CalmaLink privacy notice
26-10-2026 · CALMA LINK LTD
Summary for students
Our authorised team accesses your application and documents to advise you, review missing items and process the admission you request. Your documents are not visible to other students or to people who referred you.
We share only the necessary information with the admissions partner or institution handling your application, when you ask to proceed and confirm submission. The recipient and documents are checked before delivery. We tell you the specific recipient before submission.
We keep data for as long as the application and legal obligations require. Applications that do not continue are reviewed for deletion or anonymisation, normally within 12 months of closure. Accounting records may need 6 years. Encrypted backups are kept for 30 days; deleted data may remain in them until they expire.
You can request access, correction or deletion on WhatsApp or through the privacy contact below. You do not have to wait for the retention period. If a legal duty requires us to keep some data, we explain it.
WhatsApp +44 7927 486655Controller and contact
CALMA LINK LTD, company number 17109753. 3rd Floor, 86–90 Paul Street, London, EC2A 4NE. Privacy contact: info@calmalink.co.uk. This notice covers students, tools and outstanding obligations to collaborators.
Application and documents
The portal handles your chosen course, CV, passport or applicable travel document, proof of address and settled/pre-settled status where relevant. To manage the account and application, it also processes identity, contact, residence and study details entered in the form. Fields may be saved as you complete them and viewed live by authorised administrators in the CRM. We do not access other pages or applications. We do not ask for Student Finance passwords.
Purpose and lawful basis
We use information to answer your enquiry, carry out pre-contractual steps you request and provide the service. We retain records where legally required and use limited data to prevent duplicates and fraud under legitimate interests, subject to your rights. An enquiry does not mean agreeing to advertising. Optional consent is requested separately.
Application delivery and checks
After you confirm submission and the required documents are approved, the portal may deliver the application to the agreed workspace and sheet of the authorised recipient. Incomplete applications or those awaiting internal review are not delivered. Preliminary reading may run in your browser; server checks may use private Google Drive processing to extract text, delete the temporary copy and retain only the summary result. Unclear cases need human review. These checks do not certify authenticity or decide admission or funding. You can request human review.
Security, providers and communications
Access is controlled by account and role. Cloudflare hosts the portal and database; Resend processes codes and notifications; Google Drive supports the document operations and encrypted backups described here. Documents are not attached to emails. Pending-application reminders are service messages and include an opt-out without closing your account. International transfers must have applicable legal safeguards; you can request information about them. Keep your private links secure.
Collaborators and historical obligations
This section applies only to outstanding agreements and rewards; it is not an invitation to join. We retain identity, agreement acceptance, attribution, general status, rewards and payments needed to settle earlier obligations. Referrers cannot access student documents, contact details, financial information or sensitive reasons. An abbreviated name is shown only with separate permission. Where a reward is outstanding, encrypted bank details are used only to pay it and are accessible to the holder and authorised administrators. We do not request banking credentials or verify account ownership with the bank.
Tools, storage and attribution
Answers in /empieza stay on this device for 30 days and can be removed using “Delete my answers”; they contain no name, email, phone number or documents. Local favourites have the same expiry. Funding tools do not save or send answers. sessionStorage holds the first campaign source in the tab, restricted to utm_source, utm_medium, utm_campaign and utm_content, without click identifiers or contact details, until the tab session ends. The portal retains its existing technical cookie and preferences. No advertising pixels are added.
Career test: classroom mode
Classroom mode stores the name or initials entered by the student, the class code and the result so the teacher can review the group. Access is restricted to the teacher with their key and CalmaLink. Results are deleted at the end of the school year. Individual mode does not require these details.
Your rights
You may exercise rights of access, rectification, erasure, restriction, portability and objection where applicable, and withdraw optional consent. We verify identity proportionately when needed. You can complain to the Information Commissioner’s Office (ICO).
Campaigns and saved results
We keep this tab’s first network, medium, campaign and video labels in sessionStorage. When you create an account, these labels and the entry tool are saved with your record to understand where applications come from. If you choose to save a test result, we save only its summary in your account, not your answers. Before registration, that summary expires on your device after 30 days. We count WhatsApp and course-choice clicks; accounts only after email verification and documents only after successful storage. Events are retained for up to 90 days, without storing IP addresses, advertising identifiers or document contents in the statistics. Account attribution follows your application’s retention period. To exercise your rights, contact info@calmalink.co.uk.
Journey and speed measurement
We use first-party statistics to understand completed steps, search categories with no course results and page speed. A random session identifier is stored in this tab for 30 minutes; limited events are retained for 30 days. We do not send your answers, free-text searches, form data or documents to these statistics. We record the public page, language, device type and connection category when the browser provides it. Cloudflare Web Analytics also provides aggregate statistics without cookies. You can disable our first-party measurement on this device; we also respect Do Not Track and Global Privacy Control.
