Privacy Policy

This outlines the data we collect and how we keep it safe.

This policy explains what personal data we collect when you use FreeForStudents (www.freeforstudents.org), why we collect it, and your rights over it.

The data controller is Slateform Ltd, registered in England and Wales (No. 16427818), 3rd Floor, Old Stock Exchange, St Nicholas Street, Bristol, BS1 1TG. We process your data in line with the UK Data Protection Act and UK/EU GDPR. Questions? Email hello@freeforstudents.org.

We only process your data where we have a legal basis to do so: your consent, a contract with you, our legitimate interests (always balanced against yours), or a legal obligation. The relevant basis is noted against each activity below.

1. Data we collect

  • Log and hosting data: when you browse the site, we collect technical data including your IP address, date and time of access, pages accessed, browser, session ID, and referrer URL. Our hosting providers (DigitalOcean, Cloudflare, and Vercel) process this data on our behalf. Legal basis: legitimate interest.
  • Google Fonts: displaying fonts requires a connection to Google's servers in the USA, which shares your IP address and the referring site with Google. Legal basis: legitimate interest.
  • Contacting us: we store the details you provide (name, email, phone number) solely to handle your enquiry, then delete them unless we're legally required to keep them. Legal bases: contract and legitimate interest.
  • Forms and surveys: data you submit is processed via Tally and/or Survicate. Legal bases: consent and legitimate interest.
  • Student deals: redeeming a deal redirects you to the advertising partner, sharing your IP address and technical data. What the partner collects after that is covered by their privacy policy, not ours.

2. Cookies

We use essential cookies (needed for the site to work) and, with your consent, non-essential cookies for analytics and advertising. When you first visit, you can accept all cookies, choose categories, or refuse everything except essential cookies - and you can change your choices or withdraw consent at any time. Our consent tool records your choice along with your IP address, browser, device, and time of visit.

  • Google Analytics analyses how the site is used (anonymised IP address, pages visited, referrer, time on site, visit frequency). Data is stored by Google, including in the USA. Basis: consent. Opt out.
  • Hotjar helps us understand usage patterns (anonymised IP, device and browser information, country-level location) in a pseudonymised profile - it isn't used to identify you. Basis: consent. Opt out.
  • Google AdSense uses cookies and web beacons to serve and measure ads. Data (including your IP address) is stored by Google in the USA and may be shared with third parties where legally required or processing on Google's behalf. Basis: legitimate interest in advertising. Manage ad settings.

Advertising cookies set by our partners may be used to profile your interests and show you ads on other sites. You can opt out of behavioural advertising generally at youronlinechoices.com or optout.networkadvertising.org, and delete or block cookies in your browser settings. Third-party sites we link to set their own cookies, which this policy doesn't cover.

3. Marketing and analysis

Where you've consented (explicitly, or implied through your relationship with us), we may send you marketing through the channels you've agreed to. Every message includes an unsubscribe option. We also analyse enquiries, transactions, and browsing behaviour for internal business evaluation and market research, using summarised or anonymised data wherever possible and never sharing it externally. Legal basis: legitimate interest.

4. Social media

If you interact with us on social media, we and the platform are joint controllers of your data under a joint controller agreement. Legal bases: legitimate interest, consent, or steps towards a contract.

5. Storage, security, and sharing

  • Retention: we keep your data for as long as our relationship requires, stored securely with our cloud hosting provider, plus statutory retention periods of typically 2 to 6 years.
  • Security: we use SSL/TLS encryption and technical and organisational measures like need-to-know access. No internet transmission is completely secure, but if we learn of a breach we'll notify affected individuals as soon as possible.
  • Sharing: we only share your data where necessary to provide our services, where you've consented, where legally required (e.g. a court order or legal investigation), or to meet our legitimate interests. Where data is transferred internationally, we have contractual safeguards in place.
  • What we don't do: we don't request data from children, don't use automated decision-making or profiling, and don't sell your personal data.

6. Your rights

You have the right to access, correct, and erase your data; to data portability; to object to processing; to withdraw consent at any time (without affecting processing already carried out); and not to be subject to solely automated decisions. To exercise any of these, just contact us - we'll respond as soon as possible, and if we need longer than 30 days or can't fulfil a request, we'll explain why.

You can also complain to the Information Commissioner's Office (ico.org.uk), Wycliffe House, Water Ln, Wilmslow SK9 5AF - though we'd appreciate the chance to address your concerns first.

7. Changes

We may update this policy from time to time, for example to reflect changes in the law or our practices. Check back here for the latest version, or email hello@freeforstudents.org with any questions.