Data Protection & Document Handling

When you engage our services, you may share sensitive documents — passports, ID, financial records, academic certificates. This page explains how we handle them, beyond what's covered in our Privacy Policy.

Documents we may collect

• Passport / national ID
• Proof of address (utility bills, bank statements)
• Academic certificates and transcripts
• References and letters of recommendation
• CVs and personal statements
• Financial documents for SFE (payslips, P60s, Tax Year Overviews)
• Visa or immigration documentation (where relevant)

How documents are handled

• Encrypted in transit: All uploads use TLS encryption (HTTPS).
• Encrypted at rest: Stored on secure cloud services with encryption-at-rest enabled.
• Access-controlled: Only the advisor handling your case can access your documents. We maintain access logs.
• Not stored on website servers: Documents are never stored on our public website hosting. They are kept in dedicated secure document storage systems.
• Never shared without consent: We do not share documents with universities, agencies, or any third party without your explicit written consent for that specific transfer.

Retention

• Active applications: Documents retained until the application cycle concludes (typically end of academic year).
• Post-engagement: Documents retained for up to 7 years for legal/financial record-keeping (per HMRC and accounting requirements).
• Earlier deletion: You may request deletion at any time. We will comply unless legally required to retain.

Sharing with universities/SFE

Where you authorise us to submit documents on your behalf to a university or to the Student Loans Company, we will:

• Confirm exactly what is being shared and with whom
• Use the official secure channels of the receiving institution
• Retain a record of what was sent and when

In the event of a breach

If a security incident affects your data or documents, we will:

• Notify you without undue delay
• Provide guidance on protective steps you should take

Your control

You have the right at any time to:

• Request a copy of all documents we hold for you
• Request immediate deletion (where not legally required for retention)
• Withdraw consent for any pending document sharing

Email ask@cobaltzpathways.com to exercise any of these rights.