Privacy Policy
In effect from
Draft. This document has not yet been reviewed by a solicitor and does not constitute legal advice. It is published here for review and is not indexed by search engines.
Who we are
This policy explains what Happy Education does with personal data, and what you can ask us to do about it.
The data controller is HAPPY EDUCATION CONSULTANCY LTD, a company registered in England and Wales with company number 11331426. Our registered office is 16 Upper Woburn Place, London, England, WC1H 0AF. That is our registered and correspondence address, not a place where you can call in to see us.
You can reach us about anything in this policy at:
- Email: admin@happyeducation.uk
- Phone and WhatsApp: +44 7735 826785
- Post: Data Protection, HAPPY EDUCATION CONSULTANCY LTD, 16 Upper Woburn Place, London, England, WC1H 0AF
We have not appointed a Data Protection Officer. Data protection questions are handled by the company director.
The rules we work to
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), which is the law that governs cookies and marketing messages.
Many of the people we work with live in Türkiye. Turkish data protection law (KVKK, Law No. 6698) can also apply to them. Section 12 sets out what that means and where the two regimes differ.
The personal data we hold
Data you give us when you get in touch. Your name, email address, phone number, the country you are in, the language you prefer, and whatever you tell us about what you are looking for.
Consultation and appointment data. The date and time of your appointment, how it was held, notes of what was discussed, and the actions we agreed.
Application support data. Where you ask us to help with an application, this can include your date of birth, nationality, passport details, address history, academic transcripts and certificates, English or other language test results, references, personal statements, financial evidence, and details of family members named on an application.
Health, disability and other special category data. Some applications ask about a medical condition, a disability, a dietary requirement or a learning need. This is "special category" data and we only handle it where you have given us explicit consent to pass it on, or where the law otherwise allows it.
Invoice and accounting data. If you later become a client, we may keep service, invoice and transaction records received outside this website. This website does not collect card details or take online payments.
Newsletter and marketing data. Your email address, the language you chose, whether you opened or clicked a message, and the record of when and how you subscribed or unsubscribed.
Website and technical data. Your IP address, browser and device type, the pages you viewed, the site that referred you, and your cookie choices. Where analytics cookies are allowed, we also receive aggregated usage statistics.
Security and log data. Records of requests to our website and to our forms, kept so we can detect and block abuse.
Records of your contact with us. Emails, WhatsApp and social media messages, call notes, and complaint files.
Where the data comes from
Most of it comes from you. Some comes from a parent or legal guardian applying on behalf of someone under 18. Some comes back to us from a school, college or university you have asked us to contact, for example an offer letter or a request for a missing document. Technical data is generated automatically when you use the website.
What we use it for, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering an enquiry and telling you what we can do | Steps taken at your request before entering a contract (Article 6(1)(b)), or our legitimate interest in responding to people who contact us (Article 6(1)(f)) |
| Booking, holding and following up a consultation or appointment | Performance of a contract, or steps before a contract (Article 6(1)(b)) |
| Providing our services: research, shortlisting, preparing and submitting applications, liaising with institutions, administrative support for a visa application | Performance of a contract (Article 6(1)(b)) |
| Passing on health, disability or dietary information that an institution or programme requires | Your explicit consent (Article 9(2)(a)), on top of Article 6(1)(b) |
| Issuing invoices and recording transactions handled outside this website | Performance of a contract (Article 6(1)(b)) |
| Keeping accounting and tax records | Legal obligation (Article 6(1)(c)) |
| Sending our newsletter or marketing emails | Your consent (Article 6(1)(a)) and PECR regulation 22 |
| Website analytics | Your consent (Article 6(1)(a)), given through the cookie banner, and PECR regulation 6 |
| Protecting the website and our forms from abuse, spam and fraud | Our legitimate interest in keeping the service secure and available (Article 6(1)(f)) |
| Handling a complaint | Our legitimate interest in resolving complaints properly (Article 6(1)(f)), and a legal obligation where one applies |
| Keeping records to establish, exercise or defend a legal claim | Our legitimate interest in protecting our position (Article 6(1)(f)) |
Where we rely on legitimate interests, we have to weigh our interest against your rights. You can ask us for the reasoning behind any of those decisions, and you can object to that processing. See section 9.
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects for you.
Who we share it with
Institutions you ask us to approach. Universities, colleges, language schools, summer programmes, boarding schools and their admissions agents. Once your information reaches them, they decide what to do with it and they are a separate data controller. Their own privacy notice applies and we will point you to it.
Government authorities. Where you ask us to support a visa or immigration application, the information goes to the relevant authority through the official channel. That authority decides the application, not us.
Our suppliers. These act on our instructions under a written contract:
| Supplier | What they do |
|---|---|
| Vercel | Hosts the website and serves it to your browser |
| Sanity | Stores website content and enquiries submitted through the website |
| Cloudflare | Provides the challenge that stops bots submitting our forms |
| Resend | Sends transactional email, such as an enquiry confirmation |
| Provides tag management and analytics, only where you have allowed analytics cookies | |
| Our customer records system | Stores enquiry and client records, where one is connected |
Not every one of these is switched on at any given time, and features that are not configured simply do not run. We review this list whenever we change a supplier.
Professional advisers. Our accountant, and a solicitor or insurer where we need advice about a claim.
Anyone we are legally required to tell. A court, a regulator, or the police where the law obliges us to disclose.
We do not sell personal data, and we do not share it with third parties for their own marketing.
Sending data outside the UK
Some of our suppliers are based outside the UK, or store data outside the UK. Where that happens, we rely on one of these safeguards:
- the country is covered by UK adequacy regulations, which means the government has decided it offers equivalent protection
- the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses
- your explicit consent, or the transfer being necessary to perform your contract, where no other route is available
Türkiye is not currently covered by UK adequacy regulations. If we need to send your information to a colleague or contact in Türkiye, we rely on the transfer being necessary to perform the contract you asked us for, or on your explicit consent. You can ask us for a copy of the safeguard that applies to any particular transfer.
How long we keep it
| What | How long |
|---|---|
| Enquiries that do not become a client relationship | 12 months from your last contact with us |
| Client files, including correspondence and application documents | 6 years after the engagement ends, which matches the time limit for a contract claim under the Limitation Act 1980 |
| Copies of identity and financial documents supplied for an application | Deleted once the application is decided, unless we need them for a specific reason we will explain |
| Accounting and payment records | 6 years after the end of the financial year they relate to |
| Appointment records and consultation notes | 24 months |
| Newsletter subscription | Until you unsubscribe, plus 12 months to record that you asked to stop |
| Cookie consent record | 6 months, after which we ask you again |
| Website security and server logs | 12 months |
| Complaint files | 6 years from the date the complaint is closed |
| Records of a safeguarding concern | Kept separately, with restricted access. We are taking specialist advice on the retention period and will state it here once it is set |
When a period ends we delete the data or anonymise it so it can no longer be linked to you. Backups are overwritten on their own cycle, so a deleted record can persist in a backup for a short period before it is gone.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong or incomplete
- delete it, where we no longer have a reason to keep it
- restrict what we do with it while a question about it is resolved
- transfer it to you or to someone else in a machine readable format, where we hold it on the basis of consent or a contract
- stop processing it where we rely on legitimate interests and you object
You can withdraw consent at any time where consent is our basis, for example for marketing or analytics. That does not affect anything we did before you withdrew it.
You can object to direct marketing at any time and we must stop. Every marketing email has an unsubscribe link, and you can also just email us.
To use any of these rights, email admin@happyeducation.uk. We will reply within one month. If the request is complicated we can extend that by up to two further months, and we will tell you why within the first month. There is no charge. We may ask you to confirm your identity first, so that we do not hand your information to somebody else.
Complaining
Please tell us first, so we have a chance to put it right. Our complaints procedure is on this website and sets out the timescales we work to.
You can also complain to the UK regulator at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint
If you are in Türkiye, you can also complain to the Kişisel Verileri Koruma Kurumu: kvkk.gov.tr. Section 12 explains the procedure.
Children and young people
Some of the programmes we help with are for people under 18, including summer schools and boarding schools.
An application for someone under 18 must be made by a parent or legal guardian, and we correspond with that parent or guardian. We do not ask a child to give us information directly.
We do not knowingly send marketing to anyone under 18. If you are under 18, please do not subscribe to our newsletter without your parent or guardian.
Please never send passports, visas, medical reports, birth certificates or anything about a child's welfare through a public form, a social media message or an unprotected email attachment. Ask us and we will give you a secure route.
Cookies
Our cookie policy explains every cookie we set, what it is for, how long it lasts and how to change your mind. Nothing that is not strictly necessary runs until you have allowed it, and refusing is as easy as accepting.
If you are in Türkiye: KVKK
Turkish law calls the data controller the veri sorumlusu. For the services described here, the veri sorumlusu is HAPPY EDUCATION CONSULTANCY LTD, at the address in section 1.
Turkish law (Law No. 6698, KVKK) works differently from UK GDPR in ways that matter to you:
- Consent has a bigger role. KVKK starts from explicit consent (açık rıza) and then lists the situations where consent is not needed, such as processing that is directly necessary for a contract you are party to. UK GDPR treats consent as one basis among six.
- Special categories are handled separately. Health data has its own rules under Article 6 of KVKK.
- Transfers abroad have their own regime. Article 9 of KVKK, as amended in 2024, allows transfer on the basis of an adequacy decision, appropriate safeguards such as a standard contract notified to the Kurum, or one of the listed exceptions including explicit consent.
- The complaint route is different. Under KVKK Article 13 you apply to us first. We must answer within 30 days. If we refuse, or do not answer in time, you can complain to the Kurul within 30 days of learning our answer and in any event within 60 days of applying.
- Your rights under Article 11 cover learning whether your data is processed, asking what it is used for, asking for correction or deletion, asking us to notify third parties of a correction, objecting to a result produced by automated analysis, and claiming compensation for damage.
Whether a UK company that serves customers in Türkiye must register with VERBİS and appoint a Turkish representative depends on facts we are confirming with a Turkish data protection lawyer. We will state the position here once it is settled. We are not claiming a registration we do not hold.
Keeping your data safe
We use encrypted connections, restrict access to client files to the people who need them, and protect our forms against automated abuse. No system is perfectly secure, so please help us: never send us a password, and never send sensitive documents through a public form or a social media message.
We will never ask you to send money to a personal bank account, and we will never email you asking you to change payment details. If you receive a message like that claiming to be from us, do not act on it. Call us on the number published on this website.
Changes to this policy
If we change this policy we will update the date shown on this page. If a change materially affects how we use your data, we will tell current clients and newsletter subscribers by email before it takes effect. You can ask us for a previous version at any time.
Who is responsible for your data
HAPPY EDUCATION CONSULTANCY LTDRegistered in England and Wales, company number 11331426
Registered office: 16 Upper Woburn Place, London, England, WC1H 0AF
