EduQuantica Ltd – Data Protection (UK GDPR) Policy

Purpose and scope

EduQuantica Ltd processes personal data of students, parents, staff and partners lawfully, fairly and securely, in line with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. EduQuantica is a data controller registered with the Information Commissioner's Office (ICO), registration number ZB779105.

This policy applies to all directors, staff, contractors and sub-agents, in every country, and to all personal data we handle in any format.

Data protection principles

We make sure personal data is:

1. processed lawfully, fairly and transparently;
2. collected for specific, explicit and legitimate purposes;
3. adequate, relevant and limited to what is necessary;
4. accurate and kept up to date;
5. kept no longer than necessary;
6. kept secure against loss, damage or unauthorised access.

We are accountable for showing compliance, through records, policies, training and audits.

Lawful bases we rely on

Special category data, such as health or disability information for support needs, is collected only when needed and with explicit consent. For students under 18, we involve a parent or guardian and get their consent where required.

Data we hold

• Students: name, contact details, date of birth, passport details, academic transcripts and certificates, English test results, CVs, personal statements, financial evidence for visas, application and visa outcomes.
• Parents and guardians: name, contact details, relationship to the student, and financial sponsor documents where provided.
• Staff and sub-agents: identity, contract, training, bank and payroll details, and due-diligence records.
• Enquiries and marketing contacts: name, contact details, study interests and consent records.

Sharing personal data

We share data only where needed for the service and on a lawful basis:

• with UK universities and colleges the student chooses to apply to;
• with approved sub-agents, under a written data processing agreement;
• with service providers such as our CRM, email and cloud storage suppliers, under data processing agreements;
• with UKVI, the police or regulators only where the law requires it.

We never sell personal data.

International transfers

We work with students and sub-agents outside the UK. Data transferred out of the UK goes only to countries covered by UK adequacy regulations, or under the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.

Security

• Access to student records is limited by role, with multi-factor authentication on all systems.
• Documents are stored in our CRM and approved cloud storage only, never on personal devices, personal email or messaging apps.
• Laptops and phones used for work are encrypted and password protected.
• Paper documents are kept locked and shredded when no longer needed.
• All staff and sub-agents complete data protection training at induction and every year.

Retention

At the end of the retention period, data is securely deleted or anonymised.

Individuals' rights

Students, parents, staff and others can ask to:

• access the personal data we hold about them (a subject access request);
• correct inaccurate data;
• have data erased, where we have no legal reason to keep it;
• restrict or object to processing, including direct marketing;
• receive their data in a portable format;
• withdraw consent at any time.

Requests go to compliance@eduquantica.com. We respond within 1 month, free of charge, extendable by 2 months for complex requests, with the person told why. We verify identity before releasing data. Anyone unhappy with our response can complain to us first and then to the ICO (opens in a new tab).

Data breaches

1. Anyone who discovers a suspected breach, such as a lost device, an email sent to the wrong person or a hacked account, reports it to the Data Protection Lead immediately and within 24 hours at most.
2. The Data Protection Lead contains the breach and assesses the risk to individuals.
3. If the breach is likely to risk people's rights, we notify the ICO within 72 hours of becoming aware of it.
4. If the risk is high, we also tell the people affected without undue delay.
5. Every breach, reported or not, is logged with the facts, effects and action taken.