Privacy policy

Who we are

Everest Language School is an English language school at 26 Merrion Square N, Dublin 2, D02 DX36, Ireland. This page explains what personal data we collect through this website, why we collect it, and what you can ask us to do with it.

If you have a question about anything here, write to info@everestlanguageschool.com or call 00353 (0) 1 559 4919.

What we collect, and when

We only collect what you type into one of our forms. We do not buy lists and we do not follow you around other websites.

Enquiry form

On Contact us, and on the course and accommodation pages: your first and last name, email address, the type of course you are interested in, and your message.

Booking form

On Book now: your name, email address, phone number, country, gender, date of birth and home address; the course and the accommodation you want, with their dates; any dietary requirements, allergies or medical conditions you choose to tell us about; an emergency contact; and, if you need help with a study visa, a scan of your passport.

Free level test

Your name, email address, your answers to the test, and the short piece of writing you submit.

Where it goes

The enquiry and booking forms are provided by HubSpot, the customer management system the school uses. What you send is stored in the school’s HubSpot account, on HubSpot’s servers in the European Union, and is read by the school’s staff. The chat window on this site is HubSpot too.

The free level test is the exception: it is stored on this website’s own server and emailed to our staff.

Why we are allowed to hold it

For enquiries and level tests, because you asked us for something and we need the data to answer you.

For bookings, because we are preparing a contract with you, and because Irish immigration rules require a school to hold certain records about its students.

Where you tick the box to hear from us about courses, that is your consent, and you can withdraw it whenever you like.

How long we keep it

Enquiries and level tests: two years from your last contact with us, then deleted.

Bookings and the documents attached to them: for as long as the law requires a school to keep student records, and no longer.

You can ask us to delete your data before that. If the law obliges us to keep part of it, we will tell you which part and why.

Who else sees it

The school’s own staff, and HubSpot, the company that provides our forms, chat and customer records. We do not sell your data and we do not hand it to advertisers. Who the school shares student records with once you enrol, such as accommodation providers, insurers and immigration, is set out in the Data Protection & GDPR Policy further down this page.

Content that comes from other companies

A few pages load content from other companies. When they do, those companies can see that your browser asked for it.

• Student Reviews plays a video hosted by YouTube, which is Google.
• The Podcast pages embed a player from Spotify.
• Every page loads typefaces from Google Fonts.
• The forms and the chat window come from HubSpot.
• If you choose a language other than English, the page is translated by Google Translate.

If you do not open those pages, nothing is requested from them.

Cookies

The first time you visit, a banner asks which cookies you accept. The cookies the site needs in order to work are always on, and HubSpot, which runs the forms and the chat, sets its own. Statistics and advertising cookies from Google (Google Analytics and Google Ads) are only set if you accept them, and you can change your choice at any time. The full list, and how to switch them off, is in our Cookie Policy.

Your rights

Under the GDPR you can ask us to:

• show you a copy of what we hold about you
• correct anything that is wrong
• delete it
• send it to you, or to someone else, in a portable format
• stop using it for a particular purpose

Write to info@everestlanguageschool.com and we will answer within one month.

If our answer does not satisfy you, you can complain to the Data Protection Commission, the Irish supervisory authority, at dataprotection.ie.

The school’s Data Protection & GDPR Policy

Everything above is about this website. What follows is the school’s full data protection policy, for students, staff and partners, as Everest Language School publishes it.

Data Protection Manager (DPM): Robert McComish

Next Review Date: January 2027

Introduction and Purpose

Everest Language School (“the School”) is committed to protecting the rights and freedoms of all individuals whose personal data we process. This policy outlines our commitment to the General Data Protection Regulation (EU 2016/679) and the Irish Data Protection Act 2018. It ensures that our data processing activities are lawful, secure, and transparent.

Governance and Accountability

The School adopts a “Privacy by Design” approach. The Governing Body holds ultimate responsibility for data protection, with daily management delegated as follows:

• Data Protection Manager: Robert McComish is the designated lead for GDPR compliance, incident response, and handling Subject Access Requests (SARs).
• Staff Training: All staff must complete GDPR awareness induction
• Review Mechanism: Data protection and IT security are standing agenda items for monthly Governance Meetings.

Data Protection Principles

We process all personal data in accordance with the following core principles:

1. Lawfulness, Fairness, and Transparency: We only collect data where we have a legal basis (Contract, Legal Obligation, or Consent).
2. Purpose Limitation: Data is collected for specific purposes (e.g., enrolment, visa compliance) and not repurposed without consent.
3. Data Minimisation: We collect only the information strictly necessary for the service provided.
4. Accuracy: We take reasonable steps to ensure data is kept up to date.
5. Storage Limitation: We do not keep data longer than 7 years for core records
6. Integrity and Confidentiality: We use high-level technical measures (MFA, Encryption, Network Separation) to ensure security.

Privacy Notice: Students

We keep student information securely to facilitate studying, provide accommodation/insurance, and meet visa requirements.

Information Held

• Personal Data: Name, age, gender, passport scans, and information provided via booking forms.
• Contact Details: Phone number, email, address, and emergency contact details.
• Attendance: Records of presence and justifications for absence (e.g., medical certificates).
• Welfare: Allergies, dietary requirements, and medical needs.
• Academic: Placement tests, class progress, certificates and grades.

Data Sharing (Students)

• Accommodation Providers: Shared to ensure health, safety, and dietary compliance.
• Partner Schools: Shared for bookings and academic placement.
• Partner Educational Tour Operators: Shared for bookings and academic placement.
• Insurance (Arachas): Shared to facilitate Medical or Learner Protection insurance.
• Immigration (GNIB/INIS): Legally mandated sharing for ILEP/Visa students including attendance and passport details.
• TrustEd/IEM (QQI): Shared for financial compliance, academic compliance and accreditation.

Privacy Notice: Staff

We hold staff information to fulfil legal employment obligations and ensure a safe environment for students.

Information Held

• Personnel Files: CVs, contact details, and educational qualifications.
• Financial: Payroll details and Revenue documents (DOB, address, bank details, PPSN).
• Compliance: Evidence of Garda Vetting and Child Protection training.

Data Sharing (Staff)

• Payroll: Sent to Haden Brown Accountants for Revenue compliance.
• Immigration/Accreditation: Qualifications and CVs shared with INIS/QQI as required for the ILEP and statutory reviews.

Technical and Organisational Security Measures

The School employs a “cloud-first” multi-layered security framework:

Cloud Environment (Google Workspace Business Plus)

• Encryption: Data is encrypted at rest (AES256) and in transit (HTTPS/TLS).
• Data Residency: All primary storage is set to the EU Region.
• Authentication: Multi-Factor Authentication (MFA) is mandatory for all staff.
• Backups: Automated daily off-site backups are performed via afi.ai.

Network Security

• Separation: We maintain two physically independent internet connections on separate hardware routers for Staff and Students.
• Firewall: The Staff network uses a Virgin Media Business firewall with Intrusion Detection Systems (IDS) enabled. High-risk ports and peer-to-peer applications are blocked.

Physical Security

• Access: Necessary hard copies are stored in locked cabinets at 26 Merrion Square. Access is restricted to authorised personnel.

Third-Party Processors

The School remains the Data Controller. We use the following processors:

• Infospeed (Class Systems): Primary student management system.
• Haden Brown Accountants: Payroll and financial processing.
• Afi.ai: Cloud backup services.
• Google: Communication and document processing.
• External Services: SumUp, Revolut, Flywire and PayPal (Payments), Facebook and Google (Analytics/Marketing). We rely on vendor Standard Contractual Clauses (SCCs) for international transfers.

Data Retention Schedule

To satisfy Revenue and statutory requirements, the following schedule is enforced:

• Financial & Payroll Records: 7 years.
• Student Academic & Visa Records: 7 years (to facilitate future visa queries).
• Garda Vetting: Full disclosures are reviewed following verification only digital copies are securely stored. The School holds these declarations on the host family’s file to satisfy regulatory inspections.
• Marketing/Enquiries: 1 year (or until consent is withdrawn).

Breach Management & Subject Rights

• Rights: Individuals have the right to access, rectify, or request erasure of their data once legal retention periods expire.
• Breaches: Suspected breaches must be reported to Robert McComish immediately. The Data Protection Commission (DPC) will be notified within 72 hours if a high risk is identified. All incidents are logged in the Integrated Risk & Audit Log.

Contact: Robert McComish, accounts@everestlanguageschool.com

Data Protection Commission (DPC): info@dataprotection.ie

Changes to this page

If we change how we handle your data, we will update this page and change the date below.

Last updated: 7 October 2026