Privacy Policy

1. Who We Are (Data Controller)

HMS Education Ltd is the Data Controller for the personal data you provide to us. We are registered in England and Wales (Company No. 16973504) with our registered office in London, United Kingdom. If you have any questions about how we handle your personal data, please use our contact page.

2. Personal Data We Collect

Depending on the services you use, we may collect the following personal data:

• Identity data — name, date of birth, nationality and passport details.
• Contact data — email address, phone number and postal address.
• Educational data — academic qualifications, examination results, transcripts, institution history and language test scores.
• Application data — personal statements, references, CVs and supporting documents submitted as part of a university or college application.
• Financial data — information about fees, scholarships or funding arrangements relevant to your application.
• Technical data — IP address, browser type, pages visited and cookies when you use our website.

We may also process special category data — such as health and disability information or details relevant to visa requirements — where it is strictly necessary to provide our services or where you have given explicit consent.

3. How We Collect Your Data

We collect your personal data through the following means:

• Directly from you — when you enquire about our services, complete a form on our website, or engage with us by phone, email or in person.
• From third parties — such as educational institutions, referees or partner organisations that provide information relevant to your application.
• Automatically — via cookies and similar technologies when you browse our website.

4. Why We Use Your Data (Purposes and Lawful Bases)

We use your personal data for the following purposes, each supported by a lawful basis under UK GDPR:

• To provide consultancy services — processing your enquiry, shortlisting programmes and supporting your application (lawful basis: performance of a contract).
• To communicate with you — responding to enquiries and keeping you informed about your application or our services (lawful basis: legitimate interests).
• To share your data with universities and institutions — transmitting your application documents to the relevant institutions (lawful basis: performance of a contract and, where required, your consent).
• To comply with legal obligations — such as retaining records as required by law (lawful basis: legal obligation).
• To send marketing communications — newsletters and updates about our services, only where you have opted in (lawful basis: consent). You may withdraw consent at any time.
• To improve our website and services — using anonymised analytics data (lawful basis: legitimate interests).

5. Sharing Your Data

We may share your personal data with the following parties, only to the extent necessary:

• Partner universities and colleges — to process your application.
• UK Visas and Immigration (UKVI) and relevant government authorities — where required by law.
• Service providers — IT, hosting and communication providers who process data on our behalf under data processing agreements.
• Professional advisers — lawyers or accountants where necessary.

We do not sell your personal data to third parties. We do not share your data with any third party for their own marketing purposes.

6. International Data Transfers

In the course of processing applications for international study, your personal data may be transferred to universities or institutions outside the UK or the European Economic Area (EEA). Where such transfers occur, we take steps to ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO or equivalent mechanisms. We will inform you where a transfer is to a country without an adequacy decision.

7. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy. In general:

• Enquiry data — retained for 12 months from the date of your last contact if no service was engaged.
• Application and client data — retained for 7 years from the end of our engagement, in line with legal and contractual obligations.
• Website analytics data — retained in anonymised form for up to 26 months.

After the relevant retention period, data is securely deleted or anonymised.

8. How We Protect Your Data

We take the security of your personal data seriously and have appropriate technical and organisational measures in place to prevent unauthorised access, loss, disclosure or destruction. These include access controls, encrypted data transmission and regular reviews of our security practices. Access to personal data is restricted to authorised staff who need it to perform their duties.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to request deletion of your data where there is no longer a legitimate reason to retain it.
• Right to restriction — to ask us to pause processing of your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us via our contact page. We will respond within one month.

10. Cookies

Our website uses cookies and similar technologies to improve your browsing experience, analyse site traffic and support our services. You can control cookie settings through your browser. For details on the cookies we use, please refer to our Cookie Policy.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you. All decisions relating to your application and our services involve human review.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our website or services after an update constitutes acceptance of the revised policy. We encourage you to review this page periodically.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first and we will do our best to resolve the matter. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.