Last updated: 11 November 2026
Applies to: www.ucol.co.uk, portal.ucol.co.uk and the services of UCOL FZE
This policy explains how UCOL FZE ("UCOL", "we", "us", "our") collects, uses, shares and protects personal data. It also explains your rights and how to use them. We have written it in plain English and grouped the key points into tables so that you can find what you need quickly. If anything is unclear, please contact us using the details in section 3.
| Question | Short answer |
|---|---|
| Who is responsible for your data? | UCOL FZE, a company licensed in the Sharjah Publishing City Free Zone, United Arab Emirates. UCOL FZE is a wholly owned subsidiary of Crizac Limited, which is listed on the National Stock Exchange of India and BSE. |
| Whose data do we use? | Contacts at universities and other clients, education agents and channel partners, students and parents whose applications or event bookings come through us, event attendees, job applicants and website visitors. |
| What do we collect? | Contact and business details, partner onboarding and compliance information, student application information, event information, and technical data from our website and portal. Full detail is in section 4. |
| Why do we use it? | To provide our consultancy, agent management, application, event and recruitment services, to meet our contracts and legal duties, to keep our services secure, and, with permission where needed, to send marketing. |
| Who do we share it with? | Universities and institutions, Crizac group companies, education agents, trusted service providers, and authorities where the law requires. We do not sell personal data. |
| Where does it go? | We are based in the UAE. Data is also processed in India (our parent company and its platform), the United Kingdom, and the countries where your chosen universities or partners are based. Section 13 lists the countries and safeguards. |
| Do we use automated decisions? | We use automated and AI tools to check, sort and match information. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. A person reviews before any such decision. See section 10. |
| How long do we keep it? | Only as long as we need it. Most records are kept for six years after our relationship or the relevant intake ends. Section 14 gives each period. |
| What are your rights? | Access, correction, deletion, restriction, objection, portability, withdrawal of consent, and rights about automated decisions. You can also complain to us and to the UK Information Commissioner's Office (ICO). |
| How do you contact us? | Email info@ucol.co.uk with the subject line "Data Protection", or write to us at the addresses in section 2. |
This policy applies when:
you visit www.ucol.co.uk or use our partner portal at portal.ucol.co.uk;
you contact us, or work with us as a university, institution, company or other client;
you register with us, or work with us, as an education agent or channel partner;
you are a student or parent whose application, enquiry or event booking is handled by us or submitted to us by an education agent;
you attend an event we run, such as an education fair, pre-departure briefing or alumni meet-up; or
you apply for a job with us.
Some of our services are carried out on behalf of universities and other clients, for example alumni management, running a liaison office, or recruitment and payroll for a client's overseas team. In those cases the client decides how your data is used and its own privacy notice applies. Section 21 explains this in more detail.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR), as these apply to our services offered to people and organisations in the United Kingdom. We also follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where they apply, the EU General Data Protection Regulation (EU GDPR) and India's Digital Personal Data Protection Act 2023.
UCOL FZE is the data controller for the personal data described in this policy, unless section 21 says otherwise. This means we decide why and how your personal data is used.
| Detail | Information |
|---|---|
| Legal name | UCOL FZE |
| Legal form | Free Zone Establishment (single shareholder company) |
| Licensing authority | Sharjah Publishing City Free Zone, United Arab Emirates |
| Formation number | 4419640 |
| Registered address | Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates |
| Parent company | Crizac Limited (CIN L80903WB2011PLC156614), Wing A, Constantia Building, 11 U.N. Brahmachari Street, Kolkata 700017, West Bengal, India. UCOL FZE is wholly owned by Crizac Limited. |
| UK representative (Article 27 UK GDPR) | Crizac Ltd (company number 10714236), 24 Great Chapel Street, Soho, London, W1F 8FS, United Kingdom. Crizac Ltd is also a wholly owned subsidiary of Crizac Limited. You can contact our UK representative about any matter in this policy. |
| Telephone | +44 121 823 1000 (08:00 to 19:00 UK time, Monday to Friday) |
| info@ucol.co.uk |
For any question, request or complaint about your personal data, please email info@ucol.co.uk with the subject line "Data Protection",
The data we collect depends on how you deal with us. We only collect what we need for the purpose concerned.
| Who you are | Personal data we may collect | Where it comes from |
|---|---|---|
| University, institution and company contacts | Name, job title, employer, work email, work phone, office address, details of our meetings and correspondence, contract and invoicing contacts. | You, your organisation, our group companies, public sources such as your organisation's website and LinkedIn, and event introductions. |
| Education agents and channel partners | Name and contact details of owners, directors and staff; business name, registration and licence details; office address; identity documents of owners and authorised signatories; tax details; bank account details for commission payments; references; training and certification records; compliance and due diligence results; performance, application and commission records; portal login details and activity. | You, your business, public registers, sanctions and adverse media screening, references, universities and regulators, and our group companies. |
| Students and parents | Name, date of birth, gender, nationality, contact details, passport details, address, academic history and transcripts, English language and other test results, course and university choices, work history, personal statement, references, funding and sponsor information, visa and travel history, parent or guardian contact details, and the progress and outcome of applications. In limited cases, the information described in section 6. | Mostly from the education agent who submits your application. Also from you, your parent or guardian, your school or referees, universities, testing bodies, verification providers and our group companies. |
| Event attendees | Name, contact details, school or organisation, study interests, attendance records, photographs and video taken at events, and any access or dietary needs you tell us about. | You, the organisation that invited you, and event partners. |
| Job applicants | CV, cover letter, contact details, employment and education history, interview notes, references, right to work documents and any pre-employment checks. | You, recruitment agencies, referees and screening providers. |
| Website and portal users | IP address, browser and device type, pages viewed, dates and times of visits, referring site, cookie identifiers, login details and security logs. | Your device, through cookies and similar technologies (see section 19). |
We collect most personal data directly from you. We also receive personal data from:
education agents and channel partners, who submit student applications to us and confirm that they have told students how their data will be shared;
universities and institutions we work with, for example application decisions and enrolment updates;
Crizac Limited and other Crizac group companies, when a client, partner or student relationship is shared across the group;
identity, document verification, sanctions and fraud screening providers;
schools, referees and testing bodies; and
public sources, such as company registers, professional networking sites and organisation websites.
Some information is more sensitive and has extra protection in law. This includes information about health, disability, racial or ethnic origin, religion and criminal convictions.
We do not ask for this information unless a university, a visa process or the law requires it, or you choose to share it so that we can support you. Examples include a disability or health need you tell us about so we can arrange support at an event, or a question about criminal convictions that a university includes in its application form.
Where we use this information, we rely on your explicit consent, on the need to establish, exercise or defend legal claims, or on another condition allowed by law. We keep it only for as long as needed, restrict who can see it, and pass it to a university only where the university requires it.
Our website and partner portal are for businesses and adults. Some students whose applications we handle may be under 18. Where this is the case, we expect the education agent or school to involve a parent or guardian, and we use the student's data only to process the application or event booking. We do not send marketing to anyone under 18.
We must have a lawful basis for each use of personal data. The table below sets out what we do, and the lawful basis we rely on.
| What we use it for | Whose data | Lawful basis |
|---|---|---|
| Replying to enquiries and providing consultancy, market entry, liaison office, alumni, agent management, transnational education and event services | Client contacts, enquirers | Contract with you or your organisation; legitimate interests in running our business |
| Registering, onboarding and checking education agents and channel partners, including identity checks, sanctions screening and compliance checks required by universities and regulators | Agents and partners | Contract; legal obligation; legitimate interests in working only with compliant, trustworthy partners |
| Paying commission and managing partner performance and training | Agents and partners | Contract; legal obligation (tax and accounting) |
| Receiving, checking, completing and submitting student applications to universities, and tracking their progress | Students and parents | Contract, where you have asked us or your agent to apply on your behalf; legitimate interests in providing an accurate application service to students, agents and universities |
| Checking documents and preventing fraud in applications | Students, agents | Legitimate interests (including the recognised legitimate interest of detecting and preventing crime); legal obligation where it applies |
| Connecting you, at your request, with education finance, accommodation, insurance or similar services offered by Crizac group companies or partners | Students and parents | Consent; contract |
| Running events, including registrations, attendance and follow-up | Event attendees | Contract; legitimate interests; consent for photographs where required |
| Sending news, updates and invitations about our services | Client contacts, agents, enquirers | Consent, or legitimate interests for business contacts where the law allows (see section 11) |
| Recruiting our own staff | Job applicants | Steps before entering a contract; legal obligation (right to work checks); legitimate interests |
| Operating, securing and improving our website and portal | Website and portal users | Legitimate interests; consent for non-essential cookies |
| Meeting legal, regulatory, tax, audit and group reporting duties, including the reporting duties of our listed parent company | All groups | Legal obligation; legitimate interests |
| Establishing, exercising or defending legal claims | All groups | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. Our legitimate interests are:
providing an efficient, accurate service to universities, agents and students;
working only with education agents who meet the standards that universities and regulators expect;
preventing fraud, misuse of our services and security incidents;
developing our business relationships and telling business contacts about relevant services;
managing our business within the Crizac group, including shared systems, reporting and audit; and
protecting our legal rights.
You can ask us for more information about how we balanced these interests, and you have the right to object (see section 16).
We use the Crizac group's application management platform, which includes automated and artificial intelligence (AI) tools. We use these tools in the following ways:
| Activity | What the tool does | Human involvement and impact |
|---|---|---|
| Application checks | Checks that applications are complete, reads uploaded documents, and flags missing items, inconsistencies or possible signs of document fraud. | Our team reviews every flag. An application is not rejected or withheld because of a flag alone. |
| Eligibility screening | Compares a student's academic results, test scores and other details with a university's published entry requirements. | Used to guide advice. Our team reviews the result before an application is held back. Admission decisions are made by the university under its own policies. |
| Course matching and recommendations | Suggests courses and universities that fit a student's profile and preferences. | Suggestions only. The student and their agent decide where to apply. |
| Partner onboarding and monitoring | Screens agents and partners against sanctions and adverse media lists, and highlights unusual application patterns. | Our team reviews every match or alert before any action is taken on a partner account. |
| Communications support | Helps draft replies, summarise correspondence and answer common questions. | Our team is responsible for what we send. |
Our commitment. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. If we plan to do so in future, we will update this policy first and put the safeguards required by law in place.
Your rights. If you believe a decision about you was made by automated means, you can ask us to explain how it was made, give us your point of view, ask for a person to review it, and challenge it. Contact us using the details in section 3.
Our contracts with providers of AI and automation tools require them to process personal data only on our instructions and to keep it secure.
We send marketing about our services to business contacts at universities, institutions, companies and education agents. We do this based on our legitimate interests or, where the law requires, your consent. We do not send marketing to students under 18.
You can opt out at any time by using the unsubscribe link in any email, or by contacting us. We keep a record of opt-outs so that we do not contact you again. Opting out of marketing does not affect service messages, such as application updates or commission statements.
We do not sell personal data. We share it only where needed for the purposes in section 8.
| Recipient | Why we share | Their role |
|---|---|---|
| Crizac Limited (India) and other Crizac group companies, including Crizac Ltd (UK) | To run the shared application management platform, provide operational, technology and support services, process applications, and meet group reporting and audit duties | Processor acting on our instructions, or independent controller where it provides its own service to you under its own privacy notice |
| Universities, colleges and other institutions | To submit applications, agree agent arrangements, report on partner compliance, and deliver the services our clients buy from us | Independent controllers |
| Education agents and channel partners | To update agents on the progress of the applications they submitted, and to manage our partnership | Independent controllers |
| Technology service providers, including cloud hosting (for example Amazon Web Services), email, customer relationship management, communication, AI and automation tools | To host, run and secure our systems | Processors |
| Identity, document verification, sanctions and fraud screening providers | To check identities and documents and to prevent fraud | Processors or independent controllers |
| Banks and payment providers | To pay commission and receive payments | Independent controllers |
| Education finance, accommodation, insurance and similar providers | Only when you ask us to connect you with them | Independent controllers |
| Event venues and co-hosts | To manage event registration and access | Processors or independent controllers |
| Professional advisers, auditors and insurers | To obtain advice, complete audits and manage risk | Independent controllers |
| Regulators, government bodies, courts and law enforcement | Where the law requires us to, or to prevent or detect crime | Independent controllers |
| A buyer or investor in our business | If we sell, transfer or restructure all or part of our business, under strict confidentiality | Independent controller |
Universities that sponsor student visas may share application information with immigration authorities, such as UK Visas and Immigration. They do this under their own privacy notices.
UCOL FZE is based in the United Arab Emirates. When an organisation in the United Kingdom or the European Economic Area sends personal data to us, or when we send personal data to other countries, the law requires safeguards to make sure the data stays protected. The table below explains where personal data may go and how we protect it.
| Country or region | Who receives it and why | Safeguard |
|---|---|---|
| United Arab Emirates | UCOL FZE, to provide our services | UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, signed with the UK and EEA organisations that send data to us |
| India | Crizac Limited and the Crizac group application management platform, hosted on cloud servers in India, for processing, technology and support | Intra-group data transfer agreement based on the UK IDTA and the UK Addendum to the EU Standard Contractual Clauses |
| United Kingdom | Crizac Ltd (UK), universities and our UK service providers | The UK is recognised as providing adequate protection by the EU and under UAE law; UK data protection law applies to the recipients |
| European Economic Area, Canada, New Zealand and other countries with UK adequacy regulations | Universities, partners and service providers in those countries | UK adequacy regulations |
| United States | Universities and service providers | The UK Extension to the EU-US Data Privacy Framework for certified organisations; otherwise the UK IDTA |
| Australia and other destination countries without UK adequacy regulations | Universities you have chosen to apply to | The UK IDTA where the university has signed one with us; otherwise the transfer is necessary to carry out the application you have asked for |
| Countries where our education agents are based (including in South Asia, Africa, the Middle East, East Asia and Latin America) | Agents, for updates on the applications they submitted and to manage our partnership | Our agent agreement, which includes data protection terms, or the transfer is necessary to carry out the application you have asked for |
You can ask for a copy of the safeguards that apply to your data, or more detail about any transfer, by contacting us. We may remove commercial terms from any copy we provide.
We keep personal data only for as long as we need it for the purposes in this policy, or as long as the law requires. When the period ends, we securely delete or anonymise it.
| Type of record | How long we keep it |
|---|---|
| General enquiries that do not lead to a relationship | 2 years from our last contact |
| Client and business contact records, contracts and invoices | For the length of the relationship, then 6 years |
| Education agent and partner records, including identity, compliance, bank and commission records | For the length of the partnership, then 6 years |
| Student application records | 6 years after the end of the intake the application relates to, or longer if a university contract or the law requires it |
| Special category and criminal offence data | Only as long as needed for the application or support concerned, and no longer than the related application record |
| Event registration and attendance records | 2 years after the event |
| Marketing contact details | Until you opt out. We keep a short suppression record so that we do not contact you again. |
| Unsuccessful job applications | 6 months after the recruitment decision, unless you agree to a longer period |
| Data protection requests and complaints | 3 years after the matter is closed |
| Website and portal security logs | Up to 12 months |
| Cookies | As set out in section 19 |
| Data we process on behalf of a client | As set out in our contract with that client |
We may keep data for longer where it is needed for a legal claim, an investigation or a regulatory request.
We use technical and organisational measures to protect personal data. These include:
encryption of data in transit and at rest;
role-based access, so that staff and partners see only the data they need;
multi-factor authentication for our systems and partner portal;
logging and monitoring of access to our systems;
data protection and security training for our staff;
written contracts with service providers that require them to protect personal data; and
a process for investigating and reporting personal data breaches to regulators and to you, where the law requires.
No system is completely secure. Please keep your portal password confidential and tell us straight away if you think your account has been misused.
You have the following rights over your personal data. Some rights apply only in certain situations.
| Right | What it means |
|---|---|
| Right to be informed | You have the right to clear information about how we use your data. This policy provides it. |
| Right of access | You can ask for a copy of the personal data we hold about you and information about how we use it. |
| Right to rectification | You can ask us to correct data that is wrong or complete data that is incomplete. |
| Right to erasure | You can ask us to delete your data, for example if we no longer need it or you withdraw consent. We may need to keep some data for legal reasons, and we will tell you if so. |
| Right to restrict processing | You can ask us to limit how we use your data, for example while we check its accuracy. |
| Right to object | You can object when we rely on legitimate interests. You can object to direct marketing at any time, and we will stop. |
| Right to data portability | You can ask for data you gave us, in a structured, commonly used format, or ask us to send it to another organisation, where we rely on consent or contract and use automated means. |
| Right to withdraw consent | Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it. |
| Rights about automated decisions | You can ask for information about an automated decision, give your point of view, ask for a person to review it, and challenge it (see section 10). |
| Right to complain | You can complain to us, and to the ICO or another data protection regulator (see section 18). |
How to ask. You can make a request by email to info@ucol.co.uk with the subject line "Data Protection", by post to either address in section 2, or by speaking to any member of our team. You do not need to use a form or any legal wording. Please tell us your name, how we know you (for example, as a student, agent or client contact) and what you would like us to do.
Checking your identity. To protect your data, we may ask you to confirm your identity before we act on a request, usually with a copy of a photo ID or by asking questions only you would know. If someone else, such as an education agent, parent or solicitor, makes a request for you, we will ask for your written permission. We ask only for the information we need for this check.
How long it takes. We will reply within one month of receiving your request. If your request is complex, or you have made several requests, we may extend this by up to two further months. We will tell you within the first month if we need to do this, and why. If we need to confirm your identity or ask you to clarify your request, the time limit starts when we receive that information.
Fees. We do not charge a fee. We may charge a reasonable fee, or refuse to act, if a request is clearly unfounded or excessive. If we refuse a request, we will explain why and tell you how to complain.
Searches. We will carry out a reasonable and proportionate search for your data.
Complain to us first. If you are unhappy with how we have handled your personal data, please tell us so that we can put things right. Email info@ucol.co.uk with the subject line "Data Protection Complaint", or write to us at either address in section 2. We will:
acknowledge your complaint within 30 days of receiving it;
investigate it without undue delay and keep you updated on our progress; and
tell you the outcome and what we have done.
Complain to a regulator. You also have the right to complain to the UK Information Commissioner's Office (ICO). The ICO usually expects you to contact us first.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Depending on where you live, you can also complain to the UAE Data Office, the Data Protection Board of India, or the data protection authority in your EU or EEA country.
Cookies are small text files placed on your device when you visit a website. We use them to make our website and portal work, to keep them secure and, with your permission, to understand how they are used.
| Type | What it does | Your choice | How long |
|---|---|---|---|
| Strictly necessary | Keeps you logged in to the partner portal, keeps the website and portal secure, and remembers your cookie choices | Always on, as the services cannot work without them | Session, or up to 12 months for your cookie choices |
| Functional | Remembers preferences such as language | On only with your consent | Up to 12 months |
| Analytics | Tells us how visitors use our website, for example which pages are popular, so that we can improve it | On only with your consent | Up to 13 months |
| Marketing | Used to show relevant content and measure campaigns | On only with your consent | Up to 13 months |
Managing cookies. When you first visit our website, we ask for your consent to non-essential cookies. You can change your choice at any time using the cookie settings link at the bottom of each page. You can also block or delete cookies in your browser settings, although parts of the portal may not work if you block strictly necessary cookies.
Our website links to other websites, such as university websites and our pages on Facebook and LinkedIn. These sites have their own privacy policies, and we are not responsible for how they use personal data. When you interact with our social media pages, the social media platform and UCOL may both use your data, and the platform's own privacy policy also applies.
For some services, we act on behalf of a university, institution or company and follow its instructions. In these cases we are a processor and the client is the controller. Examples include:
managing a university's alumni network and local alumni events;
running a client's liaison or regional office; and
recruitment, payroll and statutory formalities for a client's overseas staff.
The client's privacy notice explains how your data is used in these cases. If you contact us about these services, we will pass your request to the client and help it respond.
Some personal data is needed by law or under a contract. For example, we cannot register an education agent without identity and business checks, or pay commission without bank details. Universities also require certain information before they can consider an application. If you do not provide the information we need, we may not be able to provide the service you have asked for. We will tell you when information is required.
We review this policy at least once a year and when our services or the law change. We will post the updated version on this page with a new "last updated" date. If we make an important change, such as a new use of your data, we will tell you directly where we can, before the change takes effect.
| Version | Date | Summary of changes |
|---|---|---|
| 2.0 | 11 November 2026 | Policy expanded: data controller details, UK representative, automated decision-making and AI, international transfers by country, retention periods, rights request process, complaints process and cookie information. |