1. Introduction and scope
This Privacy Policy explains how [AdmitFlow legal entity name] ("AdmitFlow", "we", "us") collects, uses, shares and protects personal information across our website and our student lifecycle platform. It applies to admitflow.com, our applicant and student portals, our mobile experiences, and the CRM, Admissions, Student Information System and Commerce products we provide to education institutions (together, the "Services").
AdmitFlow supports institutions from first enquiry to alumni. That means we handle information about several groups of people:
- Website visitors who browse our site, read our content or book a demo.
- Institution users, such as admissions officers, registrars, faculty, finance teams and administrators, who use AdmitFlow on behalf of their institution.
- Enquirers, applicants, students and alumni whose records an institution manages in AdmitFlow.
By using the Services, you acknowledge the practices described in this policy. This policy forms part of our Terms and Conditions.
Our role: controller and processor
Our role depends on whose information it is:
- Institution data (AdmitFlow as processor). When an institution uses AdmitFlow to manage enquiries, applications, enrolments, academic records or payments, the institution decides why and how that information is used. The institution is the data controller (or, in the United States, the educational agency holding education records), and AdmitFlow processes that data only on the institution's documented instructions, under our agreement with them.
- Our own data (AdmitFlow as controller). For information about our website visitors, prospective customers, institution account holders and our own business contacts, AdmitFlow decides how the information is used and acts as controller.
If you are an applicant or student and have a question about how your institution uses your information, please contact your institution first. We will support them in responding to you.
2. Information we collect
Information you give us directly
- Contact and demo requests: name, work email, phone number, institution name, job role and the details you share when you book a call, register for a webinar or contact us.
- Institution account information: names, work email addresses, roles, permissions, login credentials and profile settings of institution users.
- Billing information: billing contact, invoicing address, tax details and payment records for an institution's AdmitFlow subscription. Card details are handled by our payment processor; we do not store full card numbers.
- Support and feedback: messages, call notes, screenshots and attachments you send to our support team.
Information institutions manage in AdmitFlow
An institution may configure AdmitFlow to collect and hold, on its behalf:
- Enquiry and lead data: name, contact details, programme interest, location, source campaign and communication history.
- Application data: personal details, academic history, test scores, transcripts, personal statements, references, interview notes, uploaded documents and admissions decisions.
- Identity and eligibility documents: passport or ID copies, visa or immigration documents and residency information, where an institution requires them.
- Student records: enrolment status, course registrations, attendance, grades, progression, academic standing and graduation details.
- Financial records: tuition fees, scholarships, financial aid, payment plans, transactions and ledger balances.
- Special category or sensitive data: where an institution chooses to collect it for a lawful purpose, such as disability support needs, health or vaccination records for clinical placements, or diversity monitoring information.
- Communications: emails, SMS, call logs and recordings, portal messages and chat transcripts between the institution and applicants or students.
The institution decides which of these fields it collects. We do not use this information for our own marketing.
Information we collect automatically
- Device and usage data: IP address, browser type, device identifiers, operating system, pages viewed, features used, clicks, session times and referring URLs.
- Log and security data: sign-in events, audit trail entries, error logs and security event records that help us keep the Services reliable and secure.
- Cookies and similar technologies: described in section 6.
Information from third parties
- Connected systems: data an institution imports or syncs through integrations such as Salesforce, HubSpot, Microsoft Dynamics, UCAS, payment gateways or its own systems.
- Single sign-on providers: basic profile details when an institution user signs in through an identity provider.
- Business sources: publicly available professional information and event or partner leads about prospective institutional customers.
3. How we use information
Institution data
We use institution data only to provide the Services the institution has contracted for, including to:
- capture enquiries, run admissions workflows, score and route leads, and issue offers and acceptances;
- create and maintain student records, registrations, attendance, grades and transcripts;
- process fees, payment plans and financial aid records through the Commerce module;
- send the emails, SMS and portal notifications the institution configures;
- produce the reports, dashboards and accreditation or compliance outputs the institution requests;
- secure, back up, support and troubleshoot the institution's environment.
We do not sell institution data, use it to build advertising profiles, or use it to contact applicants or students for our own purposes.
Our own data
We use information we control to:
- respond to enquiries, run demos and manage our relationship with customers;
- create and administer institution user accounts;
- invoice, collect payment and keep financial records;
- send service announcements, such as maintenance windows, security notices and changes to these terms;
- send product updates, event invitations and marketing, where permitted, with an option to opt out at any time;
- understand how the Services are used so we can improve features, performance and usability;
- detect, prevent and investigate fraud, abuse and security incidents;
- meet legal, tax, accounting and regulatory obligations and enforce our agreements.
We may also create aggregated or de-identified statistics that cannot reasonably identify any person or institution, and use them to improve the Services.
Legal bases (UK and EU users)
Where UK or EU data protection law applies to information we control, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services and managing customer accounts | Performance of a contract |
| Billing, tax and record keeping | Legal obligation |
| Security, fraud prevention and service improvement | Legitimate interests |
| B2B marketing to institutional contacts | Legitimate interests, or consent where required |
| Non-essential cookies and marketing to individuals | Consent |
For institution data, the institution is responsible for identifying its own legal basis, including any condition needed for special category data.
4. How we share information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share information only in the following situations:
- With the institution. Applicant and student information is available to the institution that holds it, and to the staff, faculty and other users that institution authorises through role-based access.
- With sub-processors. We use carefully selected service providers for cloud hosting, data storage, email and SMS delivery, telephony, payment processing, customer support and analytics. They may use the information only to provide services to us, under written contracts that require confidentiality and appropriate security.
- With integrations the institution enables. When an institution connects AdmitFlow to another system, such as Salesforce, HubSpot, Microsoft Dynamics, UCAS, a payment gateway or its own tools, data flows to that system as the institution configures it.
- With agencies and partners the institution authorises. Where an institution grants access to a recruitment agent, marketing agency or other partner, that access is limited to the permissions the institution sets.
- Within our corporate group. With our affiliates that help us operate the Services, under the same protections described here.
- For legal reasons. Where we reasonably believe disclosure is required by law, regulation, subpoena or court order, or is needed to protect the rights, safety or property of AdmitFlow, our customers, students or the public.
- In a business transfer. If AdmitFlow is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy and our commitments to customers.
5. Retention, security and AI features
How long we keep information
- Institution data is kept for as long as the institution's agreement is active and in line with retention settings.
- Account and billing records are kept for the life of the customer relationship, then for tax/legal obligations.
- Marketing and enquiry data is kept until you opt out or it is no longer relevant (reviewed every 24 months).
- Logs and audit trails are kept for security and compliance (typically 12 months).
How we protect information
We use technical and organisational measures designed to protect information against loss, misuse and unauthorised access, including encryption in transit and at rest, role-based access control, audit trails, and regular backups.
AI-assisted features
Some AdmitFlow features use AI to help institution staff work faster (e.g., summarising applications, drafting replies, scoring leads). These features process institution data only to deliver the feature, are not used to train general-purpose AI models without written agreement, and support staff decisions without making final automated administrative determinations.
6. Children, cookies and tracking
Our website and marketing are intended for adults acting for institutions. We do not knowingly collect information directly from children under 13 for our own purposes.
We use cookies, pixels and local storage on our website and in the Services. You can manage your preferences through your browser or the cookie preferences link in the site footer.
7. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or restrict your personal information.
- Applicants, students and alumni: Please contact your institution's admissions or data protection office directly, as they control your records.
- Website visitors, prospects and institution users: Email privacy@admitflow.com with the subject line "Privacy request".
8. Other terms and contact
For questions about this policy or our privacy practices, contact us at [AdmitFlow legal entity name], [Registered address], or via email at privacy@admitflow.com. General enquiries: hello@admitflow.com.