Privacy Policy

Last updated: October 19, 2026

This policy explains what personal data Universities DB collects when you use universitiesdb.com, why we collect it, who we share it with, how long we keep it and the rights you have. It covers students and parents using the site, people who send us enquiries, and university staff who manage a listing.

Who we are

Universities DB ("we", "us") runs universitiesdb.com. We are the data controller for the personal data described here. For any privacy question or request, use our contact page or reply to any email we've sent you.

Information we collect

Enquiries to universities: your name, email, optional phone/WhatsApp, country of residence, nationality, study level, subject, intake, budget and your message. We also record the page you sent it from, the website or campaign that brought you to us (referrer and UTM tags) and your IP address, which we use to block spam.
Contact form: your name, email and message, and your IP address for spam protection.
University representatives: when you claim, edit, add or upgrade a listing, we collect your name, work email, role, the changes you make, and billing details if you buy a paid plan. Sign-in uses one-time codes sent to your email.
Usage data: our servers and our security provider (Cloudflare) process technical data such as IP address, browser type and pages requested, to deliver the site and protect it from abuse. We count listing views and clicks (for example "Visit website") per university, without identifying you.
Analytics (only with your consent): if we enable Google Analytics, it will only run after you click "Accept analytics" on our cookie banner. See our cookie policy.

We don't ask for sensitive information (such as health, religion or financial account details) in enquiries. Please don't include it in your message.

How we use it, and our legal basis

To pass your enquiry to the university you chose and send you a copy: based on your consent, which you give with the checkboxes on the form.
To run listings for universities, verify that claimants work for the university, provide paid plans and send invoices: to perform our contract with the university, and our legitimate interest in keeping the directory accurate.
To answer messages sent through the contact form: our legitimate interest in replying to you.
To keep the site secure, prevent spam and fraud and fix errors: our legitimate interest.
To improve the site with analytics: your consent, which you can withdraw at any time.
To meet legal obligations, such as keeping accounting records for invoices.

We don't sell your personal data, and we don't use it for automated decisions that have legal or similarly significant effects on you.

Enquiries to universities

When you send an enquiry from a university's page, and you have ticked the box allowing us to share it, we send your details and message to that university's admissions contact so it can reply to you directly. Once the university has your enquiry, its own privacy policy also applies to how it uses your data.

If the university has not yet claimed its listing on Universities DB, we hold your enquiry and pass it on once the listing is claimed. Until then, we only tell the university how many enquiries are waiting, never your details. If you tick "Also send my enquiry to similar universities", we share it with the universities named next to that box, and with no others.

We keep enquiries for up to 24 months and then delete them automatically. You can ask us to delete an enquiry sooner. We can't recall an enquiry that has already been delivered to a university, but we will tell you which universities received it so you can contact them.

Universities: only the enquiries you choose to send them, as described above.
Service providers who process data for us under contract: our hosting provider; Cloudflare (security, performance and spam protection); Zoho ZeptoMail (sending email).
Outside content: pages with a map load map images from Google Maps, and videos load from YouTube or Vimeo only when you click to play them. These providers receive your IP address when that happens (see our cookie policy). Our fonts are hosted on our own server.
Authorities, if the law requires it, or to protect our rights or the safety of others.

Some of these providers and universities are located outside your country, including outside the EU/EEA and Thailand. Where we transfer data internationally, we rely on the safeguards the law requires, such as your consent to send an enquiry to a university abroad, or standard contractual clauses with our providers.

How long we keep data

Enquiries and contact form messages: up to 24 months, then deleted automatically.
Record of your cookie choice: 25 months (stored with a one-way hash of your IP address, not the IP itself).
University representative details: while you manage the listing. Ask us at any time to remove you as a contact.
Invoices and billing records: as long as tax law requires (usually 5–10 years).
Security logs: normally no longer than 90 days.

Your rights

Depending on where you live (for example under the EU/UK GDPR or Thailand's Personal Data Protection Act), you have the right to:

access the personal data we hold about you and get a copy;
correct inaccurate data;
have your data deleted;
object to, or restrict, how we use it;
receive your data in a portable format;
withdraw consent at any time (for example to analytics cookies, using "Cookie settings" in the footer). This doesn't affect what we did before you withdrew it;
complain to a data protection authority, such as Thailand's PDPC or the authority in your own country.

To make a request, including deleting an enquiry, reply to the confirmation email we sent you or use our contact page with the email address you used. We may ask you to confirm the request from that address. We reply within 30 days.

Children

The site is meant for prospective university students, parents and university staff. If you are under 16, please ask a parent or guardian before sending an enquiry. If you believe a child has given us personal data without permission, contact us and we will delete it.

Security

We use encrypted connections (HTTPS), restricted and two-factor admin access, encrypted storage for secret keys, spam protection on every form, and regular backups. No system is completely secure, so please contact us straight away if you think your data has been put at risk.

AI-assisted content

We use AI tools to help research and write listing information and articles from public sources (see how we collect data). We don't send your enquiries or other personal data to AI services.

Changes to this policy

If we make significant changes, we'll update the date at the top of this page and, where the law requires, ask for your consent again.