Privacy Policy

1. Introduction

Access Oxbridge ("we", "us", or "our") is committed to protecting your privacy and handling personal data responsibly and transparently. This Privacy Policy explains how we collect, use, store, and protect personal information when you interact with our website, services, and communications.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK data protection laws.

2. Who We Are

Access Oxbridge is an independent educational mentoring organisation based in the United Kingdom. For data protection purposes, Access Oxbridge is the data controller of any personal data collected through our website or services.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity information: name, age, date of birth (where relevant)
• Contact information: email address, phone number
• Educational information: academic interests, school or educational background, application-related details voluntarily provided
• Account information: login details if you create an account
• Communications: messages sent via contact forms, email, or other correspondence
• Technical data: IP address, browser type, device information, and usage data collected via cookies or analytics tools

We only collect personal data that is necessary for legitimate educational, administrative, or operational purposes.

4. How We Use Your Data

We use personal data for the following purposes:

• To provide and manage our services and mentoring programmes
• To respond to enquiries and communicate with users
• To administer accounts and bookings
• To improve our website, resources, and user experience
• To comply with legal and regulatory obligations
• To protect our rights, users, and systems

We do not sell personal data to third parties.

5. Legal Bases for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Consent: where you have given clear permission
• Contract: where processing is necessary to provide services you request
• Legitimate interests: for operational, educational, or security purposes, where these interests are not overridden by your rights
• Legal obligation: where required by law

6. Cookies and Analytics

Our website may use cookies and similar technologies to improve functionality and analyse usage. You can manage cookie preferences through your browser settings. Further details are set out in our Cookie Policy.

7. Calls and Text Messages

If you make an enquiry with us, we may contact you about it by phone (including automated calls made on our behalf) and by text message. You can ask us to stop at any time (see Opting out below).

• Recording: calls are recorded and transcribed so we can follow up properly, keep an accurate record of anything agreed (such as a consultation booking) and improve our service.
• Who processes this: our telephony and voice providers, Twilio and Retell AI, process your phone number, call audio, transcripts and text messages on our behalf. They may process data outside the UK (see International Transfers).
• How long we keep it: call recordings and transcripts are kept for up to 12 months, unless we need them for longer to resolve a complaint or meet a legal obligation.
• Opting out: you can ask us to stop calling or texting you at any time: tell us on the call, reply STOP to any of our texts, or email office@accessoxbridge.io.

8. Data Sharing

We may share personal data only where necessary, including with:

• Trusted service providers who support website hosting, communications, or analytics
• Professional advisers or regulators where legally required

All third parties are required to respect data protection laws and process data securely.

9. International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, or safeguarding requirements. Data is securely deleted or anonymised when no longer needed.

11. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure. However, no system can be guaranteed to be completely secure.

12. Your Rights

Under UK data protection law, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (subject to legal limits)
• Object to or restrict certain processing
• Withdraw consent where applicable
• Lodge a complaint with the Information Commissioner's Office (ICO)

Requests can be made by contacting us using the details above.

13. Children's Data

We do not knowingly collect personal data from children under the age of 13 without appropriate consent. Where services involve minors, data is processed responsibly and proportionately.

14. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and continued use of our services indicates acceptance of the updated policy.