1. Introduction

Oscar Education Group Ltd (trading as Oscar Education, “we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. We are a UK education consultancy providing services to students, parents, schools, and partner institutions in the United Kingdom and internationally.

This Privacy Policy explains how we collect, use, store, share, and safeguard personal data obtained through our website www.oscaredu.uk, our email and telephone correspondence, and the consultancy services we deliver. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the “controller” of personal data collected through this website, which means we decide why and how your personal data is processed.

2. Who we are

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

3. The personal data we collect

We may collect and process the following categories of personal data:

3.1 Information you provide directly

• Identity and contact details: name, date of birth, nationality, gender, postal address, email address, and telephone number.
• Education and background information: school or university details, academic records, English language proficiency, qualifications, references, and personal statements.
• Family and guardian details: where the student is a minor, the name and contact details of a parent or legal guardian.
• Travel and immigration details: passport information, visa status, and travel preferences, where required to support a study placement.
• Payment and billing information: where you book and pay for a service online, billing name, billing address, and transaction reference. Card details are entered directly into our payment provider’s secure environment and are not stored by us.
• Correspondence: the content of enquiry forms, emails, and other communications you send us.

3.2 Information we collect automatically

When you visit www.oscaredu.uk we automatically collect certain technical information through cookies and similar technologies, including your IP address, device type, browser type and version, operating system, referring website, pages viewed, and dates and times of visits. Please see our Cookies Policy for details.

3.3 Information from third parties

We may receive information about you from partner schools, universities, language centres, agents, accommodation providers, and similar third parties where this is necessary to deliver the services you have requested.

4. How we use your personal data

We use your personal data for the following purposes and on the following lawful bases under UK GDPR:

• To respond to enquiries: when you submit a contact or enquiry form, we use your details to reply, provide information about programmes, and follow up where appropriate. Lawful basis: legitimate interests and, where relevant, steps taken at your request prior to entering into a contract.
• To deliver consultancy services: including school and university selection, application support, visa and travel guidance, and accommodation referrals. Lawful basis: performance of a contract.
• To process bookings and payments: including issuing invoices and confirmations, and to maintain accurate financial records. Lawful basis: performance of a contract and compliance with legal obligations (e.g. accounting and tax).
• To share applications with partner institutions: such as schools, universities, language centres, and accommodation providers, where this is necessary to progress your placement. Lawful basis: performance of a contract.
• To comply with legal and regulatory obligations: including immigration support requirements, anti-fraud, anti-money-laundering, and safeguarding obligations where children or vulnerable individuals are involved. Lawful basis: legal obligation.
• To improve our website and services: including analysing usage patterns, maintaining security, and preventing fraud. Lawful basis: legitimate interests.
• For marketing communications: where you have given consent or where you are an existing client and we are providing information about similar services, you may receive updates about programmes and events. You can opt out at any time. Lawful basis: consent or legitimate interests, as applicable.

5. Special category data and children’s data

In limited circumstances we may process special category data, for example health or dietary information needed for a residential programme, or background information relevant to a safeguarding assessment. We only do this where we have your explicit consent or another lawful basis under UK GDPR Article 9.

We provide services to students of all ages, including minors. Where the data subject is under 18, we will normally collect and process personal data with the involvement of a parent or legal guardian, and we apply additional safeguards in line with our safeguarding obligations. We do not knowingly market our services directly to children under 13.

6. Sharing your personal data

We do not sell your personal data. We share personal data only where necessary and with appropriate safeguards in place. Recipients may include:

• Partner schools, universities, language centres, summer schools, and accommodation providers in the UK and abroad, where required to progress your application or placement.
• Visa and immigration authorities, where you are applying to study in a country that requires this information.
• Service providers acting on our behalf, including IT and hosting providers, email and CRM platforms, payment processors, professional advisers (legal, accounting, audit), and analytics providers.
• Government, regulatory, and law-enforcement bodies, where we are required by law to do so.
• Successors in title and purchasers, in the event of a sale or restructuring of our business.

7. International transfers

Because we work with partner institutions outside the United Kingdom and the European Economic Area (EEA), your personal data may be transferred to countries that do not provide the same level of data protection as the UK. Where this happens, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries covered by UK adequacy regulations. You may contact us for further information about the safeguards we use.

8. How long we keep your personal data

We retain personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Our standard retention periods are:

• Enquiry data (where you did not become a client): retained for up to 5 years from your last meaningful contact with us (for example, the date you last opened, clicked, or replied to one of our communications, or last contacted us yourself), after which it is deleted or anonymised.
• Marketing consent: where we contact you for marketing purposes on the basis of your consent, we will refresh your consent at least every 2 years. If you do not actively re-confirm your consent or otherwise engage with our communications during that period, we will stop sending you marketing.
• Client and placement records: retained for up to 7 years after the end of the engagement, in line with UK accounting and tax requirements.
• Financial and transactional records: retained for at least 6 years from the end of the financial year in which the transaction occurred, in line with HMRC requirements.
• Safeguarding records (where applicable): retained in line with our safeguarding policy and any specific obligations relating to programmes involving children or vulnerable individuals.

You can ask us to delete your personal data sooner at any time by contacting us — see section 9 (Your rights) below. You can also unsubscribe from marketing at any time using the link in any marketing email or by contacting us directly.

9. Your rights

Under UK data protection law you have the following rights in relation to your personal data:

• The right to be informed about how we process your personal data.
• The right of access to your personal data (commonly known as a “subject access request”).
• The right to rectification of inaccurate or incomplete personal data.
• The right to erasure of your personal data (the “right to be forgotten”), in certain circumstances.
• The right to restrict processing of your personal data, in certain circumstances.
• The right to data portability, in certain circumstances.
• The right to object to processing based on legitimate interests or for direct marketing.
• Rights in relation to automated decision-making and profiling. We do not currently use automated decision-making that has legal or similarly significant effects on you.
• The right to withdraw consent at any time, where we rely on consent to process your personal data.

To exercise any of these rights, please contact us at info@oscaredu.uk. We will respond within one calendar month, although in complex cases we may extend this period by up to two further months and will tell you if we do.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

11. Security

We have implemented appropriate technical and organisational measures designed to secure personal data from accidental loss and unauthorised access, use, alteration, or disclosure. These include access controls, encryption in transit, staff confidentiality obligations, and the use of reputable hosting and payment providers. While we take security seriously, no method of transmission over the internet is completely secure.

12. Links to third-party websites

Our website may contain links to third-party websites, such as partner schools or universities. We are not responsible for the privacy practices of those websites and encourage you to read their own privacy notices.

13. Changes to this Privacy Policy

We keep this Privacy Policy under regular review. We will publish the latest version on our website and update the “Effective date” shown at the top of this document. Where changes are material, we will take reasonable steps to bring them to your attention.

14. Contact us

If you have any questions, comments, or requests regarding this Privacy Policy or your personal data, please contact us at info@oscaredu.uk, by telephone on +44 73 0591 6410, or by post at 3 Buckland’s Wharf, Thames Side, Kingston upon Thames, KT1 1TF, United Kingdom.