Legal
Privacy Notice
This notice explains how Britvia uses your personal information and the rights you have under UK data protection law.
Last updated: 13 September 2026
1. Who we are
Britvia is the data controller for the personal information described in this notice.
- Legal entity: To be confirmed
- Company number: To be confirmed
- Registered address: To be confirmed
- ICO registration number: To be confirmed
- Contact for privacy questions: our contact form
2. Information we collect
- Enquiry and profile check details: name, email, phone, city, country, study plans, qualification, grades, English test status, budget and your message.
- Account information: email, password (stored by our authentication provider in hashed form), name and account preferences.
- Student profile: academic background, study preferences, shortlists, applications, offers, consultations and messages with advisers.
- Documents you upload: for example transcripts, certificates or a CV, stored privately.
- Consent records: what you agreed to, when, and the wording shown, with a one-way hash of your IP address and browser details as evidence.
- Payments: handled by our payment provider. We do not receive or store card details.
- Technical and security data: hashed IP addresses for rate limiting and security logs.
- Analytics: anonymous page and funnel statistics, only if you accept analytics cookies.
We do not ask for special category information (such as health, religion or ethnicity) and ask you not to include it in messages or documents unless it is necessary for your application. We do not collect passport details at signup.
3. How we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and profile checks | Steps at your request before a contract; legitimate interests |
| Providing your account and advisory services | Contract |
| Service emails about your enquiry or account | Contract; legitimate interests |
| Marketing emails about UK admissions, events and guidance | Consent, which you can withdraw at any time |
| Managing our adviser workflow in our CRM | Legitimate interests |
| Security, fraud and abuse prevention, including rate limiting | Legitimate interests |
| Analytics to improve our guidance | Consent |
| Financial and tax records | Legal obligation |
4. Who we share information with
We use carefully selected service providers (processors) who act on our instructions:
- Supabase: database, authentication and private document storage, hosted in a UK (London) region.
- Vercel: website hosting and, with consent, privacy-friendly analytics.
- HubSpot: customer relationship management. We send only contact details, study interests and journey stage, never grades, documents or identity documents.
- Brevo: service emails, and marketing emails only if you have consented.
- Stripe: payment processing for paid services.
- Sanity: our content management system. It holds editorial content, not student data.
We share information with a university only when you ask us to support an application to it. We never sell personal information.
5. International transfers
Some providers process data outside the UK. Where this happens, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep information
- Enquiries without an account: 24 months after our last contact with you.
- Student accounts and profiles: while your account is active; accounts inactive for 24 months are deleted after notice.
- Documents: until you delete them or your account.
- Marketing preferences: after you unsubscribe, we keep a minimal record so we do not contact you again.
- Financial records: six years, to meet UK legal obligations, in anonymised form after account deletion.
- Security and audit logs: 24 months.
7. Your rights
You have rights to access, correct, delete, restrict or object to the use of your information, to data portability, and to withdraw consent at any time. Signed-in students can export their data and delete their account from account settings. You can also contact us to exercise any right.
If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
8. Automated decisions
Our course matching produces indicative guidance for advisers and students. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
9. Cookies
See our cookie policy.
10. Changes to this notice
We will update this notice when our practices change. Version: 2026-09-13.