Privacy Policy
Your privacy matters. This policy explains how UniEntrance collects, uses, and protects your personal data in compliance with the GDPR, UK GDPR, CCPA, and other international privacy laws.
Last updated: 14 October 2026
1. Introduction
UniEntrance ("we", "us", "our") operates the platform at unientrance.com (the "Platform"), a global education marketplace connecting students, educational institutions, and recruitment agents. We are committed to protecting the privacy and personal data of everyone who uses our Platform.
This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data. It applies to all users of the Platform regardless of location, and is designed to comply with:
- The EU General Data Protection Regulation (GDPR, Regulation 2016/679)
- The UK GDPR and Data Protection Act 2018
- The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
- Other applicable national data protection laws in the countries where our users reside
By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.
2. Data Controller
UniEntrance is the data controller responsible for your personal data. This means we determine the purposes and means of processing your personal data. For GDPR purposes, our details are:
We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with data protection law. You can contact the DPO at the email address above.
3. Data We Collect
We collect only the data necessary to provide our services. The categories of personal data we may collect include:
Identity & Contact
- Full name, email address, password (hashed)
- Agency name (for agents), institution name & website (for institutions)
- Nationality, country of residence, date of birth / age
- Profile photo (optional, uploaded by you)
Academic & Application
- Highest qualification, field of study, education history
- Language test scores (IELTS, TOEFL, etc.)
- Course preferences, interested countries, intended intake
- Application records, submitted documents, offer letters
Usage & Technical
- IP address, browser type, device information
- Pages visited, features used, timestamps
- Session and authentication tokens (encrypted)
- Aggregated analytics data (non-identifying)
Communications
- Messages between students, institutions, and agents
- Support tickets and email correspondence
- Notifications and platform alerts
- Consent logs for data-sharing permissions
Special category data: We do not knowingly collect special category data under Article 9 of the GDPR (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). Nationality is collected solely for the purpose of matching students with relevant institutions and visa requirements, and is processed on the basis of your explicit consent.
4. How We Use Your Data
We process your personal data for the following purposes:
- Account management: Creating and managing your account, authenticating your identity, and maintaining platform security.
- Application processing: Enabling students to create profiles, apply for courses, and allowing institutions and agents to manage those applications.
- Matching & discovery: Helping institutions find qualified students and helping students find suitable courses based on their profile.
- Communications: Sending notifications, messages between users, support responses, and important account-related information.
- Verification & safety: Verifying institution claims via domain-matched emails, background-checking agents, and preventing fraud or abuse.
- Service improvement: Analysing usage patterns (in aggregate) to improve features, performance, and user experience.
- Legal compliance: Meeting our legal, regulatory, and contractual obligations.
5. Legal Basis for Processing
Under the GDPR, we rely on the following legal bases for processing your personal data:
Consent (Article 6(1)(a)) — For processing nationality data, uploading profile photos, sharing data with specific institutions when you apply, and for any marketing communications. You can withdraw consent at any time.
Contract performance (Article 6(1)(b)) — For processing necessary to provide the Platform services you requested, including account creation, application processing, and inter-user messaging.
Legal obligation (Article 6(1)(c)) — Where we are required to retain or disclose data by law, regulation, or court order.
Legitimate interests (Article 6(1)(f)) — For fraud prevention, platform security, analytics, and improving our services, balanced against your rights and reasonable expectations.
6. Data Sharing & Disclosure
We do not sell your personal data. We share it only in the following circumstances:
- With your consent: When a student applies for a course, their profile and documents are shared with that specific institution or agent only. No other institution sees your data unless you separately apply to them.
- Between platform users: Messages, documents, and application details are visible to the relevant student, institution, and agent involved in a specific application.
- Service providers: We use trusted third-party providers for hosting, database storage, authentication, and email delivery. These providers act as data processors under strict contractual terms and process data only on our instructions.
- Legal requirements: We may disclose data to law enforcement, regulators, or courts where required by law or to protect our rights, safety, or the safety of others.
7. International Data Transfers
UniEntrance is a global platform, and your data may be processed in countries outside your country of residence, including countries that may not have the same level of data protection as your jurisdiction.
Where we transfer personal data outside the European Economic Area (EEA) or the UK, we ensure an adequate level of protection through:
- Standard Contractual Clauses (SCCs) approved by the European Commission or UK government
- Adequacy decisions for countries recognised as providing adequate data protection
- Binding Corporate Rules or other legally recognised transfer mechanisms where applicable
You may request a copy of the safeguards we rely on by contacting us at privacy@unientrance.com.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law. Our general retention periods are:
9. Data Security
We implement industry-standard technical and organisational measures to protect your personal data, including:
- Encryption: Passwords are hashed using strong, one-way algorithms. Data in transit is encrypted via TLS. Sensitive data at rest is encrypted.
- Row-level security: Database access is controlled by role-based policies, so users can only access data they are authorised to see.
- Access controls: Internal access is restricted to authorised personnel on a need-to-know basis, with audit logging.
- Consent-based sharing: Student documents are only visible to an institution after the student explicitly applies and grants permission.
Despite our efforts, no system can be guaranteed 100% secure. In the event of a personal data breach affecting your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by Article 33 and 34 of the GDPR.
10. Your Privacy Rights
Depending on your jurisdiction, you have the following rights over your personal data:
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your data ('right to be forgotten').
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Restrict Processing
Ask us to limit how we use your data in certain circumstances.
Right to Object
Object to processing based on legitimate interests or direct marketing.
California residents (CCPA/CPRA): You also have the right to know what personal information is collected, the right to opt-out of the sale or sharing of personal information (we do not sell your data), and the right not to be discriminated against for exercising these rights.
How to exercise your rights: You can submit a request by emailing privacy@unientrance.com or through your account settings. We will respond within one month (GDPR) or 45 days (CCPA). We may need to verify your identity before acting on your request.
If you are in the EU, UK, or EEA, you have the right to lodge a complaint with your local data protection supervisory authority. You can also lodge a complaint with the authority in the country where you reside, work, or where the alleged infringement occurred.
12. Children's Privacy
The Platform is intended for individuals aged 16 and over. We do not knowingly collect personal data from children under 16 without verifiable parental or guardian consent, as required by the GDPR (Article 8) and the Children's Online Privacy Protection Act (COPPA) where applicable.
If you believe we have collected data from a child under 16 without consent, please contact us immediately at privacy@unientrance.com and we will take steps to delete that data.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting a notice on the Platform or sending an email to your registered address at least 30 days before the changes take effect.
The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.
14. Contact & Complaints
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
unientrance.com
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For EU/EEA residents, you can find your supervisory authority at the European Data Protection Board. For UK residents, the supervisory authority is the Information Commissioner's Office (ICO).