Privacy Policy
This privacy policy explains how UCASCalculator.com ("we", "us" or "our") collects, uses and protects personal data when you visit our website. It complies with the UK General Data Protection Regulation (UK GDPR), the retained EU GDPR as applied in the UK by virtue of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) implementing the EU ePrivacy Directive, and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
- Last updated:
- 18 August 2026
- Effective:
- 18 August 2026
1. Who We Are & Data Controller
The website UCASCalculator.com is operated by Calc Digital Ltd, a company registered in England and Wales. For the purposes of the UK GDPR, EU GDPR, Data Protection Act 2018 and CCPA/CPRA, Calc Digital Ltd is the data controller and is responsible for determining the purposes and means of the processing of your personal data.
UCASCalculator.com c/o Calc Digital Ltd
Suite 221, 123 New Oxford Street
London WC1A 1HH
United Kingdom
Data Controller contact: dpo@ucascalculator.com
If you have any questions about this privacy policy, about how we process your personal data, or you wish to exercise any of your statutory data protection rights, please contact our Data Protection Officer (DPO) using the email or postal address above. You may also use our contact page to submit a general enquiry. We aim to respond to all data protection related correspondence within one calendar month of receipt.
2. Information We Collect
We collect two broad categories of information: usage data that is generated automatically when you browse the website, and any content that you voluntarily submit to us via email or our contact form. We do not operate a user account system, we do not require any form of registration or login to use our calculator tools, and we do not ask for personal data as a condition of accessing the core UCAS Tariff calculator functionality.
a) Usage data collected automatically
- Google Analytics 4 (GA4): anonymised or pseudonymised usage events including page views, scroll depth, outbound clicks, calculator interactions and session duration.
- Device and browser information: approximate geographic region derived from IP address (city level or coarser), operating system, browser user-agent string, screen resolution, preferred language and referring/exit pages.
- IP address handling: GA4 IP anonymisation is enabled, meaning the last octet of your IPv4 address (or the equivalent suffix of an IPv6 address) is zeroed out by Google before any storage or processing takes place.
b) Information you submit voluntarily
- Email correspondence: if you send us an email at dpo@ucascalculator.com or any other published address, we will store your email address, display name, any attachments and the full content of the message.
- Contact form submissions: any data entered into the contact form on the /contact page, which may include your name, email address, subject line and message body.
- Lawful basis: where you submit a query or request, we process that information on the basis of legitimate interests (responding to your enquiry) and, where the request relates to a data protection right, for the performance of a legal obligation to which we are subject.
We do not knowingly collect or solicit personal data from children under the age of 13 or equivalent age of digital consent in your jurisdiction. If you believe that we have received personal data from a person under the relevant age threshold, please contact our DPO immediately at dpo@ucascalculator.com and we will take reasonable steps to irretrievably delete that information from our systems.
3. Cookies We Use
A cookie is a small text file that a website stores on your device when you visit. Under PECR (which implements the ePrivacy Directive in the UK) and the equivalent GDPR cookie rules across the EEA, we are required to obtain your informed consent before setting any cookies that are not strictly necessary for the operation of the website. Our consent management banner lets you accept or reject non-essential cookies individually.
| Category | Cookie name(s) | Party | Duration | Purpose |
|---|---|---|---|---|
| Strictly Necessary | consent(consent banner state) | 1st party | 12 months | Stores your cookie consent preferences so that we do not show the consent banner on every page load. Set without consent because it is necessary to honour the choice you have made. |
| Analytics | _ga_ga_*(Google Analytics 4) | 3rd party (Google) | _ga: 2 years _ga_*: 2 years | Used by Google Analytics 4 to distinguish unique visitors, persist session state and send anonymised usage events. Subject to explicit consent. |
You can manage cookies at any time via your browser settings. Most modern browsers allow you to block third-party cookies entirely, clear existing cookies on exit, or send a Global Privacy Control (GPC) or Do Not Track (DNT) signal. Note that blocking strictly necessary cookies may prevent the consent banner from remembering your preferences, but will not impair the core UCAS Tariff calculator functionality.
4. Your Rights Under GDPR & UK GDPR
Where the processing of your personal data is subject to the UK GDPR or the EU GDPR, you have the following rights in relation to that data. These rights are not absolute and some are subject to conditions and exemptions set out in the legislation. We will respond to any valid request without undue delay and in any event within one month of receipt, extendable by a further two months only for complex or voluminous requests, in which case we will notify you of the extension and the reason within the first month.
Right of access
You may request a copy of all personal data we hold about you, together with details of the processing purposes, categories of data, recipients and retention periods, free of charge.
Right of rectification
You may ask us to correct any personal data that is inaccurate or incomplete. If we have disclosed the data to third parties, we will notify them of the rectification where this is possible.
Right of erasure
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where the processing is otherwise unlawful.
Right of restriction
You may ask us to suspend processing of your data where you contest its accuracy, where the processing is unlawful, where we no longer need the data, or while a rights objection is being determined.
Right to data portability
Where processing is based on consent or on a contract and is carried out by automated means, you may receive your personal data in a structured, commonly used and machine-readable format.
Right to object
You may object at any time to processing based on our legitimate interests, including profiling for those purposes, and to processing for direct marketing.
Right to withdraw consent
Where processing is based on your explicit consent (for example GA4 analytics cookies), you may withdraw that consent at any time via our consent banner or by contacting us. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.
Right to lodge a complaint
If you consider that our processing of your personal data infringes the UK GDPR, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk. EU-based data subjects may complain with their local national data protection authority.
5. CCPA / CPRA Rights (California Residents)
This section applies if you are a resident of the State of California, United States of America, for the purposes of the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), collectively "CCPA". Under the CCPA, California consumers have specific rights regarding the personal information that a business collects, discloses for a business purpose, or sells or shares for cross-context behavioural advertising. The 12-month lookback period for these rights commences from the date of your verified request.
Categories of personal information we collect
In the preceding 12 months, we have collected the following categories of personal information as enumerated in Cal. Civ. Code Section 1798.140: identifiers (pseudonymous cookie IDs, approximate geolocation, user agent), commercial information (no transaction data is collected), internet or other electronic network activity information (browsing history on our site, interaction events, referring URLs). We do not collect sensitive personal information as defined in Section 1798.140(ae) such as social security numbers, driver licence numbers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of private communications, or genetic or biometric data.
Right to know
You may request, up to twice in any 12-month period, that we disclose: the categories and specific pieces of personal information we collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we shared or disclosed it.
Right to delete
You may request deletion of any personal information that we collected from you, subject to certain statutory exceptions (for example, where the information is necessary to complete a transaction, to detect fraud or security incidents, to exercise a legal right, or to comply with a legal obligation).
Right to opt out of sale or sharing
Under CCPA Section 1798.120, you have the right to opt out of the sale of your personal information and out of the sharing of personal information for cross-context behavioural advertising. To opt out, you may use the cookie banner on our website (click 'Manage Options' and decline Analytics/Marketing purposes) or submit a request via our DPO contact details.
Right to non-discrimination
We will not discriminate against you for exercising any of your CCPA rights. Specifically, we will not deny you goods or services, charge you different prices or rates, provide a different level or quality of goods or services, or suggest that you will receive a different price or quality, solely because you exercised your CCPA rights.
Do Not Sell My Personal Information: In addition to the opt-out mechanisms described above, we respect Global Privacy Control (GPC) signals sent by your browser. When a GPC signal is detected, we will automatically treat your request as an opt-out of the sale or sharing of personal information for cross-context behavioural advertising on that browser and device, without requiring you to submit a separate request. To make a verified consumer request under the CCPA, please email our DPO at dpo@ucascalculator.com or write to us at the postal address in section 1. We may require reasonable verification of your identity (for example, confirmation of your email address) before responding to a request for specific pieces of personal information or for deletion, as required by Section 1798.130. An authorised agent may submit a request on your behalf provided they have written permission that we can verify.
6. Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, tax or reporting obligations. Where retention periods are mandated or permitted by statute (for example, the six-year limitation period under the UK Limitation Act 1980 for contractual claims, or the seven-year retention for VAT records under UK tax law), we apply those mandatory periods and delete or irreversibly anonymise the data promptly upon expiry. Where no mandatory retention period applies, we apply the following internal retention schedule:
Google Analytics 4 raw event data
14 monthsUser-level GA4 data retained for 14 months from date of collection, after which individual events are automatically aggregated and the pseudonymous user identifiers are permanently deleted by Google. Aggregate, non-personal reports (visits per month, top pages etc.) may be retained indefinitely for internal trend analysis.
Email enquiries and contact form submissions
24 monthsAll correspondence received via email or contact form, including attachments, held for 24 months from the date of the final reply in the thread, after which it is permanently deleted from our email provider and CRM. Where a thread results in an ongoing relationship (for example an ongoing data subject access request) the clock resets to the date of closure of that matter.
Cookie consent records
12 monthsA log of consent banner interactions (accept/reject/manage options, timestamp, consent string) retained for 12 months to demonstrate compliance with PECR and UK GDPR Article 7 requirements, on the lawful basis of our legitimate interest in being able to evidence consent if challenged.
Server and CDN access logs
30 daysWeb server, edge CDN and WAF access logs, which may contain IP addresses and user-agent strings, retained for 30 days exclusively for the purposes of security incident detection, DDoS mitigation, abuse prevention and technical troubleshooting.
7. How To Contact Our Data Protection Officer
If you have any question about this privacy policy, wish to exercise any of the rights described above, or have a concern about how we handle your personal data, please contact our Data Protection Officer (DPO) using any of the channels listed below. We do not charge a fee for responding to a legitimate data subject access request, unless the request is manifestly unfounded, excessive or repetitive, in which case we may either charge a reasonable administrative fee or refuse to act on the request.
Email (preferred)
We aim to acknowledge all data protection enquiries within 2 working days and provide a substantive response within one calendar month. Please include the phrase "Data Protection Request" in your subject line to help us triage your enquiry correctly.
Postal address
Data Protection Officer
Calc Digital Ltd
UCASCalculator.com, Suite 221
123 New Oxford Street
London WC1A 1HH
United Kingdom
For non-data-protection matters, feedback, bug reports or general questions, you may also use the general contact form on this website.
8. Last Updated
This privacy policy was last reviewed and updated on 18 August 2026. We may amend this policy from time to time to reflect changes in our processing activities, new features on the website, or changes in applicable law. Where we make material changes that affect your rights or the way in which we process your personal data, we will post a clear notice on the home page of the website for a reasonable period prior to the changes taking effect, and we will update the "Last updated" date at the top of and at the end of this document. Your continued use of UCASCalculator.com after the effective date of a revised privacy policy constitutes your acceptance of those revised terms to the extent permitted by applicable law. Where consent-based processing is affected by a material change, we will obtain fresh consent where required.