Privacy policy

Note for review. This policy describes how the admitAI platform is built and operated. It has not yet been reviewed by a data protection solicitor. Have it checked, confirm the ICO registration number, and remove this notice before publishing.

1. Who we are

admitAI is a software platform operated by 24 IT Solutions Ltd, a company registered in England and Wales, with its registered office in London, United Kingdom. In this policy "we", "us" and "our" mean 24 IT Solutions Ltd.

We provide software to student recruitment agencies. Those agencies use our platform to manage their students' applications to universities. This distinction matters a great deal for how data protection law applies to us, so we set it out in full in the next section.

2. When we are a controller and when we are a processor

We act in two different capacities depending on whose data is involved.

We are the controller for:

Data about the agencies who are our customers, and the individual staff at those agencies who hold accounts with us.
Data about people who contact us, request a demo, or subscribe to anything we send.
Data about visitors to this website.

For that data, we decide why and how it is processed, and this policy governs it directly.

We are a processor for:

Student data. When an agency uses admitAI to manage a student's application, the agency is the controller and we are the processor acting on their documented instructions.

If you are a student whose data an agency holds in admitAI, the agency — not us — is responsible for how your data is used, and you should direct your requests to them in the first instance. We will assist them in responding to you. Our obligations to agencies in this role are set out in our Data Processing Addendum.

3. What we collect

Agency account data (we are controller)

Name, work email address, telephone number, job role and the agency you work for.
Authentication data, including password hashes and session tokens. We never store passwords in readable form.
Billing details, including company name, billing address and VAT number. Card details are handled by our payment provider and never reach our systems.
Usage and audit logs — which features you use, actions taken on student records, IP address, browser and device type, and timestamps.
Support correspondence.

Student data (the agency is controller, we process it)

The categories below are typical of what agencies upload. The precise scope is determined by each agency, not by us.

Identity and contact details: name, date of birth, nationality, passport details, address, email address, phone number.
Academic history: qualifications, transcripts, grades, institutions attended, English language test results.
Immigration information: visa status and history, previous refusals, CAS details, biometric appointment dates, sponsorship details.
Financial evidence: bank statements and sponsor documentation supplied for visa maintenance requirements.
Application data: universities applied to, offers, conditions, deposits, enrolment status.
Communications between the student and their agency across the channels the agency has connected.

Some of this is special category data or criminal offence data under UK GDPR — for example, health information disclosed in a visa context, or details of a prior immigration refusal. Agencies are responsible for ensuring they have an appropriate condition for processing it, and we handle it under the additional safeguards described in section 10.

Website visitor data

Pages visited, referring page, approximate location derived from IP address, browser and device type.
Anything you type into a form on this site and choose to send us.

4. Why we use it

To provide the platform — creating and maintaining accounts, delivering the features agencies subscribe to, and syncing data between the agency workspace and the Student Hub.
To support you — responding to questions, investigating faults, and restoring service after an incident.
To bill you — processing subscription payments and maintaining financial records we are legally required to keep.
To secure the service — detecting unauthorised access, preventing fraud, and maintaining the audit trail agencies rely on for their own compliance obligations.
To improve the product — understanding which features are used and where people get stuck, using aggregated and pseudonymised data wherever it will do the job.
To communicate with you — service announcements, security notices, and, where you have agreed to it, occasional product news.
To meet our legal obligations — including tax, accounting and responding to lawful requests from authorities.

5. Lawful bases

Processing	Lawful basis
Providing the platform to an agency	Performance of a contract
Billing and financial records	Contract, and legal obligation for retention
Security monitoring and audit logging	Legitimate interests — protecting the service and our customers' data
Product analytics and improvement	Legitimate interests — improving a service you use
Service and security notices	Contract, and legitimate interests
Marketing email to prospective customers	Consent, or legitimate interests in a business context under PECR
Non-essential cookies	Consent
Student data processed for an agency	Determined by the agency as controller; we act on their instructions

Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You can ask us for that assessment.

6. AI processing

Parts of the platform use large language models and optical character recognition to generate assessment reports, read uploaded documents, draft messages and score leads. Three commitments apply, and we consider all three to be non-negotiable.

Your data is not used to train models. Not ours, and not any third party's. We use AI providers under enterprise terms that contractually exclude customer content from training.
A human reviews consequential output. No assessment report, recommendation or shortlist reaches a student until an agency counsellor has reviewed and released it. There is no fully automated decision-making that produces legal or similarly significant effects on a student within the meaning of Article 22 UK GDPR.
Only what is needed is sent. We send the minimum data required for the task, and document processing happens without retaining copies at the AI provider beyond the duration of the request.

Our current AI sub-processor is listed on our sub-processors page, which we keep up to date.

We do not sell personal data. We share it only in these circumstances:

Sub-processors who provide infrastructure and services on our behalf, each under a written contract imposing equivalent obligations. The current list is on our sub-processors page.
Services the agency chooses to connect — for example their WhatsApp Business account, email provider, calendar or CRM. This is done on the agency's instruction, and their relationship with those providers is their own.
Universities and application portals, where an agency submits an application through the platform. This is the entire purpose of the service.
Professional advisers — lawyers, accountants and auditors, bound by confidentiality.
Authorities, where we are legally required to disclose. We will notify the affected customer unless legally prohibited from doing so.
An acquirer, in the event of a merger or sale of the business, subject to this policy continuing to apply.

8. International transfers

We host customer data in the United Kingdom and the European Economic Area. Some of our sub-processors operate outside the UK. Where personal data is transferred beyond the UK, we rely on UK adequacy regulations where they exist, and otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Our sub-processors page records the location and transfer mechanism for each.

9. How long we keep data

Data	Retention
Agency account data	Duration of the contract, then 12 months
Student data held for an agency	As instructed by the agency; deleted within 30 days of contract termination unless they ask for it sooner
Uploaded documents	As instructed by the agency; erasure requests actioned within 24 hours
Billing and financial records	7 years, as required by UK tax law
Security and audit logs	12 months
Support correspondence	3 years from last contact
Marketing contact data	Until you unsubscribe, then a suppression record only
Website analytics	14 months

Backups are encrypted and cycle out on a rolling 35-day schedule, so deleted data may persist in backup for up to 35 days before it is overwritten. It is not restored into live systems during that period.

10. How we protect it

Encryption. AES-256 for data at rest, including all uploaded documents. TLS 1.2 or above in transit.
Tenant isolation. Each agency's data sits in its own logically isolated database. There is no shared table another customer could reach.
Access control. Role-based permissions, with counsellors seeing only their assigned caseload. Our own staff access is least-privilege, logged, and granted only where needed to support you.
Audit trail. Every view, upload, release and download is timestamped and retained.
Authentication. Students access the Student Hub through single-use magic links tied to a verified email or phone number. There are no student passwords to be reused or leaked.
Breach response. We maintain an incident response procedure. Where a breach is likely to result in a risk to individuals, we notify the affected agency without undue delay and in any event within 72 hours of becoming aware, so they can meet their own notification obligations.

No system is perfectly secure, and we will not tell you otherwise. What we commit to is proportionate measures, honest disclosure when something goes wrong, and no quiet handling of incidents.

11. Your rights

Under UK GDPR you have the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format, and withdraw consent where consent is the basis we rely on. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects — and as set out in section 6, we do not make them.

If you are an agency user, contact us directly at privacy@admitai.io and we will respond within one month.

If you are a student, contact the agency handling your application — they control your data. If they cannot help, or you cannot reach them, write to us and we will do what we can within our role as processor.

We do not charge for responding, and we will not make you justify the request.

12. Cookies

This website uses only what is necessary to make it work. We do not run advertising trackers, and we do not share visitor data with ad networks.

Type	Purpose	Consent needed
Essential	Session management, security, load balancing, and remembering your cookie choice	No
Analytics	Aggregate page views and navigation paths, so we can see which pages are useful	Yes
Advertising	Not used	—

Within the platform itself, we use only essential cookies. You can clear or block cookies through your browser, though blocking essential ones will stop the platform working.

13. Students under 18

The platform is sold to businesses and is not intended for direct use by children. Agencies do sometimes handle applicants under 18. Where they do, the platform requires a guardian consent record to be on file before any application can be submitted, as part of our compliance monitoring. Responsibility for obtaining that consent rests with the agency as controller.

14. Changes to this policy

We will update this page when our processing changes. For material changes affecting customers, we give at least 30 days' notice by email before they take effect. The version number and effective date at the top of this page always reflect the current text.

15. Contact and complaints

For any privacy question or to exercise a right, write to privacy@admitai.io, or by post to the Data Protection Lead, 24 IT Solutions Ltd, London, United Kingdom.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right, but you are under no obligation to.