Privacy Policy

This Privacy Policy explains how YouStudy UK Ltd ("YouStudy", "we", "us") collects, uses, shares and protects your personal data when you use our website, contact us, or use our education advisory and application services.

We help students find, apply to and enrol at universities, colleges and language schools abroad. Doing that well means handling a significant amount of information about you, including in some cases sensitive information. This policy sets out what we hold, why, who we share it with, and what you can require us to do about it.

Data controller: YouStudy UK Ltd, Aizlewoods Mill, Nursery Street, Sheffield, S3 8GG, United Kingdom.

Company registration number: [to be confirmed]
ICO registration number: [to be confirmed]
Privacy contact: support@youstudy.com

We also operate an office in Faisalabad, Pakistan. Section 7 explains what that means for your data.

Information you give us

• Account details — your email address and a password, which we store only as a cryptographic hash and can never read.
• Identity and profile — your name (which we may hold in both Latin and Arabic script), date of birth, gender, nationality and country of residence.
• Identity documents — your passport number and its issue and expiry dates, together with scanned copies of passports, national identity documents, academic transcripts, certificates, language test results and financial evidence you upload in support of an application.
• Contact details — email addresses, telephone numbers, WhatsApp contact details, social media profiles where you provide them, and the name and relationship of any emergency contact you nominate.
• Parent or guardian details — where you are under 18, or where you nominate a parent or guardian in connection with your application.
• Education and language — your educational history and qualifications, your English language level and test results, and whether you have previously studied in your destination country.
• Immigration-related information — whether you have previously overstayed a visa, and details of previous applications. Institutions and immigration authorities require this. We restrict access to it internally and never disclose it beyond what an application requires.
• Health information — where you tell us you have a medical condition. This is special category data; see Section 4.
• Financial information — who is funding your studies, invoices we issue, and payments you make.
• Communications — messages you send us, emails, WhatsApp and SMS messages, notes recorded by your adviser about your case, records and where applicable recordings of telephone calls, and records of online meetings.

Information we collect automatically

• Technical and usage data — your IP address, the country inferred from it, the pages you view, the page that referred you, your browser type and your device type.
• Notification tokens — if you use our student portal or app and enable notifications, a device token so we can deliver them. You can revoke this in your device settings.
• Security records — sign-in attempts and security events.

Information we receive from others

• From education partners and agents, where you first engaged with us through one of them.
• From institutions — decisions, offer letters, conditions, requests for further documents and enrolment confirmations.
• From marketing sources — which campaign or referrer brought you to us.
• From parents, guardians and sponsors who enquire or apply on your behalf.

Under UK data protection law we must have a lawful basis for each use of your personal data. Ours are:

• Performance of a contract — creating and operating your account, advising you on courses and destinations, preparing and submitting applications on your behalf, and communicating with you about them.
• Legal obligation — issuing invoices and keeping financial records, and keeping records required by education, immigration and financial regulation.
• Legitimate interests — securing our systems, preventing fraud and abuse, monitoring and improving the quality of our advisory service, and understanding which of our campaigns work. Where we rely on legitimate interests we have assessed that our interest is not overridden by your rights. You may ask us for that assessment, and you may object.
• Consent — sending you marketing, setting non-essential cookies, and processing health information. You can withdraw consent at any time.

We ask whether you have a medical condition because some institutions require disclosure of conditions affecting study, accommodation or fitness to practise — particularly on medical, nursing, teaching and aviation programmes — because accommodation and examination adjustments usually must be requested in advance, and because some student visa routes and mandatory health insurance schemes require it.

Health data is special category data under Article 9 of the UK GDPR. It receives heightened protection, and we rely on your explicit consent under Article 9(2)(a) to process it.

In practice, this means:

• You do not have to give it. You may decline, and we will still advise you and submit your applications. We will tell you where declining may limit the adjustments an institution can offer.
• You can withdraw your consent at any time. Withdrawal is not retrospective — it does not undo a disclosure already properly made to an institution — but it stops any further use.
• It is disclosed only where necessary, to the specific institution or insurer that requires it, and never for marketing, analytics or profiling.
• Access is restricted internally to the staff who need it for your application.

Our website uses cookies and similar technologies, including Google Tag Manager and Google Analytics, and records page-view events that include your IP address and browser information.

We group these as:

• Strictly necessary — required for the site to function and to protect against abuse. These do not require your consent.
• Analytics and performance — how the site is used, so we can improve it.
• Marketing and attribution — which campaign or referrer brought you to us, and measurement of our advertising.

Analytics and marketing technologies are not strictly necessary. You can control them through your browser settings, and you may withdraw any consent you have given at any time by contacting us.

Your browser allows you to accept or reject cookies. Rejecting them may affect how parts of the site display.

We share personal data only where necessary, and only as described here. We do not sell personal data, and we do not share it with data brokers.

Organisations that decide their own purposes

• Universities, colleges and language schools you apply to — your application, supporting documents and correspondence, so they can assess and decide it. They become independent controllers of what they receive, and their own privacy policies then govern it.
• Our authorised education partners and agents, where you engaged us through them.
• Payment providers and banks, to take and reconcile payment.
• Immigration authorities and visa services, as the relevant route requires.
• Insurers, where a required policy demands it.
• Professional advisers, auditors and regulators, as required.

Service providers acting on our instructions

These act only on our documented instructions under written data processing terms: hosting and infrastructure providers; Google (document storage, notifications, and website analytics); Meta (WhatsApp Business Platform); telephony and SMS providers; online meeting providers; and email delivery providers.

We are based in the United Kingdom and also operate an office in Pakistan, and we apply to institutions worldwide. Your personal data will therefore be transferred internationally — this is inherent to the service, not incidental to it.

Transfers happen in three ways:

• Within our own operations, between our UK and Pakistan offices and systems.
• To institutions in your destination country, which may be anywhere we place students.
• To our service providers, several of which process data in the United States and the European Union.

Where we transfer personal data out of the UK to a country without an adequacy decision, we rely on appropriate safeguards — the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment where required.

Transfers to an institution you have asked us to apply to are made because they are necessary to perform your contract with us. In some destinations this means your data will be held under a legal regime offering fewer protections than UK law. We tell you which institutions we are submitting to before we submit.

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using HTTPS/TLS;
• passwords stored only as salted cryptographic hashes, never in readable form;
• role-based access control, so staff see only what their role requires, with additional restriction on health and immigration information;
• audited change logging, so material changes to your record are attributable and reviewable;
• access controls and rate limiting on our systems to resist automated abuse;
• regular backups, held under the same protections as live data;
• data protection training for staff who handle your information.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it where required, and we will notify you directly without undue delay where the risk to you is high.

We keep personal data only as long as we need it, and then delete or anonymise it.

• Account and profile records — for the duration of our relationship with you, and then for a limited period afterwards.
• Application records and correspondence with institutions — for the period needed to support your application and any follow-on enrolment.
• Uploaded identity and academic documents — until they are no longer needed for the application they support.
• Health information — deleted when no longer required for the application it supported, or on withdrawal of your consent, whichever is earlier.
• Financial records, invoices and payments — six years, as required by UK tax and company law. An erasure request does not shorten this.
• Marketing consent records — for as long as you are subscribed, plus a record of your withdrawal.

Where a longer period is required by law, or where data is needed to establish, exercise or defend a legal claim, we keep it for that period and no longer.

Subject to the conditions in applicable law, you have the right to:

• Be informed — which this policy is intended to do.
• Access your personal data and receive a copy.
• Rectification of inaccurate or incomplete data.
• Erasure — to have your data deleted where there is no overriding reason to keep it.
• Restriction of processing in defined circumstances.
• Data portability — to receive data you gave us in a structured, machine-readable format.
• Object to processing based on legitimate interests, and at any time and absolutely to processing for direct marketing.
• Withdraw consent at any time where we rely on it. Withdrawal does not affect the lawfulness of processing before it.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

How to exercise them. Contact us using the details in Section 15. We will respond within one month. We may extend by two further months for complex requests, and we will tell you if we do. We will ask you to verify your identity first — this protects you. We do not charge for these requests unless they are manifestly unfounded or excessive.

Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority. If you live outside the UK, you may also be able to complain to the supervisory authority in your country of residence.

Many of our applicants are students approaching or entering higher education, and some are under 18. We do not claim that we never collect data from minors.

Our position is:

• Where an applicant is under 18, we require the involvement of a parent or guardian, and we record their name and relationship. Where consent is our lawful basis, we obtain it from the parent or guardian.
• We do not send direct marketing to applicants we know to be under 18.
• Where we discover we have collected a child's data without the required parental involvement, we delete it promptly.

A parent or guardian may exercise any of the rights in Section 10 on behalf of a child in their care.

We use your profile information to prioritise and route enquiries internally — for example, to identify which adviser is best placed to help you and how urgently to respond. This is profiling within the meaning of data protection law, and we disclose it for that reason.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Admissions decisions are made by institutions, and advisory decisions are made by our staff.

You may ask for human review of any decision that concerns you, and you may object to profiling.

We send marketing only where you have consented, or where applicable law permits us to contact an existing client about similar services.

Every marketing message contains an unsubscribe link, and you can change your preferences at any time by contacting us.

Withdrawing marketing consent does not stop service messages about your application — those are necessary to the service you have asked us to provide, and you cannot opt out of them while your application is live.

You can request deletion of your account and personal data using our account deletion request form, or by emailing support@youstudy.com.

We do not delete accounts instantly. A deletion request is reviewed by our team first, because deletion is irreversible and because a live application, an outstanding invoice or a legal retention duty may affect what we can remove. We will tell you the outcome.

When a deletion request is approved:

• your account and profile are deleted or irreversibly anonymised;
• your uploaded documents are deleted from our storage;
• your marketing records are deleted and you are unsubscribed;
• records we are legally required to retain — principally financial records, and records relating to submitted applications and immigration matters — are kept for the periods in Section 9, and are then deleted.

Where an application has already been submitted, the institution holds its own copy as an independent controller. You will need to contact that institution directly to have it erased from their systems; we will tell you who to contact.

For privacy enquiries and to exercise any of the rights in Section 10:

YouStudy UK Ltd
Aizlewoods Mill, Nursery Street
Sheffield, S3 8GG
United Kingdom
Telephone: +44 203 608 2800
Email: support@youstudy.com

Pakistan office
Hotel One, Business Cabin, Ground Floor, Block C, People's Colony No 1, Faisalabad, Punjab, Pakistan
Telephone: +92 (41) 539 22 22

If you are contacting us about a data protection request, please say so in your subject line — it helps us meet the statutory deadline.

This policy is reviewed regularly and updated when our processing changes. Where a change is material we will notify you in advance by email or on this website.