How We Handle Your Data

Last updated: September 2026

1. Who we are

Bright Bound Education ("Bright Bound", "we", "us", "our") is an education partnership organisation based in London, United Kingdom. We work with universities, colleges and training providers to connect people with education, training and opportunities for progression, and we support learners through course selection and applications.

For the purposes of UK data protection law — including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — Bright Bound Education is the data controller for the personal data described in this policy.

2. Information we collect

The information we collect depends on how you interact with us. It may include:

Identity and contact details

• Full name, date of birth and nationality
• Postal address, email address and telephone number
• Passport or identity document details, where required for an application

Education and application information

• Previous qualifications, transcripts and certificates
• Personal statements, references and CVs
• Your course preferences, intended start date and study level

Correspondence

• Enquiry form submissions and the content of emails, calls and messages between us
• Notes made by your advisor about your goals and circumstances

Agent information

If you register with us as a recruitment agent, we collect your business name, contact details, territory and any supporting business documentation you provide.

Technical information

• IP address, browser type and device information
• Pages visited on our website and the dates and times of those visits

3. How we collect it

• Directly from you — when you complete an enquiry form, speak with an advisor by phone or email, or send us documents in support of an application.
• From a recruitment agent — where a registered agent has introduced you to us, they may pass us your details in order for us to assist with your application.
• From partner institutions — universities and colleges may share updates on the progress or outcome of your application.
• Automatically — limited technical information is collected by our website as you browse it.

4. Why we use it and our lawful basis

UK GDPR requires us to have a lawful basis for using your personal data. Ours are set out below.

What we use it for	Lawful basis	Notes
Responding to your enquiry and giving you course guidance	Legitimate interests	It is in both our interests that we can answer the question you asked us.
Preparing and submitting your application to a university or college	Performance of a contract / consent	We only submit an application once you have asked us to.
Sharing your details with partner institutions	Consent	You can withdraw consent at any time, though this may mean we cannot progress an application.
Keeping you updated on your application	Legitimate interests	Necessary to deliver the service you have asked for.
Sending you marketing about courses and open days	Consent	Only where you have opted in. Every message includes an unsubscribe link.
Managing agent relationships and commission	Performance of a contract	Applies to registered recruitment agents.
Meeting our legal and regulatory obligations	Legal obligation	Including accounting, tax and safeguarding requirements.
Improving our website and services	Legitimate interests	Analysed in aggregate wherever possible.

5. Who we share it with

Sharing your data with partner universities and institutions is central to the service we provide. When you ask us to help you apply for a course, we pass the information needed to process that application — your identity details, qualifications, supporting documents and course preferences — to the relevant institution.

Each institution becomes an independent data controller for the information it receives, and will handle it under its own privacy policy. We will tell you which institutions we are sharing your details with, and we will not share your data with an institution you have not agreed to apply to.

We may also share your data with:

• Registered recruitment agents — where an agent introduced you to us, to coordinate your application.
• Service providers — including our email, IT hosting and customer management providers, who process data only on our instructions.
• Our artificial intelligence provider — Anthropic PBC, who generate the replies given by the assistant on this website. See section 10.
• Professional advisors — such as accountants or legal advisors, where necessary.
• Regulators and authorities — where we are legally required or permitted to disclose information, for example to funding bodies, awarding organisations or law enforcement.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. International transfers

Some of the institutions, partners and service providers we work with are based outside the United Kingdom. Where we transfer your personal data outside the UK, we make sure it is protected by an appropriate safeguard — such as an adequacy decision by the UK government, or the International Data Transfer Agreement approved by the Information Commissioner's Office.

Where you have asked us to apply to an institution outside the UK, transferring your data to that institution is necessary to fulfil your request.

7. How long we keep it

We keep your personal data only for as long as we need it.

• Enquiries that do not proceed — up to 24 months from your last contact with us, in case you return to us.
• Application and student records — up to 6 years from the end of our relationship, to handle any queries or disputes.
• Financial and agent records — 6 years, as required by HMRC.
• Marketing preferences — until you withdraw consent, plus a record of that withdrawal so we can honour it.
• Website assistant conversations — not stored on this website. Where you have asked us to get in touch, the transcript is kept with your enquiry under the periods above.

When data is no longer needed we delete it securely, or anonymise it so that it can no longer identify you.

8. Your rights

Under UK data protection law you have the following rights, free of charge:

• Access — to receive a copy of the personal data we hold about you.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to ask us to delete your data, where we have no continuing reason to keep it.
• Restriction — to ask us to pause our use of your data while a concern is resolved.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability — to receive your data in a structured, commonly used format, or have it sent to another organisation.
• Withdraw consent — at any time, where we rely on your consent. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, email info@brightbound.co.uk. We will respond within one month. We may need to verify your identity first, to make sure we are not disclosing your data to someone else.

9. Cookies, analytics and advertising

Cookies are small text files placed on your device when you visit a website. We use them in the following categories:

Category	What it does	Consent
Strictly necessary	Required for the website to function — for example remembering your cookie preferences and keeping forms secure.	Not required
Analytics	Helps us understand how visitors find and use our site so we can improve it. This may include Google Analytics.	Required — set only if you accept
Advertising and remarketing	Used to measure the performance of our advertising and to show relevant ads to people who have visited our site. This may include Google Ads and Meta (Facebook and Instagram) advertising tools.	Required — set only if you accept

We display a cookie consent banner when you first visit the site. Analytics and advertising cookies are not set until you accept them, and you can change your choice at any time through that banner. You can also block or delete cookies through your browser settings, though this may affect how parts of the site work.

Advertising platforms and lead forms

We advertise our services on platforms including Google and Meta. If you submit your details through an advertisement — for example a Google Ads lead form — that platform collects your information and passes it to us. We then use it as described in section 4 of this policy, namely to respond to your enquiry and provide course guidance.

The advertising platform is a separate data controller for the information it collects, and handles it under its own privacy policy:

• Google — policies.google.com/privacy
• Meta — facebook.com/privacy/policy

We do not use automated decision-making or profiling that produces legal effects concerning you.

Withdrawing your consent

Wherever we rely on your consent — including marketing emails, analytics and advertising cookies, and sharing your details with a partner institution — you can withdraw it at any time:

• Marketing emails — click the unsubscribe link at the bottom of any message we send you.
• Cookies — click Cookie Settings at the bottom of any page on this website to reopen the banner and change your preferences, or clear cookies in your browser.
• Anything else — email info@brightbound.co.uk stating what you would like to withdraw, and we will action it.

Withdrawing consent is free and straightforward, and we will never make it harder to withdraw than it was to give. It does not affect the lawfulness of anything we did before you withdrew it. Please note that if you withdraw consent for us to share your details with an institution, we may be unable to continue progressing an application on your behalf.

10. The assistant on this website

This website has an automated assistant — a chat window that answers questions about our courses and how we work. It is software, not a member of staff, and its answers are generated automatically. It cannot make decisions about your application, confirm a place, or confirm funding.

What it processes

When you type a message into the assistant, that message and the conversation so far are sent from your browser to our website server, and from there to our artificial intelligence provider so that a reply can be generated. Please do not type sensitive information into the assistant — for example health details, immigration documents or financial details. If you need to send us something like that, use our contact form or email us.

Our provider

The replies are generated by Anthropic PBC, who act as our processor and handle the conversation only on our instructions. Anthropic does not use conversations sent through our website to train its models. Anthropic is based in the United States, so this involves a transfer outside the UK; it is covered by the safeguards described in section 6.

If you ask us to get in touch

After a few questions the assistant may offer to pass your enquiry to our team. That only happens if you fill in your name and email and tick the consent box — nothing is sent to us unless you do. If you tick it, we receive your name, your email address and a copy of the conversation, by email, so that a person can reply to you properly. Our lawful basis for this is your consent, and you can withdraw it at any time by emailing info@brightbound.co.uk.

If you choose WhatsApp

Where the assistant cannot answer, it offers a WhatsApp button. Pressing it opens WhatsApp on your own device with your question already written out — nothing is sent until you press send yourself, and nothing reaches us until you do. WhatsApp is provided by Meta and your message is handled under WhatsApp's own terms; once it arrives with us we treat it as any other enquiry, as described in this policy.

How long we keep it

We do not store conversations on this website. A short-lived record is kept in your browser session so the assistant can follow the thread, and it is discarded when you close the browser. Where you have asked us to get in touch, the transcript arrives in our inbox and is kept with your enquiry under the periods set out in section 7.

Choosing not to use it

The assistant is entirely optional. You never have to use it, and everything it can tell you is on these pages or available from us by phone or email.

11. How we protect your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include access controls, encrypted connections to our website, secure storage of documents, and limiting access to your information to staff who need it to do their job.

No method of transmission over the internet is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and will tell you directly where the law requires it.

12. Applicants under 18

Our services are aimed at people applying for higher and further education. Where an applicant is under 18, we will ask for consent from a parent or legal guardian before processing their personal data, and we handle their information with additional care.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@brightbound.co.uk so we have the opportunity to put things right.

You also have the right to complain to the UK's data protection regulator:

14. Changes to this policy

We may update this policy from time to time to reflect changes in our services or in the law. The date at the top of this page shows when it was last revised. Where changes are significant, we will contact you directly to let you know.

15. Contact us

For any question about this policy or about how we handle your personal data: