Privacy Policy & GDPR Statement

Privacy Policy

Privacy Policy / GDPR Statement for AF Associates UK

Last updated: 20 November 2025

1. Who We Are / Data Controller

AF Associates UK (“we”, “us”, “our”) is a UK-based education consultancy.

Our website: afassociatesuk.com
Registered address: 47 Cavell Street, London, E1 2BP, United Kingdom
Contact email: info@afassociatesuk.com

We are the data controller for the personal data that user/student/lead provide to us.

2. What Personal Data We Collect

We may collect and process the following types of personal data from you, depending on how you interact with us:

Contact Data: Name, email address, phone number, postal address
Application / Inquiry Data: Educational background, course interests, budget / financial preference, country of origin / nationality, current residency
Technical / Usage Data: IP address, browser type and version, device type, pages visited on our website, time and date of visits, referring site
Marketing Data: Preferences about how we communicate with you (e.g., whether you consent to marketing emails)
Other Data: Any additional information you choose to provide via contact forms, email, or other communications (for example, CVs, qualification certificates)

3. How We Use Your Data (Purposes) & Legal Basis

We will only use your personal data where we have a lawful basis to do so under UK GDPR. Our main purposes include:

To provide our consultancy services: processing your application, suggesting suitable courses, advising on student finance, and supporting you through the admissions process. Legal basis: contractual necessity (or legitimate interest, depending on the case).
To communicate with you: responding to your inquiries, sending you information about our services, and managing your customer account. Legal basis: contract / legitimate interest / consent (if marketing).
To send marketing communications (if you opt in): about courses, consultations, blog updates, webinars, etc. Legal basis: consent.
To improve our website and services: analyzing usage data to understand how we can make our services better. Legal basis: legitimate interests (our interest in improving user experience).
To comply with legal obligations: e.g., record keeping, financial regulations, or audits. Legal basis: legal obligation.

4. Data Sharing and Recipients

We may share your personal data with:

Third-party service providers: such as CRM providers, email marketing platforms, webinar platforms. These providers act as data processors, and we have data processing agreements with them to ensure GDPR compliance.
Partner educational institutions: universities or colleges you have expressed interest in; only with your consent or when necessary to fulfill our consultancy role.
Regulatory or legal bodies: if required to do so by law (e.g., for audit or compliance).

We will not sell your personal data to third parties.

5. Data Retention

We retain your personal data only for as long as necessary:

For active clients: we keep your data for the duration of our engagement (i.e., while we are advising you), plus 6 years for record-keeping, audit or future consultation.
For marketing contacts: if you have opted in, we will keep your contact details until you unsubscribe (or you ask us to delete your data), plus a reasonable “cooling-off” period to manage any legal or financial queries.
For data required by law: we may retain certain records for as long as required by applicable law.

After the retention period ends, we will either delete or anonymise your data in a secure way.

6. Your Rights

Under UK GDPR, you have the following rights:

Right to access your personal data (i.e., request a copy)
Right to rectification (i.e., correct inaccurate data)
Right to erasure (“right to be forgotten”), in certain circumstances
Right to restrict processing (i.e., limit how we use your data)
Right to data portability (i.e., receive your data in a portable format)
Right to object to processing, including for direct marketing
Right to withdraw consent, where our processing is based on your consent
Right to lodge a complaint with a supervisory authority (in the UK, the ICO – Information Commissioner’s Office)

If you want to exercise any of these rights, please contact us at: info@afassociatesuk.com.

7. Security

We take the security of your personal data seriously and have implemented technical and organisational measures to protect it. These include, but are not limited to:

Secure servers / hosting providers
Encryption of data in transit (HTTPS)
Access controls (only authorised staff)
Regular security reviews and audits

8. International Transfers

If we transfer your personal data outside the UK (for example, to education partners in other countries), we will ensure appropriate safeguards are in place (e.g., standard contractual clauses, data-transfer agreements) to protect your data in compliance with UK GDPR.