Privacy Policy

Dated: 09 July 2026

This Privacy Policy (“Policy”) describes how FindMyCourse Ltd, a company registered in England and Wales (Company No. 17325137), together with its affiliate Urban Educational Consultants Private Limited, a company incorporated under the laws of India, operating under the brand FindMyCourse.ai (“FindMyCourse,” “Company,” “we,” “our,” or “us”), collects, uses, stores, discloses, and otherwise processes personal data in connection with your access to and use of the FindMyCourse.ai website, mobile applications, AI chatbot, course discovery tools, study abroad advisory services, and related features and content (collectively, the “Platform”).

FindMyCourse Ltd operates the Platform and is the primary entity responsible for connecting prospective students with universities, colleges, and course providers across multiple countries, including in the United Kingdom, the United States, Australia, Canada, and other study destinations. Urban Educational Consultants Private Limited developed the Platform and provides platform, technology, and operational support. The two companies are under common ownership. Their respective roles as controller, fiduciary, and processor for particular processing activities are described in Section 1 and in the regional supplements in Sections 18 to 20.

This Policy forms part of, and should be read together with, our Terms of Service. Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Service. By accessing or using the Platform, you confirm that you have read, understood, and agreed to this Policy. If you do not agree, you must stop using the Platform.

This Policy applies to data processing carried out by us as a data fiduciary (under the Digital Personal Data Protection Act, 2023 (“DPDP Act”)), as a data controller (under the General Data Protection Regulation and the United Kingdom General Data Protection Regulation (collectively, “GDPR”)), and as a business (under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”)), in each case as applicable. Region-specific rights and disclosures are set out in Sections 18 to 20.

1. Identity of the Data Fiduciary / Controller / Business

The entities responsible for the processing of your personal data under this Policy are:

Operating entity (United Kingdom):

Legal name: FindMyCourse Ltd
Company number: 17325137
Registered office: Suite 10, Capital House, 61 Amhurst Road, London, E8 1LL, United Kingdom
ICO registration number: ZC194130
Email: [email protected]

Affiliated technology and operations provider (India):

Legal name: Urban Educational Consultants Private Limited
Brand: FindMyCourse.ai
Registered office: 48, Sohal Patti, Bajakhana Road, Barnala, Punjab, India – 148101
Email: [email protected]
Grievance Officer / Data Protection Contact: as set out in Section 17

FindMyCourse Ltd operates the Platform under a licensing agreement with Urban Educational Consultants Private Limited. Depending on the processing activity and your location, either entity may act as controller/fiduciary or as processor, as described in the regional supplements below.

2. Categories of Personal Data We Collect

We may collect, receive, generate, or otherwise process the following categories of personal data, in each case to the extent applicable:

Information you provide

Identity and contact data, including name, email address, phone number, country, and city of residence;
Profile data, including academic background, qualifications, test scores, work experience, areas of interest, intended field of study, and similar information you choose to provide;
Inputs you submit to the AI chatbot, including queries, prompts, free-text descriptions of your circumstances, and any other content you submit through the Platform;
Communications with us, including emails, support tickets, feedback, and survey responses;
Verification data, where you confirm being above the age of majority or, where you are below the age of majority, where a parent or lawful guardian confirms supervision and consent.

Information collected automatically

Device and technical data, including IP address, browser type and version, operating system, device identifiers, and similar technical information;
Usage data, including pages and features accessed, time spent on the Platform, click and navigation patterns, search queries, and chatbot interactions;
Cookies and similar tracking technologies, as further described in Section 12;
Approximate location data derived from IP address.

Information from third parties

Authentication data, where you sign in using a third-party account (such as Google or similar), limited to information you authorise that third party to share with us;
Information from Course Providers, Education Partners, and Colleges, in connection with your use of the Platform;
Information from analytics, fraud-prevention, and infrastructure service providers acting on our behalf.

We do not knowingly collect financial account details (such as card numbers or bank details) since the Platform does not charge users; if such information is provided in error, you should refrain from doing so.

3. Purposes for Which We Process Personal Data

We process personal data for the following purposes:

To provide, operate, maintain, secure, and improve the Platform, including the AI chatbot and discovery, search, and advisory functionalities;
To respond to your queries, requests, and submissions;
To generate course suggestions, study abroad insights, and advisory responses on the Platform;
To facilitate, where you have explicitly opted in, introductions to Education Partners or other third parties for the specific inquiry concerned;
To train, fine-tune, evaluate, and improve our internal AI models, recommendation engines, and ranking models, including by using inputs you submit to the Platform;
To produce de-identified, aggregated, anonymised, or pseudonymised data, derivatives, and insights for our internal and commercial purposes;
To send you service-related communications, updates, and notifications;
To send you marketing or promotional communications, where permitted by applicable law and where you have not opted out;
To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;
To comply with legal, regulatory, tax, and accounting obligations, and to respond to lawful requests from authorities;
To establish, exercise, or defend legal claims, including in connection with disputes, investigations, and litigation;
In connection with corporate transactions, including mergers, acquisitions, financings, restructurings, due diligence, and successor operations, as further described in our Terms of Service;
For any other purpose disclosed to you at the time of collection or for which you have provided consent.

4. Legal Basis for Processing

We rely on one or more of the following legal bases for processing your personal data, depending on the applicable jurisdiction and the purpose of processing:

Your consent, including consent for specific purposes such as introduction to Education Partners, marketing communications, and use of non-essential cookies;
The performance of a contract with you, or steps taken at your request prior to entering into a contract;
Compliance with a legal obligation to which we are subject;
Our legitimate interests or those of a third party, except where overridden by your interests or fundamental rights and freedoms (this basis is relied on principally under GDPR);
Certain legitimate uses, as permitted under the DPDP Act;
Such other legal basis as may be available under applicable law.

Where we rely on consent, you may withdraw that consent at any time as described in Section 7 and Sections 18 to 20. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, and may result in our being unable to provide some or all of the Platform to you.

5. Disclosure of Personal Data to Third Parties

We may disclose, share, transfer, or otherwise make available your personal data to the following categories of recipients, in each case for the purposes set out in Section 3 and on terms consistent with applicable law:

Education Partners, Course Providers, Colleges, universities, and other educational institutions or partners located in any country (including the United Kingdom, United States, Australia, Canada, and other study destinations), where you have explicitly opted in for an introduction or referral or where such disclosure is required to provide a feature you have requested;
Service providers and processors engaged by us to provide hosting, infrastructure, cloud computing, communications, analytics, customer support, fraud prevention, security, AI and machine-learning services, payment-related services (where applicable in the future), and similar services on our behalf;
Professional advisors, including legal, tax, accounting, audit, and insurance advisors;
Government authorities, regulators, courts, law-enforcement agencies, and other public bodies, where required or permitted by applicable law or in response to lawful requests;
Acquirers, investors, lenders, prospective acquirers and investors, and their respective advisors, in connection with corporate transactions, due diligence activities, and successor operations, in each case as further described in our Terms of Service;
Any other person to whom you have directed or consented to such disclosure.

We do not sell your personal data in exchange for monetary consideration. We may, however, share de-identified, aggregated, anonymised, or pseudonymised data, datasets, derivatives, and insights with third parties for our internal and commercial purposes; such information is not personal data and is not subject to the protections set out in this Policy. Specific rights of users in California in respect of “sale” and “sharing” of personal data are set out in Section 20.

We do not publish a list of named third-party recipients in this Policy. Where required by applicable law, you may request, through the contact channels in Section 17, further information about the categories of recipients to whom we have disclosed your personal data.

6. International and Cross-Border Transfers

We may transfer, store, and process your personal data in jurisdictions outside the country in which you are located, including to jurisdictions that may not provide the same level of data protection as your home jurisdiction. Such transfers may occur, among other reasons, because our service providers, infrastructure, or affiliates are located in those jurisdictions, or because the recipient (such as an Education Partner) is located in those jurisdictions. In particular, because the Platform is operated by FindMyCourse Ltd in the United Kingdom with technology and operational support provided by Urban Educational Consultants Private Limited in India, your personal data may be transferred between these jurisdictions, and onward to universities, colleges, and course providers located in various countries — including the United Kingdom, the United States, Australia, Canada, and other study destinations — to whom you have consented to be introduced. These destination countries may have data protection laws that differ from those in your home country.

Where required by applicable law, we will implement appropriate safeguards for such transfers, which may include standard contractual clauses, adequacy assessments, intra-group agreements, or other mechanisms recognised under the applicable law. The DPDP Act, GDPR, and CCPA each provide for cross-border transfers subject to conditions, and we will comply with such conditions to the extent applicable.

By using the Platform and providing your personal data, you acknowledge that your personal data may be transferred outside your home jurisdiction in accordance with this Policy.

7. Your Rights

Subject to applicable law and to the conditions and limitations imposed by such law, you may have the following rights in relation to your personal data:

The right to access, obtain a summary of, or obtain a copy of personal data we hold about you;
The right to request correction or rectification of personal data that is inaccurate or incomplete;
The right to request erasure or deletion of personal data, subject to applicable exceptions;
The right to withdraw consent where processing is based on consent;
The right to nominate an individual to exercise rights in the event of your death or incapacity, where applicable;
The right to grievance redressal in relation to our processing of your personal data;
Such additional rights as may be available under the regional supplements set out in Sections 18 to 20.

To exercise any of these rights, you may contact us through the channels set out in Section 17. We may require you to verify your identity before acting on a request, and we may decline or limit a request to the extent permitted or required by applicable law. We will respond to verified requests within the timelines required by applicable law.

8. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of providing the Platform, complying with our legal, regulatory, tax, and accounting obligations, resolving disputes, enforcing our agreements, and protecting our legitimate interests. Retention periods may vary depending on the category of personal data, the nature of the processing, and the applicable legal requirements.

Following the expiry of the applicable retention period, we will delete, destroy, anonymise, or otherwise render the personal data inaccessible, in accordance with our internal data-retention policies and applicable law. De-identified, aggregated, anonymised, or pseudonymised data may be retained indefinitely for our internal and commercial purposes.

9. Security

We implement reasonable technical, organisational, and administrative measures designed to protect personal data against unauthorised access, use, disclosure, alteration, loss, or destruction, having regard to the nature of the personal data, the purposes of processing, and the state of the art. No security measure is, however, capable of guaranteeing absolute security, and we do not warrant or guarantee that personal data will be secure against all forms of attack or compromise.

In the event of a personal data breach affecting your personal data, we will notify the relevant supervisory authority and, where required by applicable law, affected individuals, in each case within the timelines required by applicable law.

10. Children’s Data

The Platform is intended for use by individuals who are at least eighteen (18) years of age. Where any individual below the age of eighteen (18) accesses the Platform, such access must be with the verifiable consent and supervision of a parent or lawful guardian, and the parent or lawful guardian shall be deemed to have provided consent under this Policy on behalf of the child.

We do not knowingly collect personal data from children below the age of thirteen (13). Where we become aware that we have collected personal data from a child below the age of thirteen (13) without the verifiable consent of a parent or lawful guardian, we will take steps to delete such personal data as soon as reasonably practicable. If you are a parent or lawful guardian and believe that we have collected personal data from your child without such consent, please contact us through the channels in Section 17.

Additional protections apply to processing of children’s personal data under the DPDP Act and other applicable laws, and we will comply with such protections to the extent applicable, including by refraining from behavioural tracking, targeted advertising, and processing likely to cause detrimental effect on the well-being of a child, in each case as required by law.

11. Automated Decision-Making and Artificial Intelligence

The Platform uses artificial intelligence systems, large language models, recommendation engines, and automated ranking models to generate course suggestions, study abroad insights, and advisory responses. Such outputs are generated probabilistically and may be incomplete, inaccurate, outdated, biased, or unsuitable for your circumstances.

Outputs surfaced to you on the Platform are informational in nature and do not, by themselves, produce legal effects concerning you or similarly significantly affect you. Decisions concerning admissions, visas, scholarships, fees, financial aid, and other outcomes are made by Course Providers, Colleges, universities, immigration authorities, scholarship bodies, lenders, and other third parties exercising their independent authority, and we are not responsible for such decisions.

Where applicable law confers rights in relation to automated decision-making (including under GDPR), such rights are addressed in Section 19. To the extent any such rights apply, you may contact us through the channels in Section 17.

12. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixels, software development kits (SDKs), and similar technologies (collectively, “Cookies”) to operate the Platform, recognise you across sessions, remember your preferences, analyse usage, and, where permitted, deliver marketing communications. Some Cookies are strictly necessary for the operation of the Platform, while others are used for analytics, performance, or marketing purposes.

Where required by applicable law, we will obtain your consent before placing or accessing non-essential Cookies on your device, and you may withdraw such consent at any time through the cookie-management mechanism made available on the Platform or through your browser or device settings. Disabling Cookies may impair the functionality of the Platform.

13. Marketing Communications

Where permitted by applicable law, we may send you marketing or promotional communications by email, SMS, push notification, or other electronic means, in relation to the Platform and other educational services we believe may be of interest to you. You may opt out of marketing communications at any time by following the unsubscribe instructions in such communications, by adjusting your account settings (where available), or by contacting us through the channels in Section 17. Opting out of marketing communications does not affect service-related communications, which we may continue to send for the purposes of operating the Platform.

14. Third-Party Links and Services

The Platform may contain links to, or integrations with, websites, applications, and services operated by third parties, including Course Providers, Education Partners, Colleges, universities, scholarship programs, loan providers, coaching partners, immigration consultants, and other external services. We do not control, and are not responsible for, the privacy practices of such third parties. Your interactions with such third parties are governed by the privacy notices and terms of those third parties, and you are encouraged to review them before providing personal data.

15. Changes to this Policy

We may update this Policy from time to time, in our sole discretion, to reflect changes to our practices, the Platform, applicable law, or for other operational, legal, or regulatory reasons. The Effective Date at the top of this Policy indicates the date from which the current version applies. Material changes will be notified through the Platform or by other reasonable means. Your continued use of the Platform after the effective date of such changes constitutes your acceptance of the updated Policy, except to the extent applicable law requires fresh consent, in which case we will obtain such consent in the manner required.

16. Survival and Conflicts

Provisions of this Policy that by their nature should survive termination of your relationship with us, including provisions relating to retention, security, disclosure to acquirers and successors, and limitation of liability and indemnification (as set out in our Terms of Service), shall survive.

In the event of any conflict or inconsistency between this Policy and our Terms of Service, the provision more protective of our rights and more clearly applicable to the matter in dispute shall prevail, except to the extent applicable law requires otherwise.

17. Grievance Officer and Contact

In compliance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, the Grievance Officer and primary contact for data-protection matters is:

Name: Pawandeep Singh Waraich
Designation: Grievance Officer
Company: Urban Educational Consultants Private Limited
Address: 48, Sohal Patti, Bajakhana Road, Barnala, Punjab, India – 148101
Email: [email protected]
Phone: +91 76961 99334
Working hours: Monday to Friday, 10:00 to 17:00 IST, excluding public holidays

For matters relating to processing by FindMyCourse Ltd under UK or EU law, you may also contact FindMyCourse Ltd at the details set out in Section 1.

We will acknowledge grievances within twenty-four (24) hours and resolve them within fifteen (15) days of receipt, in accordance with applicable law. To exercise data-principal or data-subject rights, please send a written request through the email channel above, identifying the right you wish to exercise and providing such information as may reasonably be required to verify your identity.

18. India-Specific Supplement (DPDP Act)

This Section 18 applies to data principals located in, or whose personal data is processed in connection with, the offering of goods or services within the territory of India, in addition to the other provisions of this Policy.

Capacity

We process personal data as a Data Fiduciary under the DPDP Act. Where we process personal data on behalf of another person under contract, we may act as a Data Processor for that person.

Notice

This Policy, together with any consent notice presented to you on the Platform, constitutes the notice required under Section 5 of the DPDP Act. By providing your personal data and continuing to use the Platform, you confirm that the notice has been provided to you in a clear and plain manner, and you provide your consent to the processing described in this Policy, except where another lawful basis applies.

Rights of Data Principals

Subject to the DPDP Act, you have the right to:

Obtain a summary of personal data being processed and the processing activities undertaken in respect of such personal data;
Obtain the identities of all data fiduciaries and data processors with whom your personal data has been shared, along with a description of the personal data so shared;
Request correction, completion, updating, and erasure of personal data;
Nominate any other individual to exercise the rights of the data principal in the event of death or incapacity;
Readily available means of grievance redressal in respect of any act or omission regarding the performance of obligations in relation to your personal data.

Withdrawal of Consent

Where processing is based on consent, you may withdraw such consent at any time by contacting the Grievance Officer in Section 17 or through any consent-management mechanism made available on the Platform. The withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal, and may result in our ceasing to provide some or all of the Platform to you.

Children’s Data

Personal data of any individual below the age of eighteen (18) will be processed only with the verifiable consent of a parent or lawful guardian, and we will not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in each case as required by the DPDP Act.

Complaints to the Data Protection Board

If you are unsatisfied with our response to a grievance, you may complain to the Data Protection Board of India in accordance with the DPDP Act.

19. EU/UK-Specific Supplement (GDPR and UK GDPR)

This Section 19 applies to data subjects located in the European Economic Area, the United Kingdom, or Switzerland, in addition to the other provisions of this Policy.

Capacity

For personal data processed through the Platform in connection with its operation by FindMyCourse Ltd, FindMyCourse Ltd acts as a Data Controller under the UK GDPR (and, where applicable, the EU GDPR). Urban Educational Consultants Private Limited acts as a processor in respect of that operation, and as a controller for the processing activities it determines. Where either entity processes personal data on behalf of another person under contract, it may act as a Data Processor for that person.

Legal Bases

We rely on the following legal bases under Article 6(1) of the GDPR and UK GDPR, as applicable: (a) consent; (b) performance of a contract with you; (c) compliance with a legal obligation; and (d) our legitimate interests, including operating, securing, and improving the Platform, training and improving our AI models, conducting analytics, preventing fraud and abuse, and engaging in corporate transactions, in each case where not overridden by your interests or fundamental rights.

Rights of Data Subjects

Subject to the GDPR and UK GDPR, you have the right to: (a) access; (b) rectification; (c) erasure; (d) restriction of processing; (e) data portability; (f) objection to processing, including objection to processing based on legitimate interests and to direct marketing; (g) not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, except as permitted by applicable law; and (h) withdrawal of consent where processing is based on consent.

International Transfers

Where we transfer personal data outside the European Economic Area or the United Kingdom, we will implement appropriate safeguards as required by the GDPR and UK GDPR, which may include standard contractual clauses, the UK International Data Transfer Agreement or Addendum, adequacy decisions, or other lawful transfer mechanisms. You may request a copy of such safeguards by contacting us through the channels in Section 17.

Supervisory Authority

You have the right to lodge a complaint with the data-protection supervisory authority in your country of residence, place of work, or place of the alleged infringement. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO).

UK Establishment and Contact

FindMyCourse Ltd is established in the United Kingdom and serves as the UK contact point for matters under the UK GDPR. Requests under the UK GDPR and EU GDPR may be addressed to FindMyCourse Ltd at the contact details in Section 1, or to the Grievance Officer in Section 17. Where designation of an Article 27 representative is required for any jurisdiction, such details will be made available on the Platform.

20. California-Specific Supplement (CCPA/CPRA)

This Section 20 applies to consumers who are residents of the State of California, in addition to the other provisions of this Policy.

Capacity

We act as a Business under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). Capitalised terms used in this Section 20 and not otherwise defined have the meanings given to them in the CCPA.

Categories of Personal Information

In the preceding twelve (12) months, we have collected the following categories of Personal Information, as defined under the CCPA: identifiers; customer records (Cal. Civ. Code § 1798.80(e)); commercial information; internet or other electronic network activity information; geolocation data; professional or employment-related information; education information; inferences drawn from any of the foregoing; and Sensitive Personal Information limited to account log-in credentials. The sources, purposes, and categories of recipients in respect of each category are set out in Sections 2, 3, and 5 of this Policy.

Sale and Sharing

We do not sell Personal Information in exchange for monetary consideration. We may, however, “share” Personal Information for cross-context behavioural advertising, or be deemed to “sell” Personal Information under the broad CCPA definitions, when we make Personal Information available to certain advertising or analytics service providers. Where this occurs, you have the right to opt out of such Sale or Sharing through the mechanism made available on the Platform (including the “Do Not Sell or Share My Personal Information” link or equivalent).

Sensitive Personal Information

We do not use or disclose Sensitive Personal Information for purposes other than those permitted under Cal. Civ. Code § 1798.121, and accordingly do not provide a separate “Limit the Use of My Sensitive Personal Information” link.

Rights of California Consumers

Subject to the CCPA, you have the right to: (a) know the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties with whom we share Personal Information; (b) request deletion of Personal Information; (c) request correction of inaccurate Personal Information; (d) opt out of Sale or Sharing of Personal Information; (e) limit the use and disclosure of Sensitive Personal Information (subject to the qualification above); and (f) not be subject to discrimination for exercising any of the foregoing rights.

How to Exercise Rights

California consumers may exercise rights by contacting the Grievance Officer in Section 17 or through any rights-management mechanism made available on the Platform. We may require you to verify your identity before acting on a request, and we may decline or limit a request to the extent permitted by the CCPA. You may also designate an authorised agent to make a request on your behalf, subject to verification of the agent’s authority.

Retention

We retain each category of Personal Information for the period described in Section 8 of this Policy, in each case for no longer than is reasonably necessary for the purposes for which it was collected, in accordance with the CCPA.

Notice of Financial Incentive

We do not currently offer financial incentives in exchange for the collection, retention, sale, or sharing of Personal Information. If we introduce such incentives in the future, we will provide a notice of financial incentive in accordance with the CCPA.