Version 1.3 | Updated 24 September 2026
This notice covers our website, enquiries and education-support intake. Your personalised service terms explain the agreed work. You can contact info@alasrconsulting.com about your information.
Who is responsible
AL ASR CONSULTING LTD, company number 16439991, is responsible for the company records described here. Our registered office is 131 Leman Street, London, England, E1 8EY. Contact us first; there is no walk-in service. The Company Manager handles data-protection enquiries through info@alasrconsulting.com.
What we ask for
The public enquiry form asks for your name, reply address and the information needed to understand your question. A WhatsApp number is optional. Providing it lets us answer that enquiry through WhatsApp; it does not subscribe you to marketing. You can leave it blank and use email.
The separate Admissions and Scholarship intakes ask relevant questions about contact details, age group, education, grades, intended subject, destinations, dates, language evidence, current applications and funding needs. Research and scholarship questions appear where relevant. You can identify unknown or pending information. We use your answers as your account of the facts, not as independently verified qualifications or funding. An authorised company owner may first save a private draft and enter details for you, even before a student or lead case exists. The recipient label is for administration, not proof of identity. Owner-entered answers are shown for you to review and correct; they are not your confirmation. You must confirm declarations yourself.
Do not enter passwords, identity-document numbers, passport scans, bank statements, medical records or other sensitive originals in a general form. We will explain the restricted route if a document is needed later. You do not need to describe a diagnosis to ask for help using the service.
Why we use it
We use information needed to answer your request, assess whether we can help, organise agreed next steps and provide an accepted service. The legal basis for steps you ask us to take before a contract and necessary service delivery is contract. For general or representative enquiries and site security, we rely on our legitimate interests in answering requests and operating a safe service, subject to your rights. We use necessary accounting or rights-request records to meet an applicable legal obligation. We identify the actual obligation when relying on it.
Providing relevant information is voluntary, but missing contact details or essential qualification information may prevent a reply or useful assessment. Optional fields are labelled. A privacy acknowledgement does not give permission for unrelated marketing, institution contact, payment or an application submission. We ask separately for any specific application authority. If consent is the basis for an optional use, you can withdraw it without undoing earlier lawful processing.
Who receives information
Authorised company staff use the information needed for their work. The Company Manager oversees records and restricted original documents. Company email includes an owner oversight copy under our communication controls. A parent, payer or other helper does not automatically gain access to a student's whole record.
After a final intake response, an authorised reviewer may link it to an existing student case and record a limited document-needs decision, recipient route and due date. Operations uses that reviewed decision and documents already held to prepare a relevant request. The company task board receives the case, receipt and document categories, not raw form answers or private link secrets. Saving a draft or receiving a final response does not itself send a checklist or request documents.
Hostinger provides our website hosting and company email. Our existing company tools, including Codex/ChatGPT, support research and administration. WhatsApp carries messages when that channel is used. Google sign-in is used for the protected owner portal, not as a requirement to make an ordinary enquiry. These providers have their own service and privacy information.
We do not sell student lists or add enquiry senders to a campaign. An enquiry or intake alone does not cause us to share your application with a university, scholarship body or adviser. Before an agreed disclosure, we identify the recipient, purpose and relevant authority. We may make a necessary lawful disclosure for a legal duty, safeguarding concern or protection of rights, assessed for the actual situation.
Hosting, mail, messaging and software processing can involve locations or access outside the UK. We do not claim UK-only processing. We assess the actual supplier, contract and transfer arrangements for a proposed use. Contact us before supplying information if you need to discuss a location or processing restriction, or ask for details of the safeguards relevant to your record.
Website storage and protected forms
This website release does not load Google Ads measurement or send new page-visit or enquiry-conversion events to Google Ads. An earlier optional measurement choice may remain in your browser, but this release does not read or use it. Disabling the measurement does not undo information previously sent to Google or automatically remove any cookies already on your device; you can clear those in your browser settings. Google sign-in for the protected owner portal is separate from public-site advertising measurement. We do not use Google Analytics, embedded maps or third-party font requests in this public release.
The public enquiry handler uses a temporary hashed network identifier, time and count to limit repeated submissions. That rate record contains no message or raw network address. The limit is five attempts per hour. Rate records older than one day are removed when the enquiry handler runs. Hosting operational logs are separate.
The protected owner portal uses a separate Secure, HttpOnly session cookie restricted to /control/, with a 30-minute inactivity limit and an eight-hour maximum session. Candidate forms use the Secure, HttpOnly, SameSite=Strict cookie __Secure-AlAsrIntake, restricted to /forms/. A candidate session ends after 45 minutes of inactivity, eight hours from opening, invitation expiry or revocation, whichever comes first. Owner-issued invitations can expire from one hour to seven days. While a link remains active, the intended recipient can use it to open another session for its assigned form. Bare form routes and the form schema do not provide usable form content without authorised candidate access. An unfinished draft of answers, selected language and current step is stored privately with the invitation after the form reports that the draft is saved. A saving or error status means the latest changes may not be stored. Draft saving is not submission or acceptance of declarations. Form answers are not kept in browser local storage. The same active private link can restore a saved draft. Successful submission or revocation deletes the working draft; expiry ends access immediately and the next form-store cleanup removes the expired draft. Restricted recovery copies can contain earlier data until their retention and disposal process runs. A successful submission separately stores the answers, form and notice versions, declarations, receipt and any case link in private company storage. The protected receipt can be checked during a valid session. Owner corrections create dated answer versions and retain the original submission. The selected language and meaningful language changes are recorded privately; changing the form language does not translate free-text answers. Invitation secrets are stored only as hashes. A hashed network identifier limits repeated invitation attempts to 20 in 15 minutes; those rate records older than one day are removed on an exchange attempt. Session request limits also apply. No form accepts document uploads. A stored receipt confirms receipt of the answers only, not acceptance of a paid service, a university application, admission or funding.
The study planner calculates in your browser and sends no plan to Al Asr. Saving on your device is off by default. If you choose to keep the plan, the browser stores it and can restore it on a later visit. Someone using the same browser may see it. Turn saving off or use Clear all planning data to remove that saved copy. Copies you download, print or paste elsewhere remain your responsibility. Do not put personal identifiers or account details in the planner.
How long we keep records
We keep information while it is needed for the enquiry, agreed service, an open issue or a specific legal requirement. Enquiries that do not become cases are reviewed 90 days after the last substantive contact. Case information is reviewed at relevant milestones and within 30 days of closure. Those are review points, not a promise that every document is automatically deleted then.
We minimise unnecessary copies and record any reason for keeping information longer, such as an open complaint, an application deadline, accounting duties or a specific legal claim. Original documents stay under the separate custody process. Working candidate drafts are removed on submission or revocation and after expiry at the next form-store cleanup; expiry does not delete a submitted response. Owner-entered prefill, intake answers, invitation metadata, activity history and receipt versions are not automatically deleted by the form engine. Moving a form to Deleted is recoverable and revokes its links; it is not permanent erasure. Submitted records follow the milestone and closure reviews above, with a recorded decision and date. Expired server session files are eligible for routine session cleanup after eight hours. Existing local code recovery retains 14 dated archives and excludes restricted originals; this is not a claim of a tested independent backup of candidate responses. Restricted recovery copies containing earlier drafts follow their retention and disposal process. Hosting logs have a separate provider lifecycle; contact us for the period applying to a particular record. We do not retain inactive enquiries indefinitely for possible marketing.
Your choices and rights
Depending on the purpose and applicable law, you can ask for access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Email info@alasrconsulting.com. We check identity or authority only as necessary. Subject-access requests are normally answered within one calendar month; any legally permitted clarification, extension or restriction is explained. You do not need to use a special form.
You can complain to us about our use of information. We aim to acknowledge within two working days and provide a substantive response or meaningful update within five. If resolution takes longer, we explain why and the next update. These targets do not extend legal deadlines. You can also complain to the Information Commissioner's Office.
Accuracy and decisions
We use tools to organise research and administration. You can ask us to review or correct our guidance. This release does not make solely automated decisions with legal or similarly significant effects about you. Universities, funding bodies and the relevant authorities decide admission, scholarships and visas. Completing a form does not guarantee an outcome or commit you to a paid service.
Provider information
Hostinger privacy information, company software provider privacy information, WhatsApp privacy information and Google privacy information explain their respective services. These links do not replace our responsibility for choosing and controlling company processing.