PRIVACY POLICY | Oxbridge Gateway

OXBRIDGE GATEWAY LTD — PRIVACY POLICY

Last updated: 16 October 2026

OXBRIDGE GATEWAY LTD (“Oxbridge Gateway”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our websites, use our digital platforms and applications, participate in our educational programmes, use our AI-powered services, purchase our products or services, or otherwise interact with us.

Our services include ASPIREdeck, an education and career intelligence platform, and ASPIRE Personal AI and related products and services, where applicable.

We serve students, parents, educators, schools, universities and other users in different countries. Depending on where you live and how you use our services, different data protection laws may apply.

This policy explains what personal data we process, why we process it, who may receive it, how long we retain it and the rights available to you.

This Privacy Policy should be read alongside any additional privacy notice presented when you register for, or use, a particular product, programme or service.

1. IMPORTANT INFORMATION AND WHO WE ARE

Purpose of this Privacy Policy

This policy applies to personal data processed through our websites, platforms, applications, educational services, AI-powered products, marketing activities and other business operations, unless a separate privacy notice applies.

Children and young people

Our educational services may be used by students aged 13 and above, including children and young people under the age of 18.

We recognise that children and young people require particular protection when their personal data is collected and used. We aim to collect only the personal data reasonably necessary to provide our services and to explain our data practices in clear, age-appropriate language.

Where required by applicable law, we will obtain appropriate parental or guardian authorisation, verify authority where reasonably necessary, and provide appropriate safeguards before collecting or processing a child's personal data.

The age at which a person may independently consent to particular processing, and the circumstances in which parental or guardian involvement is required, depend on the applicable law and the nature of the service.

Parents and guardians should review the relevant product information with their children where appropriate. Any rights a parent or guardian may exercise on a child's behalf will depend on applicable law.

We do not knowingly collect personal data from children in circumstances where doing so would be unlawful.

Data controller

OXBRIDGE GATEWAY LTD is the data controller responsible for personal data processed under this policy, except where another organisation determines the purposes and means of processing or a separate arrangement applies.

Where we provide services to a school, university, organisation or other institutional customer, that organisation may act as the controller for certain processing activities, with Oxbridge Gateway acting as its processor. The applicable contractual arrangements and privacy notices will determine the respective responsibilities.

Contact details

For questions about this policy, requests concerning your personal data or privacy complaints, please contact us using the details below.

Company: OXBRIDGE GATEWAY LTD
Registered office: 60 Tottenham Court Road, Suite 4799a, Fitzrovia, London, W1T 2EW, United Kingdom
Privacy contact: john.au@aspiredeck.com
Company registration number: 12447163

If you are based in the UK, you may also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk. If you are based elsewhere, you may have the right to complain to the relevant local data protection authority.

We welcome the opportunity to address your concerns first, where appropriate.

Changes to this policy

We review this policy periodically and may update it to reflect changes in our services, technology, business practices or legal obligations.

We will publish the updated policy with a revised effective date. Where required by law, we will notify affected users of material changes before they take effect.

Third-party links and services

Our websites and products may link to or integrate with third-party websites, applications, payment providers, AI services or other tools. Those third parties may process personal data under their own privacy policies and terms.

We are not responsible for the privacy practices of independent third parties. We encourage you to review their privacy notices before providing personal data or using their services.

2. THE DATA WE COLLECT ABOUT YOU

Personal data means information relating to an identified or identifiable individual. It does not include information that has been irreversibly anonymised so that the individual can no longer be identified.

Depending on how you interact with us, we may collect the following categories of personal data.

Identity and account data: Name, username, date of birth or age range, account identifiers and other information needed to create or manage an account.

Contact data: Email address, telephone number, postal address and contact details of parents, guardians or institutional representatives where relevant.

Educational and assessment data: Educational interests, subject preferences, academic aspirations, assessment answers, self-reported strengths, learning preferences, interests, goals and responses to educational questionnaires.

Personal development and career data: Career interests, aspirations, skills, competencies, self-reflections, experiences, portfolio entries, interview practice responses and information relating to personal development or future pathways.

AI interaction and experience data: Prompts, questions, responses, feedback, interaction history, learning progress, reasoning or problem-solving activities and other information generated through your use of our AI-powered services, where collected.

Profile and preference data: User preferences, saved activities, settings, feedback, survey responses and information about how you choose to use our services.

Technical and usage data: IP address, device and browser information, operating system, access logs, diagnostic information, session information, service usage and other technical information collected through our websites or applications.

Transaction and payment data: Purchase history, subscription or order details, billing records and transaction references. Payment card or bank details may be processed directly by our payment providers; we will only collect or retain such details where necessary and in accordance with applicable law.

Marketing and communications data: Marketing preferences, consent records, correspondence, enquiries and communication history.

Information provided by third parties: Information supplied by parents, guardians, schools, universities, programme partners or service providers where lawful and relevant to delivering our services.

Personal development profiles and AI-generated insights

Some of our services may use information you provide and your interactions with our services to generate personalised educational, learning, career or personal development insights.

These insights may include inferred preferences, suggested learning approaches, potential areas for development and recommended activities or opportunities. Such information may constitute personal data when it relates to an identifiable individual.

We aim to use these insights to support learning, self-discovery and informed decision-making. They should not be treated as definitive assessments of a person's identity, ability or future prospects.

We do not intentionally request sensitive personal data unless it is necessary for a specific service and there is an appropriate lawful basis and safeguard. Please avoid including sensitive personal information about yourself or others in free-text prompts unless the service specifically requires it.

If you do not provide personal data

Some information is necessary to create an account, provide a requested service, process a transaction or meet a legal obligation. If you do not provide that information, we may be unable to provide the relevant feature or service.

Where providing information is optional, you may choose not to provide it. We will explain any material consequences where appropriate.

3. HOW IS YOUR PERSONAL DATA COLLECTED?

We may collect personal data through the following methods.

Directly from you: When you register for an account, complete an assessment, use a platform or application, submit a form, contact us, participate in a programme, respond to a survey or purchase a product or service.

Through your use of our services: When you use our websites, educational platforms or AI-powered services, we may collect information about your interactions, saved preferences, activities and use of features.

Through automated technologies: We may collect technical and usage information through server logs, cookies, local storage and similar technologies, subject to applicable law and your preferences where consent is required.

From parents, guardians and institutional partners: We may receive information from a parent, guardian, school, university or programme partner when they register you, facilitate your participation or provide information necessary for a service.

From service providers and other third parties: We may receive information from payment providers, hosting providers, authentication services and other partners where relevant to our operations and permitted by law.

Where we obtain personal data from a source other than you, we will provide the required privacy information in accordance with applicable law.

4. HOW WE USE YOUR PERSONAL DATA

We process personal data only where we have a lawful basis under applicable data protection law and for specified, legitimate purposes.

Depending on the circumstances, our lawful bases may include:

Performance of a contract: To provide a service or take steps requested by you before entering into a contract.

Legitimate interests: To operate, secure and improve our services, where our interests are not overridden by your rights and interests.

Consent: Where you have given valid consent, including where consent is required for particular cookies, marketing or other processing activities.

Legal obligations: To comply with applicable legal, regulatory, accounting and reporting requirements.

Other lawful grounds: Where recognised by the data protection law applicable to the processing.

The appropriate lawful basis will depend on the specific processing activity. Where we rely on legitimate interests, we consider the potential effects on individuals and implement appropriate safeguards.

Purposes for which we use personal data

We may use personal data to:

Create and manage user accounts, authenticate users and provide requested services.
Deliver educational, learning, university preparation, career development and personal development features.
Administer assessments and use relevant responses to generate personalised insights, recommendations and suggested activities.
Maintain a user's preferences and, where the service supports it, build and update a persistent personal profile to improve the relevance of future interactions.
Operate AI-powered features, generate responses, provide personalised assistance and maintain the functionality and security of our products.
Monitor service performance, diagnose technical problems, prevent fraud, investigate misuse and protect our users and systems.
Respond to enquiries, provide customer support and communicate service updates.
Process payments, maintain business records and fulfil contractual obligations.
Conduct research, evaluate educational outcomes and improve our products using personal data where lawful, or using appropriately anonymised or aggregated information where possible.
Send marketing communications where permitted by law and consistent with your preferences and consent requirements.
Comply with legal obligations and establish, exercise or defend legal claims.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Personalisation and profiling

Certain services may analyse information you provide, assessment results and your interactions to personalise content, identify relevant opportunities and support your educational or career planning.

Where this involves profiling under applicable law, we will handle the processing in accordance with the relevant legal requirements.

We will not use profiling to make solely automated decisions producing legal or similarly significant effects on you unless permitted by applicable law and subject to the required safeguards.

AI services and model improvement

Our services may use AI models to generate educational insights, responses, summaries, recommendations or other outputs.

Where AI processing involves personal data, we will process that data only for purposes and on lawful grounds consistent with this policy and any additional notice provided to you.

We will not assume that permission to use a service automatically permits every form of AI training or model improvement. Where personal data is to be used for a materially different purpose, including training third-party or general-purpose AI models, we will assess the applicable legal requirements and obtain consent or provide additional information where required.

Marketing

We may send information about our own products, services, events and educational programmes where permitted by applicable law.

We will obtain consent where required and provide an effective means to unsubscribe or withdraw consent. We will not share personal data with third parties for their own direct marketing without the necessary permission or other lawful authority.

Changes of purpose

If we intend to use personal data for a new purpose that is not compatible with the original purpose, we will assess whether that use is lawful and provide additional information or obtain consent where required.

We will not rely on this provision to override a legal restriction or a valid consent requirement.

5. AI PROCESSING, LOCAL DEVICES AND EXTERNAL SERVICE PROVIDERS

Our products may use a combination of on-device processing, locally stored information, our own servers and third-party services. The exact processing arrangements depend on the product, device, configuration and features being used.

On-device processing

Where a product is designed to process information locally on your device, certain prompts, interactions, preferences or personal profile information may be processed and stored on that device rather than transmitted to our servers.

Local processing can reduce the amount of personal data that needs to be transmitted externally. However, it does not mean that all information associated with the product is necessarily stored locally or that no information is ever transmitted.

For example, account registration, software updates, optional synchronisation, diagnostics, technical support, online features or other connected functionality may involve external processing.

Personal profiles and learning interactions

Some products may maintain a personal profile or record of interactions to provide continuity and more relevant assistance over time.

Where supported, this information may include assessment responses, preferences, learning goals, activities, feedback and information derived from previous interactions.

The information collected, where it is stored and how it can be deleted or exported will depend on the product's actual features and settings.

Cloud-based AI and third-party AI providers

Some features may require information to be sent to a third-party AI or other technology provider for processing.

Where this occurs, the information transmitted may include prompts, relevant context, interaction content or other data necessary to deliver the requested feature. We will take reasonable steps to minimise the personal data shared and will use appropriate contractual and technical safeguards.

Third-party providers may process information in accordance with their contractual arrangements with us and applicable law. Their involvement does not automatically mean they may use your personal data to train their own general-purpose models.

Where a third-party provider processes personal data on our behalf, we will require appropriate data protection terms. Where a provider processes data as an independent controller, its own privacy notice may also apply.

Your choices

Depending on the product, you may be able to manage stored information, delete local records, change settings or disable certain connected features.

Deleting information from a device may not delete copies previously transmitted to our servers or third-party providers. Similarly, deleting an online account may not automatically remove every locally stored record. We will explain relevant deletion procedures in the product documentation where applicable.

We will not describe a product as entirely local, offline or independent of cloud services unless its actual technical operation supports that description.

6. DISCLOSURES OF YOUR PERSONAL DATA

We may disclose personal data to the following categories of recipients where necessary, lawful and consistent with this policy:

Technology and infrastructure providers: Providers of hosting, cloud infrastructure, databases, storage, cybersecurity, analytics, software maintenance and technical support.

AI and technology providers: Providers of AI models, APIs, inference services and related tools where required to deliver particular features.

Payment and administrative providers: Payment processors, accountants, auditors, insurers and professional advisers.

Educational and programme partners: Schools, universities, parents, guardians or programme partners where necessary to provide a requested service, where authorised or where otherwise permitted by law.

Regulators and public authorities: Authorities, courts, law enforcement agencies or other parties where disclosure is legally required or necessary to protect rights, safety or security.

Business transaction parties: Potential or actual purchasers, investors, successors or other parties involved in a merger, restructuring, financing, acquisition or transfer of all or part of our business, subject to appropriate safeguards and applicable law.

We seek to limit disclosure to information reasonably necessary for the relevant purpose. Where a third party processes personal data on our behalf, we require appropriate confidentiality, security and data protection obligations.

We do not sell personal data as a commercial data-broker product. We may use service providers and disclose information for the purposes described in this policy, subject to applicable law.

7. INTERNATIONAL TRANSFERS

Oxbridge Gateway serves users in multiple countries and may use technology providers or other service providers located in different jurisdictions.

As a result, personal data may be accessed, stored or processed outside the country in which you reside, including where our service providers operate or maintain their infrastructure.

Where applicable data protection law restricts international transfers, we will implement an appropriate transfer mechanism and safeguards, such as an adequacy decision, approved contractual clauses or another legally recognised mechanism.

You may contact us for further information about relevant international transfers and the safeguards applicable to them, subject to legal restrictions.

8. DATA SECURITY

We implement technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.

Depending on the service and the nature of the information, these measures may include access controls, authentication, encryption, secure development practices, system monitoring, data minimisation, staff confidentiality obligations and appropriate oversight of service providers.

Access to personal data is limited to individuals and service providers who need it for authorised purposes.

No system, device, network or method of electronic storage or transmission is completely secure. We cannot guarantee absolute security, but we work to maintain appropriate safeguards and address identified risks.

We maintain procedures for handling suspected personal data breaches and will notify affected individuals and relevant authorities where required by applicable law.

9. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining accounts, meeting legal obligations, resolving disputes and establishing or defending legal claims.

Retention periods vary according to the type of information, the nature of the service and applicable legal requirements.

When determining retention periods, we consider the amount and sensitivity of the data, the potential risks of unauthorised use or disclosure, the purposes of processing and whether those purposes can be achieved by other means.

Where appropriate, we may delete, aggregate or irreversibly anonymise personal data when it is no longer needed in an identifiable form.

Information stored locally on a user's device may remain there until it is deleted by the user, removed through a product feature or otherwise cleared. Information previously synchronised, transmitted to our servers or processed by third parties may be subject to separate retention and deletion procedures.

Backups may retain information for a limited period after deletion from active systems, subject to technical constraints, security requirements and applicable law.

You may contact us to request deletion of personal data. We will consider the request under the applicable legal requirements and explain any relevant limitations.

10. YOUR PRIVACY RIGHTS

Depending on your location and the applicable data protection law, you may have the right to:

Request access to personal data we hold about you.

Request correction of inaccurate or incomplete personal data.

Request deletion of personal data in certain circumstances.

Request restriction of processing in certain circumstances.

Object to processing based on legitimate interests or to direct marketing.

Request a copy of certain personal data in a portable format or its transfer to another organisation where the relevant legal conditions apply.

Withdraw consent where processing is based on consent.

Complain to the relevant data protection authority.

Exercise additional rights available under the law applicable to you.

These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.

How to exercise your rights

To submit a request, contact us using the privacy contact details in Section 1. Please describe your request and identify the service or account concerned.

We may request reasonable information to verify your identity or authority to act on another person's behalf. We will not request more information than is reasonably necessary for that purpose.

We will respond within the time limits prescribed by applicable law. In certain circumstances, we may extend the response period or refuse a request where legally permitted, in which case we will explain the applicable reasons.

We generally do not charge a fee for handling legitimate requests unless applicable law permits a reasonable fee or refusal in exceptional circumstances.

Children and requests made by parents or guardians

Where a user is a child, requests made by a parent or guardian will be handled in accordance with applicable law, the child's rights and interests, and any relevant verification requirements.

We may need to establish the requester's identity and authority before disclosing or changing a child's personal data.

Marketing preferences

You may unsubscribe from marketing emails using the unsubscribe mechanism provided or contact us directly. Withdrawing marketing consent will not affect the lawfulness of processing that took place before withdrawal.

Service-related communications necessary to operate an account or provide a requested service may continue.

Cookies and similar technologies

Our websites may use cookies and similar technologies to maintain sessions, remember preferences, support security, understand website usage and improve performance.

Some technologies are necessary for the operation of a website. Others, including certain analytics or advertising technologies, may require your consent under applicable law.

Where consent is required, we will provide an appropriate mechanism for you to make and change your choices. You may also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

Our use of local storage within an application may serve a different purpose from website cookies. The relevant product documentation or privacy notice will explain how locally stored information is used where necessary.

For details of the specific technologies used, their purposes and any relevant third parties, please refer to our Cookie Policy or the cookie settings presented on our website.

11. GLOSSARY

GENERAL

Personal data: Information relating to an identified or identifiable individual, as defined under the applicable data protection law.

Data controller: The organisation that determines the purposes and means of processing personal data.

Data processor: An organisation that processes personal data on behalf of a controller under the applicable arrangements.

Consent: A freely given, specific, informed and unambiguous indication of agreement to processing where consent is the applicable lawful basis. Additional requirements may apply when consent concerns children or special-category data.

Contractual necessity: Processing that is objectively necessary to perform a contract with an individual or take steps requested by that individual before entering into a contract.

Legitimate interests: Processing necessary for a legitimate interest pursued by us or a third party, provided that the individual's rights and interests do not override that interest. We assess the necessity of the processing and its potential impact on individuals.

Legal obligation: Processing necessary to comply with a legal obligation applicable to us.

Profiling: Automated processing of personal data used to evaluate or analyse aspects of an individual, such as preferences, interests, behaviour or likely future choices, as defined by applicable law.

Anonymised data: Information processed so that an individual is no longer identifiable and cannot reasonably be re-identified using the means available. Pseudonymised data remains personal data where an individual can still be identified using additional information.

International transfer: A transfer or other disclosure of personal data to a recipient in another jurisdiction where applicable data protection law imposes requirements or restrictions on that transfer.

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

THIRD PARTIES

External Third Parties

Service providers acting as processors who provide IT and system administration services.
Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.

YOUR LEGAL RIGHTS

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

If you want us to establish the data's accuracy.
Where our use of the data is unlawful but you do not want us to erase it.
Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.