Privacy Notice

1.What Information Do We Collect?

In Short: We collect personal information that you provide to us voluntarily through our contact forms.

We collect personal information that you voluntarily provide to us when you express an interest in Unilume or contact us through our website. The personal information we collect depends on the context of your interaction with us and the choices you make.

Personal information provided by you

When an individual (student or prospective user) submits our interest form, we collect:

• –Full name
• –Email address
• –Whether you are a current university student (yes or no)
• –Name of your university (if you indicated you are a current student)
• –Your area of interest in Unilume (for example, early access, staying updated, or a free-text description)

When a representative of a university or institution submits our institution enquiry form, we collect:

• –Contact name
• –Institution name
• –Work email address
• –Type of enquiry (for example, consultation, demo, or a free-text description)
• –Approximate student population (optional)

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Sensitive information

We may collect information about your student status, which in some contexts may be treated as educational data. We process this information only with your consent, as given by voluntarily submitting the form.

Technical data processed automatically

When you submit a form, our servers briefly process your IP address for the sole purpose of rate limiting (a maximum of three submissions per hour per IP address to prevent abuse). Your IP address is never written to our database and is held only in temporary server memory. We do not collect device information, browser fingerprints, or browsing behaviour through our own systems. Our infrastructure providers and domain registrar may process certain technical data independently as described in Section 4.

2.How Do We Process Your Information?

In Short: We process your information to operate our Services, communicate with you, and for security and abuse prevention. We process your information only when we have a valid legal reason to do so.

We process your personal information for the following reasons:

• –To respond to your submission — We send you a confirmation email acknowledging we received your details.
• –To contact you about Unilume — We will contact you when Unilume launches or when there are relevant updates directly related to what you expressed interest in.
• –To understand our early audience — We review aggregated submission data to understand which universities students attend and what institutions are interested, so we can plan the product effectively.
• –To prevent abuse — We use IP address rate limiting to prevent automated or malicious form submissions.
• –To comply with legal obligations — We may process your information where required by law.

3.What Legal Bases Do We Rely On?

In Short: We process your personal information only when we have a valid legal basis under UK GDPR and the Data Protection Act 2018.

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 require us to explain the legal bases we rely on:

• –Consent — We process your form submission data because you voluntarily chose to submit it. You can withdraw your consent at any time by emailing info@unilume.co.uk and requesting deletion of your data. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
• –Legitimate interests — We process your IP address for rate limiting on the basis of our legitimate interest in preventing abuse of our contact forms. We have assessed that this interest is not outweighed by your privacy interests, given that the IP address is held only in temporary server memory and never stored in our database.
• –Legal obligations — We may process your information where we believe it is necessary to comply with our legal obligations, such as cooperating with a regulatory authority or exercising our legal rights.

4.When and With Whom Do We Share Personal Information?

In Short: We share information only with the essential service providers that operate this website. We do not sell data or share it with advertisers or universities.

We may share your personal information in the following specific situations and with the following parties:

We do not share your personal information with universities, advertisers, data brokers, or any other parties.

Business transfers

In connection with any merger, sale of company assets, financing, or acquisition of all or part of our business, your personal information may be transferred as part of that transaction. We will notify you via the email address we hold for you of any such change in ownership or control, and this Privacy Notice will continue to apply.

5.Do We Use Cookies and Other Tracking Technologies?

In Short: We do not use advertising or analytics cookies. We use browser localStorage solely to remember your interactions with the visual elements of this website.

We do not use advertising cookies, analytics cookies, or any third-party tracking scripts on this website. We do not use Google Analytics, Facebook Pixel, Hotjar, or similar services.

We use browser localStorage to remember your interactions with the animated elements of this website (for example, which visual effects you have activated) between visits. This data is stored entirely on your device and is never transmitted to us. See our Cookie Policy for full details.

Our hosting provider (Vercel) and domain registrar (GoDaddy) may set limited technical cookies or log DNS queries as part of operating their infrastructure. These are outside our control. Please refer to their privacy policies for details.

6.How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfil the purposes set out in this notice, up to a maximum of three years from submission unless you ask us to delete it earlier.

We will retain your contact submission data for up to three yearsfrom the date you submitted it, or until you ask us to delete it, whichever comes first. This period reflects the likely timeline before and around Unilume's product launch, after which we will give you a clear choice about ongoing contact.

When Unilume launches as a product, we will contact people on our interest list and give each person a clear opportunity to decide whether they wish to remain in contact. Those who do not respond or who opt out will have their data deleted.

IP addresses processed for rate limiting are held only in temporary server memory and are not retained beyond the life of the server process.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it. If deletion is not immediately possible (for example because the data is held in backup archives), we will securely isolate it from further processing until deletion is possible.

7.How Do We Keep Your Information Safe?

In Short: We use technical and organisational security measures to protect your personal information.

We have implemented appropriate technical and organisational security measures designed to protect the security of any personal information we process. These include:

• –All data in transit is encrypted using HTTPS/TLS
• –Database access is restricted to server-side API routes using a secret service key; the client-side of this website cannot access the database directly
• –Input validation and HTML stripping on all form fields before storage
• –Rate limiting to prevent automated abuse
• –Honeypot field detection to block bot submissions
• –Security headers on all API responses (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best to protect your personal information, transmission of information to and from our website is at your own risk. You should access our Services only within a secure environment.

8.Do We Collect Information From Minors?

In Short: We do not knowingly collect data from or market to children under 13 years of age. Our service is intended for university students who are typically 17 years of age or older.

Our website is a marketing site for a university student wellbeing platform. Our intended audience is university students (in the UK, typically aged 17 or above) and university staff and administrators.

We do not knowingly solicit data from or market to children under 13 years of age. If you are aware of any data that may have been collected from someone under 13, please contact us at info@unilume.co.uk and we will take prompt steps to delete such information.

9.What Are Your Privacy Rights?

In Short: Under UK GDPR, you have rights to access, correct, delete, and restrict use of your personal information. You can exercise any of these rights by contacting us at info@unilume.co.uk.

As a data subject in the United Kingdom, you have the following rights under UK GDPR and the Data Protection Act 2018:

• –Right of access — You can request a copy of the personal data we hold about you.
• –Right to rectification — You can ask us to correct inaccurate or incomplete personal data.
• –Right to erasure — You can ask us to delete your personal data, subject to certain legal exceptions.
• –Right to restrict processing — You can ask us to limit how we use your personal data in certain circumstances.
• –Right to data portability — You can ask us for your personal data in a structured, machine-readable format.
• –Right to object — You can object to processing based on legitimate interests.
• –Right to withdraw consent — Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at info@unilume.co.uk. We will respond within one calendar month, and in complex cases within three months.

Complaints

If you are located in the UK and you believe we have not handled your personal information correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Withdrawing your consent and opting out

Because all form submissions are voluntary, you can ask us to stop holding your data at any time by emailing info@unilume.co.uk with a deletion request. We will confirm deletion within one calendar month. You may also unsubscribe from any future communications by replying to any email we send you with the word 'unsubscribe'.

10.Controls for Do-Not-Track Features

In Short: We do not currently respond to Do-Not-Track browser signals because no uniform standard for their implementation exists.

Most web browsers include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised. As a result, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your preference not to be tracked.

Because we do not use analytics or advertising tracking on this website, the practical effect of DNT is limited. If a standard for online tracking is adopted in the future that we must follow, we will update this notice.

11.Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes in our practices.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this notice. If we make material changes, we will notify you either by prominently posting a notice of the changes on this website or by sending you a direct notification to the email address we hold for you. We encourage you to review this notice periodically.

12.How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact us by email at info@unilume.co.uk. We are a small team and do not currently have a formally appointed Data Protection Officer, as we are not required to designate one under current UK GDPR thresholds. All data protection queries are handled directly by the founder.

13.How Can You Review, Update, or Delete the Data We Collect?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.

To request to review, update, or delete your personal information, please contact us at info@unilume.co.uk. We will respond within one calendar month.