Prospectus Plus is a personalised prospectus and marketing platform used by education providers, including universities, colleges and similar organisations. It includes both:

1. a front-end experience used by prospective students, applicants, parents, carers and other people viewing or interacting with prospectus content; and2. an administrator application used by education provider staff and other professional users to manage, configure, analyse and support Prospectus Plus.

This policy applies to:

prospective students, applicants and other front-end users;
parents, carers or supporters who use Prospectus Plus;
administrator users and professional contacts;
representatives of clients, prospective clients, suppliers or partners;
people who submit enquiries, forms or support requests through Prospectus Plus; and
people whose information is provided to us by an education provider in connection with Prospectus Plus.

This policy should be read alongside any privacy notice provided by the relevant education provider. Where an education provider uses Prospectus Plus, that organisation may be responsible for deciding how and why some personal information is used.

2. Who we are

Prospectus Plus is operated by We are SMILE Ltd, a company registered in England and Wales under company number 07405582.

Registered address:
Onyx House
12 Phoenix Business Park
Avenue Close
Birmingham
England
B7 4NU

Main trading address:
Onyx House
12 Phoenix Business Park
Avenue Close
Birmingham
England
B7 4NU

VAT number: 987 216 775

Data protection contact: dataprotection@wearesmile.com

We are registered with the Information Commissioner’s Office.

In this policy, “SMILE”, “we”, “us” and “our” means We are SMILE Ltd.

3. Key terms used in this policy

In this policy:

“Administrator application” means the back-end part of Prospectus Plus used by education provider staff and other authorised professional users.
“Administrator user” means a person who uses the administrator application, manages a Prospectus Plus account, configures content, views reporting or otherwise uses Prospectus Plus in a professional capacity.
“Client” means an education provider or other organisation that has contracted with us to use Prospectus Plus.
“Client Data” means data provided to Prospectus Plus by or on behalf of a Client, or generated through a Client’s use of Prospectus Plus.
“Education provider” means a university, college, school, training provider or other organisation using Prospectus Plus.
“Front-end user” means a person using the front-end Prospectus Plus experience, such as a prospective student, applicant, parent, carer or supporter.
“Personal information” means information that identifies you or could reasonably be used to identify you.
“Product” means Prospectus Plus.
“Special category data” means more sensitive personal information, such as information about health, race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, trade union membership, political opinions, genetic data or biometric data used for identification.
“UK GDPR” means the UK General Data Protection Regulation.

4. Our role under data protection law

Our role depends on the context.

4.1 Where we act as processor

Where a Client uses Prospectus Plus and provides, uploads, connects or otherwise makes personal information available through the Product, the Client will normally be the data controller and SMILE will normally act as data processor.

This means the Client decides why and how that personal information is used, and we process it on the Client’s instructions.

For example, we may act as processor when we:

host the Client’s prospectus content;
process student or prospect enquiry data on behalf of the Client;
make engagement information available to the Client;
support personalisation configured for the Client;
provide reports or analytics to the Client; or
process data connected to the Client’s use of the Product.

In these situations, the Client is responsible for ensuring it has a lawful basis for collecting, using and sharing the personal information with us.

4.2 Where we act as controller

We may act as data controller where we decide how and why personal information is used.

This may include:

managing our relationship with Clients and prospective Clients;
creating and managing administrator accounts;
providing support and training;
handling sales enquiries and demonstrations;
sending relevant communications to administrator users and professional contacts;
maintaining business, billing and contract records;
securing, monitoring and improving Prospectus Plus;
using aggregated or anonymised information for our own business purposes;
complying with legal obligations; and
managing our own suppliers, systems and internal operations.

Where we act as controller, we are responsible for complying with data protection law in relation to that processing.

5. How this policy applies to different users

Prospectus Plus is used by different types of people. We do not use personal information in the same way for every user.

5.1 Prospective students and front-end users

If you use the front-end Prospectus Plus experience, we use your personal information to provide, personalise, support, secure and improve that experience.

This may include helping you view personalised prospectus content, save interests, submit enquiries, book events, request information, or share preferences with the relevant education provider.

We do not use personal information collected from prospective students or other front-end users for SMILE’s own direct marketing.

If you receive recruitment, admissions, course, event or marketing communications connected with an education provider, those communications are normally sent by that education provider, or by us on that provider’s behalf. The education provider is responsible for ensuring it has a lawful basis for those communications and for explaining its use of your information in its own privacy notice.

5.2 Administrator users and professional contacts

If you use the Prospectus Plus administrator application, work for a Client, work for a prospective Client, attend a demonstration, request support, or otherwise deal with us in a professional capacity, we may use your personal information for account management, service delivery, support, training, billing, customer research, product updates, renewals and relevant business-to-business marketing.

This may include contacting you about Prospectus Plus, related SMILE services, product improvements, events, training, webinars, sector insights or other information that may be relevant to your professional role.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting dataprotection@wearesmile.com.

Opting out of marketing does not prevent us from sending service, security, legal, billing, contractual or account-related messages where necessary.

5.3 Client Data

Where a Client provides, uploads or connects personal information to Prospectus Plus, that information is Client Data.

The Client is normally responsible for the accuracy, legality, reliability and quality of Client Data. We process Client Data in line with our agreement with the Client, unless we are legally required to do otherwise or unless this policy explains that we act as controller for a specific purpose.

6. What personal information we collect

The personal information we collect depends on how Prospectus Plus is used.

6.1 Information about front-end users

We may collect the following information about front-end users:

name;
email address;
telephone number;
address or postcode;
age, date of birth, school year, applicant stage or study stage, where relevant;
course, subject or qualification interests;
preferred study level;
preferred campus, location or study mode;
university or college preferences;
personalisation choices;
saved content, bookmarked courses or prospectus preferences;
event bookings or open day interests;
enquiry details;14. communication preferences;
responses to forms, surveys or preference questions;
account details, where an account is created;
login information, including username and password or authentication details;
technical data, including IP address, browser type and version, time zone setting, device type, operating system, platform and app or browser information;
usage data, including pages viewed, content interacted with, links clicked, dates and times of access, referring pages and similar information; and
support requests or other communications with us.

We will only collect date of birth, full address or similar higher-risk information where it is needed for the relevant Prospectus Plus service or where the Client has configured Prospectus Plus to collect it.

6.2 Information about administrator users and professional contacts

We may collect the following information about administrator users and professional contacts:

name;
work email address;
work telephone number;
job title;
employer or organisation;
department or role;
administrator account details;
login information, including username and password or authentication details;
permissions and access levels;
audit logs showing use of the administrator application;
training, support or onboarding records;
meeting, demonstration or event attendance;
billing, contract or procurement information;
marketing preferences;
feedback, survey responses or research participation;
communications with us;
technical data, including IP address, browser type and version, time zone setting, device type, operating system, platform and app or browser information; and
usage data relating to the administrator application.

6.3 Information provided by Clients

Clients may provide, upload, connect or generate information through Prospectus Plus.

This may include:

prospectus, course, event and marketing content;
user records;
enquiry records;
applicant, student or prospect information;
CRM identifiers;
communication preferences;
segmentation or personalisation settings;
event attendance data;
reporting or analytics data;
administrator account information; and
other information needed to configure, provide, support or improve Prospectus Plus.

6.4 Information we collect automatically

When you use Prospectus Plus, we may automatically collect technical and usage information, including:

IP address;
device type;
operating system;
browser type and version;
app version, where applicable;
time zone setting and approximate location;
login activity;
pages, screens or features used;
referring website, campaign or source;
dates and times of access;
error logs;
performance data;
cookie or similar technology identifiers;
security and audit logs; and
analytics events.

6.5 Special category data

Prospectus Plus is not designed to routinely collect special category data.

You should not provide special category data through Prospectus Plus unless it is specifically requested and there is a clear reason to do so.

However, some people may choose to provide information that could reveal special category data, for example in a free-text enquiry, accessibility request, support message or event booking form.

Where this happens, we will only use that information where we have a lawful basis and, where required, an additional condition under data protection law. Where we process this information on behalf of a Client, the Client is normally responsible for identifying the relevant lawful basis and condition.

7. How we collect personal information

We may collect personal information:

directly from you when you use Prospectus Plus;
when you create an account;
when you submit an enquiry, form, request, booking or support message;
when you save preferences or personalise prospectus content;
when a Client provides, uploads or connects information to Prospectus Plus;
when we receive information from connected systems, such as CRM, analytics, email or event systems;
automatically through your use of the Product;
through cookies and similar technologies;
when you communicate with us by email, phone, forms, meetings or events;
when you attend a demonstration, webinar, training session or event; and
from publicly available sources, where relevant and lawful.

8. How we use personal information

We use personal information to provide, manage, support, secure and improve Prospectus Plus.

8.1 Uses relating to front-end users

We may use front-end user information to:

provide access to personalised prospectus content;
show relevant courses, subjects, events, locations or study options;
remember saved content and preferences;
enable enquiries, bookings, requests and form submissions;
pass relevant information to the education provider whose content you interact with;
support the education provider’s student recruitment, admissions, outreach or enquiry management activities;
send service messages, confirmations or transactional communications;
provide support;
understand how prospectus content is used;
provide analytics and reporting to the relevant Client;
improve Prospectus Plus;
test and develop product features;
maintain security and prevent misuse;
diagnose technical issues; and
comply with legal obligations.

We do not use front-end user information for SMILE’s own direct marketing.

8.2 Uses relating to administrator users and professional contacts

We may use administrator user and professional contact information to:

create and manage administrator accounts;
provide access to the administrator application;
manage permissions and security;
provide onboarding, support and training;
respond to enquiries and support requests;
manage our relationship with Clients and prospective Clients;
provide product updates and service information;
arrange demonstrations, meetings, webinars or events;
carry out billing, contract management and procurement processes;
seek feedback and conduct customer research;
send relevant business-to-business marketing communications where permitted by law;
monitor use of the administrator application;
protect Prospectus Plus and our systems;
improve the Product;
maintain internal records; and
comply with legal obligations.

8.3 Uses relating to Client Data

Where we process Client Data on behalf of a Client, we use it to:

provide Prospectus Plus;
host and serve the Client’s content;
support the Client’s use of the Product;
provide reporting and analytics;
support personalisation and configuration;
maintain security and availability;
diagnose and fix technical issues;
assist with data subject rights requests, where required;
assist with data protection impact assessments, security matters and personal data breach notifications, where required; and
comply with our agreement with the Client.

8.4 Aggregated and anonymised data

We may use information collected through Prospectus Plus in aggregated or anonymised form.

This may include using anonymised statistics to:

understand how Prospectus Plus is used;
improve product performance and usability;
identify trends in content engagement;
develop new features;
produce benchmark or insight reports;
support product strategy; and
demonstrate the value and performance of Prospectus Plus.

Where information is genuinely anonymised, it no longer identifies individuals and is not personal information under data protection law.

9. Lawful bases for using personal information

Where we act as controller, we only use personal information where we have a lawful basis.

Depending on the context, we may rely on one or more of the following lawful bases.

9.1 Contract

We may use personal information where necessary to perform a contract or take steps before entering into a contract.

This may apply when we:

provide access to Prospectus Plus;
manage administrator accounts;
provide support, onboarding or training;
manage Client relationships;
process billing or contract information; or
respond to requests connected with a service.

9.2 Legitimate interests

We may use personal information where necessary for our legitimate interests, or those of a Client or third party, and where those interests are not overridden by your rights and freedoms.

This may include:

providing and improving Prospectus Plus;
securing the Product and our systems;
understanding how the Product is used;
supporting Clients and users;
providing analytics and reporting;
maintaining business records;
managing professional relationships;
sending relevant business-to-business communications where permitted by law;
developing new features and services;
preventing fraud, misuse or unauthorised access; and
protecting our legal rights.

9.3 Consent

We may rely on consent for certain activities, such as:

non-essential cookies or similar technologies;
some forms of direct marketing;
optional product research;
optional app permissions, such as push notifications, where applicable;
certain uses of special category data, where required; and
any other activity where consent is required by law.

You can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

9.4 Legal obligation

We may use personal information where necessary to comply with legal obligations, including obligations relating to data protection, tax, accounting, fraud prevention, regulatory requests, court orders or legal claims.

9.5 Public task

Where a Client is a public authority or carries out public functions, it may rely on public task for some processing. Where this applies, we will usually process personal information as processor on the Client’s instructions.

9.6 Vital interests

In rare circumstances, we may use personal information where necessary to protect someone’s vital interests.

10. Marketing communications

We distinguish between prospective students or front-end users, and administrator users or professional contacts.

10.1 Prospective students and front-end users

We do not use personal information collected from prospective students or other front-end users for SMILE’s own direct marketing.

Where a prospective student or front-end user receives recruitment, admissions, event, course or marketing communications connected with an education provider, those communications are normally sent by that education provider, or by us on that provider’s behalf.

The education provider is responsible for ensuring it has an appropriate lawful basis and has provided the required privacy information.

We may still send service messages where necessary, such as account, security, enquiry confirmation, preference, transactional or support messages.

10.2 Administrator users and professional contacts

We may send marketing communications to administrator users, Client contacts, prospective Client contacts, partners and other professional contacts where permitted by law.

This may include information about Prospectus Plus, SMILE services, product updates, training, events, research, renewals, webinars or relevant sector insights.

We may rely on consent or legitimate interests depending on the communication method, the recipient and the context. Where the Privacy and Electronic Communications Regulations require consent, we will seek consent before sending marketing communications.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting dataprotection@wearesmile.com.

Opting out of marketing does not prevent us from sending important service, security, legal, billing, contractual or account-related communications.

11. Personalisation and profiling

Prospectus Plus may use information you provide, and information about how you use the Product, to personalise your experience.

For front-end users, this may include using your course interests, subject preferences, location preferences, saved content, enquiry activity or prospectus interactions to show more relevant content.

For administrator users, this may include showing relevant account information, product guidance, reports, configuration options or support information.

Personalisation is intended to make Prospectus Plus more useful and easier to use.

We do not use Prospectus Plus to make solely automated decisions that produce legal or similarly significant effects on individuals.

Where a Client uses Prospectus Plus engagement data for student recruitment, admissions, outreach, enquiry management or marketing, the Client is responsible for explaining its own use of that information in its privacy notice.

12. Automated decision-making

We do not currently use Prospectus Plus to make solely automated decisions that have a legal or similarly significant effect on individuals.

If this changes, we will update this policy and provide information about the logic involved, the significance of the processing, the likely consequences, and your rights.

13. Children and young people

Prospectus Plus may be used by prospective students, including people under the age of 18.

We take additional care where personal information relates to children or young people. This includes aiming to:

use clear and accessible language;
collect only the information needed;
avoid using children’s information for SMILE’s own direct marketing;
avoid unnecessary profiling;
apply appropriate security measures;
consider the best interests of children and young people;
provide appropriate privacy information; and
work with Clients to support responsible use of the Product.

Where Prospectus Plus is provided through an education provider, that organisation may also be responsible for explaining how children’s personal information is used.

If you are a parent, carer or guardian and you are concerned about how a young person’s information has been used, please contact us at dataprotection@wearesmile.com.

14. Cookies and similar technologies

Prospectus Plus may use cookies, pixels, local storage, software development kits, analytics identifiers and similar technologies.

These technologies may be used to:

keep the Product working;
support login and authentication;
remember preferences;
maintain security;
understand how Prospectus Plus is used;
measure performance;
identify and fix errors;
improve content and user experience;
support reporting and analytics; and
support relevant communications where permitted by law.

We will not use non-essential cookies or similar technologies unless we have obtained consent where required.

Strictly necessary technologies may be used without consent where they are required to provide the service.

You can manage cookie and tracking preferences through the settings made available on the relevant website, app or platform, and through your browser or device settings.

If you block or disable some technologies, parts of Prospectus Plus may not work as intended.

15. App permissions and notifications

If Prospectus Plus is provided through an app, it may request permission to use certain device features.

This may include:

push notifications;
camera access, where needed for a specific feature;
file or photo access, where needed to upload content;
storage access, where needed for the app to function; or
location access, where a location-based feature is provided.

We will only request permissions that are relevant to the feature being used.

You can control app permissions through your device settings.

If you disable a permission, some features may not work fully.

If push notifications are used, we will only send these where enabled through your device or app settings. You can turn off push notifications at any time.

16. Who we share personal information with

We may share personal information with the following categories of recipient.

16.1 Clients and education providers

Where you interact with a Client’s content through Prospectus Plus, we may share relevant personal information with that Client.

This may include:

enquiries you submit;
saved courses or interests;
event bookings;
communication preferences;
prospectus engagement information;
account or profile information;
personalisation choices; and
analytics and reporting.

Clients are responsible for how they use personal information once it is made available to them, unless we are independently determining the purpose and means of processing.

You should read the relevant Client’s privacy notice.

16.2 Service providers and sub-processors

We may share personal information with service providers that help us operate, secure, support and improve Prospectus Plus.

These may include providers of:

hosting and infrastructure;
cloud services;
analytics;
email delivery;
customer relationship management;
support and helpdesk tools;
error monitoring;
security monitoring;
authentication;
content management;
payment processing, where applicable;
communications tools; and
professional services.

Where these providers process personal information on our behalf, we require them to protect it and only process it in accordance with our instructions.

16.3 Professional advisers and authorities

We may share personal information with:

lawyers, accountants, auditors, insurers and other professional advisers;
regulators, public authorities, courts or law enforcement bodies where required by law;
parties involved in legal claims, disputes or investigations; and
prospective buyers, investors or advisers if our business or assets are sold, transferred, merged, financed or restructured.

17. Current service providers

We may use third-party providers to support Prospectus Plus and our wider business operations.

We list these sub-processors on our support website.

Where we use sub-processors to process Client Data, we will do so in accordance with our agreement with the relevant Client.

18. International transfers

Some personal information may be transferred to, stored in or otherwise processed in countries outside the United Kingdom.

Where this happens, we will take steps to ensure that appropriate safeguards are in place, as required by data protection law.

These safeguards may include:

adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to the EU Standard Contractual Clauses;
equivalent contractual safeguards; or
other lawful transfer mechanisms.

Where a Client has agreed a specific data hosting region with us, we will handle Client Data in accordance with that agreement, subject to any lawful exceptions or operational requirements set out in the agreement.

19. How long we keep personal information

We keep personal information only for as long as necessary for the purposes described in this policy.

Retention periods depend on:

the type of information;
the purpose for which it was collected;
whether we act as controller or processor;
the requirements of the relevant Client;
legal, accounting, tax or reporting requirements;
whether an account remains active;
whether there is an ongoing enquiry, complaint, dispute or legal issue; and
whether information can be anonymised instead of retained in identifiable form.

As a general guide:

technical logs are kept for a limited period unless needed for security, diagnostics or legal purposes;
account information is kept while the account remains active and for a reasonable period afterwards;
enquiry and communication records are kept for as long as needed to manage the enquiry and maintain appropriate records;
administrator user records are kept for as long as needed to manage the Client relationship and Product access;
marketing preference records may be kept to ensure we respect opt-outs;
billing and contract records may be kept for legal, accounting and tax purposes;
analytics data may be aggregated or anonymised where possible; and
Client Data processed on behalf of a Client is retained in accordance with our agreement with that Client.

Where our agreement with a Client requires deletion of Client Data at the end of the contract, we will delete or return that data in accordance with the agreement, unless we are required by law to retain it.

20. Data deletion at the end of a Client contract

Where required by our agreement with a Client, we will securely delete Client Data after the contract ends.

This may include deleting Client Data in our possession or control, including relevant copies, within the period set out in the agreement.

Where required by the agreement, we will also take reasonable steps to ensure that relevant subcontractors or sub-processors comply with equivalent deletion obligations.

Where applicable, we may provide the Client with confirmation or evidence of deletion in accordance with the agreement.

This section does not prevent us from retaining information where we are legally required to do so, where the information has been anonymised, or where we act as controller and have a lawful basis to retain it.

21. How we protect personal information

We use appropriate technical and organisational measures to protect personal information.

These may include:

access controls;
authentication;
role-based permissions;
encryption where appropriate;
secure hosting environments;
firewalls;
monitoring and logging;
backup and recovery processes;
staff confidentiality obligations;
supplier due diligence;
contractual safeguards with service providers;
secure development practices;
vulnerability management;
internal policies and procedures; and
regular review of security measures.

No online service can be guaranteed to be completely secure. You should take care when sharing information online and use strong, unique passwords where accounts are required.

22. Personal data breaches

Where we identify a personal data breach, we will assess it and take appropriate action.

Where we act as processor, we will notify the relevant Client where required by our agreement and applicable data protection law.

Where we act as controller, we will notify the Information Commissioner’s Office and affected individuals where required by law.

23. Your rights

Depending on the circumstances, you may have the following rights under data protection law:

the right to be informed about how your personal information is used;
the right of access to your personal information;
the right to have inaccurate information corrected;
the right to have personal information deleted in certain circumstances;
the right to restrict processing in certain circumstances;
the right to object to processing in certain circumstances;
the right to data portability in certain circumstances;
the right to withdraw consent where processing is based on consent; and
rights relating to automated decision-making and profiling.

These rights are not absolute and may depend on the circumstances.

To exercise your rights, contact dataprotection@wearesmile.com.

Where we process personal information on behalf of a Client, we may need to refer your request to that Client or act on that Client’s instructions.

24. How to make a complaint

If you have concerns about how we use personal information, please contact us first so we can try to resolve the issue.

You can contact us at: dataprotection@wearesmile.com

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: ico.org.uk

25. Links to other websites and services

Prospectus Plus may contain links to websites, platforms, forms, services or content operated by Clients or other third parties.

We are not responsible for the privacy practices of those third parties.

You should read their privacy notices before providing personal information to them.

26. Changes to this policy

We may update this Privacy Policy from time to time.

Where changes are significant, we will take reasonable steps to bring them to your attention, such as by updating the relevant website, app, platform notice or administrator application notice.

The latest version will apply from the date shown at the top of this policy.

27. Contact us

For questions about this Privacy Policy or how personal information is used, contact:

Data Protection
We are SMILE Ltd
Onyx House
12 Phoenix Business Park
Avenue Close
Birmingham
England
B7 4NU

Email: dataprotection@wearesmile.com