Privacy Policy

1. Who We Are

Universitio Ltd ("Universitio", "we", "us", "our") is the data controller responsible for your personal data.

Universitio Ltd is a UK-registered education consultancy company (Company No. 15168670), with its registered office at 44 Birmingham Road, Birmingham, B72 1QQ, United Kingdom.

We are registered with the UK Information Commissioner's Office (ICO).

For any privacy-related question, contact us at [email protected].

2. Data We Collect

Depending on how you use our website and services, we may collect:

• Identity data — name, date of birth, nationality, country of birth, gender, marital status, passport number and passport expiry date
• Contact data — email address, phone or WhatsApp number, residential address, city, postcode and country
• Emergency contact data — the name, relationship and phone number of the person you nominate
• Education data — qualifications, grades, level and subject of study, study preferences, language test results and intended destination
• Funding data — how you tell us your studies will be funded
• Documents — CV, statement of purpose, transcripts, certificates, research proposals and identification documents
• Payment data — records of fees paid to us, the date and amount, and the reference supplied by our payment provider. We do not collect or store your full card details. Card data is handled directly by our payment provider.
• Communication data — messages, emails, call notes and form submissions exchanged with us
• Technical data — IP address, browser type, device information, operating system and usage information collected through cookies and similar technologies
• Marketing preferences — your consent or opt-out choices

3. Special Category and Criminal Offence Data

This section exists because our Student Application Form asks three questions that, depending on your answers, involve categories of data that UK law treats as requiring extra protection. We want you to know exactly why we ask and what happens to the answers.

3.1 What we ask

The form asks:

• whether you have ever been refused a visa, refused entry, or deported from any country;
• whether you have ever had a criminal conviction, caution or pending charge in any country;
• whether you have a medical condition or disability for which you may need support.

3.2 Why we ask

We ask because institutions and immigration authorities ask. An undisclosed refusal, conviction or support need that emerges later can end an application that would otherwise have succeeded. Knowing early lets us prepare your application properly, or tell you honestly that a route is not realistic.

3.3 How each is treated

• Visa and immigration history is ordinary personal data. It is not a special category.
• Criminal convictions, cautions and pending charges are criminal offence data under Article 10 of the UK GDPR.
• Medical conditions and disabilities are health data, which is special category data under Article 9 of the UK GDPR.

3.4 Our lawful basis for the sensitive answers

We process the health and criminal offence answers only with your explicit consent, given when you complete and sign the form. You are not required to answer those two questions in order to use our services, and we will tell you plainly where an unanswered question limits what we can do for you.

You can withdraw that consent at any time by emailing [email protected]. Withdrawal does not affect processing carried out before you withdrew, and we will tell you what it means for any application already submitted.

3.5 What we do with those answers

• We use them only to assess and prepare your application and to advise you.
• We share them with an institution or authority only where that institution or authority requires the disclosure, and only to the extent required.
• We do not use them for marketing, profiling, or any automated decision-making.
• They are held in your private shared folder described in section 4.1, not on our website, and are accessible only to the Universitio team members working on your application.
• Where an application does not proceed, we delete these answers ahead of your other data, on the schedule in section 11.

3.6 What we do not want

Beyond those three questions, please do not send us data about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or your sex life or sexual orientation. We do not need it and we do not ask for it.

4. How We Collect Data, and Where Your Documents Live

• Directly from you — when you complete a form, take the Smart Assessment, request a consultation (including uploading a CV with your request), or contact us by email, phone or WhatsApp
• Automatically — when you visit our website, through cookies, server logs and similar technologies
• From third parties — in limited cases, through trusted education partners or institutions, or where information is publicly available

4.1 Your secure shared folder

When we begin working with you, we create a private cloud folder for you alone, hosted on Google Drive and shared only between you and Universitio. It is shared with your specific email address, not by a public or open link.

That folder is where:

• you complete and sign your Student Application Form
• you upload the documents we ask for, including identification and original certificates
• we place the offers and correspondence we receive on your behalf

Your signed form and your documents are held in that folder, not on our website. The website never stores your passport, your certificates, or the answers you give to the questions in section 3. The one exception is a CV you choose to upload when requesting a consultation: that CV is kept in private storage on our website so that we can prepare for your consultation.

You can ask us at any time to show you everything in the folder, to correct anything in it, or to delete it.

5. How We Use Data

We use your personal data to:

• respond to your enquiries and requests
• provide our consultancy and admissions services
• operate the Smart Assessment
• assess your eligibility and recommend suitable courses and institutions
• prepare and submit your applications and correspond with institutions on your behalf
• communicate with you about your enquiry, application or services
• send relevant educational opportunities and updates where you have agreed
• monitor, evaluate and improve the quality of our services
• maintain the security and integrity of our website and services
• comply with our legal, regulatory and accounting obligations

6. Legal Basis for Processing

We process personal data only where we have a lawful basis:

• Consent — for marketing, non-essential cookies, optional data collection, and for the health and criminal offence answers described in section 3. You may withdraw consent at any time.
• Contract — where processing is necessary to deliver a service you have asked for, including preparing and submitting your applications and taking payment.
• Legitimate interests — where processing is necessary for our legitimate business interests and your rights do not override them. This includes operating and securing our services, preventing misuse, analytics, and service-related communications.
• Legal obligation — where we must process data to comply with UK law, including tax, accounting and regulatory obligations.

7. Marketing

We may send you educational opportunities, updates and offers where you have agreed to receive them.

You can opt out at any time using the unsubscribe link in any marketing email, or by emailing [email protected].

We do not sell your personal data, and we never use the answers described in section 3 for marketing.

8. Data Sharing

We share personal data only where necessary, with:

• Universities, colleges and schools — where you ask us to support your application, or where we introduce you to a programme
• Trusted service providers — hosting, cloud infrastructure, email, customer relationship management, analytics, payment processing and security providers. This includes Google, whose Drive service hosts the private shared folder described in section 4.1 and therefore stores your documents and signed form.
• Professional advisers — accountants, auditors and lawyers, where reasonably necessary
• Authorities and regulators — where required by law or in response to a lawful request
• Successors in interest — in a corporate restructuring, merger or sale, subject to appropriate confidentiality and data protection arrangements

All third parties processing personal data on our behalf do so under written agreements meeting UK GDPR standards, apply appropriate security measures, and may use your data only for the purposes we specify. We do not allow them to use your data for their own marketing.

9. International Transfers

Some service providers may process personal data outside the United Kingdom. Where that happens we ensure an appropriate safeguard is in place, such as:

• a UK adequacy decision for the destination country
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
• another lawful transfer mechanism recognised under UK data protection law

10. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include encryption in transit, access controls, authentication safeguards, secure infrastructure and staff confidentiality obligations.

Access to the data described in section 3 is further restricted to team members directly working on your application.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work continuously to maintain and improve our safeguards.

11. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

• General enquiry and consultancy data, including any CV uploaded with a consultation request — up to three (3) years from your last interaction with us
• Health and criminal offence answers (section 3) — deleted within six (6) months of your application process ending, whether or not it succeeded, unless we are required to keep them for longer by law. Because these answers sit on your signed form, this means removing that form from your shared folder
• Your shared folder and its documents (section 4.1) — kept while your application is active and for up to three (3) years afterwards, then deleted. You can ask us to delete it sooner
• Financial and accounting records — as required by UK law, typically six years
• Marketing preference records — until you withdraw consent, or as long as needed to honour your opt-out

Data may be kept longer where necessary for legal, regulatory, dispute-resolution or fraud-prevention purposes. When no longer needed, data is deleted or anonymised.

12. Your Rights

Under UK GDPR you have the right to:

• access — obtain a copy of the personal data we hold about you
• rectification — ask us to correct inaccurate or incomplete data
• erasure — ask us to delete your data, subject to legal exceptions
• restrict processing — ask us to limit how we use your data in certain circumstances
• object — object to processing based on legitimate interests, and to direct marketing at any time
• data portability — receive certain data in a structured, commonly used, machine-readable format
• withdraw consent — where we rely on consent, including the section 3 answers
• complain — to the Information Commissioner's Office

To exercise any of these rights, email [email protected]. We may need to verify your identity. We aim to respond within one calendar month, which may be extended for complex requests as permitted by law.

13. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected]. We will do our best to resolve it.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk.

14. Cookies

Our website uses cookies and similar technologies. Essential cookies are necessary for the site to function. Non-essential cookies, including analytics, are used only with your consent, which you can change at any time.

15. Third-Party Links

Our website may link to third-party websites, institutions or services. We do not control and are not responsible for their content, accuracy, availability or privacy practices.

16. Children's Data

Where we support applications for school or college placements, we may process data about applicants under 18. In those cases we require the involvement and consent of a parent or legal guardian, we collect only what the institution requires, and we apply the same restrictions set out in section 3 to any sensitive information.

17. Changes to This Policy

We may update this policy. The current version is always published on this page with an updated "Last updated" date. Where a change materially affects how we use data you have already given us, we will tell you.

18. Contact

Email: [email protected]

Phone: +44 7963 345465

Address: 44 Birmingham Road, Birmingham, B72 1QQ, United Kingdom