Legal
Privacy Policy
How Institute of Rugby London handles your personal data
How Institute of Rugby London handles your personal data
How the Institute of Rugby London collects, uses and protects personal information, including information about applicants under 18.
Last updated 31 July 2026. We are the data controller. Contact us at info@instituteofrugby.london.
We only collect what you give us through the forms on this site. Nothing is bought from third parties and nothing is scraped.
Enquiry form. Name, email address, phone number if you give one, the topic of your enquiry, your message, and optionally your role, age group, club, playing position and the programme you are interested in.
Programme application. Name, email, phone, the programme applied for, age band, playing level, position, club, coaching level where relevant, country of residence, anything you add in the notes, and for applicants under 18 the name and email of a parent or guardian.
Accommodation application. Name, email, phone, programme, age band, move-in and move-out dates, board preference, any access, dietary or medical needs you choose to tell us, and a parent or guardian's name and phone number for under-18s.
Where you tell us about medical or dietary needs, that is special category data under UK GDPR. We ask for it only so we can look after you safely on a residential programme, we rely on your explicit consent, and we share it only with the staff who need it.
Many of our programmes and camps are for under-18s, so we design for that rather than treating it as an exception.
If you are under 18, we ask for a parent or guardian's details and we expect them to be involved in your application. We will not progress an application for a minor without contacting the named adult. A parent or guardian may ask us at any time to show them what we hold about their child, correct it, or delete it.
Safeguarding concerns are handled separately from applications, by our Designated Safeguarding Lead, and are kept only as long as our safeguarding obligations require.
To answer your enquiry and assess your application. Our lawful basis is legitimate interests: you contacted us and expect a reply.
To arrange accommodation, catering and medical support. Performance of a contract once you accept a place, and explicit consent for health-related details.
To keep you safe on our programmes. Legal obligation and legitimate interests, particularly our safeguarding duties towards under-18s.
To understand how the site is used. Consent, which you give or refuse through the cookie notice, and can change at any time.
We do not use your details for marketing unless you have separately asked us to, and we never sell them.
Only the suppliers who run parts of this service for us, under contract, and only for that purpose.
Supabase stores form submissions. Data is held in Ireland (eu-west-1).
Resend sends the confirmation emails. Processed in the EU (eu-west-1).
Vercel hosts this website.
Google Analytics measures site usage, and only if you consent.
Brunel University London receives the details needed to arrange campus
accommodation, and only for applicants who apply for a room.
Some of these providers are based in the United States. Where information is transferred outside the UK, it is protected by the UK International Data Transfer Addendum or an adequacy decision.
Enquiries are kept for 12 months from your last contact with us. Unsuccessful applications are kept for 12 months so we can consider you for a future intake, unless you ask us to remove them sooner. Records for people who join a programme are kept for the duration and for six years afterwards, which covers our insurance and accident reporting obligations. Safeguarding records are kept in line with statutory guidance, which can be longer.
We set no analytics cookies until you agree. When you first visit, a notice asks whether you accept them. If you decline, Google Analytics is loaded in a mode that stores nothing on your device. If you accept, Google Analytics sets cookies to recognise repeat visits and measure which pages are used.
To change your mind, clear this site's data in your browser settings and the notice will appear again.
You can ask us to show you what we hold, correct anything wrong, delete it, restrict how we use it, or provide it in a portable format. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object.
Email info@instituteofrugby.london and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Submissions travel over an encrypted connection and are stored in a database that blocks public read access: a form can add a record but nothing can read the records back without authorised access. Confirmation emails are sent from our own verified domain.
If we change this policy we will update the date at the top. Where a change materially affects how we use information you have already given us, we will contact you.