Privacy notice
Plain English: what personal data we hold, where it came from, what we do with it, and how to tell us to stop. Last updated August 2026.
Who we are
Global Horizons Ltd is the data controller for the personal data described here. We are registered in England and Wales, company number 16681939, at 28 Main Street, Ratby, Leicester, LE6 0JG. For anything to do with your data, email hello@ghorizons.co.uk or call 0330 090 2023.
If we emailed you and you were not expecting it
We sometimes write to schools, colleges and youth organisations we have not worked with before. When we do, the work email address we used came from a public source: your organisation's own website, a published Erasmus+ or eTwinning directory, a national education directory, or a professional network profile. We did not buy it, and we did not get it from a list broker. We hold the address, the role it belongs to, and the organisation name — nothing more. If you would rather we did not write again, use the unsubscribe link in the email or reply and say so; either way we stop, and we keep a record of the address purely to make sure we do not contact it by mistake later.
What we hold and why
| Who | What | Why | Lawful basis | How long |
|---|---|---|---|---|
| People who contact us | Name, organisation, email address, phone number, and whatever you tell us in your message. | To answer you and, if it goes further, to plan a programme together. | Legitimate interests — responding to an enquiry you sent us. | 24 months from our last contact. |
| People who opt in to marketing | Name, email address, organisation, and which form or guide you signed up through. | To send occasional updates about Erasmus+ funding, hosting opportunities and Global Horizons news. | Consent — you can withdraw it at any time using the unsubscribe link in every email. | Until you unsubscribe, or 24 months after our last contact if you stop engaging. |
| Staff at schools, colleges and youth organisations we approach | Work email address, role, organisation name, and any public information about the organisation's international work. | To introduce our Erasmus+ hosting programmes to organisations whose published work suggests they may be interested. | Legitimate interests — business-to-business outreach to a professional contact at a professional address. | 24 months from collection, or immediately on request. |
| Partner and participant records | Contact details for staff coordinating a visit, plus the group details needed to run the programme safely. | To deliver the programme, meet safeguarding duties and keep the records our funders and insurers require. | Contract, and legal obligation where records must be retained. | Six years after the programme ends. |
| Website visitors | Anonymous analytics, only if you accept non-essential cookies. | To see which pages are useful. | Consent — see the cookie policy. | Up to 24 months. |
Where we rely on legitimate interests, we have weighed our interest in reaching organisations that run international mobility against your interest in not being contacted. You can object at any time and we will stop.
Who else sees it
We use a small number of service providers, each acting only on our instructions under a written data processing agreement. Transactional emails — form confirmations, guide downloads and enquiry replies — are sent through Lovable's email service, which uses Resend infrastructure. Marketing emails and campaign lists are sent through Brevo (Sendinblue SAS, France), which stores campaign and contact data in the EU. Our website and forms run on infrastructure inside the UK and EU. We do not sell personal data, and we do not share it for anyone else's marketing. Where a provider processes data outside the UK or EEA, we rely on the UK Addendum to the EU Standard Contractual Clauses.
Keeping it safe, and not keeping it too long
Access is limited to the people who need it, accounts use multi-factor authentication, and data is encrypted in transit. The retention periods in the table above are the outside limits; we delete sooner when there is no reason to keep something. Records tied to safeguarding, funding or insurance are kept for six years because we are required to keep them.
Your rights
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything inaccurate.
- Ask us to delete it.
- Object to us using it for outreach — we will stop, and there is no test to pass.
- Withdraw consent to marketing emails — we will stop and add your address to our suppression list so it cannot be used again.
- Ask us to restrict how we use it while a question is being resolved.
- Ask for the data you gave us in a portable format.
- Complain to the Information Commissioner's Office at ico.org.uk, or to your own national data protection authority.
Write to hello@ghorizons.co.uk and we will respond within one month. There is no charge.
Cookies and changes
Cookies are covered separately in our cookie policy. If we change this notice we will update the date at the top of the page, and we will tell you directly if the change materially affects you.