Privacy Policy

YStudy is operated by Dinnovi Ltd

YStudy is a brand owned and operated by DINNOVI LTD, a private limited company registered in England and Wales under company number 12453420.

Registered office: Birmingham Business Centre Ltd, Quadrant Court Room 6, 51/52 Calthorpe Road, Edgbaston, Birmingham, England, B15 1TH.

Unless stated otherwise, “YStudy”, “we”, “us” and “our” in this policy mean Dinnovi Ltd when operating the YStudy brand. Where Dinnovi Ltd determines the purposes and means of processing personal data through YStudy, Dinnovi Ltd is the data controller.

1. Who this notice is for

This notice applies to people who use the YStudy website, tools and application services — including prospective and current students, people making enquiries, and visitors to our site. It explains what we collect, why, who we share it with, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

YStudy is aimed at adults. Our services are not directed at children under 18, and we do not knowingly collect data from under-18s through our application service. If you believe a child has provided us with personal data, contact us and we will delete it.

2. Information we collect

Depending on how you use YStudy, we may collect:

• Identity and contact details — name, email, telephone/WhatsApp number, and (where relevant) date of birth and address.
• Application information — the course or degree level you want, your previous study, whether you have had UK student finance before, study preferences and saved courses.
• Residence and immigration status — such as British, EU settled/pre-settled, Indefinite Leave to Remain or Refugee status, collected because it determines eligibility for particular courses and for Student Finance.
• Education and background — qualifications, employment and work-experience information you choose to share, and documents you upload (such as a CV, personal statement or qualification certificates).
• Messages — the content of enquiries and communications you send us by form, email, WhatsApp or phone.
• Technical and usage data — IP address, device and browser information, and how you use our site, collected through cookies and similar technologies (see our Cookie Policy).

Special category and sensitive data. Certain information, such as data that may reveal your racial or ethnic origin or health information relevant to a Disabled Students' Allowance enquiry, is classified as "special category" data under the UK GDPR. We only collect this information when necessary and rely on an appropriate additional legal condition, usually your explicit consent or reasons of substantial public interest. Immigration status is handled with the same level of care. You are not required to provide sensitive information; however, without it, we may be unable to assess your eligibility for certain funding routes.

3. Why we use your information, and our lawful bases

Under the UK GDPR we must have a lawful basis for each use of your data. Our uses and bases are:

• To respond to your enquiry and provide guidance — steps taken at your request before any contract, and our legitimate interest in helping people who contact us.
• To assess eligibility and support your application (checking funding, matching courses, preparing documents, liaising with universities) — performance of our services to you, and where sensitive data is involved, your explicit consent.
• To contact you about your application by your chosen method (WhatsApp, phone or email) — providing the service you asked for.
• Marketing — your consent, which you can withdraw at any time (see section 8).
• Legal, safeguarding, accounting and dispute purposes — compliance with our legal obligations and our legitimate interest in protecting our business and the people we help.
• Improving and securing our site — our legitimate interest in a safe, working service, and consent for non-essential cookies.

Marketing consent is always kept separate from the information you give us to get application support — agreeing to be contacted about your application does not sign you up to marketing.

4. Who we share your information with

We share your information only where necessary for the service you have asked for, or where we are legally required to. This may include:

• Universities and education providers — where you ask us to support an application, we share the information needed to progress it. We tell you which providers are involved.
• Service providers acting on our behalf — for example our form and CRM provider, hosting, email/communications and messaging (including WhatsApp), who process data under contract and only on our instructions.
• Professional advisers — such as legal, accounting or insurance advisers, where needed.
• Regulators or authorities — where we are legally obliged to disclose, or to protect someone's safety.

We do not sell your personal information, and we do not share it with advertisers for their own purposes. Advertising cookies (see the Cookie Policy) are used to measure and target our own campaigns, and only with your consent.

5. International Transfers

Some of our service providers may process personal data outside the UK. Where this occurs, we ensure that appropriate safeguards are in place, such as UK adequacy regulations for the destination country, the ICO's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum. For example, certain communications, analytics, and advertising service providers may be based in the United States. You may contact us to request further details about the safeguards that apply to a specific international transfer.

6. How long we keep your information

We keep personal information only for as long as we need it for the purpose it was collected, then delete or anonymise it. Our standard retention periods are:

• Enquiries that do not proceed — up to 24 months from your last contact, then deleted.
• Applicant and student records — for the duration of your application and while you remain a student we support, and then up to 6 years, to meet legal, accounting and dispute requirements.
• Uploaded documents (CV, personal statement, certificates) — kept while your application is active and removed within 12 months of it closing, unless you ask us to remove them sooner.
• Marketing records — until you unsubscribe or withdraw consent, and a suppression record afterwards so we can honour your opt-out.
• Website/account data — cleared when you close your account or after a period of inactivity.

These are general periods; a specific legal obligation may occasionally require us to keep certain records for longer.

7. Your rights

Under UK data protection law you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent at any time. Where we rely on legitimate interests, you can object and we will stop unless we have compelling legitimate grounds. You will not receive worse service for exercising your rights.

To exercise any right, contact us using the details in section 11. We explain these rights in more detail, and how to make a request, in our Data Protection & GDPRTerms of Use page.

8. Marketing

We only send you marketing where you have agreed to it. Every marketing message includes an easy way to unsubscribe, and you can opt out at any time by using that link, replying STOP to a WhatsApp/text message, or contacting us. Opting out of marketing does not stop the essential messages we need to send about an application you have asked us to support.

9. Cookies and similar technologies

We use cookies and similar technologies (including browser storage used to save your progress in our tools and dashboard) to run the site, understand how it is used, and — with your consent — to measure and improve our advertising. Full details and your choices are in our Cookie Policy.

10. How we protect your information

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and limiting access to those who need it. No system is completely secure, but we work to protect your information and to notify you and the ICO where we are legally required to in the event of a breach.

11. Complaints and how to contact us

If you have any question about this notice, or wish to exercise your rights, contact us at privacy@ystudy.co.uk or via our contact page, or by writing to Dinnovi Ltd at the registered office above.

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.