Privacy Policy

Nova Pathways Partnership Ltd ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, browse courses and institutions, submit an application or enquiry, create an account, or otherwise use our services. Please read this policy carefully so you understand how we handle your information.

This policy applies to: • Prospective students and applicants who browse courses, make enquiries, or apply through our website • Account holders who register to track or manage an application • Institutions that work with us • Visitors to our website Which parts apply to you depends on how you interact with us.

We collect personal information that you provide to us and that is generated as you use our services, including: • Identity and contact details — your first and last name, email address, phone number, and postal address. • Application and enquiry details — the course(s) and intake(s) you are interested in, and the information you submit when you apply for or enquire about a programme. • Account information — if you create an account, your login credentials and the verification codes (such as one-time passcodes sent by email) used to confirm your identity, together with your application history. • Documents — any documents you choose to upload in support of an application. • Communications — records of your correspondence with us, including emails, SMS/WhatsApp messages, and support requests. • Institution details — where you register interest or work with us as an institution (such as your name, organisation, and contact details). • Technical and usage information — information collected automatically through cookies and similar technologies, such as your device and browser type and how you use our website. • Special category and sensitive information — where relevant, information relating to health, disability, support requirements, and criminal record information provided as part of an application, enquiry, visa process, safeguarding assessment, or request for reasonable adjustments.

We may collect and process special category personal information and other sensitive personal information about you. This information is only collected where it is necessary, relevant and proportionate for the purposes described below, and where we have an appropriate legal basis and safeguards in place. Health and disability information We may collect information about your health, medical conditions, disabilities, learning differences, or support requirements where you choose to provide it. We use this information to: • understand and provide reasonable adjustments or additional support during the application process, studies, assessments, or other services; • support your access to education and ensure that appropriate arrangements can be considered with the relevant education provider; and • comply with applicable legal obligations relating to equality, accessibility, and non-discrimination. Criminal record information Where relevant and necessary, we may collect information relating to criminal records, convictions, or other safeguarding-related information. We process this information only where there is a lawful basis to do so, including where it is required or permitted by law, requested by an education provider, or necessary for specific course, professional, placement, visa, immigration, safeguarding, or regulatory requirements. Criminal record information may be shared with the relevant education provider or authorised parties where necessary to assess eligibility, meet legal or regulatory requirements, or support safeguarding obligations. Ethnicity and equality monitoring information Where you choose to provide it, we may collect information relating to your ethnic background for equality, diversity, and inclusion monitoring purposes. This information helps us understand access to our services, identify potential barriers, improve our services, and support fair and inclusive practices. Ethnicity information is not used to make decisions about admissions, applications, course suitability, or eligibility. Legal basis and safeguards Where we process special category information (including health, disability, or ethnicity information), we only do so where an applicable UK GDPR Article 9 condition applies and appropriate safeguards are in place. Where we process criminal record information, we do so in accordance with the UK GDPR and the Data Protection Act 2018, including ensuring that appropriate safeguards are applied. Access to sensitive personal information is restricted to authorised individuals who need it for the purposes described above. We do not use this information for unrelated purposes or make decisions based solely on automated processing of this information.

We use the information we collect to: • Operate our website and provide the course and institution search and information services. • Process your enquiries and applications and, where requested by you, share your information with the relevant education provider so it can assess your application or enquiry. • Create and manage your account and verify your identity (for example, through email or one-time passcode verification). • Match you with courses and education providers that are relevant to your interests and requirements. • Communicate with you about your application, enquiries, account, and our services. • Send you marketing communications where you have consented to receive them. You can withdraw your consent at any time. • Maintain the security of our website and systems, prevent fraud, misuse and other unauthorised activity, and protect our users. • Monitor, analyse and improve our website, platform and services, including resolving technical issues and enhancing the user experience. • Comply with our legal, regulatory and contractual obligations, including maintaining appropriate records and responding to lawful requests from public authorities. • Respond to enquiries from our partner education providers relating to your enquiries, applications or use of our services.

Where UK and EU data protection law applies, we rely on the following legal bases to process your personal information: • Performance of a contract — to process your application and provide the services you request, or to take steps at your request before entering into a contract. • Consent — for optional activities such as marketing communications and non-essential cookies. You may withdraw consent at any time. • Legitimate interests — where processing is necessary for our legitimate business interests and these are not overridden by your rights and freedoms. Our legitimate interests include: operating, administering and improving our student recruitment services and website; matching prospective students with suitable education providers and courses; communicating with prospective students, education providers and other partners in relation to our services and responding to enquiries; maintaining the security, integrity and availability of our systems and platform; preventing, detecting and investigating fraud, misuse and other unlawful activities; monitoring and improving the quality, effectiveness and performance of our services; and establishing, exercising or defending legal claims where necessary. • Legal obligation — to comply with applicable laws, regulatory requirements and lawful requests from public authorities. For special category data, we only process such information where an applicable Article 9 UK GDPR condition applies and appropriate safeguards are in place.

We may share your personal information with: • The education institution(s) you choose to apply to or enquire about, so they can consider and process your application. • Trusted service providers who help us operate our platform — including for website hosting, database storage, email and SMS/WhatsApp delivery, secure file storage, and analytics — who process data on our behalf under appropriate data-protection terms. • Legal, regulatory, or government authorities where we are required to do so by law. • Where you provide health, disability, or criminal record information, we will only share this with relevant education providers or authorised parties where necessary for the purposes described in this policy. We do not sell your personal information to third parties.

Our services are hosted on infrastructure located within the United Kingdom and European Economic Area. Where it is necessary to transfer your personal information outside the UK or EEA, we will ensure that appropriate safeguards are in place in accordance with applicable data protection law. These safeguards may include: • transferring personal information to countries that have been recognised as providing an adequate level of protection by the UK Government or the European Commission (as applicable); or • entering into the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures required to ensure your personal information remains protected. We take appropriate technical and organisational measures to protect personal information wherever it is processed.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, support applications and enquiries, and comply with our legal and regulatory obligations. In general: • Information relating to enquiries and applications is retained for the duration of the application process and for a reasonable period afterwards to support admissions, respond to follow-up enquiries, and meet our legal and contractual obligations. • Account information is retained for as long as your account remains active. If your account becomes inactive or you ask us to close it, we will delete or anonymise your information within a reasonable period unless we are required or permitted to retain it for longer. • Where you have consented to receive marketing communications, we will retain your marketing preferences until you withdraw your consent or opt out. We may retain a record of your opt-out request to ensure we respect your preferences. • We may retain certain information for longer where necessary to comply with applicable laws, resolve disputes, prevent fraud, maintain appropriate business records, or establish, exercise or defend legal claims. When personal information is no longer required, we will securely delete it or anonymise it so that it can no longer be used to identify you.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure.

Our website uses cookies and similar technologies for essential functionality and to understand how our website is used. You can control non-essential cookies through your browser settings. For more information, please refer to our Cookie Policy.

Under applicable data protection laws, you have the right to: • Access the personal information we hold about you • Request correction of inaccurate or incomplete information • Request deletion of your personal information • Restrict or object to our processing of your information • Request portability of your information • Withdraw consent at any time, where processing is based on consent To exercise these rights, please contact us using the details below. You also have the right to lodge a complaint with your local supervisory authority or the UK Information Commissioner's Office (ICO): Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Website: www.ico.org.uk Telephone: 0303 123 1113

Our services are intended for applicants who are of an appropriate age to pursue higher or further education. We do not knowingly collect personal information from children below the applicable age of digital consent without appropriate parental or guardian consent. If you believe we have collected such information, please contact us so we can address it.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and revising the "Last updated" date above.

Our contact details for any data privacy related queries are as follows: Name of company: Nova Pathways Partnership Ltd Name of data protection officer: Ashlea Bullock Email address: dpo@zahs.co.uk Registered address: Part First Floor, Moorfoot House, Meridian Place, 21 Marsh Wall, London, E14 9FJ