Privacy Policy
How we handle personal data across all of our services.
| Item | Details |
|---|---|
| Version | 2.1 |
| First published | 1 April 2020 |
| Last revised | 3 October 2026 |
| Language | This page is available in Japanese and English. If the two differ, the Japanese version prevails. |
Summary
- This page sets out the parts of how ELT Education Inc. ("we", "us") handles personal data that are common to all of our services.
- Detailed information for each group of people we deal with (what we collect, why, who processes it for us and how long we keep it) is in the notices for each group. Matters common to those notices (contact point, your rights, joint use with our UK company, security measures, international transfers and supervisory authorities) are governed by this page.
- There is one contact point for questions, requests and complaints: privacy (at) elteduc.com.
- We and our UK company, ELT School of English Limited, jointly use personal data about customers, staff and tutors. We are responsible for its management (section 5).
- We may store and process personal data in Japan and also in the United Kingdom, the EU, the United States and other countries (section 10).
- For enquiries, job applications and report requests on this website (elteduc.com), and for how we measure its use, see section 11 and Cookies and external transmission.
1. Notices for each group
| Who you are | Notice |
|---|---|
| Students and parents of ELT's school, people who contact the school, and corporate training clients (including customers in the UK) | Customer Privacy Policy |
| PCAT test takers and purchasers, and contacts at corporate clients | PCAT Privacy Policy |
| Staff of ELT Education Inc. and of the UK company, and tutors | Privacy Policy on the staff site and the tutor site (identical) |
| Schoozy users and contacts at listed schools | Schoozy Privacy Policy |
| Visitors to this website (elteduc.com), and people who contact us, apply for a job or request a report through it | Section 11 of this page |
Cookies and other information stored on your device or sent to third parties are described in Cookies and external transmission.
2. Who we are
| Item | Details |
|---|---|
| Name | ELT Education Inc. (株式会社ELTエデュケーション) |
| Address | 5-32-12 Shiba, Minato-ku, Tokyo 108-0014, Japan |
| Representative | Tatsuya Tanaka, Representative Director |
ELT School of English Limited (Company No. 04497523, 35 Ballards Lane, London N3 1XW, United Kingdom) is a separate company from us. Our relationship with it is described in section 5 and section 6.
3. Contact point
We handle questions, requests and complaints about personal data at the contact point below. This includes requests about all of our services and about personal data jointly used with the UK company (section 5).
| Item | Details |
|---|---|
| privacy (at) elteduc.com | |
| Post | Personal Data Contact, ELT Education Inc., 5-32-12 Shiba, Minato-ku, Tokyo 108-0014, Japan |
| Languages | Japanese, English |
See section 8 for how to make a request.
4. Applicable law
We handle personal data in accordance with Japan's Act on the Protection of Personal Information (the "APPI"). Where the UK GDPR (including the Data Protection Act 2018) or the EU GDPR applies, we also comply with that law to the extent it applies.
On this page, "personal data" means personal information and personal data as defined in the APPI. For people to whom the UK GDPR or the EU GDPR applies, it also includes personal data as defined in those laws.
5. Joint use with our UK company
We and ELT School of English Limited (the "UK company") jointly use personal data as set out below. We are the party responsible for managing the jointly used personal data.
| Item | Details |
|---|---|
| Parties to the joint use | ELT Education Inc.; ELT School of English Limited (Company No. 04497523, 35 Ballards Lane, London N3 1XW, United Kingdom) |
| Party responsible for management | ELT Education Inc. (address and representative as in section 2) |
5.1 Customer personal data
We and the UK company each handle the other's customer data (we handle data about customers who contract with the UK company, and the UK company may access data about customers who contract with us).
| Item | Details |
|---|---|
| Who it covers | Students and parents of ELT's school, people who contact the school, and corporate training clients |
| Personal data jointly used | Name; contact details (address, telephone number, email address, etc.); history of lessons, training and counselling; results and assessments; contract details; payment status |
| Purposes of each party | Both companies: providing, running and improving our services (lessons, training, counselling, etc.); delivering and supporting lessons through tutors and staff in our locations, including the UK; managing contracts and billing; responding to enquiries |
See the Customer Privacy Policy for details.
5.2 Staff and tutor personal data
Employees and contractors of the UK company also use our business system as staff. Some tutors contract with the UK company.
| Item | Details |
|---|---|
| Who it covers | Staff of ELT Education Inc. and of the UK company, and tutors |
| Personal data jointly used | Data that employees and contractors of the UK company handle in their work (tutors' profiles, contact details, contracts, pay, lesson records, tutor notes and customer feedback; staff names, email addresses and work records, etc.) |
| Purposes of each party | ELT Education Inc.: the purposes set out in the Staff and Tutor Privacy Policy. The UK company: managing staff who are its employees or contractors, and managing tutors it contracts with (assigning lessons, calculating and paying fees, quality management and work communications) |
See the Staff and Tutor Privacy Policy for details.
5.3 Roles under the UK GDPR and the EU GDPR
Where the UK GDPR or the EU GDPR applies, we and the UK company are joint controllers of customer personal data. The essence of how the two companies share their responsibilities as joint controllers (UK GDPR Article 26) is:
| Matter | Arrangement |
|---|---|
| Providing information to individuals | We do this through the Customer Privacy Policy and this page |
| Requests and complaints | We receive them centrally at our contact point (privacy (at) elteduc.com) and the two companies deal with them between them. Regardless of this arrangement, you may exercise your rights against either company |
| Security | Each company takes security measures for the personal data it handles |
| Breaches | The company that becomes aware of a breach informs the other immediately, and we lead on reporting to supervisory authorities and notifying affected individuals |
The roles of the two companies for staff and tutor personal data differ by purpose. See section 2.3 of the Staff and Tutor Privacy Policy.
6. UK representative
Because we offer services to people in the UK without having an establishment there, we have appointed the UK company as our representative in the UK under Article 27 of the UK GDPR. People in the UK and the UK supervisory authority (the ICO) may contact the representative as well as our contact point.
| Item | Details |
|---|---|
| Representative | ELT School of English Limited |
| Address | 35 Ballards Lane, London N3 1XW, United Kingdom |
| Contact | privacy (at) elteduc.com (please write "UK Representative" in the subject line) |
7. Your rights
Subject to the applicable law and the conditions for each right, you may exercise the following rights.
| Right | What it means | Legal basis |
|---|---|---|
| Notification of purposes | To be told the purposes for which we use the personal data we hold about you | APPI |
| Disclosure / access | To have the personal data we hold about you disclosed and to receive a copy | APPI, GDPR |
| Disclosure of third-party provision records | To have records of our providing your personal data to, or receiving it from, third parties disclosed | APPI |
| Correction, addition or deletion | To have inaccurate data corrected, added to or deleted | APPI, GDPR |
| Suspension of use / erasure | To have the use of your data stopped and the data erased | APPI, GDPR |
| Suspension of provision to third parties | To have the provision of your data to third parties stopped | APPI |
| Restriction | To have processing temporarily restricted | GDPR |
| Data portability | To receive the personal data you provided to us in a structured format, or have it sent to another organisation | GDPR |
| Objection | To object to processing based on legitimate interests. You may object at any time to use for direct marketing | GDPR |
| Withdrawal of consent | To withdraw consent at any time for processing based on consent. This does not affect the lawfulness of processing before the withdrawal | GDPR |
Information that you can view or change in a service (such as your email address or contact details) can also be viewed or changed there.
8. How to make a request
| Item | Details |
|---|---|
| Where to send it | privacy (at) elteduc.com (or by post to the address in section 3) |
| What to include | The type of request (disclosure, correction, suspension of use, etc.), the service concerned, your name and the email address you registered with us |
| Identity check | We verify a request by its coming from the email address you registered with us. We may ask for further information to confirm your identity where necessary |
| Requests by a representative | A legal representative (such as the parent or guardian of a minor) or a representative you have appointed may make a request. We will ask for documents confirming their authority |
| Fee | Free of charge. However, for manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act on the request, to the extent permitted by law |
| How we respond | By email (including providing data in electronic form) or by another method you specify. If the method you specify is difficult for us, we will tell you and respond in writing or by another method |
| Response time | We respond to requests under the APPI without delay. We respond to requests under the GDPR within one month of receipt. Where a request is complex or numerous, we may extend this by up to two further months, telling you why |
Where the law allows (for example, where we must keep the data by law, where responding could harm the rights or interests of you or a third party, or where it could seriously interfere with the proper conduct of our business), we may decline all or part of a request. If so, we will tell you and explain why.
9. Security measures
We take the following measures to prevent leakage, loss or damage of personal data and otherwise keep it secure.
| Category | Measures |
|---|---|
| Basic policy | We have set out and published this page and the notices for each group to ensure personal data is handled properly |
| Organisational measures | We have appointed a person responsible for handling personal data. Personal data is handled for the purposes and in the ways set out on this page and in the notices for each group, and in line with the procedure for leaks and other incidents (9.1) |
| Human measures | Employees and contractors handle personal data they learn through their work in accordance with the confidentiality obligations in their contracts |
| Physical measures | Personal data is mainly stored in the data centres of cloud services, whose physical security is managed by the cloud service providers |
| Technical measures | We use access control based on role and the sensitivity of information, multi-factor authentication, password protection, encryption of communications and protection against unauthorised access |
| Understanding the external environment | We take security measures after understanding the personal data protection systems of the countries where we store or process personal data (Japan, the UK, EU member states, the United States and others). The places where each service stores and processes data are listed in the notice for each group |
9.1 If a breach occurs
If personal data is leaked, lost or damaged, or this may have happened, we act to prevent further harm, investigate the facts and the scope of the impact, and take steps to prevent it happening again. Where the law requires, we report to the Personal Information Protection Commission of Japan (and, where people in the UK or EU are affected, to the ICO or other supervisory authorities) and notify the individuals affected.
10. International transfers
To provide our services, we may provide personal data to organisations outside Japan (such as the UK company and cloud service providers that process data for us), or store personal data outside Japan. The actual destination countries and organisations are listed in the notice for each group.
| Direction | Our approach |
|---|---|
| From Japan to the UK or the EU | The Personal Information Protection Commission of Japan has designated the UK and the EU as having personal data protection systems equivalent to Japan's (PPC Notice No. 1 of 2019) |
| From Japan to other countries | Through contracts and other measures with the recipient, we ensure the system required by Article 28 of the APPI (a system for continuously taking measures consistent with the APPI). You may ask our contact point in section 3 for information on that system and on the recipient country's laws. Where the law requires, we obtain your consent |
| From the UK or the EU to Japan | The UK and the EU have found Japan to provide adequate protection. We apply the Personal Information Protection Commission's Supplementary Rules to personal data we receive from the UK or the EU on the basis of those adequacy findings |
| From the UK or the EU to other countries | We protect the data with standard contractual clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) or Addendum with the recipient, or with an adequacy finding for the recipient country (including the recipient's participation in the EU-US Data Privacy Framework and its UK Extension) |
11. This website (elteduc.com)
This section covers visitors to our website elteduc.com and people who use its forms.
11.1 What we collect and why
| When | What we collect | Why | GDPR legal basis |
|---|---|---|---|
| Enquiries (contact form) | Type of enquiry, name, company or school name (required for some types), email address, telephone number (optional), subject, message | To answer your enquiry and respond to requests for consultation | Steps prior to entering into a contract (Article 6(1)(b)); legitimate interests ((f): answering enquiries) |
| Job applications (application form) | Position, name, email address, cover letter, CV file; optionally teaching qualifications, portfolio URL, time zone and availability | To assess your application and contact you | Steps prior to entering into a contract ((b)) |
| Report requests (Insights reports) | Name, organisation, role category, email address, whether you would like a consultation | To send you the report, contact you if you asked for a consultation, and understand demand for our reports | Performance of a contract ((b): sending the report you requested); legitimate interests ((f): understanding demand and responding to consultation requests) |
| Any form submission | IP address; browser information (user agent, language, time zone, screen size); the page you submitted from and the previous and first pages you viewed; referrer; advertising and campaign identifiers (utm_* parameters, gclid, fbclid, etc.); Google Analytics identifier | To prevent fraudulent submissions and understand how people reach us | Legitimate interests ((f): preventing abuse and improving the site) |
A form cannot be submitted without its required fields. The previous and first pages you viewed, the referrer, advertising and campaign identifiers and the Google Analytics identifier are attached only if you allow analytics (Cookies and external transmission).
11.2 Processors and recipients
| Recipient | Purpose | Data received | Location |
|---|---|---|---|
| Vercel Inc. | Serving the website and processing form submissions | Communication content, IP address, browser information | United States and other countries (content is served from locations close to the visitor) |
| Resend (a US company) | Sending confirmation emails and notification emails to our staff | Form content and the common information in 11.1 | Japan (Tokyo, for sending the emails), United States |
| Google (Google Workspace) | Receiving and storing notification emails to our staff | Form content, the common information in 11.1, and the download link for CVs | United States and other countries |
| Google Cloud (Cloud Storage) | Storing CVs and records of report requests | CV files and report request details | Japan (Tokyo) |
| Google (reCAPTCHA Enterprise) | Preventing fraudulent form submissions | Device and interaction information sent by your browser | United States and other countries |
| Google (Google Analytics) | Analysing use of the website | As set out in Cookies and external transmission | United States and other countries |
11.3 How long we keep data
| Data | Retention |
|---|---|
| CVs | Deleted automatically two years after being stored in Cloud Storage |
| Records of report requests | Deleted automatically two years after being stored in Cloud Storage |
| Notification emails to our staff (enquiries, applications, report requests) | Kept after we have finished dealing with the matter (answering the enquiry, assessing the application or sending the report) for as long as needed to handle disputes and enquiries, and deleted once no longer needed. They are not deleted automatically after a fixed period |
| Google Analytics data | Up to 14 months under our Google Analytics settings (data on individual visits; aggregated reports remain after that) |
11.4 Analytics and cookies
This website uses Google Analytics to analyse how it is used. For visitors from the UK and the EU (EEA), and visitors whose region cannot be determined, we do not load analytics tags until you consent. In other regions (including Japan), analytics is on by default and you can refuse it at any time. See Cookies and external transmission for details.
This website does not serve advertising.
12. Complaints and supervisory authorities
We handle complaints about how we handle personal data at the contact point in section 3.
You may also complain to the following supervisory authorities.
| Authority | Contact |
|---|---|
| Personal Information Protection Commission (Japan) | https://www.ppc.go.jp/en/ |
| Information Commissioner's Office (ICO, UK) | https://ico.org.uk/make-a-complaint/ |
| Supervisory authorities in EU member states | Where the EU GDPR applies, the authority in the country where you live or work, or where the alleged infringement took place (list: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) |
13. Changes
- We may revise this page and the notices for each group as laws change or as our business requires. The revision date and version are shown at the top of each page.
- We will tell you about important changes, such as new purposes, new processors or new destination countries, through our services, by email or by other appropriate means, as required by law.
14. Revision history
14.1 This page
| Date | Version | Changes |
|---|---|---|
| 1 April 2020 | — | First published (Japanese version) |
| 1 June 2025 | — | Revised (Japanese version) |
| 3 October 2026 | 2.0 | Complete revision. This page became the hub for matters common to all of our services: a single contact point, joint use with the UK company, UK representative, international transfers, a list of the notices for each group, and how this website handles personal data. The English version now matches the Japanese version. Cookie information moved to Cookies and external transmission |
| 3 October 2026 | 2.1 | Updated 14.2 for the revised PCAT Privacy Policy (version 2.0). Added the PCAT websites to the list of analytics in Cookies and external transmission |
14.2 Current versions of the notices for each group
| Notice | Version | Last revised |
|---|---|---|
| Customer Privacy Policy | — | 14 November 2025 |
| PCAT Privacy Policy | 2.0 | 3 October 2026 |
| Staff and Tutor Privacy Policy | 1.0 | 26 September 2026 |
| Schoozy Privacy Policy | — | 13 April 2026 |