Legal
Privacy Policy
This policy explains how Britvia uses personal information and the rights you have in the UK and in India.
Last updated: 14 September 2026 · Version
1. Who we are
Britvia is a product of ApexLogic Labs Ltd. ApexLogic Labs Ltd is the data controller for personal information collected through the Britvia website at britvia.co.uk and our services. This means we decide how and why your information is used.
Our company details and privacy contact are in section 17.
2. Information we collect
We collect information you give us, information created when you use our services, and limited technical information.
| Category | Examples |
|---|---|
| Contact details | Name, email address, phone or WhatsApp number, city and country |
| Academic background | Qualifications, institution, degree or subject, grades or CGPA, graduation year, and English test status and scores |
| Experience and goals | Work experience and career goals, where you choose to tell us |
| Study preferences | Course, subject and study level, preferred intake, locations and universities, scholarship needs and budget |
| Application information | Shortlists, applications, offers, consultation notes and, if we ask for them through a secure process, documents such as transcripts or a CV |
| Account information | Email address, name, account preferences and your password, which our authentication provider stores in hashed form |
| Communications | Messages and emails you exchange with us, consultation requests and, if you contact us there, WhatsApp conversations |
| Consent records | What you agreed to, when, and the exact wording shown, with a one-way hash of your IP address and browser details as evidence |
| Technical and security information | A hashed IP address for rate limiting and security, browser type, pages requested and error logs |
| Analytics information | Only if you accept analytics cookies: pages visited, performance measurements, the page you first arrived on and campaign links you followed |
We do not ask for special category information, such as health, religion or ethnicity. Please do not include it in messages or documents unless we explain that it is needed. We do not ask for passport details when you make an enquiry, and we do not take payments through the website.
3. How we use information and our lawful bases
Under UK data protection law we must have a lawful basis for each use of your information:
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry, assessment or consultation request | Steps you ask us to take before entering a contract; legitimate interests in answering people who contact us |
| Assessing your profile and identifying courses and universities that may suit you | Steps at your request before a contract; legitimate interests |
| Providing your account, consultations and application support | Contract |
| Service communications about your enquiry, account or service | Contract; legitimate interests |
| Customer service and handling complaints | Legitimate interests; legal obligation for data protection complaints |
| Managing our adviser workflow in our customer relationship management system | Legitimate interests |
| Security, fraud and abuse prevention, including rate limiting | Legitimate interests |
| Analytics to improve our guidance | Consent |
| Marketing emails about UK admissions, events and guidance | Consent, which you can withdraw at any time |
| Keeping records to meet legal obligations and to establish or defend legal claims | Legal obligation; legitimate interests |
4. Service and marketing communications
Service communications are messages we need to send to respond to your enquiry or provide a service, for example acknowledging your assessment, arranging a consultation or telling you about your account. We keep them to what is necessary.
Marketing communications are updates about UK admissions, events, scholarships and guidance. We only send them if you tick the optional marketing box, and submitting an enquiry does not subscribe you to marketing. Every marketing email has an unsubscribe link, and you can also manage your choices on our email preferences page.
5. Recommendations and automated tools
Britvia uses automated tools and data, and may in future use AI-assisted systems, to help organise information and identify UK university and course options that may be suitable for you.
Recommendations are decision-support information. They are not a guarantee of eligibility, admission, scholarship funding, visa approval or employment, and Britvia does not make admissions decisions.
Verify current requirements directly with the relevant university before making an application or financial commitment.
Our assessment and matching tools apply rules to the information you provide to suggest options for you and an adviser to consider. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
We do not currently send your personal information to third-party artificial intelligence (AI) providers. Before we do, we will update this policy to explain the purpose, the provider and the safeguards, and we will limit the information shared to what is necessary.
7. International transfers
Some of our providers are based in, or process information in, countries outside the UK, including the United States and countries in the European Economic Area. Your information does not always stay in the UK.
Where personal information is transferred outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, where a US provider is certified, the UK Extension to the EU-US Data Privacy Framework. Contact us for more information about the safeguards for a particular provider.
If you are in India, your information is transferred from India to the UK and to the other countries where our providers operate, subject to any restrictions notified by the Government of India.
8. How long we keep information
| Information | How long we keep it |
|---|---|
| Enquiries and assessments that do not lead to an ongoing service | 24 months after our last contact with you |
| Student accounts | While your account is open. If an account is inactive for 24 months, we will contact you before deleting it |
| Records of services we provide, including communications and consultation notes | 6 years after the service ends, so we can respond to questions or legal claims |
| Documents you upload | 12 months after the service ends, or sooner if you ask us to delete them and we do not need them for an ongoing application |
| Consent and unsubscribe records | 6 years after you withdraw consent or our relationship ends, so we can show we respected your choices |
| Complaint records | 6 years after the complaint is closed |
| Security and audit logs | 24 months |
| Analytics information | Up to 26 months |
| Financial records, if we introduce paid services | 6 years, to meet UK legal obligations |
When a retention period ends, we delete the information or anonymise it so it no longer identifies you.
9. How we protect information
- Encrypted connections (HTTPS) across the whole website.
- Database access controls that limit student information to the student and authorised Britvia staff.
- Private file storage: documents are never available through public links, and downloads use short-lived signed links.
- Passwords handled by our authentication provider and never stored in plain text.
- Rate limiting, security headers, audit logs and, where enabled, bot protection.
- Staff access based on role and need.
No online service can be completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant regulators as the law requires.
10. Your privacy rights
Under UK data protection law you have the right to:
- access a copy of your personal information;
- have inaccurate information corrected and incomplete information completed;
- have your information erased in certain circumstances;
- restrict or object to our use of your information, including objecting to marketing at any time;
- receive information you gave us in a portable format, where this applies;
- withdraw consent at any time, without affecting anything we did before you withdrew it;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.
To use any of these rights, contact us using the details in section 17. We may need to confirm your identity. We respond within one month, or tell you within that month if we need up to two more months for a complex request.
11. Complaints about how we use your information
If you are unhappy with how we have handled your personal information, you can complain to us using our Complaints Policy. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk. The ICO usually expects you to raise your concern with us first.
12. For users in India
This section is for people in India. It explains how we handle your digital personal data with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 in mind. The Rules were notified on 14 November 2025, and their obligations take effect in phases.
- What we collect and why: the categories of personal data and the purposes are set out in sections 2 and 3.
- Consent: where we rely on your consent, for example for marketing emails or analytics cookies, we ask with a separate, clearly worded choice that explains the purpose. Consent is never pre-selected.
- Withdrawing consent: you can withdraw consent at any time, as easily as you gave it, using the unsubscribe link in our emails, the cookie settings in the website footer, or by contacting us. This does not affect processing before you withdrew it.
- Your rights: you can ask for information about the personal data we hold and how we use it, and ask us to correct, complete, update or erase it. You can nominate another person to exercise your rights if you die or become unable to do so.
- Responses: we respond to requests and grievances within the time the law requires, and in any case within 90 days.
- Children: Indian law treats anyone under 18 as a child and requires verifiable consent from a parent or lawful guardian. If you are under 18, please ask a parent or guardian to complete our forms with you or to contact us for you (see section 13).
- Retention: we keep personal data only for the periods in section 8, then erase it.
- Service providers and transfers: see sections 6 and 7.
- Breaches: if a personal data breach affects you, we will tell you as the law requires, in plain language, including what happened, the likely consequences, what we are doing and how to contact us.
- Contact and grievances: contact us using the details in section 17. If you are not satisfied with how we handle your grievance, you may complain to the Data Protection Board of India.
13. Children and young people
Britvia is intended for people applying to university and for their parents or guardians. Our forms ask you to confirm that you are 18 or over, or that you are a parent or guardian completing the form for a student under 18.
If you are under 18, please ask a parent or guardian to contact us with you. We ask only for the information needed to guide a student, and we do not knowingly collect unnecessary personal information from anyone under 18. If we learn that we have collected information from someone under 18 without a parent or guardian's involvement, we will ask for that involvement or delete the information.
14. WhatsApp
By contacting Britvia on WhatsApp, you acknowledge that your conversation may be processed through WhatsApp and Meta's services. Please do not send passport numbers, passwords, bank or card details, or other highly sensitive information through WhatsApp.
If you ask us to contact you on WhatsApp, we use your number only for your enquiry or service. WhatsApp and Meta process messages under their own terms and WhatsApp's privacy policy. We will never ask for passport numbers, passwords or financial credentials in an ordinary WhatsApp chat.
16. Changes to this policy
We update this policy when our practices or the law change. The current version is 2026-09-14, and the last-updated date is shown at the top of this page. If we make a significant change, we will tell you on the website and, where appropriate, by email before it takes effect.
17. How to contact us
ApexLogic Labs Ltd is the data controller responsible for your personal information.
- Britvia is a product of ApexLogic Labs Ltd.
- Company number: To be confirmed
- Registered office: To be confirmed
- Place of registration: To be confirmed
- ICO registration number: To be confirmed
- Privacy contact: use our contact form