Privacy Policy.

Last updated: 21 May 2026.

1. Who we are

Global Students Orientation Services Limited ("GSOS", "we", "us") is the data controller for personal data collected through gsos.co.uk and through the delivery of our welcome service.

We are a company registered in England and Wales with company number 17208774. Contact: [email protected].

2. The data we collect

From parents when you submit an enquiry or make a booking:

• Your name and contact details (email, phone, preferred messaging channel)
• Your relationship to the student
• Your country of residence (used to localise communications)
• Payment information, processed by Stripe (we do not store full card details)

About the student with your authority and consent:

• Full name, age, university, accommodation address
• Flight details and arrival information
• Preferred language and any dietary or accessibility needs
• Any safeguarding considerations you tell us about
• Photographs taken during the service, only with your (and, where applicable, the student's) explicit consent

From hosts when they apply or work with us:

• Contact details, university, year of study, languages
• References, basic DBS check results, right-to-work documentation
• Bank details for contractor payment

3. Why we collect it and the lawful basis

We process the data above for the following purposes, on these lawful bases under UK GDPR Article 6:

• Contract performance (Article 6(1)(b)) — to deliver the GSOS service you have booked.
• Legitimate interests (Article 6(1)(f)) — to vet hosts, respond to enquiries, prevent fraud, improve our service.
• Consent (Article 6(1)(a)) — for marketing communications, for photography beyond the operational minimum, and for sharing testimonials.
• Legal obligation (Article 6(1)(c)) — for tax, accounting, right-to-work checks, and any law-enforcement requests.

Some information you choose to share — such as medical, dietary, accessibility, or safeguarding details about the student — is "special category" data under UK GDPR Article 9. We process it only with your explicit consent (Article 9(2)(a)), or where it is necessary to protect someone's vital interests (Article 9(2)(c)). You are never required to share this information to use our service.

4. Who we share data with

We share data only as needed to deliver the service or as required by law:

• Your assigned host — the student's name, age, flight details, accommodation, language, and any notes you have shared.
• Service providers — Stripe (payments), our email and messaging providers, our cloud hosting (Cloudflare), and Plausible Analytics if enabled and configured without personally identifying cookies.
• Education agents who referred your booking — only the fact and amount of the booking for commission processing; not the student's personal data.
• Regulators or law enforcement — only when legally required.

We do not sell your data, and we do not share it with third parties for their own marketing.

5. International transfers

Most data is stored on services in the UK and EU. If you are located outside the UK (for example in China, India, or Nigeria), your enquiry data travels from your country to our UK systems. We rely on standard contractual clauses or equivalent safeguards where required.

6. How long we keep it

We retain booking-related data for as long as needed to deliver and audit the service, and for the periods required by tax and accounting law (currently 6 years in the UK). We retain marketing-consent data until you withdraw consent. We delete enquiry data that does not become a booking after 12 months.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Restrict or object to processing
• Data portability — receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the UK Information Commissioner's Office at ico.org.uk

To exercise any of these, email [email protected]. We respond within one month, unless the law allows more time for a complex request.

8. Cookies and analytics

See our Cookies Policy for details. In short: we have not yet enabled analytics. If we enable Plausible Analytics, we will update the Cookies Policy first and confirm whether any consent control is required.

9. Marketing communications

We will only email you marketing content (such as articles from our Stories blog or updates about new cities) if you opt in. You can opt out at any time using the link at the bottom of every marketing email or by emailing us.

10. Children's data

Some students are aged 17 — under 18 in the UK. We collect data about under-18 students only with the booking parent's explicit authority and consent. We apply additional safeguards to photographs and communications involving under-18s; see our Safeguarding Policy.

11. Data breaches

If we discover a personal data breach, we assess whether it must be reported. Where reporting is legally required, we notify the UK Information Commissioner's Office within 72 hours of becoming aware of it. Where the law requires direct notice to affected people, we notify them without undue delay.

12. Changes to this policy

We may update this policy as the service evolves or as laws change. We will update the "last updated" date at the top and, for material changes, notify you by email if we hold your email for an active booking.

13. Contact

For privacy questions or to exercise any of your rights:

Email: [email protected]
Company number: 17208774 (registered in England & Wales)
Data protection contact: [email protected]

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.