Privacy policy

Who we are

Millbank Education helps people in the UK find and apply for university courses. We are Millbank Education Limited, Unit 4, 113-115 Fonthill Road, London N4 3HH. Our registered office is 124 City Road, London EC1V 2NX, and we are registered in England and Wales, company number 14566008.

We are the “data controller” for the information you give us. That means we decide how it’s used and we’re responsible for looking after it. We are registered with the Information Commissioner’s Office (ICO), registration number ZB548242.

You can contact us about your data at any time: email [email protected], call 020 3488 6212, or write to us at the address above.

What we collect

We only ask for what we need.

When you apply or ask us to contact you

Contact details: your name, mobile number and email address. If you ask for a call back, also what it’s about and the best time to call, and if you live outside the UK, your country and what you’d like to study.
Your course choices: the course, level and subject you’re interested in, where and when you’d like to study, and which weekdays you can attend.
Eligibility answers: your date of birth, your status in the UK, how long you’ve lived in the UK, your highest qualification, whether you’ve studied at university or had a student loan before, and whether English is your first language.

We save your answers as you complete each step of the form, so if you stop part way through, we can send you one reminder to finish.

When you use the course finder

Your answers, the courses we suggest and, if you ask us to send you the suggestions, your first name and email address.

When you register as a partner

Your name, mobile number and email address, your company name if you register as a company, whether you recruit students now (and if so, roughly how many you helped enrol in the last 12 months and whether you’ve done the British Council agent training), and your website or social media page if you give it.

When you talk to us

Notes from calls, emails and WhatsApp messages with your adviser, and any documents you choose to share with us later (such as ID, a share code or certificates).

When you visit the website

Basic technical information every website receives, such as your IP address and browser type, used to keep the site working and secure. If you accept optional cookies, we also collect how you use the site (see Cookies).

Your status in the UK and your nationality are personal, so we treat them with extra care. We never ask about health, religion or ethnicity.

Why we use it

Data protection law says we must have a valid reason (a “lawful basis”) for using your information. Here’s what we do and why.

Contact you about your application, check which courses and funding you may be eligible for, and help you apply: You asked us to. It’s a step you’ve asked us to take before we provide our service (“contract”), and you’ve agreed to us contacting you (“consent”).
Call you back when you ask us to, at the time you choose: You asked us to. It’s a step you’ve asked us to take before we provide our service (“contract”).
Send your application to the university or college you choose: You asked us to, as part of our service (“contract”). We always check with you first.
Send you course suggestions from the course finder: You agreed to it (“consent”).
Consider your partner enquiry and call you about working with us: You asked us to. It’s a step you’ve asked us to take before we agree a partner agreement (“contract”).
Keep records of our conversations and decisions: It helps us give you good advice and deal with any questions or complaints (“legitimate interests”).
Measure how people use the website, so we can improve it: Only if you accept optional cookies (“consent”).
Keep the website secure and stop spam: We need to protect our service and the people who use it (“legitimate interests”).
Meet our legal and regulatory duties, such as keeping financial records: The law requires it (“legal obligation”).

We never sell your data or use it to make automatic decisions about you. Our form gives your adviser an early idea of whether student finance is likely, but a person always makes the final judgement with you. You can withdraw your consent at any time: just tell us, or use Cookie settings at the bottom of any page.

Universities and colleges: when you decide to apply, we share your application with the university or college you choose. They then look after your data under their own privacy policy.
Student Finance England: we can help you apply for student finance, but you send that application yourself. We never send your data to Student Finance England without you knowing.
Authorities: only if the law requires it, for example to prevent fraud.

We also use trusted service providers for the following. Each works under a contract that requires them to keep your data safe and use it only on our instructions:

Website hosting and securityto run the website and keep it safe
A secure databasewhere your form answers are stored
Email servicesour business email and notifications to our team
A booking calendarif you book a call with an adviser
WhatsAppif you choose to message us there
Website analyticsonly if you accept optional cookies

We use Cloudflare Turnstile to protect our forms from spam. It checks that a real person is using the form, without asking you to solve a puzzle. To do this, Cloudflare processes some information about your device and browser, as set out in its Turnstile Privacy Addendum.

Data stored outside the UK

Some of our service providers store or process data outside the UK, for example in the European Union or the United States. When that happens, we make sure your data is protected to UK standards, using the safeguards the law allows: countries the UK recognises as having good data protection, the UK–US “Data Bridge”, or the UK’s approved contract terms.

How long we keep it

If you enrol through us: 6 years after your course starts, because universities can query enrolments and we must keep financial records.
If you don’t go ahead: we delete it once we no longer need it to help you, usually within 2 years of when we last spoke.
Partner enquiries: if we don’t go ahead, within 2 years of when we last spoke. If we agree a partnership, 6 years after it ends, because we must keep financial records.
Website analytics: deleted automatically after 14 months.

You can ask us to delete your data sooner at any time.

Your rights

You can ask us to:

see the information we hold about you
correct or delete it
limit or stop how we use it, or send it to you or another organisation

Just email [email protected] or call us. It’s free, and we’ll reply within one month.

Cookies

Cookies are small files a website saves on your device. We only use optional cookies if you say yes on the cookie banner, and you can change your mind at any time.

Essential: remember your cookie choice. These are always on.
Optional: Google Analytics and Microsoft Clarity, which show us how people use the site, and Calendly, which shows our booking calendar on the page.

Keeping your data safe

The website uses an encrypted connection. Form answers go straight to a secure database that only our team can access, and only the people who need it to help you can see it. We train our team to handle personal data properly.

You must be 16 or over to use our forms.

Questions and complaints

If you have a question, or you’re unhappy with how we’ve used your data, please contact us first at [email protected] and we’ll try to put it right.

You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

We may update this policy from time to time. The date at the top shows when it last changed.