Privacy Policy
How Advex Direct Ltd collects, uses, stores, transfers, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
Advex Direct Ltd (“we,” “our,” or “us”) is committed to protecting the privacy, confidentiality, and personal data of our website visitors, student applicants, partner institutions, and users (“you”). This Privacy Policy outlines how we collect, use, store, transfer, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
By submitting your information, using our website, or engaging our student consultancy services, you acknowledge the collection and processing of your personal data as described in this Privacy Policy.
Data Controller Identification
Advex Direct Ltd is the designated Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
If you have any questions about this privacy notice, our data protection practices, or wish to exercise any of your legal rights, please contact our Data Protection Team at privacy@advexdirect.com or via telephone at +44 7404 016346.
Information We Collect and Sources
To deliver educational consultancy, university placement assistance, and visa guidance, we collect both personal and non-personal information from direct and indirect sources:
Information you provide via consultation forms, application packs, email, or in-person appointments:
- Identity Data: Full legal name, date of birth, gender, nationality, country of residence, and passport details.
- Contact Data: Email address, telephone numbers, postal address, and emergency contact details.
- Academic Records: Educational history, transcripts, graduation certificates, diplomas, syllabus details, and predicted grades.
- Language & Test Records: IELTS, SELT, TOEFL, PTE, or other recognized language proficiency test scores and certificates.
- Financial & Visa Documentation: Bank statements, proof of funding/sponsorship, previous visa application history, immigration refusal notices (if applicable), and Confirmation of Acceptance for Studies (CAS) records.
- Statement of Purpose (SOP) & Curriculum Vitae: Personal statements, academic essays, and work experience summaries.
- Academic & Professional Referees: Letters of recommendation and reference verification provided on your behalf.
- Partner Universities & Institutions: Application progression updates, offer letters, CAS issuance notifications, and enrollment status.
- Parents, Guardians, or Sponsors: Contact details, relationship proof, and financial sponsorship commitments.
- Authorized Sub-Agents & Partners: Inquiry details and academic profiles referred under binding Data Processing Agreements.
- Educational Testing Services: Official verification directly from test providers (e.g., British Council, Pearson).
IP address, browser type and version, time zone setting, operating system, URLs clickstream, page response times, and visit durations gathered via cookies and analytics to ensure platform security and optimization.
We only process special category data when strictly necessary:
- Health & Accessibility: Disclosed disabilities or medical conditions to request reasonable adjustments from partner universities.
- Criminal Record Checks: Where explicitly mandated by university admissions for regulated professions (e.g., Medicine, Nursing, Teaching, Social Work).
Processed solely under explicit consent (Article 9(2)(a)) or substantial public interest (Article 9(2)(g)). Consent can be withdrawn at any time.
Purposes and Lawful Bases for Processing
Under UK GDPR Article 6, we must maintain a lawful basis for every processing activity:
Contractual Necessity
Assessing qualifications, submitting applications, admissions tracking, and pre-departure advisory services.
Consent
Clear affirmative consent for marketing communications, event invitations, and accessibility accommodations.
Legal Obligation
Compliance with statutory reporting, UKVI sponsor guidance, tax laws, and anti-money laundering regulations.
Legitimate Interests
Preventing fraud, maintaining IT security, verifying document authenticity, and channel partner oversight.
Requirement to Provide Personal Data & Consequences
Providing your identity, academic history, and financial verification documents is a contractual requirement for us to deliver our university placement and visa guidance services.
While you are under no statutory obligation to supply personal data, failure to provide requested information means we will be unable to assess your eligibility, submit applications to universities on your behalf, or assist with CAS issuance and visa documentation checks.
International Transfers of Personal Data
Because Advex Direct operates internationally with branch offices and partner universities across the globe, your personal data may be transferred to, stored, and processed outside the United Kingdom, including in Bangladesh, India, Nigeria, the United Arab Emirates (UAE), Canada, Australia, and the United States.
Whenever we transfer personal data outside the UK, we ensure a comprehensive level of protection is maintained through:
- UK International Data Transfer Agreements (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).
- Transfers to jurisdictions recognized by the UK Government as providing an adequate level of data protection.
- Strict technical controls: SSL/TLS encryption, role-based access restrictions, and binding confidentiality covenants.
Who We Share Your Data With
We never sell, rent, or trade your personal information. We disclose personal data only to authorized recipients on a strict need-to-know basis:
How Long We Keep Your Data (Retention Schedule)
We retain personal data only for as long as necessary to fulfil the purposes for which it was gathered, including satisfying legal, accounting, compliance, and reporting requirements:
Retained for the duration of the application cycle plus 6 years following completion of services, in accordance with the UK Limitation Act 1980.
Retained for up to 2 years from last contact before permanent electronic deletion or anonymization.
When records reach the end of their retention period, they are securely destroyed using certified electronic deletion and confidential shredding.
Automated Decision-Making and Profiling
Advex Direct does NOT make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on applicants.
All academic evaluations, course recommendations, and university application decisions involve human judgment by our qualified education counsellors.
Your Statutory Rights Under UK GDPR
Under UK data protection law (UK GDPR and Data Protection Act 2018), you have statutory rights concerning your personal information:
How to Complain
If you have concerns about our use of your personal data, you can submit a formal complaint to us at privacy@advexdirect.com or follow our formal procedure at /complaints.
If you remain dissatisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to ensure the site functions correctly, analyze traffic, and enhance user experience. We categorize cookies into:
- 1. Strictly Necessary Cookies: Essential for page navigation, session management, and platform security.
- 2. Analytics & Performance Cookies: Helping us understand visitor interaction and aggregate traffic patterns.
- 3. Functional Cookies: Remembering language and region preferences.
You can manage or withdraw cookie preferences at any time via your browser settings.
Children and Young People Under 18
We assist students applying for foundation and undergraduate degrees who may be 16 or 17 years of age.
In compliance with the ICO Children's Code and UK data protection principles, processing personal data for applicants under 18 requires the verified consent and active involvement of a parent or legal guardian. We do not knowingly collect personal data from minors without parental authorization.
Data Security Measures
We have implemented robust technical and organizational security measures to safeguard your personal data:
- End-to-end SSL/TLS encryption for all data in transit.
- Multi-factor authentication (MFA) across all staff systems.
- Restricted, role-based database permissions on a need-to-know basis.
- Mandatory annual data protection and cybersecurity training for personnel.
Changes & Data Protection Inquiries
We regularly review and update this privacy notice to ensure ongoing compliance with UK data protection legislation. Any updates will be published directly to this page with an updated revision date.