Privacy Policy

1. Who we are

InternationalSchools.org (the "Service") is operated by ICPLeads, Inc., a corporation organised under the laws of Delaware, USA ("we", "us", "our"). We are the data controller responsible for personal information processed through the Service.

• Privacy & data requests: privacy@internationalschools.org
• Legal: legal@internationalschools.org
• Data Protection Officer (EU/UK): dpo@internationalschools.org

EU/UK Representative (GDPR Art. 27): appointment in progress. Until then, EU and UK residents may direct GDPR/UK-GDPR enquiries to dpo@internationalschools.org and we will route them appropriately.

2. Scope of this policy

This policy applies to personal information we process when you visit internationalschools.org, submit a family profile, communicate with our advisors, or otherwise interact with our content and emails. It does not apply to schools, third-party websites, or services we link to, which have their own privacy practices.

3. Personal information we collect

Information you provide

• Family profile: child age(s) or year group, intended start date, destination city/country, curriculum preferences (e.g. IB, British, American, bilingual), boarding/day preference, budget range, languages, learning needs you choose to share, and any free-text description you submit.
• Contact details: parent/guardian name, email address, and (optional) phone number, including country code.
• Communications: messages, email replies, and call notes when you correspond with our advisors.

Information collected automatically

• Technical data: IP address, device type, browser, operating system, language, pages visited, referring URL, and timestamps.
• Marketing attribution: UTM parameters, click identifiers (e.g. Google gclid), and referrer information so we can understand which channels bring families to us.
• Cookies & similar technologies: see our Cookies & Tracking page for the full list, retention periods, and your choices.

Information from third parties

• Advertising and analytics providers (e.g. Google) provide aggregated measurement and conversion data.
• Partner schools may confirm whether they have contacted you following an introduction.

We do not knowingly collect special-category data (such as health, religion, or biometric data). Please do not include such information in your free-text submissions unless you wish for it to be considered as part of your shortlist.

4. Why we use it (purposes & lawful bases)

5. Accuracy of submissions

When you submit a family profile, you confirm that the information you provide is true, accurate, current, and complete, and that you are the parent, legal guardian, or an adult authorised to share information about the named child. We may decline, remove, or report submissions that we reasonably believe to be false, automated, fraudulent, or made without authority.

6. Children's data

InternationalSchools.org is intended for parents, legal guardians, and authorised adults. The Service is not directed to children, and we do not knowingly collect personal information directly from children under 13 (or the equivalent local age of digital consent). The information we hold about a child is limited to non-sensitive descriptors you choose to provide as part of a school search (e.g. age band, year group, learning preferences). If you believe a child has provided us with personal information, please contact privacy@internationalschools.org and we will delete it.

7. Who we share information with

• Shortlisted schools — only when you tick the school-introductions consent box on our form. Your details are shared with the specific schools on the shortlist we send you, and never with the wider market. Each school becomes an independent controller for the personal information we share with it and handles your data under its own privacy policy.
• Service providers (sub-processors) — see our Sub-processors list for the current vendors that host, secure, analyse, or transmit data on our behalf under written contracts.
• Advertising and analytics partners — only when you grant the relevant cookie consent.
• Legal, regulatory, and safety disclosures — where required by law, to enforce our Terms, or to protect rights, property, or safety.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with appropriate confidentiality protections.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising (as those terms are defined under the California Consumer Privacy Act / CPRA) without your consent. We honour Global Privacy Control (GPC) signals as an opt-out request from your browser.

8. International data transfers

We are based in the United States and our service providers may process information in the US and other countries. Where personal information of EU/EEA, UK, or Swiss residents is transferred outside those regions, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the Swiss Federal Data Protection Act addendum, and, where applicable, the EU-US, UK Extension, and Swiss-US Data Privacy Framework certifications of our providers. You may request a copy of the relevant safeguards from dpo@internationalschools.org.

9. How long we keep your information

• Family profile and contact details: up to 24 months from your last interaction with us, after which we delete or anonymise them.
• Consent records: retained for 6 years as evidence that you opted into school introductions (or marketing), as recommended by data-protection authorities.
• Email correspondence: retained while reasonably needed to handle your enquiry and any follow-up, then archived or deleted.
• Analytics and ad-measurement data: retained per provider settings; Google Analytics 4 user-level data is set to a 14-month retention window.
• Tax, accounting, and legal records: retained for the periods required by applicable law (typically 7 years).

10. Security

We protect personal information using administrative, technical, and physical safeguards proportionate to the risk: TLS encryption in transit, encryption at rest where supported by our providers, role-based access controls, audit logging, vendor due diligence, and regular review of permissions. No method of transmission or storage is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

11. Your rights

EU/EEA, UK, and Switzerland (GDPR / UK GDPR)

• Access a copy of your personal information.
• Rectify inaccurate or incomplete information.
• Erase your information ("right to be forgotten") subject to legal exceptions.
• Restrict or object to certain processing, including direct marketing.
• Receive your information in a portable format.
• Withdraw consent at any time without affecting the lawfulness of prior processing.
• Lodge a complaint with your local supervisory authority (e.g. the UK Information Commissioner's Office, your national EU Data Protection Authority, or the Swiss FDPIC).

California (CCPA / CPRA) and other US states

• Right to know what personal information we collect, use, disclose, and retain.
• Right to delete or correct personal information, subject to exceptions.
• Right to opt out of "sale" or "sharing" for cross-context behavioural advertising — we honour GPC.
• Right to limit use and disclosure of sensitive personal information (we do not use it for inferences).
• Right to non-discrimination for exercising these rights.
• Equivalent rights are available to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws.

How to exercise your rights

Submit a request via our Privacy Request page or by emailing privacy@internationalschools.org. We will verify your identity using information you have already provided and respond within 30 days (GDPR/UK GDPR) or 45 days (CCPA, extendable by 45 days). You may use an authorised agent where the law allows.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects on you using solely automated processing. Shortlists are reviewed by a real person before they are sent.

13. Marketing & email preferences

We send transactional emails (such as confirmations and shortlist deliveries) on the basis of your enquiry, and you cannot opt out of those while your enquiry is open. Any optional newsletters or educational content are sent only with your consent and include an unsubscribe link in every message.

14. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated by updating the effective date above and, where appropriate, by additional notice (such as a banner or email). Your continued use of the Service after changes take effect constitutes acknowledgement of the updated policy.

15. Contact

Questions or complaints about this policy may be sent to privacy@internationalschools.org or by post to the address above.