Privacy & Cookies Notice

1. Who this notice applies to

This notice covers everyone whose personal data we handle: visitors to this website, people who submit the eligibility check or enquiry form, clients and their sponsors, and people whose details appear in an application we prepare (for example a dependant or a referee).

2. What we collect

• Identity and contact data: name, date of birth, nationality, passport details, address, email, phone and WhatsApp number.
• Academic and professional data: certificates, transcripts, results, English-language qualifications, CV, employment history, references.
• Application data: statements of purpose, motivation letters, course and university choices, offers received, scholarship applications.
• Travel history: where a university, scholarship body or non-UK visa application requires it. We do not ask for your UK immigration history, previous refusals or immigration status, because we are not registered to advise on those matters; that information belongs with your regulated immigration adviser. If you send it to us unprompted we will not act on it, and we will delete it on request.
• Financial evidence: bank statements, sponsorship letters, proof of funds, and our own records of fees you have paid us. We do not collect or store payment card numbers.
• Travel data, where trip planning is involved: dates, group size, preferences, accommodation and transport requirements.
• Correspondence: emails, messages and notes of calls and meetings.
• Website data: aggregate statistics about pages visited (see section 12).

3. Where it comes from

Almost all of it comes directly from you, through the forms on this website, by email or WhatsApp, or in conversation. Some may come from a parent, spouse, sponsor or employer acting on your behalf, or from a university or visa centre in the course of your application.

4. Why we use it, and our lawful bases

• To answer your eligibility check or enquiry (lawful basis: steps taken at your request before entering a contract).
• To provide the services you engage us for, including preparing and submitting applications (lawful basis: performance of our contract with you).
• To communicate with you about your application, deadlines and payments (contract, and our legitimate interest in running the engagement properly).
• To keep records of the advice given and work done, including for insurance, accounting and defending complaints (legitimate interests and legal obligation).
• To comply with law, including tax and, where applicable, anti-money-laundering and fraud prevention obligations (legal obligation).
• To improve the website using aggregate statistics (legitimate interests in understanding which pages are useful).
• To publish a client story on this website (consent, which you may withdraw at any time, after which we remove the story).

5. Special category and sensitive data

Some applications require information that is more sensitive than ordinary contact details, for example a health condition relevant to a visa medical requirement, or details of a criminal conviction that must be declared. We ask for such information only when a specific application genuinely requires it. Where we handle it, we do so on the basis of your explicit consent, or because it is necessary for the establishment, exercise or defence of legal claims. You can decline, though we may then be unable to complete that application.

6. Who we share it with

We share only what is necessary, and only with:

• universities, colleges, scholarship bodies and their agents, to make your application;
• immigration authorities, visa application centres and their appointed contractors;
• accommodation providers, airlines and travel operators where you have asked us to arrange or recommend a booking;
• our service providers, who process data on our instructions only. These currently are: Barely Notable OÜ (pepita), Estonia, for website hosting and enquiry-form handling; and Zoho, for our business email, hosted in its European data centre;
• professional advisers such as lawyers, accountants or insurers where necessary; and
• anyone we are legally required to disclose to.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

7. International transfers

We operate between Ghana and the United Kingdom, and your data may be transferred between the two, and to service providers located elsewhere. Where personal data is transferred out of the UK to a country that is not covered by UK adequacy regulations, we rely on appropriate safeguards (typically the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), and we take reasonable steps to satisfy ourselves that the data will be protected. You can ask us for details of the safeguards applied to your data.

8. How long we keep it

• Eligibility check and enquiry submissions that do not become engagements: up to 12 months, then deleted.
• Client files, including application documents and correspondence: 6 years from the end of the engagement, which reflects the period in which a claim or complaint could reasonably arise.
• Financial and tax records: 6 years, as required by tax law.
• Published client stories: until you withdraw consent.
• Aggregate website statistics: retained in aggregate form only and not linked to you.

We delete or securely destroy personal data at the end of these periods unless we are required to keep it longer.

9. How we protect it

• This website is served only over an encrypted HTTPS connection, with a strict content security policy and no third-party advertising or profiling scripts.
• Access to client files is limited to those who need it to deliver the service; accounts are protected by strong, unique passwords and two-factor authentication where the provider supports it.
• We ask for sensitive documents only when required, and through channels agreed with you.
• We never ask for your passwords or one-time codes, and we will never ask you to send money to an account not confirmed in writing; see Trust & Safety.
• If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.

10. Your rights

Under UK data protection law you have the right to:

• be told how your data is used (this notice);
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, where we no longer need it and no legal obligation requires us to keep it;
• restrict processing, or object to processing carried out on the basis of legitimate interests;
• receive certain data in a portable format;
• withdraw consent at any time, where consent is the basis we rely on; and
• not be subject to decisions based solely on automated processing; we do not make any such decisions.

To exercise any of these, email info@ongodadvisory.com. We respond within one month, and we do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

11. Children and young applicants

This website is not directed at children. Where an applicant is under 18, we work with a parent or legal guardian, and we require their consent before handling the young person's data.

12. Cookies and website analytics

This website does not use advertising cookies, tracking pixels, social media trackers or cross-site profiling of any kind.

Our hosting platform records aggregate visitor statistics (such as which pages are viewed, the approximate country a visit came from, and which site a visitor arrived from) so that we can see which pages are useful. This is reported to us as totals, not as profiles of individuals, and we cannot use it to identify you.

The site loads fonts from Google Fonts, which means your browser makes a request to Google's servers when a page loads. Your IP address is necessarily visible to Google as part of that request; Google states that Google Fonts does not set cookies for this purpose.

Any cookie that is strictly necessary for the website or its forms to function may be set without consent under the Privacy and Electronic Communications Regulations. If we ever add analytics or marketing technology that requires consent, we will ask you first through a cookie banner, and this section will be updated before that happens.

You can block or delete cookies through your browser settings at any time; the website will continue to work.

13. Marketing

We do not run mailing lists or send marketing messages to people who have not asked for them. If we introduce a newsletter, it will be opt-in, and every message will carry a one-click unsubscribe. Replying to your enquiry is not marketing.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at info@ongodadvisory.com so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. If you are in Ghana, you may instead complain to the Data Protection Commission of Ghana.

15. Changes to this notice

We update this notice when our practices or the law change. The current version and its effective date are shown at the top of this page, and material changes will be communicated to active clients directly.

This notice describes our actual practices and is written to meet UK GDPR and Data Protection Act 2018 requirements. It is not legal advice. Before registering a UK company you should confirm whether you must pay the ICO data protection fee and register as a data controller, and have this notice reviewed against your final business structure.