Unifresher customer privacy notice
Registered name: Student Media Ltd
We are the controller of your personal data. For more information on controllers and their responsibilities please see our guidance on data protection principles, definitions, and key terms.
This privacy notice tells you what to expect us to do with your personal information.
- Contact details
- What information we collect, use, and why
- Children and young people’s privacy
- Cookies, tracking and similar technologies
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- International transfers
- How to complain
Contact details
Post: 86-90 Paul Street, London, EC2A 4NE, GB
Email: felicity@unifresher.co.uk
What information we collect, use, and why
We collect or use the following information to provide and improve products and services for clients:
- Names and contact details
- Occupation
- Payment details (including card or bank information for transfers and direct debits)
- Transaction data (including details about payments to and from you and details of products and services you have purchased)
- Audio/visual recordings (eg phone calls or video calls)
- Records of meetings and decisions
We collect or use the following personal information for the operation of client or customer accounts:
- Names and contact details
- Purchase or service history
- Account information, including registration details
- Audio/visual recordings (eg phone calls or video calls)
- Records of meetings and decisions
- Marketing preferences
We collect or use the following personal information for information updates or marketing purposes:
- Names and contact details
- Marketing preferences
- Purchase or account history
We collect or use the following personal information for recruitment purposes:
- Contact details (eg name, address, telephone number or personal email address)
- Date of birth
- National Insurance number
- Copies of passports or other photo ID
- Employment history (eg job application, employment references or secondary employment)
- Education history (eg qualifications)
- Right to work information
- Audio/visual recordings (eg phone calls or video calls)
- Records of meetings and decisions
We collect or use the following personal information for dealing with queries, complaints or claims:
- Names and contact details
- Payment details
- Account information
- Purchase or service history
- Call recordings
- Customer or client accounts and records
- Correspondence
Children and young people’s privacy
We don’t design our website or services specifically for under-18s, but we recognise that some visitors — for example, prospective or current students — are likely to be under 18.
We don’t knowingly collect any special or additional categories of information from under-18 visitors beyond what’s set out in this notice, and we don’t use profiling or targeted advertising techniques aimed specifically at children.
If you’re a parent or guardian and you’re concerned about personal information we hold about a child, please contact us using the details above and we’ll look into it.
Cookies, tracking and similar technologies
When you visit our website, we and our third-party partners may use cookies, pixels, tags and similar tracking technologies to collect information about you and your device. These technologies work by placing a small file on your device or reading information already there.
We use the following categories of cookies and similar technologies:
- Strictly necessary/functional — needed for the website to work properly, such as remembering your login, items in a basket, your cookie preferences, and keeping the site secure. These cannot be switched off.
- Analytics and performance — help us understand how visitors use our website (for example, which pages are visited and for how long) so we can improve our services.
- Advertising and tracking pixels — used by social media and advertising platforms to help us measure the effectiveness of our advertising and to show more relevant ads.
- Social media and embedded content — if we embed content from third parties (for example, social media posts or share buttons), those third parties may set their own cookies on your device when you interact with that content.
- Email tracking — the sales and marketing email tools we use may include tracking pixels that tell us when an email has been opened, and links in our emails (including shortened links) may be tracked to tell us when they’ve been clicked. This helps us understand how people engage with our communications and isn’t limited to our website.
Where we are required to obtain your consent before using non-essential cookies, we will ask for this via a cookie banner or preference tool on our website, and you can change your preferences or withdraw consent at any time. You can also control or delete cookies through your browser settings — for guidance on how to do this, see your browser’s help pages. Please note that blocking some types of cookies may affect how the website functions.
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
- Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
- Your right to erasure — You have the right to ask us to delete your personal information. Read more about the right to erasure.
- Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
- Your right to object to processing — You have the right to object to the processing of your personal data. Read more about the right to object to processing.
- Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
- Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for information updates or marketing purposes are:
- Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We collect the names and email addresses of marketing contacts to provide relevant information updates, product news, and marketing communications to individuals who have a professional interest in our services. Processing this information is legitimate and necessary because it allows us to communicate effectively, personalise messages, and ensure that updates are sent to the correct people, which benefits both our organisation and the recipients by making communications timely, accurate, and relevant. The use of limited contact details supports our legitimate interest in promoting and improving our services while helping contacts stay informed about developments that may be useful to them. We minimise any potential impact on individuals by collecting only the information required for these purposes, using it in line with their reasonable expectations, keeping it secure, and offering clear options to opt out or update preferences at any time. We believe these safeguards ensure that our interests do not override individuals’ rights or freedoms.
- For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information for recruitment purposes are:
- Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We collect and use personal information for recruitment purposes to manage applications, communicate with candidates, and progress recruitment processes in an efficient and organised way. This processing is legitimate and necessary because it enables us to identify applicants, acknowledge applications, share updates, arrange interviews, and provide outcomes, which benefits both the organisation and candidates by ensuring clear, timely, and accurate communication. Using this limited personal information supports our legitimate interest in attracting and selecting suitable candidates while allowing applicants to engage fairly and effectively with the recruitment process. We take care to minimise any potential impact on individuals by collecting only relevant contact details, using them solely for recruitment-related purposes, keeping them secure, and retaining them only for as long as necessary. These measures help ensure that our recruitment needs are balanced against and do not override the rights and expectations of applicants.
- For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
- Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We collect and use personal information, such as names and contact details, to respond to queries, complaints, or claims in a clear, accurate, and timely manner. The lawful basis for this processing is our legitimate interests in providing effective customer support, maintaining service quality, and resolving issues fairly, as well as, where applicable, compliance with legal obligations related to complaints handling and claims management. Processing this information is necessary to understand the issue raised, communicate with the individual involved, and keep appropriate records of actions taken. This benefits individuals by ensuring their concerns are properly addressed and helps us improve our services and meet regulatory or contractual requirements. We limit the information collected to what is relevant for handling the matter, use it only for this purpose, keep it secure, and retain it in line with legal and operational requirements, ensuring our use of personal information does not override individuals’ rights or expectations.
- For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Where we get personal information from
- Directly from you
- Publicly available sources
- Previous employment
How long we keep information
| Purpose | Type of information | How long we keep it |
|---|---|---|
| Providing and improving our services | Names, contact details & occupation | For the duration of our relationship and up to 6 years after it ends |
| Payment and transaction information | 6 years to meet accounting and tax requirements | |
| Call recordings | Up to 6 years | |
| Records of meetings and decisions | Up to 6 years | |
| Managing customer or client accounts | Account and registration details | While the account is active and up to 6 years after closure |
| Purchase or service history | Up to 6 years | |
| Audio/visual recordings | While the account is active and up to 6 years after closure — kept alongside your account records for training purposes | |
| Records of meetings and decisions | While the account is active and up to 6 years after closure | |
| Marketing preferences | Until you update your preferences or opt out | |
| Marketing and information updates | Names, contact details, and marketing preferences | Until you opt out, withdraw consent, or after a period of inactivity (usually 36 months) |
| Recruitment | Job application and recruitment information | For the recruitment process and up to 12 months afterwards |
| Audio/visual recordings | For the recruitment process and up to 12 months afterwards | |
| Records of meetings and decisions | For the recruitment process and up to 12 months afterwards | |
| Right-to-work and identity documents | For successful candidates, during employment and up to 2 years after it ends | |
| Queries, complaints, or claims | Contact details, correspondence, and relevant records | Until the matter is resolved and up to 6 years afterwards |
Who we share information with
We share personal information with the following categories of third party, who process it on our behalf or for their own related purposes:
- Debt collection agencies — where necessary to recover payments owed to us.
- Professional or legal advisors — such as accountants, auditors, or solicitors, where we need advice or representation.
- Payment processors — to process card, bank and direct debit payments.
- Accounting software providers — for bookkeeping, invoicing and accounting.
- Cloud storage, email and productivity software providers — to store files, run email and support day-to-day operations.
- CRM and marketing platform providers — to manage customer relationships and send marketing communications and information updates, where you have agreed to receive these.
- Sales engagement, outreach and email-verification tools — to send and track sales and marketing emails, and to check the validity of email addresses before we contact them.
- Advertising and social media platforms — for advertising and audience measurement.
- Recruitment platforms — to advertise vacancies and manage job applications.
- Automation and workflow tools — to connect and automate data flows between the other systems listed in this notice.
- Website hosting and development providers — to host and build our website and web-based tools.
- Design and creative software providers — for producing marketing and design materials.
- Link management tools — for shortening and tracking links we share, including in marketing emails.
- AI tools — which we may use to help draft or process content and information as part of running our business.
We only share the personal information that is necessary for these third parties to provide their service to us, and — where they’re processing it on our behalf — we have agreements in place requiring them to keep it secure and to use it only for the purposes we specify.
If you’d like to know the specific named organisations behind any of these categories, you can ask us using the contact details above.
International transfers
Many of the categories of service provider listed above are based outside the UK, principally in the United States. Some are based elsewhere, including in the EU/EEA.
Where we transfer personal information outside the UK, we put an appropriate safeguard in place. Depending on the provider, this may be:
- the UK’s extension to the EU-US Data Privacy Framework (known as the “UK-US Data Bridge”), which allows transfers to US organisations that have current, active certification covering the relevant data;
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, for providers not covered by the Data Bridge; or
- UK adequacy regulations, where the destination country (including the EU/EEA) has been assessed by the UK government as providing an adequate level of protection.
You can ask us for more information about the safeguard used for a specific provider using the contact details above.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated
22 September 2026