Privacy Policy

1. Data we collect

• Log and hosting data: when you browse the site, we collect technical data including your IP address, date and time of access, pages accessed, browser, session ID, and referrer URL. Our cloud hosting providers (such as Vercel, Railway, Upstash, and Amazon Web Services, among others we may use from time to time) process this data on our behalf, which may involve processing in the USA or other countries under appropriate contractual safeguards. Legal basis: legitimate interest.
• Contacting us: we store the details you provide (name, email, phone number) solely to handle your enquiry, then delete them unless we're legally required to keep them. Legal bases: contract and legitimate interest.
• Forms and surveys: data you submit is processed via Tally. Legal bases: consent and legitimate interest.
• Student deals: redeeming a deal redirects you to the advertising partner, sharing your IP address and technical data. We and our affiliate networks may use tracking links, parameters, or cookies to attribute your click and any resulting purchases or other actions (such as sign-ups or bookings) so partners can pay us commission. What the partner collects after that is covered by their privacy policy, not ours.

2. Cookies

We use essential cookies to remember your privacy choices. Depending on your country, optional services are either off until you consent or on until you opt out. They stay off if we cannot determine your country. We also turn them off when we receive a Global Privacy Control signal. Your choice is stored in the ffs_consent cookie for six months.

• Google Analytics: this helps us understand how people use the site. It records pages viewed, searches, filters, deal clicks, and referral details. It sets cookies such as _ga, which may last for up to two years. Redirect events are sent through Google's EU endpoint, and we do not add your IP address or browser details to them. We disable advertising features. Google may process data outside the UK or EEA. Legal basis: consent where required; otherwise legitimate interest. Opt out.
• Newsletter form: MailBluster and Google reCAPTCHA may receive your IP address and browser details when the form loads. Where consent is required, the form stays off until you enable it. Submitting the form means you agree to receive our newsletter.

Use Cookie settings in the footer to change your choice at any time. Turning optional services off stops them and removes our known analytics and referral cookies. Sites reached through deal links have their own cookie policies.

3. Marketing and analysis

Where you've explicitly consented, we may send you marketing through the channels you've agreed to. Every message includes an unsubscribe option. We also analyse enquiries, transactions, and browsing behaviour for internal business evaluation and market research, using summarised or anonymised data wherever possible and never sharing it externally. Legal basis: legitimate interest.

4. Newsletter

You can subscribe to our email newsletter through a signup form or an occasional popup on the site. We only ask for your email address, which we use solely to send you the FreeForStudents newsletter. Every email includes an unsubscribe link, and you can withdraw your consent at any time. We will never sell your email address to a third party. Legal basis: consent.

• MailBluster and Amazon Web Services: our newsletter is managed through MailBluster, which stores your email address and sends emails on our behalf using Amazon Web Services (Amazon SES). Your data may be processed in the USA under appropriate contractual safeguards. Legal basis: consent.
• reCAPTCHA: our signup form is protected by Google reCAPTCHA to prevent spam and abuse. This connects to Google's servers and collects device and usage data, which may be processed in the USA, subject to Google's privacy policy and terms. Legal basis: legitimate interest.

5. Social media

If you interact with us on social media, we and the platform are joint controllers of your data under a joint controller agreement. Legal bases: legitimate interest, consent, or steps towards a contract.

6. Storage, security, and sharing

• Retention: we keep your data for as long as our relationship requires, stored securely with our cloud hosting provider, plus statutory retention periods of typically 2 to 6 years. Privacy choices last six months, referral cookies last 30 days, Google Analytics cookies may last two years, and analytics event data is kept for no more than 14 months.
• Security: we use SSL/TLS encryption and technical and organisational measures like need-to-know access. No internet transmission is completely secure, but if we learn of a breach we'll notify affected individuals as soon as possible.
• Sharing: we only share your data where necessary to provide our services, where you've consented, where legally required (e.g. a court order or legal investigation), or to meet our legitimate interests. Where data is transferred internationally, we have contractual safeguards in place.
• What we don't do: we don't request data from children, don't use automated decision-making or profiling, and don't sell your personal data.

7. Your rights

You have the right to access, correct, and erase your data; to data portability; to object to processing; to withdraw consent at any time (without affecting processing already carried out); and not to be subject to solely automated decisions. To exercise any of these, just contact us - we'll respond as soon as possible, and if we need longer than 30 days or can't fulfil a request, we'll explain why.

You can also complain to the Information Commissioner's Office (ico.org.uk), Wycliffe House, Water Ln, Wilmslow SK9 5AF - though we'd appreciate the chance to address your concerns first.

8. Changes

We may update this policy from time to time, for example to reflect changes in the law or our practices. Check back here for the latest version, or email hello@freeforstudents.org with any questions.