Privacy policy

Ibtiaath Ltd (referred to as “Ibtiaath”, “we” or “us”) is a company registered in England and Wales (company number 17056260), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We operate the Ibtiaath platform, a digital service that facilitates university admissions, scholarship applications, document translation and attestation, student flight bookings, international eSIM data plans, payment of university and research publication fees via PayPal, and a store for academic and technical software and subscriptions.

We act as the “data controller” for the personal data collected through our platform. For privacy enquiries, contact us at: privacy@ibtiaath.com

We collect the following categories of personal data:

• Identity data: Full name, date of birth, nationality, passport or government ID number.
• Contact data: Email address, phone number, postal address.
• Academic data: Educational qualifications, transcripts, certificates, grades, and academic history.
• Financial data: Payment card details (processed through payment providers — we do not store full card numbers), billing address, and transaction history.
• Document data: Scanned copies of the official and academic documents you upload.
• Technical data: IP address, device type, browser type, operating system, and usage logs.
• Correspondence data: Messages, support requests, and correspondence with our team.

We do not collect or process special category data (such as health data, racial or ethnic origin, religious beliefs or biometric data) unless you provide it voluntarily and we have a specific legal basis for processing it.

Under the UK and EU General Data Protection Regulation (GDPR), we rely on the following legal bases to process your personal data:

• Performance of a contract (Article 6(1)(b)): Processing necessary to deliver the services you requested, including handling applications and payments.
• Legitimate interests (Article 6(1)(f)): Improving our platform, preventing fraud, security, and internal analytics. We balance these interests against your rights.
• Legal obligation (Article 6(1)(c)): Complying with applicable law, including financial regulations and anti-money-laundering requirements.
• Consent (Article 6(1)(a)): For sending marketing messages, or if we use non-essential cookies in the future (we do not use any today). You can withdraw your consent at any time.

• Processing and submitting your university admission applications.
• Applying for scholarships on your behalf.
• Translating and attesting academic documents.
• Processing payments securely through external payment service providers.
• Booking student flights.
• Activating eSIM plans and delivering store purchases.
• Paying university and research publication fees via PayPal at your request.
• Communicating with you about your requests and your account.
• Detecting and preventing fraud and misuse of the platform.
• Complying with legal obligations.
• Sending service-related updates, and marketing messages where you have consented.

We do not sell, rent or trade your personal data to third parties for their marketing purposes. We may share your data with:

• Universities and academic institutions: To process your admission or scholarship applications.
• Payment service providers: To process financial transactions securely (such as Stripe and PayPal). These providers are PCI DSS compliant and process payments under their own privacy policies.
• Certified translators and attestation bodies: To deliver translation and attestation services.
• Airlines and eSIM providers: To issue your tickets and activate the data plans you order.
• SuperQi: When you use the Mini App inside SuperQi, to sign you in with your SuperQi account and complete payments with its approved payment methods.
• Cloud service providers: Who host and secure our platform infrastructure under data processing agreements.
• Legal and regulatory bodies: Where required by law, a court order, or a regulatory authority.

All third-party data processors are bound by data processing agreements and are required to handle your data in accordance with applicable data protection law.

Some of our service providers may be located outside the United Kingdom or the European Economic Area (EEA). When we transfer personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or the European Commission, or reliance on adequacy decisions. You can request a copy of these safeguards by contacting us.

We keep your personal data only for as long as necessary for the purposes described in this policy:

• Account and service data: Kept for the lifetime of your account plus 3 years after it is closed.
• Financial and transaction records: Kept for 7 years in compliance with UK financial regulations.
• Application and document data: Kept for two years from the date of the last service.
• Marketing consent records: Kept until you withdraw your consent, or for 3 years of inactivity.
• Technical logs: Kept for up to 12 months.

Once the applicable retention period ends, data is securely deleted or anonymised.

If you are resident in the United Kingdom, the European Economic Area, or a jurisdiction with comparable data protection laws, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data in certain circumstances.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at privacy@ibtiaath.com. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or, if you are in the European Economic Area, to the supervisory authority of your country of residence or work.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.
• Right to limit use of sensitive information: Contact us to limit our use of sensitive personal data to what is necessary to deliver the services.

To submit a verifiable consumer request, contact us at privacy@ibtiaath.com. We will respond within 45 days.

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include TLS encryption for data in transit, encrypted storage of sensitive documents, access controls, and periodic security reviews. In the event of a data breach likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority in accordance with applicable law.

Our platform is intended for users aged 18 and over. We only process the personal data of people under 18 when it is provided by their parent or legal guardian through an account the guardian created on their behalf, as set out in our terms of use. If you believe a minor has given us their data in any other way, please contact us immediately and we will delete it.

We use cookies and similar technologies as described in our cookie policy. We do not currently set any cookies that require your consent, so no consent banner is shown; you can manage or delete cookies through your browser settings.

We may update this privacy policy from time to time. Where we make material changes, we will notify you by email or by posting a prominent notice on the platform. The “last updated” date at the top of this page indicates when the policy was last reviewed. Continuing to use our platform after the changes constitutes acceptance of the updated policy.

If you have any questions, concerns or requests regarding this privacy policy, please contact us: