Student Privacy Notice

LOPEX UNICONS LTD (trading as UNICONS) is the Data Controller in respect of the personal data you provide to us and that we collect when you use the UNICONS platform.

Contact details:

• Address: 214 High Street, Second Floor, Hounslow, TW3 1HB, London, United Kingdom
• Email: enquiry@unicons.co.uk
• Website: www.unicons.co.uk
• ICO Registration Number: [ICO Registration Number — to be inserted upon registration]

If you have any questions about how we process your personal data, or wish to exercise any of your data protection rights, please contact us at the email or postal address above.

This Privacy Notice applies to students and prospective students who register or engage with the UNICONS platform. It should be read alongside our Cookie Policy and, where applicable, any supplementary privacy information provided to you at the point of data collection.

We collect and process the following categories of personal data about you:

2.1 Identity and Contact Data - Full name, preferred name, date of birth, gender, nationality, and country of origin - Postal address, email address, telephone number, and WhatsApp number (if provided) - Passport number and copy, national identity document details

2.2 Educational Data - Academic qualifications (secondary, undergraduate, postgraduate), grades, and transcripts - English language test results (including IELTS, TOEFL, PTE, Duolingo, and ETS TOEFL scores) - Personal statements, references, and supporting academic documents - Details of current or previous educational institutions attended - Course and programme preferences and academic goals

2.3 Application and Enrolment Data - Records of applications submitted to Partner Institutions - Offer letters, conditions, and enrolment confirmations received - Communication records between you and UNICONS, and between UNICONS and Partner Institutions on your behalf - Counsellor and agent assignment records

2.4 Financial Data - Evidence of financial capacity (e.g. bank statements, scholarship letters) required for visa or admission purposes - Payment records where applicable (note: UNICONS does not charge students for core services)

2.5 Special Category and Biometric Data - Where you submit ETS (Educational Testing Service) TOEFL scores, we may process biometric data associated with your ETS profile as part of the identity verification embedded in the testing process. We process this data solely to verify the authenticity of scores submitted in your application and in accordance with ETS' own terms. - Health information, only where voluntarily disclosed and relevant to disability support or special consideration requests made to a Partner Institution

2.6 Immigration and Visa Data - Details of previous visa applications and outcomes, including any refusals - Immigration status and right to study in the UK or destination country

2.7 Technical and Usage Data - IP address, browser type and version, operating system, device identifiers - Log data relating to your access to and use of the Platform - Cookie and tracking data (see our Cookie Policy for full details)

We process your personal data under the following lawful bases as defined in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

3.1 Performance of a Contract (Article 6(1)(b) UK GDPR)

We process your identity, contact, educational, and application data as necessary to provide the consultancy services described in our Student Terms and Conditions, including: - Creating and managing your account - Preparing, submitting, and managing university applications on your behalf - Communicating with Partner Institutions in connection with your applications - Facilitating offers, enrolment, and onboarding communications

3.2 Legitimate Interests (Article 6(1)(f) UK GDPR)

We process certain data where it is in our legitimate business interests to do so, and where those interests are not overridden by your rights and interests. This includes: - Analysing platform usage to improve our services and user experience - Fraud prevention and platform security - Record-keeping and internal audit purposes - Communicating with you about service updates that are directly related to your account (transactional communications)

3.3 Legal Obligation (Article 6(1)(c) UK GDPR)

We may process your data where we are required to do so by law, including: - Compliance with HMRC, Companies House, or other regulatory obligations - Responding to lawful requests from law enforcement or regulatory authorities - Reporting to the Information Commissioner's Office (ICO) in the event of a data breach

3.4 Consent (Article 6(1)(a) UK GDPR)

Where we process data on the basis of your consent, including for marketing communications, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

3.5 Special Category Data (Article 9 UK GDPR)

Where we process special category data (such as health information or biometric data related to ETS scores), we do so on the basis of: - Your explicit consent (Article 9(2)(a)) - Or the establishment, exercise, or defence of legal claims (Article 9(2)(f)) where applicable

We use the personal data we collect for the following purposes:

• Account management: Creating, verifying, and managing your UNICONS account and profile
• Application processing: Preparing, reviewing, and submitting applications to Partner Institutions on your behalf
• Communication: Corresponding with you about your application, updates from Partner Institutions, visa guidance, and service-related matters
• Institution liaison: Sharing relevant data with Partner Institutions to facilitate admissions and enrolment processes
• Counsellor and agent coordination: Enabling assigned counsellors and agents to support you through the application process
• Document verification: Reviewing and verifying the authenticity and completeness of documents you submit
• Visa support: Providing general informational guidance on student visa processes
• Platform improvement: Analysing aggregated and anonymised usage data to improve the Platform and our services
• Legal and regulatory compliance: Meeting our obligations under applicable law
• Fraud prevention: Detecting and preventing fraudulent activity on the Platform
• Marketing communications: Sending you relevant educational opportunities, events, and partner updates where you have given consent

We may share your personal data with the following categories of recipients:

5.1 Partner Institutions We share your application data, academic records, and supporting documents with universities and educational institutions to which you have applied or expressed interest. Sharing is governed by our data sharing agreements with those institutions.

5.2 Agents and Counsellors Authorised UNICONS agents and counsellors who are assigned to support your application will have access to your profile and application data on a need-to-know basis.

5.3 Overseas Education Partners Where applications are made to institutions outside the UK, your data may be shared with our overseas partner organisations who act as local representatives in those territories.

5.4 Service Providers and Processors We engage third-party service providers who process data on our behalf under written data processing agreements. These include: - Cloud hosting and infrastructure providers - Email and communication platform providers - Customer relationship management (CRM) software providers - Document management and e-signature providers

5.5 Regulatory and Law Enforcement Authorities We may disclose personal data to the Information Commissioner's Office (ICO), UKVI, police, courts, or other governmental bodies where required by law, court order, or to protect the rights and safety of UNICONS or others.

5.6 Professional Advisers Lawyers, accountants, and insurers who provide professional services to UNICONS under obligations of confidentiality.

5.7 Business Transfers In the event of a merger, acquisition, or sale of UNICONS' business, your data may be transferred to the acquiring entity, subject to equivalent data protection safeguards.

We do not sell your personal data to third parties for their own commercial purposes.

UNICONS operates globally and may transfer your personal data to countries outside the United Kingdom and the European Economic Area (EEA). Such transfers occur when we share data with:

• Partner Institutions located outside the UK/EEA
• Overseas partner organisations assisting with applications in their territory
• Cloud infrastructure or software providers whose servers are located outside the UK/EEA

Where we transfer your data internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V, including:

• UK Adequacy Regulations: Transfers to countries that the UK government has determined provide an adequate level of data protection
• Standard Contractual Clauses (SCCs): Use of the UK International Data Transfer Agreement (IDTA) or addendum to the EU SCCs approved by the ICO
• Binding Corporate Rules (BCRs): Where applicable for intra-group transfers
• Your explicit consent: Where no other safeguard applies and you have been informed of the risks

You may request details of the specific safeguards in place for any international transfer by contacting us at enquiry@unicons.co.uk.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any legal, regulatory, or contractual retention requirements. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes.

Where you make a request for erasure under your right to be forgotten (see Section 8), we will assess whether any legal obligation requires us to retain the data before acting on that request.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in respect of your personal data:

8.1 Right of Access (Subject Access Request) You have the right to request a copy of the personal data we hold about you and information about how we process it. We will respond within one calendar month of receiving a valid request.

8.2 Right to Rectification You have the right to request correction of any inaccurate or incomplete personal data we hold about you. We will correct the data within one calendar month.

8.3 Right to Erasure ("Right to be Forgotten") You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where we have processed it unlawfully. This right is subject to certain exceptions, including where we are required by law to retain the data.

8.4 Right to Restriction of Processing You may ask us to restrict processing of your data in certain circumstances, for example while we investigate a rectification request or where you contest the lawfulness of our processing.

8.5 Right to Data Portability Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.

8.6 Right to Object You have the right to object to processing based on our legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

8.7 Rights Related to Automated Decision-Making You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. At present, UNICONS does not make fully automated decisions about students. Where profiling or automated tools are used to assist in matching students to institutions, a human review is always involved.

To exercise any of your data protection rights, please contact us in writing:

• Email: enquiry@unicons.co.uk (please include "Data Rights Request" in the subject line)
• Post: Data Protection, LOPEX UNICONS LTD, 214 High Street, Second Floor, Hounslow, TW3 1HB, London, United Kingdom

We may ask you to verify your identity before acting on any request. We will respond to all valid requests within one calendar month. Where a request is particularly complex or numerous, we may extend this period by a further two months and will notify you accordingly.

We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

If you are unhappy with how we have handled your personal data, or if you believe we have processed it in breach of applicable data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

Information Commissioner's Office - Website: www.ico.org.uk - Telephone: 0303 123 1113 - Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in the first instance at enquiry@unicons.co.uk.

UNICONS may use automated tools and algorithms to assist with certain functions, including:

• Matching student profiles to relevant courses and institutions based on academic criteria
• Identifying recommended next steps in the application process
• Sending targeted communications based on application stage or profile data

These automated processes are used to assist and inform human decision-making, not to replace it. All significant decisions relating to your application or suitability for a particular programme are reviewed by a qualified UNICONS counsellor or adviser.

You have the right to request human review of any automated processing that has a significant effect on you. To do so, please contact us at enquiry@unicons.co.uk.

The UNICONS Platform uses cookies and similar tracking technologies to enhance your experience, analyse usage, and enable certain functionality. The types of cookies we use, their purposes, and how you can manage your cookie preferences are set out in our Cookie Policy, available at www.unicons.co.uk/legal/cookie-policy.

By continuing to use the Platform, you consent to the use of cookies in accordance with our Cookie Policy. You may withdraw consent to non-essential cookies at any time through the cookie preference centre accessible in the Platform footer.

We may update this Privacy Notice from time to time to reflect changes in our data processing practices, applicable law, or our services. Where we make material changes, we will notify you by email or via a prominent notice on the Platform at least 14 days before the changes take effect.

The current version of this Privacy Notice, together with its effective date, is always available at www.unicons.co.uk/legal/privacy.

This Privacy Notice was last updated on 1 September 2025 and is version 1.0.