This Privacy Policy explains how the Global University Rankings Index (GURI) collects, uses, shares and protects personal information when you use the GURI portal, including our university discovery and application services.
This document is a professionally structured draft pending final review by qualified legal counsel. It does not claim compliance certification.
The Global University Rankings Index ("GURI"), operated by GURI Global LLC, provides university rankings, institutional profiles, higher education intelligence, university discovery tools and application-related services.
- Registered company address: [Registered company address — to be completed]
- Privacy contact email: [privacy@gurindex.com]
- General contact email: [info@gurindex.com]
- Data protection representative, where applicable: [Data protection representative, where applicable]
This policy applies when you:
- Visit the GURI portal
- Create an account
- Search for universities
- Save institutions or programs
- Contact a university
- Submit an enquiry
- Start or submit a university application
- Upload application documents
- Subscribe to communications
- Use rankings, analytics or institutional services
- Full name
- Email address
- Telephone number
- Password or authentication credentials
- Country of residence
- Preferred language
- Date of birth
- Gender, where requested and legally permitted
- Nationality
- Country of residence
- Postal address
- Passport or national identification details, only where required
- Photograph, where required for an application
- Schools and universities attended
- Qualifications
- Grades
- Transcripts
- Graduation dates
- Academic interests
- Intended degree level
- Intended program
- Preferred intake
- Language proficiency
- Standardized test results
- CV or résumé
- Personal statement
- Recommendation letters
- Certificates
- Transcripts
- Portfolio
- Passport copies
- Supporting documents
- Scholarship-related information
- Application answers
- Messages sent to universities
- Enquiry forms
- Support requests
- Email preferences
- Communication history
- IP address
- Browser
- Device type
- Operating system
- Login records
- Session identifiers
- Approximate location
- Cookie identifiers
- Security logs
- Referral source
- Pages viewed
- Name
- Position
- Institutional email
- Telephone number
- University affiliation
- Administrative activity logs
We do not collect sensitive information unless it is necessary for a specific university application or legally required.
Personal information may be used to:
- Create and manage accounts
- Provide university search and discovery tools
- Save user preferences
- Process student enquiries
- Prepare and transmit applications
- Share applications with universities selected by the student
- Verify submitted information
- Communicate application updates
- Provide technical support
- Prevent fraud and misuse
- Maintain platform security
- Improve the GURI portal
- Produce anonymized or aggregated analytics
- Comply with legal obligations
- Maintain consent and audit records
We do not use student application data for unrelated advertising, and we do not sell it to third parties.
Depending on the activity and your jurisdiction, our processing may rely on:
- Performance of a service you requested
- Your consent
- Our legitimate interests
- Compliance with legal obligations
- Establishment or defense of legal claims
Consent is not the legal basis for every processing activity. Where we do rely on consent, the request is specific and separate, no boxes are pre-ticked, and we store the consent text, policy version, date, time, user identifier and IP address.
Where processing relies on consent, you may withdraw it, and withdrawal is made as accessible as giving consent. Withdrawal does not affect processing carried out before withdrawal, and it does not always require a receiving university to erase data it holds under another lawful basis or retention obligation.
When you select a university and submit an application:
- GURI processes your information to provide the application service.
- GURI transmits the application and supporting documents only to the selected receiving university or authorized admissions partner.
- The receiving university may process the information according to its own privacy notice and applicable law.
- The university is solely responsible for evaluating the application and making admission, scholarship and enrollment decisions.
- GURI does not guarantee admission, funding, visas or enrollment.
Before submission we show you the receiving university's legal name, country, privacy-policy link where supplied, data-use notice, application destination and contact information where available.
We do not transmit an application to a university that you have not selected or expressly authorized.
Applications may be transferred to universities in countries different from your country of residence.
Your application and supporting documents will be transferred to the selected university, which may be located in another country and subject to different privacy laws.
We record your confirmation of this notice before final submission. Appropriate safeguards and jurisdiction-specific notices are configured by GURI and are subject to legal review.
We retain personal data only for as long as reasonably necessary for providing the service, completing an application, resolving disputes, maintaining security records, meeting legal obligations, and establishing or defending legal claims.
Retention periods are configured by GURI administrators per data category (incomplete applications, submitted applications, closed applications, student accounts, uploaded documents, consent logs, security logs, support records and university administrator records). After the configured period, records are deleted or anonymized.
Depending on your jurisdiction and applicable law, you may request access, correction, deletion, account closure, data portability, withdrawal of consent, objection or restriction, an appeal of a rejected request, an opt-out from non-essential communications, or a change to your cookie preferences. Not all rights apply to every user.
You can submit a request through the GURI privacy request form at /privacy-request. We verify identity proportionately and do not request excessive identity documents.
We maintain safeguards designed to protect personal information, including:
- TLS encryption in transit
- Encryption at rest for sensitive documents
- Role-based access controls
- Multi-factor authentication for administrators
- Secure password hashing
- Audit logging
- Malware scanning for uploaded files
- Rate limiting
- Access monitoring
- Backup controls
- Incident-response procedures
- Least-privilege access
- Secure document URLs with expiration
- Prevention of public document indexing
No online system can guarantee complete security. GURI maintains reasonable administrative, technical and organizational safeguards designed to protect personal information.
The university application service is not intended for children under 13. We ask for date of birth in a neutral age-screening step before collecting application information.
- A user identified as under 13 cannot proceed with a standard application account.
- We display guidance to involve a parent or legal guardian instead.
- We do not store unnecessary information about the child.
- Where GURI intentionally supports applicants below the applicable digital-consent age, a verified parental or guardian authorization workflow applies.
The minimum permitted age is configurable by jurisdiction. We do not apply a single global age rule, because applicable ages differ between jurisdictions.
For privacy questions or requests, contact [privacy@gurindex.com] or use the privacy request form at /privacy-request.
Internal note for GURI staff: These legal templates and workflows must be reviewed and approved by qualified legal counsel before production publication, particularly regarding governing law, international transfers, children's data, retention periods, university-controller responsibilities, and jurisdiction-specific consumer rights.