Privacy Policy

Luxbn Ltd
G13A, Manchester Business Park, Manchester, M22 5TG, United Kingdom
Email: mdsac@luxbn.com
Phone: +44 7352 991215

We are the data controller for the personal data described in this policy, unless otherwise stated. This means we decide how and why your personal data is processed.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our approach to data protection and for answering any questions about this Privacy Policy or how we handle your personal data.

Data Protection Officer: Monjur E Alahi Chowdhury
Email: Monjur1000980@gmail.com
Postal address: Data Protection Officer, Luxbn Ltd, G13A, Manchester Business Park, Manchester, M22 5TG, United Kingdom

If you have any questions or concerns about how we use your personal data, please contact our DPO in the first instance.

We may collect and process the following categories of personal data:

• Identity Data: first name and last name.
• Contact Data: email address, phone number, and postal address.
• Application Data: academic and background information, and documents you provide for counselling, university or scholarship applications, or visa and migration assistance.
• Technical Data: IP address, browser type and version, device identifiers, operating system, and data collected through cookies and similar technologies.
• Usage Data: pages visited, time spent on the website, and navigation paths.
• Social Media Data: if you choose to contact us or log in through a social media account (such as Google, Facebook, or X/Twitter), we may receive your name, email address, and basic profile information from that provider.
• Transactional Data: records of services you have requested or purchased from us.

We do not intentionally collect special category data (such as data about your health, ethnicity, or religion) through our website. If you send us such information voluntarily and unsolicited, we will delete it unless a specific condition under Article 9 UK GDPR (such as your explicit consent, or the establishment, exercise, or defence of legal claims) allows us to retain it and retention is necessary.

We collect personal data from the following sources:

• Directly from you – when you complete forms on our website, contact us by email or phone, subscribe to updates, or otherwise interact with us.
• From social media authentication providers – where you choose to log in, register, or contact us using a social media account, that provider shares certain profile information with us in line with your settings on their platform.
• Automatically through our website – technical and usage data is collected through cookies, server logs, and similar technologies when you browse our website (see Section 13).

We do not purchase personal data from third-party marketing list providers.

We only process your personal data where we have a valid legal basis under UK GDPR. Depending on the circumstances, we rely on:

• Contract – where processing is necessary to provide services you have requested or to take steps at your request before entering into a contract.
• Consent – where you have agreed to the processing, for example receiving marketing communications or accepting optional cookies. You can withdraw your consent at any time.
• Legitimate Interests – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. Our legitimate interests include maintaining the security of our website, preventing fraud and misuse, responding to enquiries, understanding how our website is used, and improving our services. We have assessed these interests and balanced them against your rights and freedoms, and we do not use legitimate interests where the impact on you would be unfair or unexpected.
• Legal Obligation – where processing is necessary to comply with laws and regulations that apply to us, such as accounting, tax, and regulatory requirements.

The table below summarises the purposes for which we use your personal data and the legal basis we rely on for each purpose:

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

You are not obliged to provide personal data to us. However, where personal data is required for us to provide our services or respond to your request – for example, contact details needed to reply to an enquiry, or academic details needed to process an application – failure to provide that data may mean we are unable to fulfil your request or provide the service. Where this is the case, we will tell you at the time.

We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. If this changes in the future, we will update this policy and provide you with the information required by law, including your right to request human intervention.

We may share your personal data with the following categories of recipients:

• Service providers who process data on our behalf under contract, including our website hosting provider, IT support providers, cloud storage providers (for example, Microsoft 365 or Google Workspace), our enquiry-form and email delivery provider (EmailJS), customer relationship management (CRM) systems, and email marketing platforms.
• Analytics providers, such as Google Analytics where used, which help us understand how visitors use our website (see Section 13 on cookies).
• Partner universities, colleges, and institutions, and visa or immigration authorities, where necessary to process an application you have asked us to make.
• Professional advisers, including accountants, auditors, lawyers, and insurers, where reasonably necessary.
• Business partners where you have specifically requested services delivered jointly with a partner. We will make this clear to you at the time.
• Regulators and public authorities, such as HMRC or the Information Commissioner’s Office, where we are legally required to do so.

All third-party service providers acting on our behalf are required to process your personal data only on our instructions, under written contracts, and with appropriate security measures in place.

We do not sell your personal data.

Some of our service providers – including cloud storage, email delivery, analytics, and social media authentication providers – are based outside the United Kingdom or store data on servers located outside the UK, including in the United States. In addition, when you ask us to apply to a university or institution overseas, your data will be sent to that organisation. This means your personal data may be transferred outside the UK.

Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by using at least one of the following safeguards:

• Adequacy regulations – transfers to countries that the UK Government has determined provide an adequate level of protection for personal data (for example, transfers to the United States under the UK–US Data Bridge, where the recipient is certified).
• International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses – contractual terms approved by the UK Government that give personal data the same protection it has in the UK.
• Additional safeguards – where appropriate, we apply supplementary measures such as encryption and data minimisation.

Where a transfer is necessary to carry out an application at your request, we will rely on your explicit request or the performance of our contract with you. You may contact our DPO for further information on the specific safeguards applied to any transfer of your personal data outside the UK, including a copy of the relevant safeguard where applicable.

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting, and reporting requirements. Our standard retention periods are:

When personal data is no longer required, we securely delete or anonymise it.

Under UK data protection law, you have the following rights:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure – ask us to delete your data (the “right to be forgotten”), in certain circumstances.
• Restriction – ask us to limit how we use your data, in certain circumstances.
• Data portability – receive the data you provided to us in a structured, commonly used, machine-readable format.
• Objection – object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent – at any time, where consent is the legal basis. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact our Data Protection Officer at Monjur1000980@gmail.com or by post at the address in Section 2. We will respond within one month. We will not charge a fee unless your request is manifestly unfounded or excessive, and we may need to verify your identity before acting on your request.

If you are unhappy with how we have handled your data or responded to your request, you have the right to complain to the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

We may use cookies and similar technologies on our website. Cookies are small text files placed on your device that help websites function and provide information to site owners. The categories we may use are:

• Essential cookies – required for the website to operate (for example, security settings). These do not require consent.
• Functional cookies – remember your preferences and choices to improve your experience. Set only with your consent.
• Analytics cookies – help us understand how visitors use our website, including through Google Analytics where used. Set only with your consent. Information collected is aggregated and used to improve the website.
• Marketing cookies – used to personalise content and measure the effectiveness of our marketing. Set only with your consent.

Where used, Google Analytics is provided by Google LLC. Google may also process this information for its own purposes as described in its privacy policy, available at https://policies.google.com/privacy.

Where we use non-essential cookies, you can accept or reject them when you first visit our website, and you can change your preferences at any time through your browser settings. Blocking some cookies may affect how the website functions.

We use appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration, and disclosure. These include access controls, encryption where appropriate, staff awareness, and contractual obligations on our service providers. While no system can be guaranteed as completely secure, we regularly review and enhance our safeguards. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the ICO as required by law.

Our website and services are not directed at children under 13, and we do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will be posted on this page with a revised “Last updated” date. Where changes are significant, we will notify you by email or by a prominent notice on our website.

For any privacy-related questions or to exercise your rights, please contact:

Luxbn Ltd
Data Protection Officer: Monjur E Alahi Chowdhury
G13A, Manchester Business Park, Manchester, M22 5TG, United Kingdom
Email: Monjur1000980@gmail.com (or mdsac@luxbn.com for general enquiries)
Phone: +44 7352 991215
Website: Contact us