Privacy Policy

Last updated: August 2026

1. Who we are

Bright Bound Education ("Bright Bound", "we", "us", "our") is an education consultancy based in London, United Kingdom. We provide free guidance to students seeking undergraduate, postgraduate and professional courses, and we support them through the application process to our partner universities and institutions.

For the purposes of UK data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — Bright Bound Education is the data controller for the personal data described in this policy.

2. Information we collect

The information we collect depends on how you interact with us. It may include:

Identity and contact details

• Full name, date of birth and nationality
• Postal address, email address and telephone number
• Passport or identity document details, where required for an application

Education and application information

• Previous qualifications, transcripts and certificates
• English language test results (such as IELTS)
• Personal statements, references and CVs
• Your course preferences, intended start date and study level
• Visa and immigration status where relevant to your application

Correspondence

• Enquiry form submissions and the content of emails, calls and messages between us
• Notes made by your advisor about your goals and circumstances

Agent information

If you register with us as a recruitment agent, we collect your business name, contact details, territory and any supporting business documentation you provide.

Technical information

• IP address, browser type and device information
• Pages visited on our website and the dates and times of those visits

3. How we collect it

• Directly from you — when you complete an enquiry form, speak with an advisor by phone or email, or send us documents in support of an application.
• From a recruitment agent — where a registered agent has introduced you to us, they may pass us your details in order for us to assist with your application.
• From partner institutions — universities and colleges may share updates on the progress or outcome of your application.
• Automatically — limited technical information is collected by our website as you browse it.

4. Why we use it and our lawful basis

UK GDPR requires us to have a lawful basis for using your personal data. Ours are set out below.

What we use it for	Lawful basis	Notes
Responding to your enquiry and giving you course guidance	Legitimate interests	It is in both our interests that we can answer the question you asked us.
Preparing and submitting your application to a university or college	Performance of a contract / consent	We only submit an application once you have asked us to.
Sharing your details with partner institutions	Consent	You can withdraw consent at any time, though this may mean we cannot progress an application.
Keeping you updated on your application	Legitimate interests	Necessary to deliver the service you have asked for.
Sending you marketing about courses and open days	Consent	Only where you have opted in. Every message includes an unsubscribe link.
Managing agent relationships and commission	Performance of a contract	Applies to registered recruitment agents.
Meeting our legal and regulatory obligations	Legal obligation	Including accounting, tax and safeguarding requirements.
Improving our website and services	Legitimate interests	Analysed in aggregate wherever possible.

5. Who we share it with

Sharing your data with partner universities and institutions is central to the service we provide. When you ask us to help you apply for a course, we pass the information needed to process that application — your identity details, qualifications, supporting documents and course preferences — to the relevant institution.

Each institution becomes an independent data controller for the information it receives, and will handle it under its own privacy policy. We will tell you which institutions we are sharing your details with, and we will not share your data with an institution you have not agreed to apply to.

We may also share your data with:

• Registered recruitment agents — where an agent introduced you to us, to coordinate your application.
• Service providers — including our email, IT hosting and customer management providers, who process data only on our instructions.
• Professional advisors — such as accountants or legal advisors, where necessary.
• Regulators and authorities — where we are legally required to disclose information, including to UK Visas and Immigration in connection with a visa application.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. International transfers

We support students internationally, and some of the institutions or service providers we work with are based outside the United Kingdom. Where we transfer your personal data outside the UK, we make sure it is protected by an appropriate safeguard — such as an adequacy decision by the UK government, or the International Data Transfer Agreement approved by the Information Commissioner's Office.

Where you have asked us to apply to an institution outside the UK, transferring your data to that institution is necessary to fulfil your request.

7. How long we keep it

We keep your personal data only for as long as we need it.

• Enquiries that do not proceed — up to 24 months from your last contact with us, in case you return to us.
• Application and student records — up to 6 years from the end of our relationship, to handle any queries or disputes.
• Financial and agent records — 6 years, as required by HMRC.
• Marketing preferences — until you withdraw consent, plus a record of that withdrawal so we can honour it.

When data is no longer needed we delete it securely, or anonymise it so that it can no longer identify you.

8. Your rights

Under UK data protection law you have the following rights, free of charge:

• Access — to receive a copy of the personal data we hold about you.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to ask us to delete your data, where we have no continuing reason to keep it.
• Restriction — to ask us to pause our use of your data while a concern is resolved.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability — to receive your data in a structured, commonly used format, or have it sent to another organisation.
• Withdraw consent — at any time, where we rely on your consent. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email info@brightbound.co.uk. We will respond within one month. We may need to verify your identity first, to make sure we are not disclosing your data to someone else.

9. Cookies, analytics and advertising

Cookies are small text files placed on your device when you visit a website. We use them in the following categories:

Category	What it does	Consent
Strictly necessary	Required for the website to function — for example remembering your cookie preferences and keeping forms secure.	Not required
Analytics	Helps us understand how visitors find and use our site so we can improve it. This may include Google Analytics.	Required — set only if you accept
Advertising and remarketing	Used to measure the performance of our advertising and to show relevant ads to people who have visited our site. This may include Google Ads and Meta (Facebook and Instagram) advertising tools.	Required — set only if you accept

We display a cookie consent banner when you first visit the site. Analytics and advertising cookies are not set until you accept them, and you can change your choice at any time through that banner. You can also block or delete cookies through your browser settings, though this may affect how parts of the site work.

Advertising platforms and lead forms

We advertise our services on platforms including Google and Meta. If you submit your details through an advertisement — for example a Google Ads lead form — that platform collects your information and passes it to us. We then use it as described in section 4 of this policy, namely to respond to your enquiry and provide course guidance.

The advertising platform is a separate data controller for the information it collects, and handles it under its own privacy policy:

• Google — policies.google.com/privacy
• Meta — facebook.com/privacy/policy

We do not use automated decision-making or profiling that produces legal effects concerning you.

Withdrawing your consent

Wherever we rely on your consent — including marketing emails, analytics and advertising cookies, and sharing your details with a partner institution — you can withdraw it at any time:

• Marketing emails — click the unsubscribe link at the bottom of any message we send you.
• Cookies — reopen the cookie banner on our website and change your preferences, or clear cookies in your browser.
• Anything else — email info@brightbound.co.uk stating what you would like to withdraw, and we will action it.

Withdrawing consent is free and straightforward, and we will never make it harder to withdraw than it was to give. It does not affect the lawfulness of anything we did before you withdrew it. Please note that if you withdraw consent for us to share your details with an institution, we may be unable to continue progressing an application on your behalf.

10. How we protect your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include access controls, encrypted connections to our website, secure storage of documents, and limiting access to your information to staff who need it to do their job.

No method of transmission over the internet is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and will tell you directly where the law requires it.

11. Applicants under 18

Our services are aimed at people applying for higher and further education. Where an applicant is under 18, we will ask for consent from a parent or legal guardian before processing their personal data, and we handle their information with additional care.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@brightbound.co.uk so we have the opportunity to put things right.

You also have the right to complain to the UK's data protection regulator:

13. Changes to this policy

We may update this policy from time to time to reflect changes in our services or in the law. The date at the top of this page shows when it was last revised. Where changes are significant, we will contact you directly to let you know.

14. Contact us

For any question about this policy or about how we handle your personal data: