This Privacy Policy explains how SEDA College collects, uses and protects personal data when you visit our website seda.college, contact us, apply for or book a programme, use the MySEDA app, and study with us in Dublin or Cork. It also explains your rights and how to exercise them.
We process personal data in accordance with the following laws:
the General Data Protection Regulation (EU) 2016/679 ("GDPR");
the Data Protection Acts 1988 to 2018;
the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011).
Our use of cookies is explained in detail in our Cookie Policy at seda.college/cookie-policy.
1. Who we are
SEDA College is the trading name of SEDA (Skills & Enterprise Development Academy) Ltd ("SEDA", "we", "us"). It is a company registered in Ireland with company registration number 462209. Its registered office is at Zhivago Building, 68–72 Capel Street, Dublin 1, D01 AR29.
We are the controller of the personal data described in this policy, except for the personal data SEDA Summer College Limited processes as a separate controller for its services described below.
Dublin: Zhivago Building, 68–72 Capel Street, Dublin 1, D01 AR29 · Telephone: +353 (0)1 473 4915
Cork: Clarke's Bridge House, Hanover Street, Cork, T12 P9RY · Telephone: +353 (0)21 241 0944
Email: info@seda.ie · Website: seda.college
SEDA Summer College Limited. SEDA Summer College Limited is our sister company (company registration number 748340, 68–73 Capel Street, Dublin 1). For junior and short-stay bookings, it may:
arrange commercial and operational services, including recruitment, accommodation, transport, activities and welfare outside academic hours;
collect educational fees on behalf of SEDA College, as our disclosed collection agent.
Your booking will specify which of these services apply.
For the personal data it processes for those services, SEDA Summer College Limited acts as a separate controller. SEDA College remains the education provider and the controller of the personal data processed for teaching, assessment and certification.
For any question or request about your personal data in connection with these services, contact our Data Protection Officer, Golam Sorwar, at sorwar@seda.ie. We will make sure it is answered, either by us or by SEDA Summer College Limited. Your booking documents will identify its role and the services it is responsible for.
Data Protection Officer. Our Data Protection Officer is Golam Sorwar. For any question about this policy or your personal data, you can:
email sorwar@seda.ie; or
write to the Data Protection Officer, SEDA College, Zhivago Building, 68–72 Capel Street, Dublin 1, D01 AR29.
2. The personal data we collect
Depending on how you interact with us, we may process:
Identity and contact details: name, email address, telephone and WhatsApp number, country, address, date of birth, nationality and student ID.
Enquiry details: the programme you are interested in, your preferred dates, and the messages you send us by email, web form, telephone, WhatsApp or social media.
Application and booking details:
programme and dates, English level and placement-test results, previous studies and qualifications;
passport and immigration details, where needed for your stay;
emergency contacts, accommodation, transfer and flight details;
insurance details, payments and invoices.
Card payments are processed by our payment provider; we do not store your full card number.
Student records: attendance, progress, assessments, examination registrations and results, certificates, your communications with us, and any complaints, appeals or requests you make, including through the MySEDA app.
Health and support information:
information about a disability, medical condition, allergy, dietary requirement or medication that you give us so that we can support you;
for junior learners, the medical, allergy and support information we ask the parent or guardian to provide (see section 4).
Safeguarding information: records of concerns, incidents and the actions taken, where we need to protect a learner or are required to do so by law.
Information about other people: emergency contacts you give us, parents or guardians of junior learners, and staff of education agents and group organisers.
Photographs and video: for promotional use, only with consent.
CCTV images: images recorded by CCTV cameras at our premises, which are signposted.
Online information:
IP address, device and browser information and cookie identifiers;
the pages you visit on our website and how you arrived (for example, from one of our ads);
whether you open or click our marketing emails.
Marketing preferences.
3. Where we get your personal data from
Directly from you, when you:
fill in a form on our website;
email, call or message us;
apply, book, use the MySEDA app or study with us.
From your education agent or group organiser, if you book through one.
From your parent, legal guardian or group organiser, if you are a junior learner.
From SEDA Summer College Limited, where it handles your junior or short-stay booking.
From examination bodies, when they send us your results.
From Google Analytics 4 and HubSpot website tracking, only if you accept analytics cookies. Website enquiry forms work without analytics consent; first-touch campaign and referral values are attached to a submitted enquiry.
Information about other people comes from whoever gives it to us:
emergency contacts, from the learner, parent, guardian, agent or group organiser;
details of parents or guardians, from the parent, guardian or group organiser;
contact details of agents' and organisers' staff, from those organisations.
If you give us information about another person, please make sure they know you are doing so and point them to this policy.
4. Why we use your personal data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry or quotation request and sending you the course information you asked for. | Steps taken at your request before entering into a contract (Article 6(1)(b)). |
| Recording your enquiry in our customer relationship management system (HubSpot) and following it up. We do not use this to send you marketing unless you have consented to it. | Our legitimate interest in managing enquiries from prospective students efficiently (Article 6(1)(f)). |
| Sending you news and offers about our programmes by email or other electronic messages, and measuring whether those messages are opened and their links clicked. | Your consent (Article 6(1)(a)), as required by Regulation 13 of S.I. No. 336/2011. You can unsubscribe at any time. |
| Measuring how our website is used with Google Analytics 4, loaded directly only after analytics consent. | Your consent (Article 6(1)(a)), as required by Regulation 5(3) of S.I. No. 336/2011. |
| Delivering your programme: processing your application and booking, taking payments, placement and assessment, registering you for external examinations, issuing certificates, providing the MySEDA app, and arranging any accommodation, transfers and activities you book. | Performance of our contract with you (Article 6(1)(b)). Where someone else books for you (for example a parent, guardian or group organiser): our legitimate interest in delivering the programme booked for you (Article 6(1)(f)). |
| Issuing immigration-related letters, keeping attendance records and providing information to immigration authorities where we are legally required to do so. | The same basis as the row above; and compliance with a legal obligation (Article 6(1)(c)) where we must provide information to immigration authorities. |
| Meeting our quality-assurance and regulatory obligations, including as part of the TrustEd Ireland / International Education Mark evaluation process, and learner protection arrangements. | Compliance with a legal obligation (Article 6(1)(c)) under the Qualifications and Education and Training (Quality Assurance) Acts 2012 to 2019; and our legitimate interest in maintaining our quality-assurance standards (Article 6(1)(f)). |
| Keeping accounting and tax records. | Compliance with a legal obligation (Article 6(1)(c)). |
| Supporting a disability, medical condition, allergy or other need you tell us about. | The same Article 6 basis as for your booking (see above), and your explicit consent (Article 9(2)(a)). |
| Acting in an emergency. | Vital interests (Article 6(1)(d)) and, for health information where you cannot give consent, Article 9(2)(c). |
| Junior programmes (learners under 18): parental consents, supervision, collection arrangements, emergency contacts and safeguarding. | Parent or guardian who books: performance of our contract (Article 6(1)(b)). Junior learner: our legitimate interest in delivering the programme safely and supervising junior learners (Article 6(1)(f)); and, where necessary to protect a child or comply with the law, Article 6(1)(c) or (d). Medical, allergy and support information: the explicit consent of the parent or guardian, collected directly from them, including for group bookings (Article 9(2)(a)); in an emergency, Article 9(2)(c). Giving this information is voluntary. If a parent or guardian prefers not to give it, we will discuss with them how to keep the learner safe. |
| Recording and reporting safeguarding concerns, including reports to Tusla or An Garda Síochána. | Compliance with a legal obligation (Article 6(1)(c)) under the Children First Act 2015 and related law; vital interests (Article 6(1)(d)). For special-category data: Article 9(2)(g) and section 52 of the Data Protection Act 2018, or Article 9(2)(c). |
| Keeping the details of emergency contacts you give us, so that we can reach them if needed. | Our legitimate interest in being able to contact someone on your behalf (Article 6(1)(f)); in an emergency, vital interests (Article 6(1)(d)). |
| Working with education agents and group organisers (contact details of their staff and group leaders). | Our legitimate interest in managing our relationships with partners who book on behalf of learners (Article 6(1)(f)). |
| Handling complaints, refund requests and appeals, and establishing, exercising or defending legal claims. | Our legitimate interests in handling these fairly and in establishing, exercising or defending legal claims (Article 6(1)(f)) and, where applicable, legal obligations (Article 6(1)(c)). For health information you provide to support a request: your explicit consent (Article 9(2)(a)) or, where a legal claim is involved, Article 9(2)(f). |
| Using photographs and video in our promotional materials. | Your consent (Article 6(1)(a)); for junior learners, the consent of a parent or guardian. This consent is separate from accepting our Terms and Conditions. Refusing it will not affect your enrolment or participation. |
| CCTV at our premises, for the security of people and property. | Our legitimate interest in protecting learners, staff, visitors and property (Article 6(1)(f)). |
| Keeping our website, systems and the MySEDA app secure. | Our legitimate interest in protecting our website, systems and users (Article 6(1)(f)). |
Where we rely on legitimate interests, you can object at any time on grounds relating to your particular situation (see section 9).
5. Website analytics
Google Analytics 4 and HubSpot tracking are the optional analytics tools loaded by this website, only after you accept analytics cookies. Google and HubSpot process analytics data on our behalf. You can reject analytics or withdraw consent through Cookie settings at any time. No advertising tools are loaded.
6. Who we share your personal data with
Service providers acting on our behalf (processors), under contracts that meet the requirements of Article 28 GDPR. These are:
HubSpot (customer relationship management and enquiry follow-up);
Google (Google Analytics 4, only after analytics consent); HubSpot (website tracking, only after analytics consent);
Replit (website hosting and website-server enquiry storage); our n8n automation webhook (enquiry routing and follow-up); Resend and SendGrid (email notifications); and the providers of our other IT, payment and student-management systems and the MySEDA app.
Website form enquiries, including nationality, country of residence and first-touch campaign/referral values, are stored on our website server and sent to HubSpot, our n8n automation webhook and by notification email through Resend, with SendGrid as a fallback. Submitting a form does not depend on analytics consent. The HubSpot visitor cookie is included in HubSpot form context only when available.
Your education agent or group organiser, where they are involved in your booking. This includes attendance and progress information where your booking terms provide for it.
SEDA Summer College Limited, where it is involved in your junior or short-stay booking.
Examination bodies (for example, Trinity College London or IELTS), when you register for an external examination.
Accommodation, transfer and activity providers that supply services you book through us.
Insurers, where insurance is part of your booking or a claim is made.
Quality and Qualifications Ireland (QQI) and the providers of our learner protection arrangements, where required for quality assurance, as part of the TrustEd Ireland / International Education Mark evaluation process, or learner protection.
Immigration authorities (Immigration Service Delivery, Department of Justice), where we are legally required to provide information.
Tusla, An Garda Síochána, emergency services and other appropriate authorities, where necessary to protect a person or to comply with the law.
Revenue and other public bodies, where the law requires it.
Professional advisers (such as lawyers, accountants and auditors), and courts and regulators where the law requires it.
A buyer or successor, if all or part of our business is reorganised, sold or transferred, under appropriate confidentiality safeguards.
We do not sell your personal data.
7. International transfers
Some of our providers, including Replit, Google, HubSpot, Resend, SendGrid and our n8n automation service, may process personal data in the United States and other countries outside the European Economic Area (EEA). When we, or service providers acting on our behalf, transfer personal data outside the EEA, we make sure one of these GDPR transfer mechanisms applies:
an adequacy decision of the European Commission (Article 45 GDPR). For the United States, this is the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for organisations certified under it; or
the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914; Article 46(2)(c) GDPR).
Where we share your booking information with an education agent or group organiser outside the EEA:
we rely on an adequacy decision for that country where one exists, or on Standard Contractual Clauses;
where neither is available and the transfer is necessary to perform your contract or one made in your interest, we may rely on Article 49(1)(b) or (c) GDPR.
You can request a copy of the relevant safeguards by writing to our Data Protection Officer, Golam Sorwar, at sorwar@seda.ie.
8. How long we keep your personal data
| Information | Retention period |
|---|---|
| Enquiries that do not lead to a booking | 24 months after your last interaction with us; then deleted or anonymised. |
| Marketing contacts | Until you unsubscribe or withdraw your consent. We then keep your email address on a suppression list only to make sure we do not contact you again. |
| Website analytics | Google Analytics data: up to 14 months. HubSpot analytics data linked to your contact record: as long as that record. HubSpot data about visitors who never become contacts: deleted within 14 months. How long each cookie stays on your device is shown in our Cookie Policy. |
| Student records (booking, attendance, results, certificates and payments) | Six years after the end of your programme, to meet our legal, tax and accounting obligations and to deal with any claims. |
| Passport and immigration documents | For as long as required by immigration rules, and no longer than the student record. |
| Health and support information | Deleted at the end of your programme, unless we need it for a complaint, a claim or a legal obligation. |
| Complaints, appeals and legal claims | Six years after the matter is closed, or longer if proceedings are ongoing. |
| Contact details of staff of education agents and group organisers | While we work with the organisation and for 24 months after the relationship ends. |
| Safeguarding records | For as long as required by law and statutory guidance. |
| CCTV footage | 30 days, unless needed to investigate an incident or a claim. |
| Photographs and video | Until you withdraw your consent. We will then stop using them and remove them from our website and social media within 30 days. Printed materials already distributed cannot be recalled. |
When a retention period ends, we securely delete or anonymise the data.
9. Your rights
Under the GDPR you have the right to:
access your personal data and receive a copy;
rectification of inaccurate or incomplete data;
erasure of your data, where the legal conditions apply;
restriction of processing;
data portability, for data you gave us that we process by automated means on the basis of your consent or a contract;
object to processing (see the box below);
withdraw your consent at any time, without affecting the lawfulness of processing before you withdrew it.
Your right to object.
You can object at any time, on grounds relating to your particular situation, to processing of your personal data based on our legitimate interests (Article 21(1) GDPR).
You can also object at any time to the use of your personal data for direct marketing, including profiling related to it. If you do, we will no longer use your personal data for that purpose (Article 21(2) and (3) GDPR).
To object, email sorwar@seda.ie or use the unsubscribe link in any marketing email.
To exercise your rights, contact our Data Protection Officer at sorwar@seda.ie (or info@seda.ie).
Response time: we will reply without undue delay, and in any event within one month of receiving your request.
Extensions: we may extend this by two further months where necessary, taking into account the complexity and number of requests. If so, we will tell you within the first month and explain why.
Cost: exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
Identity: we may ask you to confirm your identity before we act on a request.
Exceptions: some rights are subject to legal exceptions. If we cannot fully meet your request, we will tell you why.
Complaints. You have the right to lodge a complaint with the Data Protection Commission:
6 Pembroke Row, Dublin 2, D02 X963, Ireland
telephone (01) 765 01 00 or 1800 437 737
You can also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place. We would appreciate the chance to resolve your concern first, so please contact our Data Protection Officer at sorwar@seda.ie.
10. Do you have to give us your personal data?
You can browse our website without giving us personal data; non-essential cookies are only used if you accept them.
To answer your enquiry, we need your contact details. To process an application or booking, we need the information requested in the application form. Some of it is required by law or by the immigration process, such as passport and immigration information for learners who need permission to study in Ireland. If you do not provide it, we may not be able to process your booking.
11. Automated decisions and profiling
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Placement tests may be scored automatically, but your level is confirmed by a teacher.
The website does not load advertising tools or use website advertising cookies for profiling. You may withdraw analytics consent at any time through Cookie settings.
12. Children
Our website and marketing are addressed to adults and to the parents or guardians of junior learners.
Junior programmes are booked by a parent, legal guardian or authorised group organiser, as set out in our Terms and Conditions.
Consent to participation, and any medical, allergy and support information, are given by the parent or guardian.
Where we rely on consent for an online service offered directly to a child under 16, we obtain it from the holder of parental responsibility (Article 8 GDPR and section 31 of the Data Protection Act 2018).
We do not use children's personal data for direct marketing, profiling or advertising.
For optional uses such as photographs, we also respect the learner's wishes.
If you are under 18, in short:
Your parent, guardian or group organiser booked your course and gave us some information about you, such as your name, age and emergency contacts. Your parent or guardian also told us about any health needs.
We use this information to teach you and to keep you safe while you are with us.
We only share it with people who need it for that, when the law requires it, or in an emergency.
You can ask us what information we have about you and ask us to correct it.
You can tell us if you do not want us to use your information in a certain way. We will stop, unless we have an important reason to continue, such as keeping you safe.
Just talk to a member of staff or email info@seda.ie, or ask your parent or guardian to do it for you.
13. Security and data breaches
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include access controls, encryption where appropriate, staff training and contracts with our service providers. Health and safeguarding information is handled with appropriate restrictions and is accessible only to staff who need it.
If a personal data breach occurs:
we will notify the Data Protection Commission within 72 hours where required (Article 33 GDPR);
we will tell you without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).
14. Links to other websites
Our website links to other sites, including sedasummer.com (SEDA Summer College Limited), examination bodies and social media. Those sites have their own privacy policies, and we are not responsible for how they use your personal data.
15. Changes to this policy
We may update this policy, for example when we add a new tool to our website. The current version, with its effective date, is always available at seda.college/privacy-policy. If a change significantly affects how we use your personal data, we will inform you directly where appropriate.
16. Contact us
SEDA College · SEDA (Skills & Enterprise Development Academy) Ltd · Zhivago Building, 68–72 Capel Street, Dublin 1, D01 AR29 · info@seda.ie · +353 (0)1 473 4915 · Data Protection Officer: Golam Sorwar, sorwar@seda.ie