Privacy and Cookie Policy

1Introduction

This policy explains how ACS Global Consultants Limited collects, uses, shares and protects personal data, and what rights you have. It applies to people who visit our website, contact us, use our services as students or parents, and to our staff and job applicants (section 18).

ACS Global Consultants Limited is the controller of your personal data. That means we decide how and why it is used, and we are responsible for it under UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations).

This policy covers ACS Global Consultants Limited only. Other companies, including any with a similar name, have their own privacy notices.

2Interpretation and definitions

In this policy:

• "We", "us" and "our" mean ACS Global Consultants Limited.
• "You" and "your" mean the person whose personal data we hold: a website visitor, someone who contacts us, a student, a parent, guardian or sponsor, a member of staff or a job applicant.
• Personal data means any information about an identified or identifiable living person.
• Special category data means data about health, racial or ethnic origin, religion, political opinions, trade union membership, genetics, biometrics used for identification, sex life or sexual orientation. It needs extra protection.
• Criminal offence data means data about criminal convictions, offences or related security measures, including police certificates.
• Processor means a company that handles personal data for us, on our instructions, such as our email or CRM provider.
• Sub-agent means an independent education agent outside the UK who refers students to us.
• Cookies are small files a website stores on your device.
• The website means theacsglobal.com.

3Collecting and using your personal data

Types of data we collect

What we collect depends on how far you go with us. Someone who sends one enquiry gives us far less than a student we apply to universities for.

Student finance login details. We normally help with student finance applications on a video call while you share your screen, so we never see your password. Only if screen-sharing isn't possible, and you ask us to, you may send us your login details so we can submit the application with you on the call. You change your password straight afterwards, and we delete the message containing your login details as soon as the application is submitted.

Do you have to give us your data?

No law requires you to give us personal data, and you can ask general questions without giving us more than a way to reply. But universities and visa authorities set their own requirements. If you do not give us the documents they ask for, such as your transcripts or passport, we cannot apply to universities for you or check whether you meet the entry requirements.

4Where we get your personal data from

Most of your data comes directly from you. We also receive it from:

• Sub-agents in Pakistan who refer students to us. If you started with a sub-agent, they send us your contact details and the documents you gave them so we can apply to universities on your behalf.
• Universities and colleges, which send us your application status, offers, decisions and enrolment confirmations.
• Your parents, guardians or sponsors, if they contact us for you or provide funding documents.
• People who refer you, such as a friend or former student who passes on your contact details with your agreement.
• Our website, which records usage data automatically (see section 6). Facebook and Instagram lead forms: when you respond to one of our adverts and submit your details, Meta passes them to us.

If we receive your data from someone other than you, we will send you a link to this policy when we first contact you, and no later than one month after we receive your data.

5Special category and criminal offence data

We only handle health information and police certificates when a university or visa route requires them, or when you choose to tell us about a disability so we can ask a university about support. We do not ask for information about your ethnicity, religion or sexual orientation.

We ask for your consent in writing before we accept these documents. You can withdraw it at any time by contacting us. If you withdraw it, we will stop using and delete these documents, but we will not be able to submit an application that requires them. Withdrawing consent does not affect anything we did before you withdrew it.

We keep these documents for a shorter time than the rest of your file (section 12), and only the staff working on your application can see them.

6Cookies and similar technologies

We store one item in your browser to remember your cookie choice and, only if you click Accept, use Google Analytics cookies. We do not use advertising cookies, and the website has no user accounts or logins.

When you first visit, a banner asks whether you accept analytics cookies. Accept and Reject are given equal weight. Until you click Accept, Google Analytics does not load at all. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. Open cookie settings

PECR covers anything stored on your device, not only cookies. The acs_cookie_consent item does not need your consent, because the website cannot remember your choice without it. After 6 months the website ignores your stored choice and asks again. If you clear your browser's site data, your choice is removed straight away and the banner reappears. If you reject analytics, the website also deletes any Google Analytics cookies already on your device. Analytics cookies are only set with your consent.

What Google Analytics tells us. It shows us which pages people read, which countries they visit from, and how they found us (for example, from an advert or a search). It does not tell us who you are. We use Google Analytics 4, which does not store IP addresses, and we keep analytics data for 14 months.

Spam protection on our forms. Our enquiry forms use Google reCAPTCHA, a service from Google that checks a real person is sending the form and not a bot. It loads only when you start to use a form (when you click or tap into it), not when the page opens. To tell people from bots, Google looks at information from your browser and device and at how you interact with the page, and it may set a cookie called _GRECAPTCHA on your device when the check runs. Google sends us a score, and we use it to decide whether to accept the form. We do not send Google your name, email address or phone number, and we do not use this check for advertising or analytics. We rely on our legitimate interest in keeping our forms secure (section 8). Because this check protects the security of the form you are using, we treat this cookie as strictly necessary and do not ask for separate cookie consent. Google handles the data it collects under its own Privacy Policy and Terms of Service.

Server logs. Like every website, our hosting provider, Hostinger, records basic technical data (such as IP address, browser type and the page requested) when you visit. This is used only to keep the website running and secure.

Links to WhatsApp, Google reviews and social media. Clicking these takes you to another company's service, which may set its own cookies under its own policy. Our website does not load their tracking code.

7How we use your personal data

UK data protection law says we must have a lawful basis for each thing we do with your data. This table matches each purpose to its basis. Section 8 explains our legitimate interests, and section 5 covers the extra conditions for health and police documents.

We will only use your data for a new purpose if it is compatible with the original one. If it is not, we will tell you first and, where needed, ask for your consent.

We never sell your personal data.

8Our legitimate interests

Where we rely on legitimate interests, we have weighed our interest against your rights and expectations. You have the right to object to any of these (section 13).

You can ask us for a copy of our assessment for any of these.

9Marketing and how to opt out

We only send marketing messages, such as news about intakes, scholarships or new destinations, if you have agreed to receive them. You agree by ticking an optional box on our website forms, our Facebook and Instagram lead forms or our onboarding form, or by telling us directly. The box is never pre-ticked, and you can use our services without ticking it. Messages about an application you are making with us are not marketing, and we will keep sending those while your application is active.

You can stop marketing at any time, free of charge:

• Email: click the unsubscribe link in any marketing email, or email info@theacsglobal.com.
• WhatsApp or SMS: reply STOP, or tell us in the chat.
• Phone: tell the person you are speaking to.

We will stop within 7 days. We keep a short record that you opted out, so we don't contact you by mistake in future.

We do not share your details with other companies for their marketing.

10Who we share your personal data with

We share your data only with the organisations below, and only what each needs.

Organisations that use your data for their own purposes

Service providers who handle data for us (processors)

These companies process data only on our instructions, under contracts that require them to keep it secure and confidential.

When you message us on WhatsApp, WhatsApp also handles some data under its own privacy policy.

11Transfers of your data outside the UK

Some of your data leaves the UK, mainly because the universities you apply to and some of the people who help you are abroad. This table shows each case and the safeguard that protects it.

You can ask us for a copy of the safeguards for any of these transfers, such as the IDTA, by contacting us. We may remove commercial details from the copy.

12How long we keep your data

We keep data only as long as we need it, then delete it securely. Supporting documents such as your passport and bank statements are deleted sooner than your basic application record, because we rarely need them once your application is finished.

Student finance login details, if you send them to us, are deleted as soon as your application is submitted. If a legal claim or investigation is under way, we may keep the relevant records until it ends. Staff and job applicant records are covered in section 18.

13Your data protection rights

These rights apply to everyone whose data we hold: website visitors, enquirers, students, parents, staff and job applicants. Some rights depend on the lawful basis we use, and some have legal exceptions.

• Right of access: ask for a copy of your personal data and information about how we use it.
• Right to rectification: ask us to correct data that is wrong or complete data that is incomplete.
• Right to erasure: ask us to delete your data. We may need to keep some records, such as accounting records, where the law requires it.
• Right to restrict processing: ask us to limit how we use your data, for example while we check whether it is accurate.
• Right to object: object to any use based on our legitimate interests (section 8). You can always object to marketing, and we will stop.
• Right to data portability: ask for the data you gave us in a common electronic format, or ask us to send it to another organisation, where we use it on the basis of contract or consent.
• Right to withdraw consent: where we rely on your consent (marketing, analytics cookies, health and police documents), withdraw it at any time. This does not affect what we did before.
• Rights about automated decisions: we do not make decisions about you by automated means alone (section 16).

How to make a request. Email info@theacsglobal.com, call or WhatsApp 07852 878789, or write to us at the address in section 1. You don't need to use a form or any particular words.

We will respond within one month. If your request is complex or you make several, we may extend this by up to two more months and will tell you why within the first month. If we need to confirm your identity or understand what you are asking for, the time limit starts once we have that information. Requests are free, unless they are clearly unfounded or excessive.

14Security of your personal data

We protect your data with measures suited to how sensitive it is, including:

• documents uploaded through our website go straight into our CRM and are never stored on the web server
• access to student files is limited to the staff working on them, using company laptops
• our business accounts, including our CRM, email and website hosting, are protected with strong passwords and two-factor authentication
• the website uses an encrypted (HTTPS) connection
• staff are bound by confidentiality, and sub-agents by written data protection terms

No system is completely secure. If a breach is likely to put your rights at high risk, we will tell you without undue delay, and we will report breaches to the ICO where the law requires.

Please send sensitive documents through the channels we give you rather than social media direct messages.

15Children and young people

Our services are for people aged 16 and over. We do not knowingly collect data from children under 16. If we find we have, we will delete it. If you are a parent and think your child under 16 has given us their details, please contact us.

We work with students aged 16 and 17, for example through school and sixth form events, because they are planning university applications. For these students:

• we explain how we use their data in plain language, and they can exercise their own data protection rights
• we involve a parent or guardian in decisions about applications and costs, where the student agrees or it is in their best interests
• we do not send marketing to anyone under 18 unless a parent or guardian has also agreed
• we collect only what is needed for their enquiry or application

16Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Tools on our website, such as a course finder, may suggest courses based on your answers, but a person at ACS always reviews your options before we advise you or apply anywhere.

If this changes, we will update this policy first and tell you about your right to have a person review the decision, to give your point of view and to challenge it.

17Links to other websites

Our website links to other sites, such as university pages, GOV.UK, the ICEF verification page, Google reviews, WhatsApp and our social media pages. We are not responsible for how those sites handle your data, so please read their privacy policies.

18Staff and job applicants privacy notice

This section applies to people who work for us, including staff working remotely outside the UK, and to people who apply for jobs with us. Sections 1, 13, 14 and 20 also apply to you.

What we collect and why

• contact details, date of birth and next of kin or emergency contact
• National Insurance number, bank details, pay, tax and pension information
• copies of passports or other ID, and right to work information
• employment and education history, qualifications and references
• photographs, for example for a staff ID or our website, if you agree
• records of your work, training, performance, absence and any disciplinary or grievance matters

We use this to recruit, employ, pay and manage staff, and to meet our legal duties as an employer.

Lawful bases

• Contract: to enter into and carry out your contract of employment.
• Legal obligation: right to work checks, tax, National Insurance, pensions auto-enrolment and employment law.
• Legitimate interests: managing our business, such as taking up references and keeping training records.
• Consent: only for optional things, such as using your photo on our website.

Where we get it from

Directly from you, from your referees, from recruitment websites or agencies you applied through, from public sources such as LinkedIn when we are recruiting, and from the Home Office online right to work check.

Who we share it with

HMRC, our accountants and payroll provider, our pension provider, training providers, our lawyers and insurers, and the Home Office where the law requires.

How long we keep it

19Data protection contact and representative

Data Protection Officer (DPO)

We are not required to appoint a Data Protection Officer, because we are not a public authority and our core work does not involve large-scale processing of special category data or large-scale monitoring of people. Our Founder and CEO, Ali Faraz, is responsible for data protection. Contact him at info@theacsglobal.com.

Representative

We are established in the UK. We do not have an office in the European Union and our services are aimed at people living in the UK, the Gulf, South Asia and Africa, so we have not appointed a representative in the EU. If that changes, we will appoint one and publish their details here.

20How to complain

If you are unhappy with how we have handled your personal data, please complain to us first. You can email info@theacsglobal.com, call or WhatsApp 07852 878789, or write to us at the address in section 1. You don't need to use particular words or a form.

We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

If you are still unhappy, you can complain to the UK's data protection regulator, the Information Commission (still known as the ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

You also have the right to go to court.

21Changes to this policy

We review this policy at least once a year and whenever how we use personal data changes. If we make a significant change, we will show a notice on the website and, if the change affects you and we have your contact details, tell you directly. The date at the bottom shows when the policy was last updated. If we start using personal data in a new way, for example by installing CCTV at our office, sponsoring overseas workers or adding new features to our website, we will update this policy before we start.

22Contact us

For any question about this policy or your personal data:

• Email: info@theacsglobal.com
• Phone or WhatsApp: 07852 878789 (+44 7852 878789 from outside the UK)
• Post: ACS Global Consultants Limited, 5 Westley Road, Acocks Green, Birmingham, B27 7UQ, United Kingdom