Privacy Policy

RS Education Limited ("RSE," "we," "our," or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, and protect your data when you interact with our services, including university applications, consulting, and student support. It also details your rights under the Data Protection Act 2018 (DPA 2018) and UK GDPR, and how you can exercise them.

By using our services, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as a lawful basis, we will ask for your specific, informed and freely given consent separately.

RS Education Limited is a company registered in England and Wales under company number 12625666.

Registered office: Suite 10, Ensign House, Admirals Way, London, England, E14 9XQ.

Email for data protection enquiries: info@rseducation.co.uk

RS Education Limited is responsible for deciding how and why we process personal data when we act as a data controller. Where we process personal data on behalf of a partner university, institution or finance provider, we may act as a data processor.

RS Education Limited has assessed whether it is required to appoint a formal Data Protection Officer under UK GDPR. At present, RS Education Limited is not required to appoint a formal Data Protection Officer because we are not a public authority, and our core activities do not involve large-scale systematic monitoring of individuals or large-scale processing of special category or criminal offence data.

Data protection responsibility is handled internally by our data protection lead. You can contact us about any privacy or data protection matter at info@rseducation.co.uk.

Under DPA 2018 and UK GDPR, personal data refers to any information that can identify an individual. This includes, but is not limited to:

• Basic Identifiers: name, date of birth, contact details, email, phone number and address.
• Government Identifiers: passport details, visa status and student loan applications.
• Academic and Professional Data: educational history and employment background.
• Financial Data: student finance applications and tuition fee payments.
• Special Category Data: information such as health information, disability information, ethnicity or other sensitive information, only where required for an application, legal obligation, safeguarding reason, accessibility support, or where you have given explicit consent.

We only collect and process data necessary to deliver our services effectively.

We primarily obtain data directly from you through:

• Online forms, such as application submissions and contact enquiries.
• Email or phone communications.
• In-person consultations and events.

We do not purchase personal data. We primarily collect personal data directly from you. In some cases, we may receive information from parents, guardians, authorised representatives, partner universities, institutions, finance providers, visa or regulatory authorities, or referral partners where this is relevant to the services we provide.

Some personal data is required so that we can provide our services. This may include your name, contact details, date of birth, identity documents, academic qualifications, residency or visa evidence, application forms, personal statement, CV, and any information required by a university, institution, finance provider or regulatory body.

If you do not provide information that is required for an application, finance process, visa-related process or legal requirement, we may be unable to submit your application, provide the requested support, or continue providing our services.

Some information is optional, such as marketing preferences, general feedback, or non-essential consultation information. You can choose not to provide optional information.

RSE acts as both:

• A Data Controller: when we collect data for marketing, recruitment, and service improvement.
• A Data Processor: when processing data on behalf of partner universities and financial institutions.

We are committed to complying with UK GDPR and the Data Protection Act 2018 in both roles.

We use your personal data strictly for legitimate business and educational purposes, including:

• Processing university applications and securing placements.
• Assisting with visa applications and student finance support.
• Improving our services based on user feedback.
• Ensuring compliance with legal and regulatory obligations.
• Communicating important updates and educational opportunities.

We do not use personal data for automated decision-making or unnecessary profiling.

We do not sell or rent your data. However, we may share your data with:

• Partner Universities: to process applications and admissions.
• Financial Institutions: if applying for student loans or funding.
• Regulatory Bodies: where legally required, such as visa authorities.
• Law Enforcement Authorities: where required for legal investigations under DPA 2018.
• Service Providers: trusted providers who help us operate our website, email, CRM, cloud storage, communication systems, appointment booking systems, and other business tools. These providers are only permitted to process personal data for authorised purposes and must protect it appropriately.

All data sharing is conducted securely and within legal frameworks.

Most of our processing is carried out in the United Kingdom. However, where you ask us to support an application, visa-related process, overseas education opportunity, or communication with an organisation outside the UK, we may need to transfer or share your personal data outside the UK.

Where personal data is transferred outside the UK, we will take steps to ensure that appropriate safeguards are in place. These may include transferring data to a country covered by a UK adequacy decision, using approved contractual safeguards, obtaining your explicit consent where appropriate, or relying on another lawful transfer mechanism permitted under UK GDPR.

We will only transfer the personal data necessary for the relevant purpose.

Our services are primarily intended for individuals applying to higher education, including university-level study. Some applicants may be under 18. Where we process personal data relating to a child or young person under 18, we will take extra care to protect that information.

We will only collect and use children's personal data where it is necessary for education consultation, application support, safeguarding, legal obligations, or another clearly explained purpose. Where appropriate, we may require the involvement or consent of a parent, guardian or person with parental responsibility.

We will present privacy information as clearly as possible and will only share children's personal data with third parties, such as partner universities, institutions or regulatory bodies, where there is a valid reason and lawful basis to do so.

We retain personal data only for as long as necessary for its intended purpose.

Storage duration:

• Application-related data: up to 4 years for regulatory compliance.
• Financial information: retained for as long as required by accounting, tax, regulatory or legal obligations.
• Contact enquiries: deleted after 12 months if no further action is taken.

After the retention period, data is securely deleted or anonymised.

If you are located in the UK or EEA, you have the following rights under UK GDPR and DPA 2018:

• Right to Access: request a copy of your personal data.
• Right to Rectification: correct any inaccurate or incomplete information.
• Right to Erasure: request deletion of personal data when no longer needed.
• Right to Restrict Processing: limit how we process your data in certain situations.
• Right to Data Portability: request transfer of your data to another organisation.
• Right to Object: object to certain data processing activities, such as direct marketing.

To exercise any of these rights, please contact us using the details below.

Where we rely on your consent to process personal data, you may withdraw your consent at any time by contacting us at info@rseducation.co.uk.

Withdrawing consent will not affect the lawfulness of any processing carried out before consent was withdrawn. If you withdraw consent, we may no longer be able to provide certain optional services, such as processing special category information or sending marketing updates. We will explain the practical effect of withdrawal at the time you make the request.

You can also opt out of marketing communications at any time by contacting us at info@rseducation.co.uk or by using any unsubscribe option provided in our communications.

RSE implements strict security measures to protect personal data, including:

• Secure storage: personal data is stored securely using appropriate technical and organisational measures, which may include encryption, password protection and restricted access controls.
• Access control: only authorised personnel can access sensitive data.
• Regular data audits: ensuring ongoing compliance with UK GDPR regulations.
• Secure deletion: data no longer needed is permanently erased.

We continuously review and update our security practices to protect against threats.

For privacy-related concerns or data protection requests, you can contact us at info@rseducation.co.uk. We aim to respond to all requests within 30 days.

We encourage you to contact us first so we can try to resolve your concern. However, if you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

ICO website: www.ico.org.uk

ICO phone: 0303 123 1113