Privacy Policy
UniPrepVisa
We are committed to protecting your personal data in full compliance with the UK GDPR and EU GDPR. This Privacy Policy explains what data we collect, why we collect it, and your rights. It forms part of our Terms & Conditions.
1. Who We Are (Data Controller)
UniPrepVisa is the Data Controller responsible for your personal data. Contact us at support@uniprepvisa.com for any privacy-related questions.
2. What Data We Collect
We collect the following categories of personal data:
- Registration data: full name (as on passport), email address, telephone number, country of origin
- Interview content: video/audio recordings, text transcripts, and AI-generated evaluation feedback
- Payment metadata: Paystack transaction references, purchase type, credit amounts — we never store card/bank details (processed solely by Paystack)
- Usage data: session timestamps, interview type, session status, band scores, credit balance
- Technical data: IP address (for country detection only, not stored persistently), browser type (standard server logs)
3. Why We Process Your Data (Legal Bases)
We process your personal data under the following legal bases (UK/EU GDPR Article 6):
Contractual Necessity (Art. 6(1)(b))
To create your account, process credits, deliver interview sessions, and generate evaluation reports. Without this processing, we cannot provide our service.
Legitimate Interests (Art. 6(1)(f))
To maintain platform security, prevent fraud, enforce anti-collusion measures, and send service-critical communications (e.g. payment confirmation).
Consent (Art. 6(1)(a))
For any optional marketing communications. You may withdraw this consent at any time.
5. Data Retention & Record Deletion
Operational Record Deletion — 21 Calendar Days
All operational user and student records in our possession — including account data, interview recordings, transcripts, and AI evaluation reports — will be permanently deleted or securely anonymised within 21 calendar days following service expiration or formal account closure, whichever is sooner.
- Account data: permanently deleted or anonymised within 21 calendar days of account closure or deactivation
- Interview recordings, transcripts, and AI feedback: permanently deleted within 21 calendar days of session completion and service expiry
- Thorough Assessment reports: permanently deleted within 21 calendar days of the 21-day report access window expiry
- No backups or archived copies of operational user or student records are guaranteed to be retained beyond the 21-calendar-day window
Statutory Financial Records — 6-Year Retention (CAMA & FIRS)
Transaction logs, payment metadata, Paystack transaction references, credit ledger entries, and all associated financial records are explicitly exempt from the 21-day operational deletion rule. These records are retained for a minimum of 6 years to comply with mandatory Nigerian corporate, tax, and anti-fraud regulations under the Companies and Allied Matters Act (CAMA) and the Federal Inland Revenue Service (FIRS) requirements. This statutory retention obligation overrides any erasure request with respect to financial transaction records.
Once operational records are deleted, they may not be recoverable. If you require a copy of your data before deletion, please submit a Subject Access Request to support@uniprepvisa.com prior to account closure.
6. Your Rights Under GDPR
Under the UK GDPR and EU GDPR, you have the right to:
- Access: request a copy of all personal data we hold about you
- Rectification: request correction of inaccurate data
- Erasure ("right to be forgotten"): request deletion of your account and associated data
- Restriction: request that we limit processing in certain circumstances
- Data portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, email support@uniprepvisa.com. We will respond within 30 calendar days. You also have the right to complain to the ICO at ico.org.uk.
7. Security
- All data in transit is encrypted using TLS 1.3
- Passwords are hashed using Argon2id — we never store plaintext passwords
- Database access is restricted to authenticated backend services only
- Payment card data is never transmitted to or stored on our servers — Paystack handles this entirely
- Session tokens are cryptographically random and expire after inactivity
9. International Data Transfers
Some service providers (e.g. Google Gemini API) may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) and the ICO’s International Data Transfer Agreement (IDTA).
10. Contact & Complaints
We will acknowledge your request within 3 business days and respond fully within 30 calendar days.
GDPR Compliant · UK & EU Data Protection
Last updated: August 2026
UniPrepVisa · All rights reserved.