Privacy Policy
Effective date: 2026-07-18
This policy explains how Global Scholarships (“we”) collects and uses personal data, in line with the UK GDPR and the Data Protection Act 2018.
1. Who the data controller is
Global Scholarships is the data controller. You can reach us at support@globalscholarships.co.uk.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address, hashed password, display name | Create and secure your account; send you deadline reminders you have opted into | Contract (Art 6(1)(b)) |
| Favourites and application tracker entries | Deliver the shortlist / tracker feature you asked for | Contract (Art 6(1)(b)) |
| Purchase records (credits, subscription status, Stripe customer id) | Fulfil paid unlocks and comply with tax / accounting rules | Contract and legal obligation (Art 6(1)(b), (c)) |
Operational session cookie (gs_sid) and funnel events | Correlate requests within one visit for security and to measure whether the paywall boundary is set correctly — a first-party, aggregate measurement, not marketing profiling | Legitimate interest (Art 6(1)(f)) |
| Server access logs (IP address, user-agent, path, timestamp) | Diagnose incidents, defend against abuse | Legitimate interest (Art 6(1)(f)) |
We do not collect special-category data. We do not sell your personal data. We do not run behavioural advertising on this site.
3. Who your data is shared with
- Stripe — for card payments. Card details never touch our servers; Stripe is a joint controller for the payment transaction itself.
- Our email provider — to send transactional email such as account and deadline-reminder messages you have opted in to.
- Our hosting provider — the VPS that runs the site (EU data centre).
We do not transfer personal data outside the UK/EEA except through Stripe under their standard-contractual-clauses framework. We disclose data to law-enforcement or regulators only where compelled by a valid legal instrument.
4. How long we keep it
- Account & favourites: while your account is open; deleted within 30 days of you closing it.
- Application-tracker entries: same lifecycle as the account.
- Purchase records: 7 years, to meet HMRC record-keeping obligations.
- Operational funnel events: 12 months, then aggregated and the raw rows deleted.
- Server access logs: 30 days.
5. Your rights
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you (Article 15);
- have it corrected if it is inaccurate (Article 16);
- have it erased (Article 17) — you can do this yourself for most of it by closing your account, and can email us for the rest;
- restrict or object to certain processing (Articles 18 & 21);
- portability — receive a machine-readable copy (Article 20);
- withdraw consent for reminder emails at any time (from your account page, or by clicking the unsubscribe link on any reminder).
To exercise any of these, email support@globalscholarships.co.uk. We respond within one calendar month.
6. Complaints
If you are not happy with our response, you can complain to the Information Commissioner’s Office (ico.org.uk). We would rather you gave us a chance to put it right first, but this is your right.
7. Security
Passwords are hashed with bcrypt. Traffic is served over TLS. Access to the production database is restricted to named administrators. We never email your password back to you — we cannot; we do not have it in a readable form.
8. Changes to this policy
When we change this policy we update the effective date above. Material changes will be notified through the site and, where you have an account, by email at least 14 days before they take effect.
9. Contact
Data-protection questions: support@globalscholarships.co.uk.