Shabuj Global Education Ltd ("we," "our," or "us") is committed to protecting the privacy, confidentiality, and personal data of our website visitors, student applicants, partner institutions, and users ("you"). This Privacy Policy outlines how we collect, use, store, transfer, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
1. Data Controller Identification
Shabuj Global Education Ltd is the designated Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. Our registered office is located at 1st Floor, 94A Whitechapel High Street, London E1 7RA, United Kingdom. If you have any questions about this privacy notice, our data protection practices, or wish to exercise any of your legal rights, please contact our Data Protection Team at privacy@shabujglobal.com or via telephone at +44 7404 016346.
2. Information We Collect and Sources
To deliver educational consultancy, university placement assistance, and visa guidance, we collect both personal and non-personal information from direct and indirect sources:
2.1 Personal Data Provided Directly by You
Information you give us directly through consultation forms, application packs, email, or in-person appointments:
- Identity Data: Full legal name, date of birth, gender, nationality, country of residence, and passport details.
- Contact Data: Email address, telephone numbers, postal address, and emergency contact details.
- Academic Records: Educational history, transcripts, graduation certificates, diplomas, syllabus details, and predicted grades.
- Language & Test Records: IELTS, SELT, TOEFL, PTE, or other recognized language proficiency test scores and certificates.
- Financial & Visa Documentation: Bank statements, proof of funding/sponsorship, previous visa application history, immigration refusal notices (if applicable), and Confirmation of Acceptance for Studies (CAS) records.
- Statement of Purpose (SOP) & Curriculum Vitae: Personal statements, academic essays, and work experience summaries.
2.2 Personal Data Collected from Third-Party Sources (Indirect Collection)
In accordance with UK GDPR Article 14, we may also receive information about you from third parties:
- Academic & Professional Referees: Letters of recommendation and reference verification provided on your behalf.
- Partner Universities & Higher Education Institutions: Application progression updates, conditional/unconditional offer letters, CAS issuance notifications, and enrollment status.
- Parents, Guardians, or Financial Sponsors: Contact details, relationship proof, and financial sponsorship commitments (particularly where the applicant is under 18).
- Authorized Sub-Agents & Channel Partners: Initial inquiry details, academic qualifications, and applicant profiles referred to us under formal Data Processing Agreements.
- Educational Testing Services: Official verification of test scores directly from test providers (e.g. British Council, Pearson).
2.3 Technical & Website Usage Data
Information automatically collected when you browse our website:
- IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform.
- Uniform Resource Locators (URLs) clickstream to, through, and from our website, page response times, download errors, and duration of page visits.
This data is gathered using cookies and analytics tools to optimize website security, performance, and user experience.
2.4 Special Category Data
Under UK GDPR Article 9, certain types of personal data are classified as special category data. We only process special category data when strictly necessary:
- Health & Accessibility Information: Where you choose to disclose a medical condition or disability so we can request reasonable adjustments and accessibility accommodations from partner universities.
- Criminal Record / Disclosure Checks: Where explicitly required by university admissions for regulated professions (e.g., Medicine, Nursing, Teaching, Social Work).
We process this data solely with your explicit consent (Article 9(2)(a)) or where necessary for reasons of substantial public interest (Article 9(2)(g)). You have the right to withdraw consent at any time.
3. Purposes and Lawful Bases for Processing
Under UK GDPR Article 6, we must have a lawful basis for every processing activity. We process your data under the following legal bases:
- Contractual Necessity (Article 6(1)(b)): To perform our educational consultancy agreement with you, including assessing qualifications, preparing and submitting university applications, tracking admissions, and providing pre-departure support.
- Consent (Article 6(1)(a)): Where you give clear, affirmative consent for specific purposes, such as sending marketing communications, event invitations, or processing special category accessibility data (consent can be withdrawn at any time).
- Legal Obligation (Article 6(1)(c)): To comply with applicable statutory laws, tax reporting, immigration advisory guidance, and anti-money laundering regulations.
- Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, provided your fundamental rights do not override them. Our legitimate interests include: preventing fraud, securing our IT infrastructure, maintaining academic integrity, and monitoring channel partner compliance.
4. Requirement to Provide Personal Data & Consequences
Providing your identity, academic history, and financial verification documents is a contractual requirement for us to deliver our university placement and visa guidance services. While you are under no statutory obligation to supply personal data, failure to provide requested information means we will be unable to assess your eligibility, submit applications to universities on your behalf, or assist with CAS issuance and visa documentation checks.
5. International Transfers of Personal Data
Because Shabuj Global Education operates internationally with branch offices and partner universities across the globe, your personal data may be transferred to, stored, and processed outside the United Kingdom, including in Bangladesh, India, Nigeria, the United Arab Emirates (UAE), Canada, Australia, and the United States.
Whenever we transfer personal data outside the UK, we ensure a comprehensive level of protection is maintained by implementing appropriate safeguards approved under UK GDPR:
- UK International Data Transfer Agreements (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) entered into with our overseas branches, sub-agents, and partner institutions.
- Transfers to countries recognized by the UK Government as providing an adequate level of data protection.
- Strict technical and organizational security controls, including encrypted file transmission, role-based access controls, and binding confidentiality obligations.
6. Who We Share Your Data With
We never sell, rent, or trade your personal information. We disclose personal data only to authorized recipients on a strict need-to-know basis:
- Partner Universities & Higher Education Providers: To submit admission applications, verify qualifications, and track CAS issuance.
- Immigration & Visa Authorities: Such as UK Visas and Immigration (UKVI) or foreign embassies when assisting you with visa document reviews.
- Overseas Regional Offices: To coordinate localized student counselling, in-person document checks, and pre-departure briefings.
- Vetted Channel Partners & Sub-Agents: Who operate under binding Data Processing Agreements and comply with our Anti-Bribery and Student Protection standards.
- Accredited Examination & Awarding Bodies: Such as the British Council and Pearson for test booking assistance and qualification verification.
- Essential IT & Cloud Service Providers: Secure CRM platforms, encrypted cloud storage, and email hosting providers operating under UK GDPR data processing contracts.
7. How Long We Keep Your Data (Retention Schedule)
We retain personal data only for as long as necessary to fulfil the purposes for which it was gathered, including satisfying legal, accounting, compliance, and reporting requirements. For enrolled or assisted student applicants, files and correspondence are retained for the duration of the application cycle plus 6 years following completion of services, in accordance with UK statutory limitation periods under the Limitation Act 1980. Prospective inquiries that do not progress to an application are retained for up to 2 years from last contact before being permanently deleted or anonymized. When records reach the end of their retention period, they are securely destroyed using certified electronic deletion and confidential shredding methods.
8. Automated Decision-Making and Profiling
Shabuj Global Education does NOT make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on applicants. All academic evaluations, course recommendations, and university application decisions involve human judgment by our qualified education counsellors.
9. Your Statutory Rights Under UK GDPR
Under UK data protection law (UK GDPR and Data Protection Act 2018), you have statutory rights concerning your personal information:
- Right of Access: You have the right to request copies of your personal information (Subject Access Request).
- Right to Rectification: You have the right to ask us to correct personal information you think is inaccurate or complete information you think is incomplete.
- Right to Erasure: You have the right to ask us to erase your personal information in certain circumstances ('Right to be Forgotten').
- Right to Restriction of Processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Right to Object to Processing: You have the right to object to the processing of your personal data. You have an ABSOLUTE, unconditional right to stop your data being used for direct marketing at any time.
- Right to Data Portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in a structured, commonly used machine-readable format.
- Right to Withdraw Consent: Where we rely on consent to process your data, you have the right to withdraw your consent at any time with no negative consequences.
- Right to Complain: You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
You do not have to pay any charge for exercising your rights. If you make a request, we have one calendar month to respond to you. To make a request, please contact our Data Protection Team at privacy@shabujglobal.com.
10. How to Complain
If you have any concerns about our use of your personal data, you can make a formal complaint to us at privacy@shabujglobal.com or follow our Complaints Procedure at /complaints. If you remain dissatisfied with our response or believe we are processing your personal data not in accordance with the law, you have the right to complain to the Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 | Website: https://ico.org.uk/make-a-complaint/
12. Children and Young People Under 18
We assist students applying for foundation and undergraduate degrees who may be 16 or 17 years of age. In compliance with the ICO Children's Code and UK data protection principles, processing personal data for applicants under the age of 18 requires the verified consent and active involvement of a parent or legal guardian. We provide clear, age-appropriate information and do not knowingly collect personal data from minors without parental authorization.
13. Data Security Measures
We have put in place appropriate technical and organizational security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. These include SSL/TLS encryption, multi-factor authentication for staff systems, restricted role-based database permissions, annual data protection training for all personnel, and secure disposal procedures.
14. Changes to This Privacy Notice
We regularly review and update this privacy notice to ensure ongoing compliance with UK data protection legislation. Any updates will be published directly on this page with an updated revision date. Where changes materially affect how your data is processed, we will notify active applicants directly via email.