Privacy policy

1. Who collects your personal information?

Applicaa is committed to protecting the privacy of third parties (including its customers and all visitors to the website applicaa.com (the “Website”)) and all other affiliated subdomains.

Our privacy policy applies to the personal information we collect if you visit our websites or use our services.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

We endeavour to ensure that all information from which you can be identified (“Personal Information”) provided to, or otherwise obtained by are handled in accordance with the UK Data Protection Act 2018 and from 25 May 2018 the EU General Data Protection Regulation (which will replace the Data Protection Act 1998) and all similar or related legislation (the “Data Protection Legislation” or “DPA”). You can be assured that your Personal Information will only be used by Applicaa in accordance with this Policy.

By visiting and/or contacting us through the Website (or otherwise engaging with us), you acknowledge that we may collect, use, process and transfer your Personal Information as set out in this Policy. Applicaa reserves the right to change this Policy from time to time and you should therefore check this page frequently to ensure that you are happy with any changes.

In this Policy, “Applicaa”, “we”, “us” and “our”, refer to Applicaa Limited, registered in [England & Wales] with registered office 2 Wyevale Business Park, King’s Acre, Hereford, Herefordshire, United Kingdom, HR4 7BS. Our company registration number is 08620380.

“The provider” may refer to either your current or prospective school, college, or training provider or the university, college, conservative, or training provider you have applied to.

If you have any questions about this policy or our use of personal data, please contact info@applicaa.com.

For the purposes of the Data Protection Legislation, we are deemed to be the “data controller” in respect of any Personal Information that you provide to us or that we otherwise obtain about you. Applicaa is registered with the UK Information Commissioner’s Office with registration number ZA146992. The registered office is 2 Wyevale Business Park, King’s Acre, Hereford, Herefordshire, United Kingdom, HR4 7BS.

If you have any questions, please feel free to contact us by email at: info@applicaa.com. Alternatively, you may call our team on 0204 538 1630, Monday to Friday: 9 am to 5 pm.

2. How do we collect it?

Applicaa Ltd collects your data through our websites (www.applicaa.com and/or www.applicaaone.com) and any Applicaa product (customer system).

3. What personal information do we collect?

a) Applicaa client & prospect data: we collect personal information about you (such as your name, address, email address, school, or telephone number) when you give this to us as part of becoming a customer, registering for any Applicaa product, signing up to our newsletters, completing a website form, or making a sales or support enquiry.

When you subscribe to any of our marketing or communications, you indicate that you have a preference to receive these communications. We store your preferences on our CRM and give you the option to amend these at any time.

As part of using our websites and marketing, we may also store information about how you use our site, for example, the pages viewed, time spent on each page, emails read, etc in order to be able to take steps to improve your digital experience. These behaviours including IP addresses are captured within Google Analytics, Power BI, and other similar tools. You can read more about this in our website cookie policy.

b) Applicaa Products (customer system): includes staff, parents, and pupils.

Schools collect admissions data. The data schools collect is dependent on the questions schools ask as part of their application form in any Applicaa product’s system and the answers the parents/applicants provide.

For example: full names, date of birth, telephone numbers, address, ethnicity, religion, home language, first language, residency, nationality, welfare and medical conditions, predicted grades, consent to school policies, and attendance records. Contacts (parent/career/guardians) of prospective students: title, relationship to the student, full names, telephone numbers, address, parental responsibility.

School staff: full name. And other information to help in the admissions process.

4. How do Schools use your personal information?

When Schools use Applicaa platforms to collect any data on applicants/students, in this instance Schools are acting as Data Controllers. Schools use data to meet business needs relating to school admissions & enrolment.

Safeguarding: It is important for the school to collect data from the students, previous schools, and parents. This data helps schools to know and understand the needs of their ‘incoming’ students. It helps them to better prepare and plan relevant provisions for the pupils. For example, questions collected concerning student welfare e.g. Medical Conditions and Learning Needs enable schools to install the relevant provision to support the student.

Only Schools and Post16 Providers who are DfE approved providers are able to access and use Applicaa products and services. For safeguarding purposes, Applicaa checks to ensure all Providers using Applicaa must have valid DfE and URN number. Providers seeking to gain access to Applicaa Products and Services, without either of these will be denied access.

5. How do we use your personal information?

Customers and Website Visitors

We may use your personal information following a:

Customer visit - whereby we may contact you regarding items discussed or similar products and solutions you have expressed an interest in.

Event attendance or registration (including webinars) in order to contact you about the event itself and/or possibly future events and/or to obtain feedback. When registering for an event we may ask you for special category data, such as dietary requirements, in order to meet your needs at the event(s).

General enquiry or feedback where you may have contacted us via telephone, email or other channels requesting information about products and services and we may use the data captured to help improve services or assist in finding a resolution to your enquiry.

Marketing subscription where you would have signed up via a web form or other data capture point. This information will be processed in accordance with that stated at the point of capture. You can unsubscribe at any time or customise your preferences.

Applicaa registration where we may use your data to send important updates, event information, direct marketing and other useful information that will help you get the most out of the products and services available to you.

Product Purchase where we may have obtained your data following the signing of a contract. We may use this data to contact you about product updates, financial queries, renewals and other useful information that will help you get the most out of our products and services.

Sales Enquiry where you may have contacted us via telephone, email or other channels requesting information about products and services we have to offer or we have contacted you and you have expressed an interest. You can unsubscribe at any time or customise your preferences.

Support Enquiry where you may have contacted us or a commercial partner via telephone, email or other channels to log a support enquiry about an issue or for general assistance. We may use the data captured to help to resolve your enquiry and may contact you after for feedback to help improve the service offered.

Training course attendance where we may have obtained your details following the attendance of a training course and webinars. We may use your data for the purpose of obtaining feedback to help improve the service offering.

Your website - Occasionally we may need to obtain your details from your company website or from a publicly available website, such as Edubase. We will only process data if a suitable legal basis has been established and will only keep the data for a short period of time unless you have consented via any of the examples mentioned above.

Referral systems - where your name has been shared by an Applicaa client who believes you would potentially be interested in purchasing any Applicaa products. You can unsubscribe from communications at any time.

Website visitors - we collect anonymous basic information on website visitors such as usage of the Applicaa website and cookies or other tracking technologies. This enables us to understand how the Applicaa website is used and improve its functionality.

Recording Calls, Online Meetings and Webinars - we record these conversations, meetings and webinars for internal training purposes.

Applicants/Students

When applying to a provider an applicant (parent or student) supplies data to the potential provider via Admissions+. The data requested and questions asked as part of the application process are defined by the provider who utilises the Admissions+ portal to capture this information.

ApplicaaOne

When applying on ApplicaaOne students will be able to research courses and check their eligibility for them by providing their grades. They may also apply to multiple Post 16 providers using their ApplicaaOne profile. When applying they will be given the opportunity to copy the relevant information from their previous application form, into a new application which is being completed. Applicaa will contact them in the event that one of their applications is unsuccessful for the purposes of supporting them in finding an alternative course.

Information on where students apply and the status of these applications is shared with their current school and the local authority. The school also shares attendance information with the local authority. This information is shared for the purposes of destination tracking, identifying and supporting students who are or are at risk of becoming NEET (Not in Education, Employment or Training), meeting the September Guarantee, and monitoring attendance. The local authority uses this information as an independent data controller in the exercise of its statutory duties.

Students applying to providers utilising an Applicaa system, will be issued with an ApplicaaOne profile as part of their application process. The ApplicaaOne profile will be available to use as described above and for tracking their applications in one place. A link to the ApplicaaOne profile will be visible within the student’s homepage on the provider’s Applicaa System. They will be able to opt into the ApplicaaOne MatchingHub referred to in the next section.

Applicaa Futures (including OneReference & Destination Tracking)

When applying on ApplicaaOne to Providers utilising an Applicaa System the Provider will automatically receive central reference information from the student’s home school where such a reference is available. Providers will see the following core Reference data:

• Full Name
• DOB
• Grades
• Strengths
• Weaknesses
• Special Needs
• UPN
• UCI
• Eligibility for Free School Meals

Applicaa Matching Hub

In the event that applicants are unsuccessful in obtaining a place at their initial Post 16 provider. Via communication from Applicaa, they will have an option to ‘opt in’ and choose if they wish to share their ApplicaaOne profile, with details, such as names (first and last name), subject/s of choice and grades, with other similar Post 16 providers. These providers, if they have vacancies on courses available, will be able to proactively reach out and contact the pupils to discuss their provision and possible next steps.

When a student goes to the matching Hub and expresses an interest and is matched with a school, the matched school can see the following data to identify the student:

• Full Name
• DOB
• Home Address
• Gender
• Contact Number
• Grades
• Preferred list of Courses

Applicants can opt out from participation in “Applicaa MatchingHub” by withdrawing their interests, which will no longer allow Post 16 providers to contact them directly.

Bursary

When applying for a bursary to a provider an applicant/parents supplies data to the provider via the Bursary platform. The data requested and questions asked as part of the application process are defined by the provider who utilises the portal to capture this information.

Students

As students you may interact with the Applicaa in two main ways:

a) As an applicant, you may also complete data collection forms to support schools with onboarding and finding out information about yourself.

b) Parents may also be named by their son or daughter (applicant) as one of their contacts/carers; and so they might be marked as someone who they would like to receive communications from the provider. In which case you may receive correspondence from the provider via email or SMS for the purpose of processing the application.

Parents, agents and other type of contacts

You may interact with the Applicaa in two main ways:

c) As an applicant on behalf of the student. You may also complete data collection forms to support schools with onboarding and finding out information about the student for who you are completing the information for.

d) Other contacts such as parents, relatives and family friends may be named by the applicant as one of the student’s contacts/carers; and they might be marked as someone who would like to receive communications from the provider. In which case these contacts may receive correspondence from the provider via email or SMS.

Referees

If you are named as a referee by an applicant during the application process. You will receive an automated email from Applicaa requesting you to complete a form to help verify the applicant’s form. You may receive emails from the school from which the student has applied.

6. AI assistant (“Emma”)

Admissions+ includes an AI assistant, Emma, that helps school staff find answers to support questions and carry out everyday administrative tasks within the platform. When Emma is used, the user’s request and the relevant information needed to complete it are processed by our AI provider, Anthropic, using Amazon Web Services (AWS Bedrock) hosted in the European Union. This information is used only to generate a response or carry out the requested task. It is not used to train AI models and is not retained by the AI provider. A member of the school’s team is always available, and Emma does not make decisions that produce legal or similarly significant effects about an individual without human involvement. Where Emma is used on behalf of a school or Trust, Applicaa acts as a data processor under our Data Processing Agreement.

7. Where is your data stored?

Applicaa clients and prospect data is stored on Hubspot. Hubspot’s product infrastructure is hosted on Amazon Web Services (AWS) in the United States East region or AWS in the Germany region. The Applicaa data is stored on Amazon Servers that are located in London (EU-West Region). Data will always be stored in EU or UK-based Data sites.

8. Keeping your information secure

We have designed the Applicaa Website and products keeping in mind the safety of your personal information. All information you provide to us is stored on secure servers. We have put in place technical and organisational measures to safeguard your information. These measures include:

1. Firewall: Servers sit behind multiple firewalls within a VPC which is only accessible via a VPN
2. Data protection: All data is stored and used as described in Applicaa Data Policy and Confidentiality Undertaking.
3. Automatic logouts: Member accounts log out automatically after 20 minutes of inactivity. Staff accounts are enabled with two factor authentication.
4. Encryption: Student data and backups are encrypted at rest and in transit using 256-bit AES encryption.
5. Layered access security: Administrators have limited access to student data, and only when strictly necessary. We use user-type appropriate password rules regarding password length, complexity, age, number of allowed failed logins per day, re-use of old passwords, and 2-step authentication.
6. Server Assessment Security: Our servers and technology infrastructures are provided by Amazon Web Services. Only our Lead developers and Managing Director have access to this environment. Servers are automatically updated as soon as security patches are released.
7. Database backups: Backups are made daily and retained in reducing granularity for a minimum of 12 months.
8. Vulnerability Assessments: Vulnerability assessments are performed regularly, both manually and automatically by our developers. Real Time protection is also provided by Amazon Web Services.

Lost Data: If users delete student accounts by accident, we can bring the student accounts back again as long as we are alerted within one month. The maximum backup retention period that Amazon RDS supports is 35 days.

Unfortunately the transmission of information via the Internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of any information transmitted to Applicaa platform and website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

To keep your data secure, we’ll provide you with a username and you’ll be asked to create a password. We also utilise Two-Factor Authentication to keep your data safe.

If you are worried that your account or your information might be at risk (for example, if somebody else has found out your password), please contact us.

9. How long do we keep your personal information?

Applicaa client and prospect personal information data will only be held on our systems for the period necessary to fulfil the purposes outlined in this privacy notice or until you request that it be deleted. Schools and users (pupils, parents, referees and school staff) have the right to request their data to be deleted from our live servers at any point. Student data will continue to be held on off-site, encrypted backups for the purposes of restoration in case of catastrophic data centre issues for a further one year, in line with ICO guidance.

10. Who do we share your personal information with?

Staff within Applicaa Ltd will have access to your personal information to carry out their job in order to provide services to you.

Some staff within our business operate outside of the EEA, for example, our staff in Vietnam and the Philippines, however, all staff are subject to the same Security and Terms & Conditions policies.

Applicaa’s commercial partners (for example ESS) may also require access to some personal data to carry out their job in order to provide services to you.

We use third-party sub-processors, such as cloud computing providers and customer support software. We ensure these providers adhere to the same data process and security standard established by GDPR or where necessary we establish GDPR-compliant data processing agreements with each sub-processor, extending GDPR safeguards everywhere personal data is processed. The following is a list of personal data sub-processors we use and links to their GDPR policies.

• Amazon Web Services (Cloud services provider & data hosting for Applicaa Platforms)
• AI assistant (“Emma”) - generating responses and carrying out requested tasks
• Anthropic (via AWS Bedrock)
• AccessPay (BACS Bureau) (Direct Debit Mandate lodger)
• Esendex (SMS Processor for Applicaa Platforms)
• HubSpot (Applicaa’s CRM)
• Slack (Applicaa’s internal messaging system)
• G-Suite (Applicaa’s Email Service, Cloud Storage and Video Conferencing)
• Zoom (Video Conferencing)
• Xero (Accounting Software)
• SendGrid - SMTP provider for emails (Email processor for Applicaa Platforms)
• Twilio (Email Processor for Applicaa Platforms)
• Postcode Look-Ups (Address lookup service on Applicaa Platforms)
• Stripe (Payment processors on Applicaa Platforms)

Where your school participates in a local authority destination-tracking or participation programme, your personal information is shared with the relevant local authority, as described in the ApplicaaOne section above. The School and Local Authority each act as independent Data Controllers for their own use of this information. You should refer to their respective privacy information for further details about how they use your Personal Information, their lawful bases, retention arrangements and how to exercise your data-protection rights.

11. How you can amend your preferences?

If you no longer wish to be on our marketing lists, you can unsubscribe by:

• opening the last email received from us and clicking on the unsubscribe or change my preference link found at the bottom of the email
• contact us by email at: info@applicaa.com
• alternatively, you may call our team on 0208 762 0882, Monday to Friday: 9 am to 5 pm

12. Your Rights

If you are in the EU or UK, by law you have the following rights with regard to your personal information:

• Access. You have the right to obtain confirmation as to whether or not your personal information is being processed, and, if it is, request access to that personal information (commonly known as a “data subject access request”). We will need you to prove your identity before we release any personal information to you. In addition, we will normally contact your School to let them know you have made a data subject access request. It is our policy not to disclose references about Students given by their Teachers or others. If you wish to request a copy of your personal information please address requests to info@applicaa.com
• Correction or deletion. You have the right to ask us to correct or delete any personal information that we hold about you (unless we have the legal right to retain it). You also have the right to ask us to delete your information where you have exercised your right to object to processing (see below).
• Objection. You have the right to object to processing of your information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your information for direct marketing purposes.
• Restriction. You also have the right to restrict us from processing your personal information. You can ask us to temporarily stop processing information about you, for example if you want us to establish that it is accurate or the reason for processing it.
• Change of preferences. You can change your information processing preferences at any time. You can contact us using the details provided below or clicking the relevant link in any communication you receive.
• Data portability. In some circumstances, you have the right to ask us to transfer a copy of the personal information we hold about you to someone else.

Please note that if you ask us to stop processing your personal information in a certain way or if you ask us to delete your information, and we need to use that information to provide our services to you, then you may not be able to continue to use it. This does not include your right to object to direct marketing, which can be exercised at any time without restriction.

If you would like to exercise any of the rights mentioned above, please contact us at info@applicaa.com

The above rights do not apply to anonymised personal information.

No fee usually required to access your personal information

You will not normally have to pay a fee to access your personal information (or to exercise any of the other rights set out above). However, we may charge a reasonable fee if your request for access is unreasonable or excessive. Alternatively, we can refuse to comply with the request.

What we may need from you

We may need to request specific information from you to confirm your identity and verify your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

Where you have consented to the collection, use or transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us via info@applicaa.com Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

13. Complaints

Should you have any queries or complaints in relation to how we use your Personal Information, please contact us at info@applicaa.com using the details set out above. Should you wish to take any complaints or queries further, you have the right to contact the Information Commissioner’s Office regarding such issues.

Our Websites may, from time to time, contain links to and from third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these websites or their related policies. Please check these policies before you submit any Personal Information via these websites.