Plain-English Summary: AEC Consultant collects only the personal information necessary to help you access UK university education. We never sell your data, we only share it with partner universities as needed to process your application, and you can ask us to delete your information at any time. Read on for the full details.
Who We Are
+44 7946 279253
AEC Consultant Ltd ("AEC Consultant", "we", "us", "our") is a UK-registered education consultancy. We are the data controller responsible for your personal information collected through our website at www.aecconsultant.co.uk and through any direct communication with our team.
If you have any questions about this policy or how we handle your data, please contact us.
Data We Collect
We collect personal data in the following categories depending on how you interact with us:
2.1 Information You Provide Directly
- Identity data: first name, last name, date of birth, nationality, gender
- Contact data: email address, phone number, postal address
- Academic data: qualifications, grades, prior study history, English language level
- Financial data: residency status, immigration status (for Student Finance eligibility assessment only)
- Application data: personal statement, course preferences, supporting documents
- Communication data: messages, enquiries, notes from counselling calls
2.2 Information Collected Automatically
- Usage data: pages visited, time spent on site, referring URLs, clicks
- Technical data: IP address, browser type, device type, operating system
- Cookie data: see Section 8 for full details
2.3 Information from Third Parties
- Partner universities may confirm offer decisions or enrolment status with us
- Student Finance England may confirm funding eligibility in connection with your application
How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide free counselling and course guidance | Identity, contact, academic data | Legitimate Interests |
| Submit your university application | All application data | Contract Performance |
| Assess Student Finance eligibility | Residency, immigration, prior study data | Legitimate Interests |
| Communicate offers, updates and support | Contact data, application data | Contract Performance |
| Send relevant guides and resources (with consent) | Contact data | Consent |
| Improve our website and services | Usage data, technical data | Legitimate Interests |
| Comply with legal obligations | Identity, contact data | Legal Obligation |
We never use your data for automated decision making that produces legal or similarly significant effects on you without human review.
Legal Basis for Processing
Under UK GDPR, we rely on the following lawful bases for processing your personal data:
- Consent (Art. 6(1)(a)): Where you have given clear, freely given consent - for example, subscribing to our newsletter or agreeing to receive marketing emails. You can withdraw consent at any time.
- Contract (Art. 6(1)(b)): Where processing is necessary to perform the advisory and application services you have engaged us for.
- Legitimate Interests (Art. 6(1)(f)): Where we have a legitimate interest in processing your data that is not overridden by your rights - for example, improving our service quality or understanding how students use our website.
- Legal Obligation (Art. 6(1)(c)): Where we are required by law to retain or process certain data.
Sharing Your Data
We share your personal data only where strictly necessary and with appropriate safeguards in place. We never sell your data.
We may share data with:
- Partner universities and colleges: to submit your application and process any conditional or unconditional offer. Only the data required by that institution is shared.
- Student Finance England: to assist with your funding application, where you have asked us to do so.
- IT and communications providers: who host our website, CRM, and communications tools, all under data processing agreements.
- Professional advisors: including legal, accounting, and compliance advisors, under strict confidentiality obligations.
- Regulatory bodies or law enforcement: where we are required to do so by applicable law.
Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.
| Data Type | Retention Period |
|---|---|
| Active student application files | Duration of engagement + 7 years |
| Enquiry / counselling records (no application) | 3 years from last contact |
| Marketing consent records | Until withdrawn + 1 year |
| Website usage / analytics data | 26 months (anonymised after 13 months) |
| Financial / accounting records | 7 years (legal requirement) |
After the applicable retention period, data is securely deleted or anonymised. You may request early deletion subject to our legal obligations - see Section 7.
Your Rights
Under UK GDPR, you have the following rights regarding your personal data. You can exercise any of these rights free of charge by contacting us at info@aecconsultant.co.uk. We will respond within 30 days.
Right of Access
Request a copy of all personal data we hold about you (Subject Access Request).
Right to Rectification
Ask us to correct any inaccurate or incomplete personal data without undue delay.
Right to Erasure
Request deletion of your data where we no longer have a lawful basis to retain it.
Right to Restriction
Ask us to restrict processing of your data while a complaint or review is pending.
Right to Portability
Receive your data in a structured, machine-readable format to transfer to another provider.
Right to Object
Object to processing based on legitimate interests, including direct marketing at any time.
Cookies
Our website uses cookies to improve your experience and to help us understand how visitors use our site. A cookie is a small text file stored on your device.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, security, form submissions | Session |
| Analytical / Performance | Google Analytics aggregate traffic and behaviour data (anonymised IP) | Up to 26 months |
| Functional | Remembering language and region preferences | 12 months |
| Marketing (optional) | Retargeting ads via Google Ads and Meta Pixel, only with your consent | 90 days |
You can manage or withdraw consent for non-essential cookies at any time through your browser settings. Note that disabling certain cookies may affect site functionality.
International Data Transfers
AEC Consultant is based in the United Kingdom. Where we share data with partner universities or service providers located outside the UK, we ensure appropriate safeguards are in place, including:
- Transfer to countries with a UK adequacy decision
- Use of the ICO's International Data Transfer Agreement (IDTA)
- Standard contractual clauses approved by the ICO
Students applying from European countries (e.g. Spain, France, Germany) should be aware their data may be transferred to UK-based systems. We process such transfers in compliance with both UK GDPR and applicable EU data protection law where relevant.
Children's Privacy
Our services are intended for individuals aged 16 and over. We do not knowingly collect personal data from anyone under the age of 16 without verified parental or guardian consent.
If you believe we have inadvertently collected data from a minor, please contact us immediately at info@aecconsultant.co.uk and we will delete the information without delay.
Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures, including:
- SSL/TLS encryption for all data transmitted via our website
- Encrypted storage of personal data on secure, access-controlled servers
- Strict role-based access controls limiting who within our team can view your data
- Regular security reviews and staff data protection training
- Incident response procedures in line with ICO guidance
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:
- Update the "Last reviewed" date at the top of this page
- Notify active users by email where the changes are significant
- Display a notice on our homepage for 30 days after any major revision
We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or wish to exercise any of your data rights, please get in touch:
For complaints about how we handle your data, you can also contact the Information Commissioner's Office (ICO). For general enquiries or our Terms & Conditions, see our Terms & Conditions page.