Global Language Training aims to be as clear as possible about how and why we use personal information about you through our website.
Here at the Global we’re committed to protecting your personal information and respecting your privacy. This Policy lets you know what data we may collect about you, how we use it and gives you information about your rights. This policy covers the use of our website, how we manage our direct marketing activities, how we handle your information when you contact us, when you enrol in our programmes and other core uses of your data that help us improve what we do. Sometimes we need to change our Privacy Policy. Any changes will be published on this website which, of course, can be accessed at any time.
Our company
We're the UK's largest online and in-class TEFL/TESOL training organization. We also offer international English proficiency exams and other academic services.
Global Language Training Ltd. is registered in England and Wales. Registered Number 7854956. Registered Office: 20 22 Wenlock Rd., London, N1 7GU.
You can contact us at
Type of information we collect about you
When you enrol in one of our programmes or tests we collect name, address and contact details (such as email, address and telephone number) when you submit an on-line form, when requesting a quote or because you purchased a course or service from us. We may also collect opinions or additional data about you that you have added into the free text area in the contact us forms, in our course forums, in surveys in the course or through any resulting correspondence with our team, phone calls or through surveys.
We also collect additional relevant information about you when you apply for jobs in our jobs list page. We need to collect this in order for you to benefit from the jobs offered and to forward this to our recruitment partners or schools. If you do not, we would be unable to do this.
When visiting our website, we collect your IP address, data showing when you visited, which pages you looked at, information about your operating system, country of origin, device and browser version. This data is gathered using commonly used tools such as cookies. We may, in the future, also use information from our social media sites if you use your credentials to log into our learning platforms or testing platforms. The information you allow us to access varies by social media network site and it also depends on the privacy settings you have in place.
Why we collect personal information about you
Your payment information, credit, debit or PayPal payments:
We do not retain payment information from any of our students/clients as this service is provided through a third-party payment provider. We take payments and provide refunds when necessary to fulfil our contract with you but the information is not stored on our website, servers or any of our databases. We check and verify payment to prevent fraud or detect fraud against you or our company.
When we have your permission or consent
|
• We will contact you to provide you with news about exciting offers and deals that we think will be of interest to you or friends. We will only contact you in the ways you have given us permission to do so. You can change your mind at any time by contacting us via email at |
Where we have a justifiable reason or a legitimate interest
|
• To enhance or improve your experience with us and how you use our learning platform or website. This may mean that we learn about your preferences and habits and then tailor our communications with you to make sure that what we send is relevant to you (‘profiling’). • To put your information together with other customers data and external non personal information so that we better understand our market through analysis and segmentation to ensure that we keep offering competitive products and services and improve our website. • To send you special course offers, new services via marketing materials where we can demonstrate a relationship with you and you have not told us that you do not want to receive these. • To maintain our list of people who have asked not to receive direct marketing material from us. • To help keep our website safe and secure. • To allow our internal business processes to function- for example transacting with our partners, carrying out audits, producing management information and dealing with complaints. • To undertake market research for the purpose of offering our courses and services. • To request feedback on our performance and that of our courses. • To help prevent fraud and maintain security on our website and learning platform. • To assist in training, quality assurance and compliance. |
Where we have to do something by law or where we have a legal obligation
|
• To ensure that your rights are met under the UK Data Protection Act. • To meet our legal obligations with law enforcement agencies, police, courts and other government organisations or agencies |
Who we share your information with?
We do not sell your information to anyone and only pass it to our trusted partners and service providers who work in job placing when you apply for a job through our jobs department.
We may pass your information to:
|
• Service providers who work for us such as marketing agencies, marketing survey sites or mass email marketing campaign websites. • Regulatory bodies, courts and law enforcement agencies. |
How long do we keep your personal information?
How long we keep your personal information depends on why we have it and what we’re doing with it. For our TEFL/TESOL courses we keep it indefinitely for certificate verification purposes as some future employer may contact us or verify the authenticity of your certificate.
|
• We keep records of any dealings you have with us for up to 3 years after the last contact. This is so that we can respond to any complaints or disputes that may arise about any of our courses or if you wish to re-enrol in one of our courses. • We will keep other personal information about you if it is necessary for us to do so to comply with the law. • Data collected from using the website such as IP address is deleted after 1 year. |
Transferring information outside of the EEA
Your personal information may be processed outside the European Economic Area (EEA) where privacy laws may not provide protection to the same level as in the UK. Before any transfer takes place, we will take steps to ensure that your personal information will be adequately protected as required by the UK Data Protection Act and that safeguards such as standard contractual clauses are in place. For more information please see the individual product or service policies or contact us.
In using our website and submitting queries, your information is able to be viewed from other countries by the service providers who do maintenance on our platform on our behalf. Contracts are in place (known as an ‘EU Model Clause’) to allow the data to transfer so that your information is kept secure and managed to the standards required by the UK Data Protection Act.
Your Rights
Marketing: You have the right to object to direct marketing from our company. This is done by unregistering from the newsletter when it is sent. It will immediately stop you from receiving emails. You may also email us at
Consent: Where we use your information on this basis, you have the right to withdraw that consent.
Access: You can request a copy of all the personal information we hold about you and other data relating to how we use your information by contacting our admin team at
Correction ('Right to Rectification'): We always want to use the most up to date information about you so please get in touch if you think we don’t have that.
Deletion ('Right to be Forgotten'): In some circumstances, including where we are relying on your consent to use your data, you have a right to request us to delete your information. When you request to be deleted from our platform, any future employer who wishes to verify your certificate, will not be able to do so.
'Right to Portability': If we have collected your data because you have given us consent, or because we need it in order to provide you with a course or service, you have the right to receive the information you gave to us back in a 'machine-readable' format.
'Right to Object' and 'Right to restriction of processing': If we are using your data for activities under the 'legitimate interest' justification and in other circumstances, then you have a right to request restriction of processing and also a right to object to that processing.
Complain: you have the right to lodge a complaint with our company if you think that our use of your information doesn’t meet the law.
Contact us
For further information about our privacy practices and to request any of these rights then please contact our team. To contact us please email us at:
|
• Email us at |
Keeping your personal information secure
At Global Language Training we take the security of your personal information seriously. We've implemented technology and security policies, rules and measures to protect the personal information we have under our control, both on and offline, from improper access, use, alteration, destruction and loss.
We will take all reasonable and proportionate steps to protect your personal information.
LGPD DATA PROTECTION ADDENDUM (BRAZIL)
Applicable to Candidate and User Data Subject to Law No. 13.709/2018 (Lei Geral de Proteção de Dados – LGPD)
Platform: iTestEnglish.com / GEP English Exams
Data Controller: Global Language Training Ltd. (Company No. 7854956, England & Wales)
Effective Date: October 16, 2026
Document Version: 2.0 (LGPD Compliance Schedule)
1. Scope, Governance, and Territorial Applicability 1.1. Statutory Application: This Data Protection Addendum (“Addendum”) supplements and forms an integral part of the Global Language Training Ltd. / GEP English Exams Privacy Policy and General Terms & Conditions. This Addendum applies strictly to the processing of personal data belonging to candidates, authorized testing center personnel, website visitors, and academic representatives located within the Federative Republic of Brazil, or where personal data is collected or processed within Brazilian national territory pursuant to Article 3 of Brazilian Federal Law No. 13.709/2018 (Lei Geral de Proteção de Dados - LGPD).
1.2. Precedence: In the event of any direct operational conflict or interpretive discrepancy between the general Privacy Policy (or Terms & Conditions) and this Addendum regarding data subjects protected by the LGPD, the terms of this Addendum shall prevail.
1.3. Controller Designation: Global Language Training Ltd. acts as the Data Controller (Controlador) regarding exam architecture, psychometric scoring, identity verification, anti-fraud evaluation, and global certificate validation. Authorized Exam Testing Centers in Brazil act either as independent Controllers or Data Processors (Operadores) in accordance with their executed Partner Agreements.
2. Legal Bases for Candidate Data Processing (Articles 7 & 11)
Global Language Training Ltd. processes candidate personal data strictly within the exhaustive legal bases recognized under Brazilian law:
3. Special Protections for Minors (Children and Adolescents – Article 14)
3.1. Best Interests Standard: All processing involving candidates under eighteen (18) years of age—specifically candidates registered for GEP Young Learners (Dolphins, Bears, Lions, YL A1, and YL A2)—is carried out strictly in the best interests of the minor, in full harmony with Article 14 of the LGPD and Law No. 8.069/1990 (Estatuto da Criança e do Adolescente - ECA).
3.2. Verifiable Parental Consent:
• Enrollment of any candidate classified as a child (under 12 years of age) requires specific, prominent, and verifiable consent provided by at least one parent or legal guardian prior to sitting the exam.
• The registration interface and Authorized Centers shall present guardians with a concise, transparent notice detailing the nature of the data collected, testing duration, and photographic records retained.
• Biometric or photographic data of children collected during test administration is strictly restricted to identity verification on test day and is never processed for commercial segmentation, advertising, or profiling.
4. Direct Institutional Verification and Data Sharing (Article 10 & 18)
4.1. Candidate-Controlled Score Disclosure: Candidate exam records and verification photos are housed on the GEP Secure Results Verification portal. Access to this data is granted solely when a candidate furnishes their unique Certificate Verification Number to a third-party receiving institution (e.g., Brazilian or international universities, corporate employers, visa authorities, or scholarship foundations).
4.2. Audit and Investigation Disclosures: Global Language Training Ltd. reserves the right to share limited candidate dossiers with Brazilian regulatory organs, judicial bodies, law enforcement, or affected receiving institutions where an internal psychometric audit or proctoring review identifies material fraud, impersonation (falsidade ideológica), or deliberate test security breaches, grounded in Article 7, VI and Article 11, II, (g) of the LGPD.
5. International Data Transfers (Articles 33–36)
5.1. Cloud and Operational Architecture: As an international testing organization headquartered in the United Kingdom, candidate data collected in Brazil is transferred to and stored on secure cloud-hosting infrastructure (e.g., AWS/Google Cloud secured environments) located in the United Kingdom, the European Union, and/or the United States.
5.2. Transfer Safeguards: Cross-border transfers from Brazil comply with Article 33 of the LGPD via:
6.1. Absolute Free-of-Charge Access (Gratuidade): In compliance with Article 18, § 5 of the LGPD, candidates located in Brazil may exercise any of their statutory rights completely free of charge. Any legacy clauses or general terms suggesting that subject access requests (SAR) or record requests incur administrative fees are entirely null and void with respect to Brazilian data subjects.
6.2. Catalog of Rights: Brazilian candidates hold the right to obtain from the Controller, at any time and upon formal request:
7. Data Retention, Certificate Verification, and Anonymization (Article 16)
7.1. Certification Persistence: Exam performance, CEFR band scores, and certificate serial numbers are retained indefinitely under Article 16, I & IV of the LGPD (contractual fulfillment, permanent verification capability, and statistical/research use). This ensures that candidates can validate their academic credentials to employers and academic institutions throughout their careers.
7.2. Candidate-Requested Deletion: If a candidate demands total erasure of their testing identity under Art. 18, VI, the candidate formally acknowledges that all associated certification verification numbers will be permanently revoked and decommissioned from the online verification registry. Employers or universities will no longer be able to authenticate the issued credential.
7.3. Log & Proctoring Telemetry: Web access logs, session tokens, and IP logs collected during testing are purged within twelve (12) months unless flagged for security investigation or fraud audits.
8. Designated Data Protection Officer (Encarregado de Dados)
8.1. Pursuant to Article 41 of the LGPD, Global Language Training Ltd. has established a dedicated communication channel to receive complaints, inquiries, and requests from Brazilian data subjects and the ANPD.
9.1. Security Incident Protocol: In the event of a security breach involving candidate personal data that may create relevant risk or damage to individuals, Global Language Training Ltd. will notify the ANPD and affected candidates within the regulatory timelines dictated by the ANPD, detailing the nature of the data affected, protective technical measures implemented, and remediation steps taken.
9.2. Revisions: This Addendum is periodically audited to reflect regulatory resolutions, guidelines, and directives enacted by the ANPD. Updates will be published on https://www.itestenglish.com/privacy-policy.
10. Assessment, Audio & Visual Proctoring Data: During online assessment sessions, our platform may record candidate audio (spoken responses), webcam footage, photographic identity verification, and browser telemetry for the explicit purpose of test authentication, assessment scoring, and anti-fraud monitoring. These records are held securely on encrypted servers.
11. Retention Periods: Candidate assessment evidence—including written scripts, audio recordings of speaking assessments, examiner marking sheets, and proctoring logs—is retained securely for a minimum period of three (3) years following result issuance, in compliance with Awarding Organisation regulatory retention schedules.
Applicable to Candidate and User Data Subject to Law No. 13.709/2018 (Lei Geral de Proteção de Dados – LGPD)
Platform: iTestEnglish.com / GEP English Exams
Data Controller: Global Language Training Ltd. (Company No. 7854956, England & Wales)
Effective Date: October 16, 2026
Document Version: 2.0 (LGPD Compliance Schedule)
1. Scope, Governance, and Territorial Applicability 1.1. Statutory Application: This Data Protection Addendum (“Addendum”) supplements and forms an integral part of the Global Language Training Ltd. / GEP English Exams Privacy Policy and General Terms & Conditions. This Addendum applies strictly to the processing of personal data belonging to candidates, authorized testing center personnel, website visitors, and academic representatives located within the Federative Republic of Brazil, or where personal data is collected or processed within Brazilian national territory pursuant to Article 3 of Brazilian Federal Law No. 13.709/2018 (Lei Geral de Proteção de Dados - LGPD).
1.2. Precedence: In the event of any direct operational conflict or interpretive discrepancy between the general Privacy Policy (or Terms & Conditions) and this Addendum regarding data subjects protected by the LGPD, the terms of this Addendum shall prevail.
1.3. Controller Designation: Global Language Training Ltd. acts as the Data Controller (Controlador) regarding exam architecture, psychometric scoring, identity verification, anti-fraud evaluation, and global certificate validation. Authorized Exam Testing Centers in Brazil act either as independent Controllers or Data Processors (Operadores) in accordance with their executed Partner Agreements.
2. Legal Bases for Candidate Data Processing (Articles 7 & 11)
Global Language Training Ltd. processes candidate personal data strictly within the exhaustive legal bases recognized under Brazilian law:
| Data Category & Purpose | Specific Data Elements | Legal Basis (LGPD) |
|---|---|---|
| Exam Registration & Delivery | Full legal name, date of birth, national tax/identity number (CPF / RG / Passport), email, phone, testing location, billing address. | Art. 7, V: Execution of contract or preliminary procedures related to an agreement at the request of the data subject. |
| Candidate Identity Verification & Anti-Impersonation | Test-day facial photographs, government ID scans, live proctoring audio/video recordings. | Art. 11, II, (g): Prevention of fraud and safeguarding candidate identity in electronic identification and authentication systems. |
| Special Academic Accommodations | Medical certificates, neurodivergence/dyslexia evaluations, visual/hearing impairment reports. | Art. 11, II, (a): Specific and prominent consent; or Art. 11, II, (e): Regular exercise of rights under contract. |
| Psychometric Scoring & Analytics | Item-level responses, response latencies, calibrated theta scores (Rasch model), CEFR band outcomes. | Art. 7, V: Contractual performance; and Art. 7, IX: Legitimate interest in test validity and score integrity. |
| Digital Verification Portal | Candidate name, certificate ID, test date, CEFR level achieved, facial photograph. | Art. 7, V: Performance of certification contract triggered by the candidate sharing credentials with third parties. |
| Regulatory & Anti-Fraud Reporting | Evidence dossiers, altered score records, identity mismatch reports. | Art. 7, II / Art. 11, II, (a): Compliance with statutory/legal obligation; Art. 7, VI: Regular exercise of rights in judicial or administrative proceedings. |
3. Special Protections for Minors (Children and Adolescents – Article 14)
3.1. Best Interests Standard: All processing involving candidates under eighteen (18) years of age—specifically candidates registered for GEP Young Learners (Dolphins, Bears, Lions, YL A1, and YL A2)—is carried out strictly in the best interests of the minor, in full harmony with Article 14 of the LGPD and Law No. 8.069/1990 (Estatuto da Criança e do Adolescente - ECA).
3.2. Verifiable Parental Consent:
• Enrollment of any candidate classified as a child (under 12 years of age) requires specific, prominent, and verifiable consent provided by at least one parent or legal guardian prior to sitting the exam.
• The registration interface and Authorized Centers shall present guardians with a concise, transparent notice detailing the nature of the data collected, testing duration, and photographic records retained.
• Biometric or photographic data of children collected during test administration is strictly restricted to identity verification on test day and is never processed for commercial segmentation, advertising, or profiling.
4. Direct Institutional Verification and Data Sharing (Article 10 & 18)
4.1. Candidate-Controlled Score Disclosure: Candidate exam records and verification photos are housed on the GEP Secure Results Verification portal. Access to this data is granted solely when a candidate furnishes their unique Certificate Verification Number to a third-party receiving institution (e.g., Brazilian or international universities, corporate employers, visa authorities, or scholarship foundations).
4.2. Audit and Investigation Disclosures: Global Language Training Ltd. reserves the right to share limited candidate dossiers with Brazilian regulatory organs, judicial bodies, law enforcement, or affected receiving institutions where an internal psychometric audit or proctoring review identifies material fraud, impersonation (falsidade ideológica), or deliberate test security breaches, grounded in Article 7, VI and Article 11, II, (g) of the LGPD.
5. International Data Transfers (Articles 33–36)
5.1. Cloud and Operational Architecture: As an international testing organization headquartered in the United Kingdom, candidate data collected in Brazil is transferred to and stored on secure cloud-hosting infrastructure (e.g., AWS/Google Cloud secured environments) located in the United Kingdom, the European Union, and/or the United States.
5.2. Transfer Safeguards: Cross-border transfers from Brazil comply with Article 33 of the LGPD via:
• Standard Contractual Clauses (SCCs): Application of data transfer agreements aligned with the standard contractual clauses mandated or approved by the ANPD (Autoridade Nacional de Proteção de Dados);
• Equivalency & Protection: Technical, organizational, and contractual measures ensuring that the recipient entities enforce data security, encryption in transit (TLS 1.3) and at rest (AES-256), and confidentiality provisions equal to or exceeding LGPD standards;
• Contractual Necessity: The transfer is directly necessary for the execution of the international educational testing agreement entered into by the candidate (Art. 33, IX).
6.1. Absolute Free-of-Charge Access (Gratuidade): In compliance with Article 18, § 5 of the LGPD, candidates located in Brazil may exercise any of their statutory rights completely free of charge. Any legacy clauses or general terms suggesting that subject access requests (SAR) or record requests incur administrative fees are entirely null and void with respect to Brazilian data subjects.
6.2. Catalog of Rights: Brazilian candidates hold the right to obtain from the Controller, at any time and upon formal request:
1. Confirmation of Processing: Confirmation that their personal data is actively processed.
2. Access to Data: Complete disclosure of data held regarding their profile and exam attempts.
3. Correction: Rectification of incomplete, inaccurate, or outdated records.
4. Anonymization, Blocking, or Deletion: Treatment of unnecessary, excessive, or unlawfully processed data.
5. Portability: Transmission of candidate data to another assessment provider in a structured, machine-readable format, subject to intellectual property protections governing test items.
6. Deletion upon Revocation of Consent: Erasure of data processed exclusively based on consent (Art. 16).
7. Third-Party Disclosures: Comprehensive listing of public and private entities with whom the Controller shared the candidate’s data.
8. Revocation of Consent: Unrestricted revocation mechanism for any activity predicated on explicit consent.
• Simplified Format: Confirmation of data presence shall be delivered immediately in simplified format via automated digital means or written communication.
• Comprehensive Statement: Detailed disclosures of origin, criteria, and processing purposes shall be fulfilled within a maximum period of fifteen (15) days from the receipt of the verified request.
7. Data Retention, Certificate Verification, and Anonymization (Article 16)
7.1. Certification Persistence: Exam performance, CEFR band scores, and certificate serial numbers are retained indefinitely under Article 16, I & IV of the LGPD (contractual fulfillment, permanent verification capability, and statistical/research use). This ensures that candidates can validate their academic credentials to employers and academic institutions throughout their careers.
7.2. Candidate-Requested Deletion: If a candidate demands total erasure of their testing identity under Art. 18, VI, the candidate formally acknowledges that all associated certification verification numbers will be permanently revoked and decommissioned from the online verification registry. Employers or universities will no longer be able to authenticate the issued credential.
7.3. Log & Proctoring Telemetry: Web access logs, session tokens, and IP logs collected during testing are purged within twelve (12) months unless flagged for security investigation or fraud audits.
8. Designated Data Protection Officer (Encarregado de Dados)
8.1. Pursuant to Article 41 of the LGPD, Global Language Training Ltd. has established a dedicated communication channel to receive complaints, inquiries, and requests from Brazilian data subjects and the ANPD.
• Designated Role: Privacy Officer & Encarregado LGPD
• Dedicated LGPD Contact:
• Corporate Address: 20-22 Wenlock Road, London, N1 7GU, England
• Operating Hours: Monday – Friday, 09:00 to 18:00 UTC (Portuguese and English language intake available)
9.1. Security Incident Protocol: In the event of a security breach involving candidate personal data that may create relevant risk or damage to individuals, Global Language Training Ltd. will notify the ANPD and affected candidates within the regulatory timelines dictated by the ANPD, detailing the nature of the data affected, protective technical measures implemented, and remediation steps taken.
9.2. Revisions: This Addendum is periodically audited to reflect regulatory resolutions, guidelines, and directives enacted by the ANPD. Updates will be published on https://www.itestenglish.com/privacy-policy.
10. Assessment, Audio & Visual Proctoring Data: During online assessment sessions, our platform may record candidate audio (spoken responses), webcam footage, photographic identity verification, and browser telemetry for the explicit purpose of test authentication, assessment scoring, and anti-fraud monitoring. These records are held securely on encrypted servers.
11. Retention Periods: Candidate assessment evidence—including written scripts, audio recordings of speaking assessments, examiner marking sheets, and proctoring logs—is retained securely for a minimum period of three (3) years following result issuance, in compliance with Awarding Organisation regulatory retention schedules.