Privacy Policy

Last updated on 22 June 2026

1. Who We Are

Lustah is an English language school based in London, United Kingdom. We operate the website lustah.org and provide English language courses for adults, teenagers and children.
Contact details: Address: 30 Churchill Place, London E14 5EU, United Kingdom
Email: info@lustah.org
Tel: +44 20 3457 8124

Lustah is the data controller for the personal data collected through this website. This means we determine how and why your data is processed.
If you have any questions about this Privacy Policy or how we handle your data, please contact us at info@lustah.org.

2. What Data We Collect

Depending on how you use our website, we may collect the following categories of personal data:
Contact and enquiry data

• Full name
• Email address
• Phone number
• The content of your message or enquiry

Technical data

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on the website
• Referring website (how you found us)

Cookie data

• Session identifiers
• Preference settings
• Analytics data (see Section 5)

We do not collect sensitive personal data (such as health information, ethnicity or financial data) unless you voluntarily provide it in a message to us.

3. How We Use Your Data

We use your personal data for the following purposes:
PurposeLegal basisResponding to your enquiries and booking requestsLegitimate interests / ContractProviding and managing your course enrolmentPerformance of a contractSending you information about our courses (if requested)ConsentImproving our website and user experienceLegitimate interestsComplying with legal obligationsLegal obligationDetecting and preventing fraud or misuseLegitimate interests
We will not use your data for any purpose that is incompatible with the purpose for which it was originally collected.

4. Who We Share Your Data With

We do not sell your personal data to third parties. We may share your data with:
Service providers We work with trusted third-party providers who help us operate our website and services. These include hosting providers, email service providers and analytics tools. All third-party providers are contractually required to process your data only on our instructions and to keep it secure.
Analytics and advertising We use Google Analytics to understand how visitors use our website. Google Analytics collects anonymised data about your browsing behaviour. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
Legal requirements We may disclose your data to law enforcement or regulatory authorities if required to do so by law or in response to a valid legal request.
We do not transfer your personal data outside the United Kingdom without ensuring appropriate safeguards are in place in accordance with UK GDPR.

5. Cookies

Our website uses cookies — small text files stored on your device — to improve your experience and help us understand how the site is used.
Strictly necessary cookies These are required for the website to function and cannot be switched off. They do not store any personally identifiable information.
Analytics cookies We use Google Analytics cookies to collect anonymised information about how visitors use our website. This helps us improve our content and services. No personally identifiable data is collected via analytics cookies.
Preference cookies These cookies remember your settings and preferences so you do not have to re-enter them each time you visit.
You can manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.
For more information about cookies and how to manage them, visit ico.org.uk/for-the-public/online/cookies

6. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes set out in this policy:
Data typeRetention periodEnquiry and contact form data12 months from the date of enquiryEnrolment and course records3 years from the end of the courseBilling and payment records7 years (legal requirement)Website analytics data26 months (anonymised)Marketing consent recordsUntil consent is withdrawn + 1 year
After the relevant retention period, your data will be securely deleted or anonymised.

7. How We Protect Your Data

We take the security of your personal data seriously and have put in place appropriate technical and organisational measures, including:

• Encryption of data in transit using SSL/TLS
• Restricted access to personal data — only staff who need it to perform their role
• Secure storage on password-protected, access-controlled systems
• Regular review of our data security practices

No method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Commissioner’s Office (ICO) as required by law.

8. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:
Right of access You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification You have the right to ask us to correct any inaccurate or incomplete data we hold about you.
Right to erasure You have the right to ask us to delete your personal data where there is no longer a lawful reason for us to hold it.
Right to restrict processing You have the right to ask us to limit how we use your data in certain circumstances.
Right to data portability You have the right to receive your personal data in a structured, commonly used and machine-readable format.
Right to object You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent Where processing is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at info@lustah.org. We will respond within 30 days. In complex cases, this period may be extended by a further 60 days, and we will inform you if this is the case.
We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.

9. Marketing Communications

We will only send you marketing emails if you have given us your explicit consent to do so. You can withdraw your consent and unsubscribe from marketing emails at any time by:

• Clicking the unsubscribe link in any marketing email
• Contacting us at info@lustah.org

We will process your unsubscribe request promptly and no later than within 10 working days.

10. Children’s Data

Our children’s English courses are provided to pupils under the age of 18. Enrolment for children requires consent from a parent or guardian. We collect only the data necessary to provide the course, and we do not use children’s data for any marketing purpose.
If you believe we have inadvertently collected data about a child without appropriate consent, please contact us at info@lustah.org and we will delete it promptly.

11. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first so we can try to resolve the matter.
You also have the right to lodge a complaint with the UK’s data protection regulator:
Information Commissioner’s Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113 Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you by email or by placing a prominent notice on our website. The date of the most recent update is shown below.
We encourage you to review this policy periodically.

13. Contact

For any questions, requests or concerns relating to this Privacy Policy or the way we handle your personal data, please contact us:
Email: info@lustah.org

Tel: +44 20 3457 8124

Address: 30 Churchill Place, London E14 5EU, United Kingdom

Opening hours: Monday–Saturday, 09:00–18:00