to use your information to fulfil a contract with you, or because you've asked us to do something before entering into a contract.
Legal duty - We must use your information to comply with the law.
Vital interests - We need to use your information to protect someone's life.
Public interest - We need to use your information to perform a task in the public interest or carry out official functions that have a clear legal basis.
Legitimate interests - We have a genuine business reason to use your information, or a third party does, but only if this doesn't unfairly override your rights and interests. Where we rely on legitimate interests as our legal basis, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. These assessments consider:
The nature of our legitimate interest
The impact on you
Any safeguards we can implement
Your reasonable expectations
The broader context of our relationship
Note that we may process your personal data for more than one legal basis depending on the specific purpose for which we are using your data. We have listed the reasons we process your data and the legal basis below. Please reach out to us if you need further details about the specific legal basis we are relying on to process your personal data.
Managing your account and providing our services
What we use your information for:
To process and manage your programme booking
To match you with suitable host, tutors and local friends based on your preferences and requirements
To communicate programme details, travel information and updates
To coordinate with hosts, tutors and local friends regarding your arrival, stay and programme activities
To provide support during your programme
To respond to enquiries, support requests and deal with complaints or claims
Internal record keeping, administrative, invoicing and billing purposes
To manage group bookings and coordinate multiple travellers
Legal basis for using this information:
Performance of a Contract
Legal Duty (for billing and record-keeping requirements)
Legitimate interests
Types of information we use:
Identity and contact details
Service-related information
Financial Information
Digital information
Group traveller information
Consent (for special category data)
Health, safety and safeguarding
What we use your information for:
To ensure your safety and wellbeing during programmes
To provide appropriate care and make necessary adjustments for health conditions, allergies or disabilities
To respond to emergencies and provide emergency contact information to relevant parties
To share relevant health and accessibility information with hosts, tutors, local friends and medical professionals as necessary
To comply with safeguarding obligations
To maintain safeguarding records
Legal basis for using this information:
Consent (for special category data)
Performance of a Contract
Legal Duty
Legitimate interests.
Types of information we use:
Identity and contact details
Special category data (health information, disabilities, accessibility needs)
Group traveller information
Programme administration and matching
What we use your information for:
To assess your language learning goals and current proficiency
To match you with appropriate hosts based on your preferences, lifestyle and requirements
To match you with suitable tutors based on your learning style and preferences
To connect you with local friends aligned with your interests
To coordinate programme logistics including accommodation, lessons and activities
To facilitate introductions between you and your host, tutor and local friends
Legal basis for using this information:
Performance of a Contract
Legitimate interests
Consent (for special category data)
Types of information we use:
Identity and contact details
Group traveller information
Client onboarding and verification
What we use your information for:
To assess whether to accept your booking
To verify your identity and travel documentation
To confirm travel insurance coverage
To perform fraud prevention and background checks where necessary
Legal basis for using this information:
Performance of a Contract
Legal Duty
Public Interest
Legitimate interests
Types of information we use:
Identity and contact details
Financial information
Group traveller information
Website enquiries and customer service
What we use your information for:
To contact and communicate with you about any enquiries you make with us via our website
Legal basis for using this information:
Legitimate interests
Types of information we use:
Identity and Contact Data
Digital Information
Business improvement and development
What we use your information for:
Analytics on our website
Market research and business development
To operate and improve our services
Legal basis for using this information:
Legitimate interests
Types of information we use:
Digital Information
Marketing and communications
What we use your information for:
To send you promotional information about our events and experiences and information that we consider may be of interest to you
To send you our newsletter (where you have subscribed)
To run promotions, competitions and offer additional benefits to you
Legal basis for using this information:
Legitimate interests
Types of information we use:
Identity and Contact Data
Digital Information
Photography and video content
What we use your information for:
To capture photos and videos during programmes for educational purposes
To use photos and videos for marketing, promotional materials and social media
To create programme reports and documentation
Legal basis for using this information:
Consent
Legitimate interests
Types of information we use:
Recordings (photos and video content)
Identity and contact details
Recruitment and employment purposes
What we use your information for:
To consider your application if you have applied to work with us and to keep you up to date with its progress
In relation to self-declared disabilities in order for us to make a reasonable adjustments to support your application and any possible future employment
In relation to any diversity or equal opportunities monitoring questionnaire data, to monitor and report on our equality and diversity composition and ensure fairness in the recruitment process
In relation to any right to work information we collect, in order to ensure we comply with the law in employing you
To keep you updated on any other suitable vacancies
Legal basis for using this information:
Legitimate interests
Legal Duty
Consent
Performance of a Contract
Types of information we use:
Identity and Contact Data
Professional Data
Legal compliance
What we use your information for:
Comply with our legal obligations or if otherwise required or authorised by law
Legal basis for using this information:
Legal Duty
Types of information we use:
All relevant Personal Data
5. Our disclosures of personal data to third parties
We may disclose personal data to:
Service providers
IT service providers
Data storage providers including Squarespace
Web hosting and server providers including Squarespace
Payment processors
Marketing and advertising providers
Analytics providers including Google
Professional advisers
Bankers
Auditors
Insurers and insurance brokers
Legal advisers
Business partners
Our existing or potential agents
Our business partners, providers or contractors
Corporate transactions
If we merge with or are acquired by another company, or sell our business assets:
Your information may be disclosed to our advisers
Your information may be disclosed to the potential purchaser's advisers
Your information may be included in the transferred assets
Legal and regulatory bodies
Courts and tribunals
Regulatory authorities including as required for reporting obligations
Law enforcement officers
Other parties
Third parties you have authorised
Emergency services when necessary
Any other parties as required or permitted by law
6. Sharing Your Data
We may share your personal data with:
Hosts, tutors, and local friends — for programme delivery and emergency purposes
Payment processors and insurers — to process bookings, cancellations, or claims
Regulatory authorities — when legally required (e.g., visas, safeguarding concerns)
Service providers and partners — to help us operate our business securely and efficiently
We never sell your personal data to third parties.
7. Overseas transfers
Where we store and access your information
We store your personal data in the United Kingdom. However, your information may be transferred to locations outside the United Kingdom in these circumstances:
When our service providers are located overseas
When we work with overseas business partners
When using cloud-based services or data storage solutions
When required by law or legal proceedings
Our approach to overseas transfers
When we transfer your personal data outside the United Kingdom, we ensure it receives appropriate protection by:
Only transferring your information to countries that UK data protection law recognises as providing adequate protection for personal data, or
Putting in place a contract with the third party that means they must protect personal data to the same standards as the UK.
Transferring personal data to organisations that are part of specific agreements on cross-border data transfers with the UK.
What this means for you
We only transfer the minimum amount of personal data necessary and require all recipients to:
Protect your information to the same standards required by UK law
Use your information only for the purposes we've agreed
Allow us to monitor how they handle your information
Provide you with the same rights over your information that you have under UK law
8. Children’s Personal Data
We do not knowingly collect or process personal data from children under 13 years of age without appropriate parental or guardian consent.
If you are under 13, please do not provide personal data to us without first asking your parent or guardian for permission.
If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete that information as quickly as possible.
Parents and guardians have the right to:
Review any personal data we hold about their child
Request correction or deletion of their child's personal data
Refuse or withdraw consent for further collection or use of their child's data
Contact us with any concerns about their child's privacy
If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately using the details provided in this policy.
9. Data retention
How long we keep your information
We only keep your personal data for as long as we need it to:
Provide our services to you
Meet our legal, tax, accounting or regulatory obligations
Handle any complaints or legal issues that may arise
We may keep your information for longer periods if:
You make a complaint that we need to investigate or respond to
We reasonably believe legal action involving our relationship with you might occur
The law requires us to keep it for specific timeframes
How we decide retention periods
When determining how long to keep your information, we consider:
How much information we have and how sensitive it is
The risk of harm if the information was accessed without permission
Whether we can achieve our purposes in other ways
What legal, regulatory, tax or accounting rules require
The nature of our relationship with you and the services we provide
What happens when we no longer need your information
Once we no longer need your personal data, we will securely delete or destroy it in accordance with our data retention policies and legal requirements.
Your Rights
You can request information about retention periods for your data and ask for early deletion where legally possible.
10. Your privacy rights and choices
Providing information
You can choose whether to provide personal data to us, however, if you don't provide certain information, we may not be able to provide some services. Let us know if you don’t want to provide information and we will let you know when information is required versus optional.
Right of Access
You have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal data from and who we share personal data with. There are some exemptions which means you may not receive all the information you ask for.
Right to Rectification
You have the right to ask us to correct or delete personal data you think is inaccurate or incomplete.
Right to Erasure (“Right to be forgotten”)
You can request deletion of your personal data in certain limited circumstances as set out in data protection law, such as where the data is no longer necessary or has been unlawfully processed. This right is not absolute and we may be required or entitled to retain your data for legal, regulatory or legitimate business reasons.
Right to Restrict Processing
You can ask us to suspend processing where:
You contest the accuracy of the data
Processing is unlawful but you don't want erasure
We no longer need the data but you need it for legal claims
You've objected to processing pending verification of our legitimate grounds
Right to opt-out of marketing communications
You can opt-out of receiving marketing communications at any time. Each marketing communication will include an unsubscribe option. You can change your marketing preferences by contacting us. We will process your request as soon as practicable.
Right to Data Portability
Where technically feasible, you can receive your personal data in a structured, commonly used format or have it transmitted to another controller where:
Processing is based on consent or contract
Processing is automated
Right to Object
You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
How to Exercise Your Rights
To exercise any of these rights, contact us using the details below. We may ask for proof of identity and will respond within one month (extendable to three months for complex requests).
These rights are available under data protection law, though some may not apply in every situation. We'll let you know if any limitations apply when you make a request.
Making a complaint
If you have concerns about how we handle your information.
If you're unhappy with how we've used your personal data, please get in touch with us first using the contact details at the end of this policy. When you contact us:
Give us full details about your complaint
We'll investigate your concerns promptly
We'll respond to you in writing explaining what we found and what we'll do to address your complaint
Your right to complain to the regulator
You can also make a complaint directly to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
You don't have to contact us first before going to the ICO, but we'd appreciate the opportunity to try to resolve your concerns directly with you.
11. Protecting your information
We use multiple layers of security to protect your information.
Technical safeguards
Enterprise-grade encryption for data storage and transmission
Regular security testing and monitoring
Automated threat detection systems
Operational security
Staff training on security and privacy
Strict access controls based on job requirements
Regular security audits and incident response procedures testing
Physical security
Secure premises with controlled access
Secure disposal of physical documents
Equipment security protocols
Public information
Please note that any information you choose to share publicly on online platforms (such as comments or reviews) can be accessed and used by others. We cannot control or protect information that you make publicly available.
You can manage cookie preferences through our website banner or browser settings. See our Cookie Policy for full details.
12. Cookies and analytics
We may use cookies and similar tracking technologies on our website to enhance your browsing experience and improve our services.
What are cookies?
Cookies are small text files that are stored on your device when you visit our website. They help us remember your preferences and understand how you use our site.
Types of cookies we use
Essential cookies: Necessary for the website to function properly
Performance cookies: Help us understand how visitors interact with our website
Functionality cookies: Remember your preferences and settings
Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness
Cookie consent
When you first visit our website, you will see a cookie notice explaining our use of cookies. You can choose which types of cookies to accept through our cookie preference centre. You’ll find more information about the cookies we use in our cookie pop-up.
Managing your preferences
You can change your cookie preferences at any time by:
Using our cookie preference centre on the website
Adjusting your browser settings to refuse or delete cookies
Visiting our cookie policy for detailed information about specific cookies
Please note that disabling certain cookies may affect the functionality of our website and your user experience.
Google Analytics
We use Google Analytics to understand how people use our website. This involves cookies that collect information about your browsing activity. You can opt out of Google's advertising features through your Google account settings, browser add-ons, or your device's privacy settings. Google provides various tools and options to control how your data is used for advertising purposes. You can learn more about how Google uses your data and your available options on Google's privacy pages.
Public information
Please note that any information you choose to share publicly on online platforms (such as comments or reviews) can be accessed and used by others. We cannot control or protect information that you make publicly available.
You can manage cookie preferences through our website banner or browser settings.
See our Cookie Policy for full details.
13. Amendments
We may update this policy at any time by posting the revised version on our website. We recommend that you review our website regularly to stay current with any policy changes.
14. Our contact details
Contact email: hello@flyingsponge.com