Privacy Policy

1. Data Controller

The International University Foundation Programme (IUFP) is the data controller responsible for your personal information. If you have any questions about this policy or our data practices, please contact us at:

• Email: legal@iufp.org.uk
• Address: LAAT, 46-48 East Smithfield, London E1W 1AW, United Kingdom

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you voluntarily provide to us when you:

• Apply for our foundation programme
• Apply to become a partner school
• Register for an account or VLE access
• Contact us through our website or email
• Subscribe to our newsletter or communications
• Submit alumni stories or testimonials

This information may include:

• Name, title, and contact information (email, phone, address)
• Date of birth and nationality
• Educational qualifications and academic records
• Passport photograph and identification documents
• IELTS scores and language proficiency information
• Disability or special needs information
• Payment and financial information
• Employment history (for partner school applications)

2.2 Information We Collect Automatically

When you visit our website, we may automatically collect certain information, including:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on pages
• Referring website or source
• Cookies and similar tracking technologies (see our Cookie Policy)

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: Processing is necessary to perform a contract with you (e.g., processing your application)
• Legal Obligation: Processing is necessary to comply with legal requirements (e.g., immigration, safeguarding)
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our services, fraud prevention)
• Consent: You have given explicit consent for specific processing activities (e.g., marketing communications)

4. How We Use Your Information

We use your personal information for the following purposes:

• Processing and evaluating programme applications
• Administering your student account and VLE access
• Communicating with you about your application or enrolment
• Providing educational services and support
• Processing partner school applications and managing partnerships
• Complying with legal and regulatory requirements
• Improving our website and services
• Sending marketing communications (with your consent)
• Preventing fraud and ensuring security
• Responding to your inquiries and providing customer support

5. Data Sharing and Disclosure

We may share your personal information with:

5.1 Partner Universities

We share application information with partner universities for the purpose of university admissions and progression.

5.2 Partner Schools

Student information may be shared with partner schools where you are enrolled for educational delivery.

5.3 Service Providers

We engage third-party service providers to support our operations, including:

• Cloud hosting and storage providers (AWS)
• Payment processors
• Email and communication platforms
• Analytics providers

5.4 Legal Requirements

We may disclose your information when required by law, court order, or to protect our rights, property, or safety.

5.5 Awarding Bodies

We share student data with ATHE and other awarding bodies for qualification registration and certification.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Generally:

• Application data: 6 years after the application decision
• Student records: 6 years after course completion
• Financial records: 7 years as required by law
• Marketing consent: Until you withdraw consent

7. Your Data Protection Rights

Under UK GDPR, you have the following rights:

7.1 Right of Access

You can request a copy of your personal data we hold about you.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure

You can request deletion of your personal data in certain circumstances.

7.4 Right to Restrict Processing

You can request that we limit how we use your personal data.

7.5 Right to Data Portability

You can request a copy of your data in a structured, machine-readable format.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at legal@iufp.org.uk.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication
• Staff training on data protection
• Secure backup procedures

9. International Data Transfers

Some of our service providers may process data outside the UK/EEA. When this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the ICO
• Adequacy decisions by the UK government
• Other lawful transfer mechanisms

10. Children's Privacy

Some of our applicants may be under 18. We take additional care to protect the privacy of minors and obtain appropriate parental consent where required by law.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience on our website. For detailed information about the cookies we use and your choices, please see our Cookie Policy.

11.1 Cookie Consent Management

When you visit our website, we will ask for your consent to use certain cookies and tracking technologies. Your cookie preferences are stored in two locations:

• Your Browser (Local Storage): For quick access and improved performance
• Our Secure Database: For compliance, audit trail, and long-term record keeping

11.2 Information We Store About Your Cookie Consent

When you accept or customize your cookie preferences, we record the following information in our database:

• Your unique session identifier (a randomly generated code)
• Your IP address (for security and audit purposes)
• Your browser and device information (user agent)
• The specific categories of cookies you consented to (Necessary, Functional, Analytics, Marketing)
• The date and time you gave consent
• The version of our cookie policy you consented to
• When your consent expires (12 months from the date given)
• If you are logged in, we link this consent to your user account

11.3 Why We Store Cookie Consent in Our Database

We store your cookie consent information to:

• Comply with GDPR and UK PECR requirements to maintain records of consent
• Demonstrate compliance in the event of a regulatory audit
• Allow you to update your preferences across devices when logged in
• Track when consent expires and prompt you to renew it (after 12 months)
• Analyze aggregate consent rates to improve our privacy practices

11.4 How Long We Keep Cookie Consent Records

We retain cookie consent records for the duration of your consent (12 months) plus an additional 6 months for audit purposes, after which they are automatically deleted. If you are a registered user, consent records may be retained for longer as part of your account history.

11.5 Your Rights Regarding Cookie Consent Data

You have the right to:

• Access your cookie consent records by contacting our Data Protection Officer
• Change your cookie preferences at any time (see link at bottom of this page)
• Withdraw consent by deleting your browser data or using our cookie preference tool
• Request deletion of your cookie consent records (subject to legal retention requirements)

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

13. Contact Us and Complaints

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: legal@iufp.org.uk
• Phone: +44 020 8133 6420
• Address: LAAT, 46-48 East Smithfield, London E1W 1AW, United Kingdom

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: https://ico.org.uk
• Phone: 0303 123 1113