Privacy notice
This notice explains how personal data is collected, used, stored, shared and deleted when you use anything Studee runs, and the rights you have over that data. It covers two things:
- the public studee.com website: programme pages, search, guides, counsellor and university information, and our other research content, which anyone can read without an account; and
- the University Application Workspace (the "Workspace"): our separate, signed-in service for students and staff at participating schools.
We have tried to write it in plain English. Where we use legal terms, it is because UK law requires them.
Our Terms and conditions cover your use of the website and the Workspace. This notice is not part of them, and there is nothing in it for you to accept. Accepting the terms is a separate act, and it is not consent to the processing described here.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Our use of cookies and similar technologies is also governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) ("PECR"), read with Article 7 of the UK GDPR on consent.
Sections that name the website apply to the public site. Sections that name the Workspace apply to Workspace accounts and Workspace features, and they are the ones that govern if a general statement and a Workspace statement could both be read to apply.
Who we are
Studee Ltd operates studee.com and the Workspace. We are registered in England and Wales under company number 06842641, and we are registered with the Information Commissioner's Office under data-protection registration number Z2110366. For our registered office, VAT number, and other corporate details, see "Who we are" in our Terms and conditions.
Our Data Protection Officer (DPO) oversees how we handle personal data and how we respond to your requests under the UK GDPR. That role is held by Ellie Robertson.
Email [email protected] to contact our Data Protection Officer.
Which law applies
Studee Ltd is established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to everything we do with personal data, wherever in the world you live and wherever your school is. Where the law of the country you are in also applies to a particular activity, we comply with that too, and nothing in this notice removes rights you have under the law that applies to you locally. Your school may also be subject to the data protection law of its own country; your school's privacy notice explains that.
Who is responsible for your data
On the public website, Studee is the data controller. We decide why and how the personal data described in the website sections of this notice is used.
In the Workspace, your school is the controller for the student, parent or guardian, and staff personal data that it and its users put in. That covers profiles, applications, tasks, documents, grades, and the parent or guardian email addresses it records. Your school decides why and how that data is used, who at the school can see it, and how long it is kept.
Studee acts as your school's processor for that data, under Article 28 of the UK GDPR and a written data processing agreement with the school. We process it on the school's documented instructions.
Studee is an independent controller for a smaller set of processing, where the school's agreement with us gives us our own purpose rather than instructing us:
- keeping your account secure, verifying who you are at sign-in, and recording sign-ins;
- sending you the service communications we decide to send for our own account-security and contract purposes, such as one-time sign-in codes; we also email each participating school's registered main contact when we publish a material change to the terms, which is a notice to the school rather than to you; invitations are sent on your school's instruction, and we send those as the school's processor;
- handling the fact of a support request and how we resolve it; the school records quoted inside a support message stay your school's data, and we handle those as your school's processor;
- keeping the record of your acceptance of the terms and of which version of this notice was shown to you when you accepted them;
- developing and improving the AI models and AI-assisted features we use for the Workspace, which has its own section below; and
- meeting our own legal obligations.
Where this notice says "we" or "us" about a purpose, the section makes clear which role we are acting in.
No statute requires you to provide Workspace data. Your school requires it so that it can give you a Workspace account, and we require it so that we can operate that account and hold evidence that you accepted the terms. If it is not provided, an account cannot be created or used. This paragraph is given under Article 13(2)(e) of the UK GDPR.
Where your data comes from
On the public website, almost everything comes from you: from your browser as you use the site, or from you emailing us. The one exception is a meeting booking. You enter your details on HubSpot's booking page, and HubSpot passes them to us.
In the Workspace, personal data reaches us in five ways. Four of them come from outside the Workspace:
- From you. What you type into the Workspace, the files you upload, and what you send us when you ask for help.
- From school staff. What counsellors, teachers and administrators record about you in the Workspace.
- From your school's information system. Where your school has connected its management information system through Wonde, Wonde passes us roster data on the school's behalf and as the school's data source. Your school decides what is shared and can stop the connection.
- From lists your school uploads. School staff can create accounts by uploading a spreadsheet of students; the rows of that upload are stored.
The fifth is the Workspace itself, which creates records as you use it: sign-in records, acceptance records and the audit trail described below.
We tell you where data came from because Article 14(2)(f) of the UK GDPR requires us to name the source of personal data we did not get from you directly.
What personal data we collect on the public website
Simply reading the site generates a limited amount of information about you. We also receive information if you choose to contact us or book a meeting. This is what we collect:
- Technical data: your IP address, browser type and version, device type, operating system, and the pages you view. We also record the date and time of your visits and the address you came from (the referring URL). We use this to keep the site running and to protect it from abuse.
- Error-monitoring and performance data: the page visited, error details, page-load timings, and technical details about your browser and device. We use Sentry to collect this information so that we can find faults and measure how quickly pages load. Sentry does not receive form contents or uploaded documents, and it does not store the user's IP address with the event. If you are signed in to the Workspace while using the site, the limited account context described under "Error monitoring and product feedback" below may also be included.
- Site-function identifiers: cookies and browser storage that let the site recognise the same browser across page loads, pass the session details our server worked out for your visit to the app running in your browser, and record when you were last active. Each one is listed, with its lifetime, in our Cookies notice.
- Cookie-consent record: your choices in the cookie banner, stored in a first-party cookie for 12 months (see "Cookies and similar technologies" below).
- Signed-in session data, if you have a Workspace account: if you are signed in to the Workspace and then read a public page, your browser keeps a record of that session so that the site knows you are signed in and can sign you out after a period of inactivity. This storage is strictly necessary to provide the signed-in service you asked for, so regulation 6(4)(b) of PECR does not require us to ask for your consent for it. It is removed when you sign out. The Cookies notice describes it.
- Preferences data, where you have consented: small interface choices you have made, such as dismissing a promotional panel, so that we do not show it to you again.
- Analytics data, where you have consented: records of the pages you view and the actions you take on the site, linked to a pseudonymous identifier stored in a cookie so that those records can be tied to the same browser. Google Analytics collects this for us and reports it to us in aggregate, so that we can improve the site. We do not use it to identify you by name.
- Marketing data, where you have consented: identifiers that help us measure how our marketing campaigns perform.
- Correspondence data: if you email one of our published addresses, we receive whatever you choose to tell us, for example your name, your email address and the content of your message.
- Meeting-booking data: some of our counsellor pages link out to a booking page operated by HubSpot. If you book a meeting there, HubSpot receives the details you enter and passes them to us so that we can hold the meeting. HubSpot's own privacy notice applies to that page as well as this one.
If you are signed in to the Workspace while you read the public site, your shortlist and everything else you do in the Workspace are covered by the Workspace sections of this notice.
We do not knowingly collect more than we need. Contact [email protected] if you think we hold data we should not.
What personal data is processed in the Workspace
Data your school controls
- Account and profile data: name, preferred name, email addresses, mobile number, date of birth, gender, citizenship, school year, the references your school's own systems use for you, whether you are under 18, and the parent or guardian email address and whether the school communicates with them.
- Study preferences: the countries, universities, subjects, qualification types, delivery methods, intakes and budget you are interested in.
- The assigned counsellor for a student, and the student groups a student belongs to.
- Aspirations, funding and grades: free text about what a student is aiming for, their funding and credits, whether anyone outside the school is helping with their applications, and their expected grades.
- Application data: the universities and programmes a student is applying to, intake and qualification details, status and history.
- Tasks: task details, who they are assigned to, due dates and outcomes.
- Saved programmes: the programmes a student has saved.
- Documents: the files uploaded to the Workspace, their content, and the record we keep about each file (who uploaded it and when, its status, and the result of the malware scan we run on it).
- Upload and roster records: the rows of any student list a school uploads, and the roster data Wonde passes us for the school (name, email addresses, date of birth, gender, year group and the school's own identifier).
- School staff accounts: the name, work email address and role at the school of each staff member, whether the account is active or archived, and the record of the school's invitation.
Documents are read by downloading them, and every download is checked against your permissions.
Special category data, as defined in Article 9 of the UK GDPR, is not collected as a structured field in the Workspace. It may still appear inside an uploaded document or in free text, where your school chooses to record it. Your school is the controller for that content and is responsible for having a lawful basis and an Article 9 condition before recording it. Tell your school before you upload health, religious or similar information about yourself.
Data Studee controls
- Sign-in data: the email address on your account and the one-time codes we send to it. If you set a password, which is optional and only where your school allows it, we store it as a one-way hash and never the password itself. When you set, change or remove a password, we confirm it is you with a code from your authenticator app or a single-use code sent to your email address, which we keep, in a protected form, only until it has been used or has expired. If you use Google sign-in, we store the account identifier Google gives us so that we recognise you the next time; we do not store the identity token Google returns. If you turn on two-step verification with an authenticator app, we also store the secret your app uses, encrypted, and your recovery codes, in a form from which they cannot be read back.
- Sign-in records: the date and time of each sign-in, the sign-in method, the account used and the IP address the request came from. These are written to our audit trail so that we can detect misuse and investigate security incidents. We also keep the dates of your most recent sign-ins on your account record, so that you and your school can see when the account was last used.
- Audit records of actions: the audit trail also records other significant actions in the Workspace, with the date and time, the account that acted, and the IP address the request came from.
- Session data: the authentication cookie and the browser storage described in our Cookies notice, which keep you signed in and remember choices you make in the Workspace.
- Session records: a record of each signed-in session on our servers: the account, when you signed in, when you were last active, when the session expires or ended, and the general type of browser, operating system and device. It does not hold your IP address or the full identifying string your browser sends. We check this record on every request, so that a session stops working as soon as it is signed out or ended by a security action, and we use it to show you the sessions signed in to your account and to let you sign out of any of them.
- Security action records: when you set, change or remove your password, sign out of your sessions, or have your two-step verification reset by your school or by Studee support, we keep a record of the action: who acted, the account affected, what was done, whether it succeeded, and when. We use it to make sure each action is carried out exactly once. An action that is carried out is also written to the audit trail described above.
- Security notifications: when your password is set, changed or removed, or your two-step verification is reset, we send you an email about it so that you can tell us if it was not you.
- Acceptance records: which version of the terms you accepted, when you accepted it, the account and role you accepted with, your school where your account has one, and which version of this notice was shown to you at the time. The audit entry written at the same moment records the IP address the acceptance came from, in the same way as every other audited action.
- Support correspondence: what you or your school send us when you ask for help, and our replies. We are the controller for the fact of the request and how we handle it. Where a message contains records from your school's Workspace - a student profile, an application, a task or a document - that content stays your school's data and we handle it as your school's processor.
- Error-monitoring, performance and feedback data: the page visited, error details, page-load timings and technical details about your browser and device, together with the limited account context described under "Error monitoring and product feedback" below. If you choose Give feedback, this also includes the message you type.
We do not use data from the Workspace for advertising or marketing.
Why we use your data and the lawful basis
Article 6 of the UK GDPR requires a lawful basis for each purpose.
On the public website
Each purpose below has one basis, which is the basis we rely on for it:
- Keeping the site secure and preventing abuse - technical data and site-function identifiers - legitimate interests, Article 6(1)(f).
- Operating the public site as a research and discovery tool - technical data and site-function identifiers - legitimate interests, Article 6(1)(f).
- Finding errors, measuring page-load performance and improving the service - error-monitoring, performance and feedback data - legitimate interests, Article 6(1)(f).
- Displaying embedded YouTube videos - loading the player and disclosing your IP address and browser information to Google when you allow the player, including through a remembered choice - consent, Article 6(1)(a). See "Embedded video" below.
- Replying to an email you send us - correspondence data - legitimate interests, Article 6(1)(f).
- Arranging a meeting you book through one of our counsellor pages - meeting-booking data - steps taken at your request before entering into a contract, Article 6(1)(b).
- Storing preferences, analytics and marketing cookies on your device, and reading them back - the storage itself - your consent, Article 6(1)(a), which is also what regulation 6 of PECR requires.
- Remembering the interface choices you make on the site - preferences data - your consent, Article 6(1)(a).
- Understanding how visitors use the site so that we can improve it - analytics data - your consent, Article 6(1)(a).
- Measuring how our marketing campaigns perform - marketing data - your consent, Article 6(1)(a).
- Keeping tax, accounting and other statutory records - whatever the relevant law requires us to keep - legal obligation, Article 6(1)(c).
You do not have to give us any personal data in order to read the public site.
Withdraw your cookie consent at any time from the Cookie preferences link in the footer. Article 7(3) of the UK GDPR gives you that right, and withdrawing your consent does not make anything we lawfully did with your data before you withdrew it unlawful.
In the Workspace, where your school is the controller
The school identifies the lawful basis for the processing it instructs us to carry out, and its own privacy notice explains that basis. We process that data on the school's instructions, as Article 28 requires. Ask your school which basis it relies on.
In the Workspace, where Studee is the controller
- Performance of a contract (Article 6(1)(b)) - to provide the Workspace to you under our terms, including keeping you signed in and sending one-time codes. Where you are a school's registered main contact, it also covers the notice we send you when we publish a material change to the terms. We do not send that notice to every user.
- Legitimate interests (Article 6(1)(f)). We rely on this basis for six things: keeping the Workspace and your account secure; preventing and investigating misuse; finding errors, measuring page-load performance and improving the service through feedback; providing support; holding evidence of which version of the terms you accepted and which version of this notice you were shown; and developing and improving the AI models and AI-assisted features we use for the Workspace. Our use of this basis requires a documented balancing test for each purpose that gives particular weight to children aged 13 to 17 and their differing ages and development needs.
- Legal obligation (Article 6(1)(c)) - where we must keep records or respond to a lawful request.
Where we rely on legitimate interests, we weigh our interest against your interests, rights and freedoms, and we rely on that basis only where our interest is not overridden by them.
Automated decision-making
We do not make decisions about you using solely automated processing that produces legal effects or similarly significant effects on you, within the meaning of Article 22 of the UK GDPR.
Error monitoring and product feedback
We use Sentry, provided by Functional Software, Inc., on the public website and in the Workspace to detect errors and measure page-load performance. For a signed-in Workspace user, the event context is limited to their role or persona, their school, the page visited and technical details about their browser. For a school user, it also includes their name and email address. For a student, it includes no name, email address or account identifier.
We do not send form contents or uploaded documents to Sentry, and Sentry does not store the user's IP address with an event. This monitoring is not used for marketing or automated decision-making.
If you choose Give feedback, Sentry receives the message you type and the same limited context. A school user can ask us to delete their feedback by emailing [email protected]. Student feedback is not linked to a name, email address or account identifier.
How we use Workspace data to develop our AI features
Studee is the independent controller for this processing. We train, fine-tune, test, evaluate, validate, secure and improve the AI models and AI-assisted features we use for the Workspace, for the Workspace generally and not only for your school's use of it. Your school's agreement with us permits this processing and records that Studee acts as an independent controller for it, rather than acting on the school's instructions.
Our lawful basis is legitimate interests under Article 6(1)(f): our interest in building features that help students find and apply to suitable courses, balanced against your interests, rights and freedoms. This basis requires a documented balancing test that gives extra weight to children aged 13 to 17 and their differing ages and development needs.
We use the minimum personal data reasonably needed for that purpose. The data we use is limited to structured Workspace records: profile and school-year data, study preferences, applications and programme records, tasks, expected grades, and saved programmes. We do not use the documents uploaded to the Workspace, and we do not use the free text you or your school write in the Workspace, to develop our AI features.
We keep uploaded documents and free text out of this data set on purpose. Your school decides what is recorded in them, so they can contain special category data as defined in Article 9 of the UK GDPR. Article 9 prohibits processing that data unless one of the conditions in Article 9(2) applies. Your school's agreement with us makes your school responsible for identifying an Article 9 condition for the data it records; it does not give Studee a condition for our own development purpose. Excluding documents and free text keeps this purpose inside the structured fields listed above, and the Workspace does not collect special category data into a structured field.
We apply these safeguards:
- we use the minimum personal data reasonably needed for the purpose;
- we pseudonymise or de-identify the data before use wherever that is reasonably practicable;
- access is limited to authorised Studee engineering, security, service-quality and support staff, is granted for a defined development purpose, is limited to what that purpose needs, and is logged where practicable; no member of our staff has standing general access to identifiable school data;
- we do not permit a third-party AI provider to train or improve its own models or services on this data; it may use the data only to provide its service to us;
- outputs are never used to make decisions that have legal effects or similarly significant effects on you;
- the data is never used for marketing;
- we apply data minimisation and access controls to the data set throughout;
- we keep the data for this purpose only as long as we need it for the documented purpose, and then delete or anonymise it; and
- you can object by emailing [email protected], and we assess and act on that objection as explained below.
How to object. Email [email protected] and say that you object to AI development. Our Data Protection Officer records and assesses your objection. We stop processing your personal data for this purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Where the objection is upheld, we exclude your personal data from new data sets and take reasonable, technically feasible steps in relation to data sets already assembled. Information that has been irreversibly anonymised so that nobody can identify you is no longer personal data; pseudonymised data remains personal data. We will explain the outcome to you and tell you about your right to complain to the ICO.
Cookies and similar technologies
Cookie use is governed by regulation 6 of PECR and, where cookies involve personal data, by the UK GDPR (including the conditions for consent in Article 7), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Your choices for preferences, analytics and marketing cookies apply across studee.com, including the Workspace. They are recorded in a first-party cookie that lasts 12 months before we ask you again. If we materially change the consent policy, for example by adding a category or a new cookie, we ask you again rather than silently applying your previous choice to the new policy.
For every cookie we set, its purpose and how long it lasts, see our Cookies notice.
On the public website
When you first visit, you see a cookie banner with two equally prominent actions: Accept site cookies and Manage preferences. These choices control preferences, analytics and marketing cookies. No non-essential cookie set by Studee is placed on your device before you make a choice. To refuse these three categories, choose Manage preferences, leave them switched off and save. The panel never pre-selects a category on your behalf. Embedded YouTube videos have a separate choice before they load, which you can review or reset in Cookie preferences as described under “Embedded video”.
We organise cookies into four categories:
- Essential - always on. They are strictly necessary to provide the site you asked for, so regulation 6(4)(b) of PECR does not require your consent for them. Their purposes and lifetimes differ, and the Cookies notice lists each one with its own lifetime.
- Preferences - off until you consent.
- Analytics - off until you consent.
- Marketing - off until you consent, subject to the note on tag delivery below.
Marketing can only be turned on together with analytics. If you turn analytics off, marketing is turned off with it.
One of our essential identifiers lasts 12 months, which is longer than a browsing session. It links the requests your browser makes, so that the site keeps your context between visits. We treat it as strictly necessary for the service you have asked for, so we do not ask for your consent for it under regulation 6(4)(b) of PECR, and we keep that classification under review.
Our analytics and marketing tags are delivered through a single tag container, which loads once you allow analytics. Turning analytics off stops the container from loading.
Click Cookie preferences in the site footer to change your choice at any time. When you withdraw consent for a category, we delete the cookies for that category that were set on studee.com. Cookies that an advertising company set on its own web address are outside our control; use your browser's settings or that company's privacy notice to remove those.
Embedded video
Some pages include videos provided by YouTube, a Google service. We do not load the YouTube player until you press its play button, unless you have chosen to load YouTube videos automatically. You can also choose “Open on YouTube” to open the video on YouTube instead.
When you allow a player to load, Google receives your IP address and information about your browser and use of the player. Google may store or access information on your device, including before playback starts, for purposes including video playback, measurement and advertising. We use YouTube’s privacy-enhanced mode at youtube-nocookie.com, which limits personalisation but does not prevent all storage or data collection. We rely on your consent under Article 6(1)(a) of the UK GDPR to load the player and disclose information to Google. Google acts as an independent controller under its privacy policy. Transfers to Google LLC in the United States are covered by the UK Extension to the EU-US Data Privacy Framework.
If you select “Always load YouTube videos on this site” before pressing play, or save “Always load videos” in Cookie preferences, we remember your permission in this browser for up to 12 months. To withdraw that saved permission, select “Ask each time” in Cookie preferences and click “Save preferences”. This removes loaded players from the current page and prevents automatic loading. If you allowed a video only for the current page without saving permission, reload or leave that page to end that permission. Withdrawal does not affect processing that took place before you withdrew your consent.
Your browser's settings or content-blocking tools may let you block embedded YouTube content.
In the Workspace
The Workspace loads no Studee product-analytics or marketing tags. Optional embedded YouTube videos have the separate consent control described under “Embedded video”. It uses one authentication cookie and a small number of cookies and browser storage keys that hold interface choices you made yourself. It also uses the diagnostic Sentry error monitoring and page-load performance measurement described above; Sentry does not use cookies or browser storage for that monitoring. Storage that is strictly necessary to provide the service you asked for is exempt from the consent requirement under regulation 6(4)(b) of PECR.
You can also make or change the studee.com cookie choice inside the Workspace, from the Cookie preferences link in its footer and on the review screen you see when you are asked to accept the terms, where it is an optional and separate choice that never blocks acceptance. It is the same choice as on the public site. Allowing analytics or marketing changes nothing inside the Workspace itself, because the Workspace loads no tags in either category.
Google sign-in. If you choose Continue with Google, Google receives the technical and account information needed to provide its sign-in service and may use cookies or similar storage under its own terms and privacy information. Google returns a signed identity token to us so that we can authenticate you.
The Cookies notice lists the cookies and storage keys we set for the Workspace, with their purposes and lifetimes, and explains storage used by optional embedded YouTube videos.
International transfers
Workspace data is stored in the United Kingdom. Several of our suppliers are outside the United Kingdom, mainly in the United States, and personal data reaches them when they perform their service. We do not transfer personal data outside the UK without a lawful transfer mechanism in place. The mechanisms we currently rely on are:
- a UK adequacy decision, where one covers the destination country;
- the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), for US suppliers certified to it; and
- the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or the Information Commissioner's International Data Transfer Agreement, relied on as an appropriate safeguard under Article 46(2) of the UK GDPR, for our other non-UK suppliers.
Workspace data is stored at rest in the United Kingdom, so it is not transferred out of the UK for storage. Where support or operational work outside the United Kingdom involves that data, we rely on one of the safeguards above.
We check which mechanism applies when we take on a supplier and when our contract with them changes.
Email [email protected] to ask which mechanism applies to a supplier, or for a copy of the safeguards we rely on.
How long we keep your data
We keep personal data only for as long as we need it for the purpose we collected it for, taking into account:
- the purposes and use of your information, now and in the future;
- whether we have a legal obligation to keep it, such as a record-keeping rule;
- whether we still have a lawful basis to keep it, such as your consent;
- how valuable the information is, now and in the future;
- any relevant agreed industry practice on retention periods;
- the risk, cost and liability of continuing to hold it;
- how hard it is to keep it accurate and up to date; and
- the nature and status of our relationship with you.
Public website data
- Analytics and marketing data - 14 months from collection, which is the retention period set on our Google Analytics property.
- Cookie-consent record (
studee_consent) - 12 months from your most recent choice, after which we ask you again. - Meeting-booking records - 24 months from the meeting, unless you go on to become a customer, in which case our record of our dealings with you applies.
- Error, performance and feedback data sent through Sentry - up to 90 days.
- Correspondence - we keep emails for as long as we need them to deal with what you contacted us about and any follow-up, and we delete them when that is no longer the case. We aim to hold them for no more than 24 months from your last contact.
- Records we are legally required to keep, such as tax records - for the period the relevant law requires.
Workspace data your school controls
Your school decides how long its Workspace data is kept, and the Workspace does not delete it automatically. In particular, nothing is deleted simply because a student leaves the school, and there is no automatic anonymisation and no automatic account closure. Nothing in the Workspace decides on its own that an account has ended.
- Deletion on the school's instruction. When your school asks us to delete a student's data, Studee staff carry out the deletion through our support procedure. Ask your school to contact us if you want your data deleted.
- End of service. When a school's agreement with us ends, the school chooses within 90 days whether we return its Workspace personal data or delete it. We delete or anonymise the school's data in our live systems within 90 days of the service ending. Backups are overwritten on our ordinary backup cycle, and we keep the records the law requires us to keep.
- Document files. When a document or a student is deleted, the files concerned are deleted from our document store. We do not keep earlier versions of uploaded files.
Workspace data Studee controls
- Acceptance records, and the audit entries about accepting the terms - kept for as long as your account exists and normally for six years after it is closed. We retain this evidence to establish, exercise or defend legal claims. The time limit for a particular claim depends on the claim and when the relevant cause of action arose; account closure does not determine that date in every case. We review and delete the evidence when it is no longer reasonably needed, subject to any legal hold or longer period required by law.
- The audit trail, including sign-in records - every other audit record stays in the live system for 90 days, is then moved to an archive, and is deleted once the record is 24 months old, counted from the moment the recorded action happened.
- The dates of your most recent sign-ins - held on your account record for as long as the account exists, so that you and your school can see when it was last used.
- The Google account identifier, where you use Google sign-in - held on your account record for as long as the account exists, so that we recognise you at each Google sign-in.
- The authenticator secret and recovery codes, where you use two-step verification - held while two-step verification is on, and deleted when it is turned off or reset. Replacing your recovery codes deletes the old ones.
- The hash of your password, where you set a password - deleted when you remove the password, when your two-step verification is reset, or when the account is deleted.
- The emailed confirmation code, session records and security action records - deleted once they are no longer needed to keep you signed in, to carry out a security action exactly once, or to show you your sessions, and in any case within a short, fixed period after they expire or the action completes.
- Session records, security action records and the confirmation code are also deleted when the account is deleted.
- Data used to develop our AI features - kept only for as long as we need it for the documented purpose, and then deleted or anonymised. An objection is assessed and acted on as described under "How to object" above.
- Support correspondence - kept for as long as we need it to answer you and deal with any follow-up, and reviewed regularly so that it is not kept longer than that.
- Error, performance and feedback data sent through Sentry - up to 90 days. A school user can ask us to delete their feedback by emailing [email protected]. Student feedback is not linked to a person.
- Records we are legally required to keep - kept for the period the relevant law requires.
Technical copies
Deleted data can survive for a limited time in technical copies after it has gone from the live systems: database backups, which are kept for 35 days; the copies our storage provider keeps briefly while it completes a deletion; application and database logs; and malware-scanning queues. Each of these has its own short, fixed retention, after which the data is deleted. Hosting access logs held in AWS are normally kept for 90 days. Older stored copies of website request logs may remain for up to a further 30 days. If routine deletion fails, fallback deletion rules can extend retention to approximately 127 days in total.
Children
Workspace accounts
Student accounts in the Workspace are for people aged 13 or over. Users aged 13 to 17 are children; users aged 18 or over are adults. Your school is responsible for authorising eligible student accounts. For users under 18, any authorisation required by applicable law must be obtained from the school, parent or guardian, as applicable. School authorisation does not replace parental authorisation where the law requires it. We do not carry out age verification in the Workspace. Your date of birth is recorded by your school for its own purposes, not as an age check by us. We do not rely on your consent for the core Workspace processing described in this notice. Loading optional embedded YouTube videos relies on your consent, as explained under ‘Embedded video’.
We have designed the Workspace with the Information Commissioner's Office Age Appropriate Design Code (the Children's Code) in mind. The Workspace's data protection impact assessment must account for children aged 13 to 17 and their differing ages and development needs, as Standard 2 of the Code requires. We treat the best interests of users under 18 as a primary consideration when we design changes to it. We do not load Studee product-analytics, advertising or marketing tags in the Workspace or profile Workspace users. Optional embedded YouTube videos have the separate consent control described under “Embedded video”. We use Workspace data only for the purposes described in this notice.
The public website
We have considered whether the public site is an information society service likely to be accessed by children, within the meaning of section 123 of the Data Protection Act 2018 and the Children's Code. Our audience includes children aged 13 to 17 researching future study, and they are children for the purposes of that Code.
We therefore apply the Code's standards to the public site. We collect the minimum data we need. We set no non-essential cookie of our own without your consent, subject to the tag-delivery arrangements described under "Cookies and similar technologies". We do not profile visitors by default. The cookie panel never turns a category on for you.
The public pages do not ask for your date of birth or your age, and no page asks you for personal details in a form. Where a page offers to save a programme to your shortlist, it does so by signing you in to the Workspace, whose student accounts are for people aged 13 or over, as described in the Workspace sections of this notice. Public browsing is available without an account. The site is not aimed at children under 13. Under Article 8 of the UK GDPR and section 9 of the Data Protection Act 2018, a child in the UK can consent to an information society service from the age of 13, and we do not knowingly collect personal data from anyone under 13. We review this position at least once a year.
Email [email protected] if you believe a child under 13 has sent us personal data. We will delete it.
Your rights
You can tell us to stop using your data for direct marketing, at any time, and we must stop. Article 21(2) of the UK GDPR gives you that right and there is no exception to it. Click Cookie preferences in the site footer to turn marketing off, or email [email protected] and we will stop.
Under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025, and subject to certain limits, you have the following rights over your personal data:
- Right to transparency (Article 12) - to have information about our processing given to you clearly and in writing.
- Right to be informed (Articles 13 and 14) - where personal data is collected from you, and where it is not.
- Right of access (Article 15) - to ask for a copy of the personal data held about you.
- Right to rectification (Article 16) - to ask for data that is inaccurate or incomplete to be corrected. Many Workspace profile fields can be corrected directly by you or your school.
- Right to erasure (Article 17) - to ask for your data to be deleted, in certain circumstances.
- Right to restrict processing (Article 18) - to ask for processing to be paused, in certain circumstances.
- Notifying others (Article 19) - when we correct, delete or restrict your data we tell each organisation we shared it with, unless that is impossible or would take disproportionate effort. Ask us and we will tell you who those organisations are.
- Right to data portability (Article 20) - to receive your data in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and is carried out by automated means.
- Right to object (Article 21(1)) - to object to processing based on legitimate interests. We stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Where an objection to our use of Workspace data to develop AI features is upheld, we exclude your personal data from new data sets and take the reasonable, technically feasible steps described above.
- Right to object to direct marketing (Article 21(2)) - to object at any time to your data being used for direct marketing. We stop, with no exception.
- Right to withdraw consent (Article 7(3)) - where we rely on your consent, to withdraw it at any time, without affecting what we lawfully did with your data before you withdrew it.
- Rights related to automated decision-making and profiling (Article 22) - the right not to be subject to a decision based solely on automated processing. We do not make decisions of that kind about you.
- Right to complain to us (section 164A of the Data Protection Act 2018) - to complain to Studee about how we use your personal data, before or instead of going to the ICO.
- Right to complain to the ICO (Article 77 of the UK GDPR and section 165 of the Data Protection Act 2018) - to complain about how we use your personal data.
Where to send your request
For public-website data, and for anything else where Studee is the controller, email [email protected] and tell us which of these rights you want to use.
For Workspace data, two organisations are involved, so the destination depends on the data:
- Contact your school about school data: profile, applications, tasks, documents, grades and parent or guardian details. School staff should also contact their school about their own account data.
- Email [email protected] about Studee data: sign-in data and records, acceptance records, AI development, and the fact of a support request and how we handled it. Ask your school about the school records quoted inside a support message; your school is the controller for those, and we handle them as its processor.
If you are not sure, email [email protected]. We will route your request, or point you to the right person at your school. Where your school handles the request, we help it, including by producing a copy of the data we hold and by making corrections, restrictions or deletions on its instruction, as our agreement with the school requires.
We respond within one calendar month, as Article 12(3) requires. If your request is complex, or if you make several requests, we may extend that by a further two months, and we will tell you within the first month if we need to.
There is no fee for most requests. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act on it, as Article 12(5) allows, and we will explain why. If we refuse a request, we will tell you why, and we will tell you that you can complain to the ICO and can apply to a court.
How we verify your identity
We check who you are before we act on a request, so that we do not disclose your data to someone else or delete it on a stranger's say-so.
Where we already hold information about you, we use that to confirm your identity. Where we have reasonable doubts about who you are, we may ask you for further information, as Article 12(6) allows. We ask only for what is proportionate to the request and to the risk, and we do not require certified copies of identity documents as a matter of course.
Send us only the information we ask for.
Complaints
You have the right to complain to us about how we have used your personal data. Complain to us first, under section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025.
Email [email protected] with the details of your complaint. We will acknowledge your complaint within 30 days, as section 164A requires, take the steps needed to deal with it, and tell you the outcome.
If you are not satisfied with our response, or we do not respond, you can complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, under Article 77 of the UK GDPR and section 165 of the Data Protection Act 2018. The law now expects you to raise a complaint with us before the ICO acts on it, and the ICO may ask whether you have done so.
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you live or work outside the United Kingdom, you may also be able to complain to the data protection authority for the country you are in, or where you believe the problem happened. You may also have a right to an effective judicial remedy. UK data protection law still applies to what we do with your personal data.
Security
We take appropriate technical and organisational measures to protect personal data, as Article 32 of the UK GDPR requires. Across both the website and the Workspace these include access controls, encryption in transit, audit logging, and regular review of our processors.
In the Workspace we also apply:
- separation between schools, so that one school's users cannot see another school's data;
- role-based access control enforced on every request, and a permission check on every document download;
- malware scanning of uploaded files;
- encryption at rest for data and documents;
- sign-in with a one-time code sent to your email address, with Google sign-in or, where your school allows it, with an optional password that is stored only as a one-way hash;
- two-step verification with an authenticator app, which any user can turn on and which a school can require;
- an authentication cookie that your browser will not expose to scripts, with a short life that is renewed while you are active;
- automatic sign-out after a period without activity, unless you choose Stay signed in;
- a server-side record of each signed-in session, checked on every request, so that signing out of a session, or signing out your other sessions, takes effect at once;
- audit logging of sign-ins and other significant actions; and
- database backups held in the UK for 35 days.
Keep your password, one-time codes and recovery codes to yourself and never forward them to anyone.
No system is perfectly secure. If a personal data breach affects data your school controls, we tell your school without undue delay, within the time our agreement with the school sets; the school then decides what it must report and to whom. If a breach affects data Studee controls, we report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, as Article 33 of the UK GDPR requires. Where the breach is likely to result in a high risk to you, we tell you as well, as Article 34 requires.
Changes to this notice
We review this notice at least once a year, and we update it whenever our practices change or our sub-processors change.
When we change it, we publish a new version. Each version carries its own version number and a note of what changed, and it is the version that applies from the moment we publish it. A new version replaces the one before it; there is no future-dated version and no notice period. The version number and the publication date of the version you are reading are published in this page's metadata.
There is nothing here for you to accept. This notice tells you what we do with personal data; it is not an agreement between us, and we never ask you to accept it.
If you hold a Workspace account, two things happen when this notice changes. The Workspace shows you a short message telling you that the notice has been updated, which you can dismiss. Separately, when we ask you to accept a new version of the Terms and conditions, we record which version of this notice was shown to you at that moment. That record is evidence of what you were shown. It is not consent, and it is not acceptance of this notice.
Read the current version of this notice before you continue using the website or the Workspace.
How to contact us
Email our Data Protection Officer at [email protected] with any privacy question, request or concern.
For corporate and contractual questions, including our company-disclosure information, see our Terms and conditions.
Policy Review
This policy was last updated on 21st October 2026 and will be reviewed by 31st July 2027 or earlier should changes in obligations or legislation occur. The effectiveness of this policy will also be reviewed regularly.