Privacy Policy | EDUEX Limited

1. Introduction and Scope

This Privacy Policy (“Policy”) sets out the manner in which EDUEX Limited (“EDUEX,” “the Company,” “we,” “us,” or “our”) collects, processes, stores, and discloses personal data. It further delineates the rights of data subjects under the United Kingdom General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“the Act”).

EDUEX Limited is committed to upholding the highest standards of data protection and privacy. This Policy applies to all personal data processed by the Company, including but not limited to data collected through our website, our student recruitment services, and our engagements with partner educational institutions.

This Policy should be read in conjunction with any contractual agreements, Data Processing Agreements, or Data Sharing Agreements entered into between EDUEX Limited and its partners.

2. Identity and Contact Details of the Controller

EDUEX Limited is a company registered in England and Wales.

Registered Address: Ground Floor Taylor Place, 1 Payne Road, London, E3 2SP
Company Registration Number: 16056747
ICO Registration Number: ZB929119

The Company confirms that its registration with the Information Commissioner’s Office is current and shall be renewed in accordance with the Data Protection Act 2018.

Data Protection Officer: The Company has appointed a Data Protection Officer (“DPO”) who is responsible for overseeing compliance with data protection law and who serves as the primary point of contact for data subjects and supervisory authorities.

DPO Contact Email: dpo@eduex.co.uk

3. Role of the Company: Controller, Processor, and Joint Controller

The Company operates in different capacities depending on the nature of the processing activity. This distinction is fundamental to determining the respective obligations under the UK GDPR.

3.1 Data Controller

Where the Company collects personal data directly from data subjects—whether through its website, direct enquiries, or marketing activities—and determines the purposes and means of processing, the Company acts as a Data Controller. In this capacity, EDUEX Limited bears full responsibility for compliance with the UK GDPR.

3.2 Data Processor

Where the Company processes personal data on behalf of a Partner Institute for the purpose of facilitating student applications, the Company acts as a Data Processor. In this capacity, the Company processes personal data strictly in accordance with the documented instructions of the Partner Institute, which remains the Data Controller. The Company’s obligations as a Processor are governed by a written Data Processing Agreement entered into with each Partner Institute, as required by Article 28(3) of the UK GDPR. This Agreement sets out the subject-matter, duration, nature, and purpose of the processing, as well as the obligations and rights of the Controller.

3.3 Joint Controller

In limited circumstances, the Company may act as a Joint Controller alongside a Partner Institute where both parties jointly determine the purposes and means of processing. Where such an arrangement exists, the Company shall enter into a documented arrangement pursuant to Article 26 of the UK GDPR, which shall set out the respective responsibilities of each party and shall be made available to data subjects.

4. Categories of Personal Data Collected

The Company may collect and process the following categories of personal data:

4.1 Identity Data: This includes name, date of birth, nationality, gender, and passport details.
4.2 Contact Data: This includes email address, telephone number, and postal address.
4.3 Educational Data: This includes academic history, transcripts, test scores, qualifications, and English language proficiency.
4.4 Financial Data: This includes payment details where applicable for services rendered.
4.5 Technical Data: This includes IP address, browser type, cookies, and usage data collected during visits to our website.
4.6 Marketing Data: This includes preferences regarding the receipt of marketing communications from the Company.

5. Special Category Data

Certain categories of personal data are afforded additional protection under Article 9 of the UK GDPR. Such data, referred to as “Special Category Data,” includes data revealing racial or ethnic origin, which may be inferred from nationality, as well as data concerning health or disability where relevant to the provision of support services.

The Company shall only process Special Category Data where one of the following conditions is satisfied:

The data subject has provided explicit consent;
Processing is necessary for reasons of substantial public interest, including equality of opportunity monitoring;
Processing is necessary for the establishment, exercise, or defence of legal claims.

Where the Company processes Special Category Data on a large scale, a Data Protection Impact Assessment shall be conducted prior to the commencement of processing, in accordance with Article 35 of the UK GDPR.

6. Lawful Basis for Processing

The Company shall only process personal data where a lawful basis exists under Article 6 of the UK GDPR. The lawful bases relied upon by the Company are as follows:

6.1 Performance of a Contract: Where processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract, the Company relies upon Article 6(1)(b).
6.2 Consent: Where the data subject has given consent to the processing of their personal data for one or more specific purposes, the Company relies upon Article 6(1)(a). This basis is primarily relied upon for marketing communications.
6.3 Legal Obligation: Where processing is necessary for compliance with a legal obligation to which the Company is subject, the Company relies upon Article 6(1)(c).
6.4 Legitimate Interests: Where processing is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, the Company relies upon Article 6(1)(f). The specific legitimate interests relied upon by the Company are:
1. The improvement and development of the Company’s website, services, and customer experience;
2. The maintenance and enhancement of the security and integrity of the Company’s systems and data;
3. The promotion of the Company’s services to prospective students and partner institutions in a manner that is proportionate and respects the rights of data subjects;
4. The prevention and detection of fraud and other unlawful activities.

7. Disclosure of Personal Data

The Company does not sell, rent, or trade personal data. The Company may disclose personal data to the following categories of recipients:

7.1 Partner Institutes: Personal data may be shared with Partner Institutes for the purpose of processing applications and facilitating enrolment.
7.2 Sub-Processors: The Company engages third-party service providers to assist in the operation of its website, the conduct of its business, and the delivery of its services. These sub-processors include providers of customer relationship management systems, cloud hosting services, and IT support. A current list of sub-processors is available upon request.
7.3 Regulatory Authorities: Personal data may be disclosed to regulatory authorities, including UK Visas and Immigration and the Information Commissioner’s Office, where required by law.
7.4 Professional Advisers: Personal data may be disclosed to professional advisers, including lawyers, auditors, and insurers, where necessary for the conduct of the Company’s business.

All third parties to whom personal data is disclosed are contractually obligated to respect the security of such data and to process it in accordance with applicable law. The Company does not permit its service providers to use personal data for their own purposes.

8. International Data Transfers

The Company primarily stores and processes personal data within the United Kingdom. The Company does not routinely transfer personal data outside the United Kingdom.

In the event that a transfer of personal data outside the United Kingdom becomes necessary, the Company shall ensure that a level of protection substantially equivalent to that afforded within the United Kingdom is maintained. Such transfers shall be effected by one of the following mechanisms:

Transfer to a country or territory that has been deemed by the United Kingdom Government to provide an adequate level of protection for personal data;
Execution of the International Data Transfer Agreement issued by the Information Commissioner’s Office;
Execution of the International Data Transfer Addendum to the European Union Standard Contractual Clauses;
Completion of a Transfer Risk Assessment prior to the transfer.

9. Data Retention

The Company shall retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, in accordance with the storage limitation principle set out in Article 5(1)(e) of the UK GDPR.

The following retention periods have been established:

9.1 Unsuccessful Applications: Personal data relating to unsuccessful applications shall be retained for a period of twelve (12) months from the date of the recruitment decision. This period allows the Company to address any follow-up enquiries, appeals, or complaints that may arise following the decision, after which the data is securely deleted.
9.2 Successful Student Records: Personal data relating to successful student records, processed on behalf of a Partner Institute, shall be retained for a period of seven (7) years from the end of the academic year in which the student completes or withdraws from their course of study. This period aligns with standard sector practice and enables the Company and its Partner Institutes to comply with legal, regulatory, and audit obligations.
9.3 Marketing Consent Data: Personal data processed on the basis of consent for marketing purposes shall be retained until such time as the data subject withdraws their consent.
9.4 Website Analytics Data: Technical data collected for analytics purposes shall be retained for a period of twenty-six (26) months.

Upon expiry of the applicable retention period, personal data shall be securely deleted or anonymised in accordance with the Company’s data destruction procedures.

10. Rights of Data Subjects

Under the UK GDPR, data subjects are entitled to the following rights:

10.1 Right of Access: The right to obtain confirmation as to whether personal data concerning the data subject is being processed and, where that is the case, access to that personal data.
10.2 Right to Rectification: The right to obtain rectification of inaccurate personal data and to have incomplete personal data completed.
10.3 Right to Erasure: The right to obtain erasure of personal data where there is no compelling reason for its continued processing.
10.4 Right to Restriction of Processing: The right to obtain restriction of processing in certain circumstances, including where the accuracy of the data is contested or where processing is unlawful.
10.5 Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
10.6 Right to Object: The right to object to processing based on legitimate interests or the performance of a task in the public interest, and the absolute right to object to processing for direct marketing purposes.
10.7 Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. To withdraw consent, data subjects may contact the DPO at dpo@eduex.co.uk.
10.8 Rights Relating to Automated Decision-Making: The Company does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the data subject. The Company does not utilise automated decision-making tools in its recruitment or admissions processes.
10.9 Right to Lodge a Complaint: The right to lodge a complaint with the Information Commissioner’s Office at any time.

To exercise any of the foregoing rights, data subjects should contact the DPO at dpo@eduex.co.uk. The Company shall respond to all requests without undue delay and in any event within one month of receipt, in accordance with Article 12 of the UK GDPR.

11. Data Security and Breach Notification

The Company has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the UK GDPR. These measures are designed to prevent unauthorised or unlawful processing, accidental loss, destruction, or damage to personal data.

In the event of a personal data breach, the Company shall notify the Information Commissioner’s Office within seventy-two (72) hours of becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of data subjects. Where the Company acts as a Data Processor on behalf of a Partner Institute, the Company shall notify that Partner Institute without undue delay and in any event within twenty-four (24) hours of becoming aware of the breach.

12. Cookies and Website Tracking

The Company’s website utilises cookies and similar tracking technologies to enhance user experience and to facilitate the improvement of its services. Detailed information regarding the cookies used, their purposes, and the manner in which consent may be provided or withdrawn is set out in the Company’s Cookie Policy, which is incorporated into this Policy by reference.

13. Amendments to This Policy

The Company keeps this Policy under regular review. This version was last updated on [Insert Date]. The Company reserves the right to amend this Policy at any time. Material changes shall be notified to data subjects by appropriate means.

14. Contact and Complaints

For all enquiries relating to this Policy or the Company’s data protection practices, please contact:

Email: contact@eduex.co.uk
Post: Ground Floor, Taylor Place, 1 Payne Road, London, E3 2SP
Data Protection Officer: dpo@eduex.co.uk

Information

Follow Us