Privacy Policy and UK GDPR

---

INTRODUCTION

At Griffin Education Group Ltd (“Griffin Education Group”, “we”, “our”, or “us”), we respect your privacy and are dedicated to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you visit our website, communicate with us, or use our education recruitment and consultancy services.

As an organisation that works with international students and educational institutions worldwide, we handle personal data responsibly and in accordance with applicable UK data protection laws.

This policy reflects the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the latest guidance issued by the Information Commissioner’s Office (ICO).

By using our website or engaging with our services, you acknowledge and accept the practices described in this Privacy Policy.

DATA CONTROLLER AND CONTACT DETAILS

For the purposes of data protection legislation, Griffin Education Group Ltdacts as the data controller responsible for the personal information we process.

We take privacy and data protection seriously and maintain appropriate policies and procedures to ensure compliance with relevant laws.

If you have any questions about this policy or about how we handle your personal data, you may contact us using the details below:

Griffin Education Group Ltd
10–16 Tiller Road
London, England
E14 8PX

Email: info@griffineducationgroup.com

We aim to respond to all privacy-related enquiries within 30 days.

If you remain dissatisfied with how your data is handled, you may submit a complaint to the Information Commissioner’s Office, the UK authority responsible for data protection regulation.

Website: www.ico.org.uk
Telephone: 0303 123 1113

PERSONAL INFORMATION WE COLLECT

In order to provide our services effectively, we collect certain types of personal and non-personal information.

Personal data we may collect includes:

• Full name
• Date of birth
• Gender
• Residential address
• Email address
• Telephone number
• Academic background and education details
• Employment information or profession
• Personal interests or preferences
• Any additional information you voluntarily submit through forms, applications, or communications

This information may be collected through:

• Online forms submitted through our website
• Email communication
• Telephone conversations
• Paper application forms
• Social media or online platforms
• Direct interactions with our staff

We may also automatically collect certain technical data when you visit our website, including:

• IP address
• Browser type and device information
• Pages visited and browsing behaviour
• Date and time of visits
• Referring website links

These insights help us analyse how users interact with our website and allow us to improve our services and user experience.

In some cases, we may also receive relevant personal information from third parties such as:

• Universities and colleges
• Education partners and agents
• Scholarship or funding bodies
• Employers participating in educational programmes

Such information is collected only where necessary to deliver our services or where consent has been provided.

LEGAL BASIS FOR PROCESSING PERSONAL DATA

Under the UK GDPR, we must have a lawful basis for processing your personal information. Griffin Education Group processes data based on one or more of the following legal grounds:

Contractual Necessity

We process personal information where it is necessary to fulfil a contract with you or to take steps prior to entering a contract. This includes services such as assisting with university applications, student recruitment processes, or educational placements.

Consent

In some situations, we rely on your explicit consent to process personal data, particularly for marketing communications or optional services. You may withdraw your consent at any time.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided that these interests do not override your rights or freedoms. Examples include improving our services, analysing website usage, preventing fraud, and maintaining system security.

Legal Obligations

We may process personal information where required by law, such as compliance with regulatory, financial, or immigration-related obligations.

Vital Interests

In rare situations, data may be processed to protect the safety or wellbeing of an individual.

Public Interest

Certain processing activities may be conducted in support of tasks carried out in the public interest or within regulated educational frameworks.

HOW WE USE YOUR INFORMATION

Your personal information may be used for several purposes, including:

• Assisting students with educational opportunities and university placements
• Connecting students with partner educational institutions worldwide
• Managing enquiries, applications, and client accounts
• Communicating with you about services, updates, and enquiries
• Delivering educational consultancy and support services
• Improving website functionality and user experience
• Conducting research, feedback analysis, and service development
• Complying with legal and regulatory obligations
• Preventing fraud or misuse of services

Where you have agreed, we may also send you marketing communications regarding educational opportunities, events, or services. You may unsubscribe from marketing communications at any time.

SPECIAL CATEGORY DATA

Certain categories of personal information are considered sensitive under data protection laws. These include information about:

• Racial or ethnic origin
• Religious or philosophical beliefs
• Health information
• Biometric or genetic data
• Sexual orientation

Griffin Education Group does not routinely collect sensitive personal data. However, such information may be collected where necessary, for example to:

• provide accessibility accommodations
• ensure student welfare and safety
• comply with legal obligations

Where such data is collected, it will only be processed under lawful conditions permitted by Article 9 of the UK GDPR, such as explicit consent or substantial public interest.

AUTOMATED DECISION MAKING

We may use automated systems or analytical tools to help evaluate website usage patterns, personalise content, and detect potential fraud.

Where automated processing influences decisions affecting you, you have the right to request human review and intervention.

If you would like further information regarding automated decision-making processes, please contact us.

COOKIES AND THIRD-PARTY TECHNOLOGIES

Our website uses cookies and similar technologies to improve functionality and analyse user behaviour.

Cookies allow us to:

• recognise returning visitors
• remember user preferences
• analyse website performance
• enhance browsing experiences

Some cookies are essential for the operation of the website, while others are used for analytics or marketing purposes.

You may manage cookie settings through your browser preferences.

DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations.

Typical retention periods include:

• Contract and account data: retained during the service relationship and for up to six years afterwards
• Marketing data: retained until you opt out or request deletion
• Website analytics: retained for up to two years
• Recruitment data: retained for twelve months
• Call recordings: retained for up to thirty days unless required for dispute resolution

When information is no longer required, it is securely deleted or anonymised.

INTERNATIONAL DATA TRANSFERS

As we work with international students and educational institutions globally, personal information may occasionally be transferred outside the United Kingdom.

Where this occurs, we ensure appropriate safeguards are in place, including:

• transfers to countries recognised as providing adequate protection
• the use of Standard Contractual Clauses (SCCs)
• contractual agreements ensuring data protection standards

These measures ensure that your personal data remains protected regardless of where it is processed.

DATA SECURITY

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or disclosure.

Security measures include:

• encrypted data transmission
• secure storage systems
• restricted access to personal information
• regular security reviews and system monitoring
• staff training in data protection practices

Although we strive to maintain strong security practices, no internet-based system can be guaranteed completely secure.

YOUR DATA PROTECTION RIGHTS

Under UK data protection law, you have several rights regarding your personal information.

These include:

• the right to be informed about how your data is used
• the right to access personal data we hold about you
• the right to correct inaccurate information
• the right to request deletion of your data
• the right to restrict certain types of processing
• the right to data portability
• the right to object to processing based on legitimate interests
• the right to challenge automated decisions

Requests to exercise these rights can be made by contacting us via the email address provided earlier.

CHILDREN’S DATA

Our services are not intended for children under the age of 13, and we do not knowingly collect personal information from individuals below this age without appropriate parental consent.

Where users are between 13 and 18 years old, parental or guardian permission may be required for certain services.

If we become aware that we have collected personal data from a child without appropriate consent, we will promptly delete the information.

THIRD-PARTY LINKS

Our website may contain links to external websites operated by third parties. We do not control these websites and are not responsible for their privacy practices.

We recommend reviewing the privacy policies of any external websites before providing personal information.

POLICY UPDATES

From time to time, we may revise this Privacy Policy to reflect changes in our services, technology, or legal obligations.

Any updates will be published on our website with an updated revision date. Continued use of our services after updates indicates acceptance of the revised policy.

CONTACT INFORMATION

For any questions regarding this Privacy Policy or how we process personal data, please contact:

Griffin Education Group Ltd
10–16 Tiller Road
London, England, E14 8PX

Email: info@griffineducationgroup.com

COMPANY INFORMATION

Company Name: Griffin Education Group Ltd
Company Number: 17032070
Registered in England and Wales

Policy Version: 1.0
Next Review Date: February 2027