Version 1.0, last updated 11 July 2026. This policy explains what personal data we collect, why we collect it, and the rights you have over it. It is written in plain English and covers our website, our learning platform, our tutoring programmes, and the TMUA Oxbridge Scholarship.
1. Who we are
The controller of your personal data is UNI ADMISSIONS PREP LTD, a company registered in England and Wales (company number 17325935, registered office 28 Denton Close, Barnet, EN5 3AP), trading as TMUA.co.uk. If you have any question about this policy or about how we handle your data, email us at scholarship@tmua.co.uk.
2. What we collect
We only collect what we need to run the platform, deliver our programmes, and assess scholarship applications. Depending on how you use TMUA.co.uk, that can include:
- Account details: your name and email address, and the password you set (stored only as a secure hash, never in readable form).
- Scholarship application data: your academic details, your free-text answers to the application questions, and the contact details of both the applicant and a parent or guardian.
- Platform performance data: the questions you attempt, your answers, your scores, and your progress, which we use to personalise your practice.
- Payment records: what you bought, when, and for how much. Payments are processed by Stripe, and we never see or store your full card number.
- Email engagement: whether our emails were delivered, opened, or clicked, measured through our email provider Resend, so we can keep our messages relevant and stop emailing people who do not want to hear from us.
- Technical and usage data: basic analytics such as the pages you view and the device or browser you use, collected first-party by us rather than sold on to advertising networks.
3. Why we use it, and our lawful bases
Under UK GDPR we must have a lawful basis for using your data. Here is what we do and the basis for each:
- Delivering the platform and tutoring programmes: running your account, giving you access to the question bank, and providing the sessions you have signed up for. Basis: performance of our contract with you.
- Assessing scholarship applications and running award calls: reading and scoring applications, contacting shortlisted applicants, and arranging award calls. Basis: taking steps at your request before a contract, and our legitimate interest in running a fair competition.
- Sending service and marketing emails: updates about your account or a programme, and occasional emails about what we offer. Every marketing email carries a one-click unsubscribe. Basis: our legitimate interest in reaching people who have shown interest in us, and your consent where the law requires it.
- Processing payments and preventing fraud: taking payment, keeping records for tax and accounting, and guarding against fraudulent transactions. Basis: performance of our contract, and our legal obligations.
4. AI processing, and how decisions are made
We may use AI services to help us process application answers, for example to summarise responses or to help us draft a personalised reply. No award or shortlist decision is made solely by an automated system. A human on our team reviews the application and makes every shortlist and award decision. If you would like to know more about how AI is used in a decision that affects you, ask us at the address in section 1.
5. Who we share it with
We do not sell your data. We share it only with the service providers that help us run TMUA.co.uk, and only to the extent they need it to do their job:
- Stripe, for taking and recording payments.
- Resend, for sending our emails and measuring delivery.
- Supabase, for our database and application data.
- Vercel, for hosting the website and platform.
- Google, for the AI processing described in section 4.
- cal.com, for booking calls with us.
- WhatsApp, only if a family chooses to message us there.
Each of these providers acts as our processor, handling data on our instructions under a data processing agreement. We may also disclose data where the law requires it, for example to comply with a court order.
6. Students under 18
Many of our students are under 18. For the scholarship we collect a parent or guardian's contact details so that a parent consents to the application and is kept informed, and we involve a parent or guardian in any discussion about a purchase. Where a student is under 18, the parent or guardian is our client and the decisions about a programme sit with them.
7. How long we keep it
- Account and platform data: for as long as your account is open, and for a short period afterwards in case you come back, then deleted or anonymised.
- Scholarship applications: for the length of the admissions cycle they relate to, then deleted, unless you become a customer, in which case the relevant records move to your customer file.
- Payment and accounting records: for six years, as UK tax law requires.
- Marketing contact details: until you unsubscribe or ask us to remove you, after which we keep only a minimal record that you opted out, so we do not email you again.
8. International transfers
Some of our providers are based outside the UK. Where your data is transferred abroad, we rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement and Standard Contractual Clauses, so that your data keeps a level of protection equivalent to UK law.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify data that is wrong or incomplete.
- Erase your data, where there is no overriding reason for us to keep it.
- Port your data to another provider in a common, machine-readable format.
- Object to processing based on our legitimate interests, and to opt out of marketing at any time.
To exercise any of these, email us at scholarship@tmua.co.uk. We will respond within one month.
10. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.
11. Changes to this policy
We may update this policy as our service changes or the law moves on. When we do, we will change the version number and the date at the top of this page. If a change is significant, we will tell you by email.