​1. About this policy

Education Quality Standards Consortium (“EQSC”, “we”, “us” or “our”) is the business brand operated through HERA LLC, USA, and transacted through Ivy InnovatEd in England and Wales, and HERA India in India.

​

This policy explains how we collect, use, disclose and protect personal information through our website, enquiries, membership, research, consultancy, assessments, certification and accreditation activities.

​

The legal entity responsible for a particular activity is identified in the relevant agreement, collection notice or project information. Where EQSC processes information on an institution’s instructions, the applicable data processing agreement also governs that activity.

​

2. Applicable laws

We handle personal information according to the laws applicable to the relevant activity and individual. These may include:

• United Kingdom: the UK GDPR, the Data Protection Act 2018, and applicable rules governing electronic communications and cookies, as amended.

• United States: applicable federal and state privacy, consumer protection and data security laws, including the California Consumer Privacy Act, as amended, where its requirements apply.

• India: applicable provisions of the Information Technology Act 2000 and associated rules, and the Digital Personal Data Protection Act 2023 (“DPDP Act”) and its rules as the relevant provisions come into force.

 

Rights and obligations depend on each law’s scope, exemptions and commencement dates. A reference to a law does not mean that every provision applies to every EQSC activity. India’s DPDP framework has phased commencement; this policy does not treat later requirements as having been in force on 1 April 2025. 

​

3. Information we collect

Depending on your interaction with EQSC, we may collect:

• Names, professional roles, institution details and contact information.

• Enquiries, correspondence, applications, agreements and membership records.

• Billing information and payment transaction references.

• Professional qualifications, experience and relevant reviewer or consultant information.

• Survey responses, interview contributions and institutional evidence needed for an agreed project.

• Website information, such as IP addresses, device and browser details, access logs and cookie preferences.

 

Information may come directly from you, your institution, authorised representatives, project partners, service providers or relevant public sources. We request information relevant to a defined purpose. Institutions should provide aggregated, anonymised or redacted evidence wherever practicable and avoid sending unnecessary personal records.

​

4. How we use information

We use personal information to:

• Respond to enquiries and administer institutional relationships.

• Deliver membership, research, consultancy and recognition services.

• Review evidence, verify findings and maintain assessment and decision records.

• Conduct agreed surveys, interviews and benchmarking studies.

• Manage contracts, invoices, payments and professional appointments.

• Maintain authorised directory and recognition register entries.

• Send permitted updates and communications.

• Protect our systems, investigate misuse, resolve disputes and meet legal obligations.

 

Under UK law, relevant grounds may include legitimate interests in administering and protecting our business, performing a contract with the individual, meeting legal obligations, or consent. We assess legitimate interests against individuals’ rights. A contract with an institution does not automatically provide a contractual basis for using its students’ or employees’ information. Where Indian law applies, we use the grounds permitted under that law, including consent or an applicable specified legitimate use. We do not treat UK legitimate interests as a substitute for an Indian legal requirement. Additional project or collection notices explain any different purposes, sensitive information or specific consent requirements.

 

5. Information supplied by institutions

An institution or representative providing personal information must have the authority and lawful basis to disclose it and must provide any required notices or obtain any required permissions. EQSC may request confirmation, supporting information or a safer alternative before accepting or using submitted records. We may decline unnecessary, excessive or unlawfully disclosed information. These responsibilities do not remove EQSC’s own obligations under applicable law.

​

6. Sharing and public information

We may disclose relevant information to authorised employees, reviewers, committee members, contracted researchers, technology providers, payment providers, professional advisers and other service providers where necessary for the stated purpose. Information may also be disclosed where legally required, to protect lawful rights, investigate fraud or security incidents, or support a business transfer with appropriate safeguards. Public directory and recognition register entries contain institutional information necessary to describe membership or recognition status. Any identifiable individual’s details require an appropriate lawful basis and notice. Confidential evidence and identifiable research responses are not published merely because an institution participates.

 

7. International processing

Information may be stored or accessed in the UK, USA, India or other countries used by authorised providers. Where cross-border restrictions apply, we use the required transfer arrangements and safeguards.

​

For restricted UK transfers, these may include an applicable adequacy arrangement or approved contractual safeguards, together with the required assessment. Indian transfers remain subject to applicable restrictions and other relevant laws.

​

8. Retention

We retain identifiable information for as long as reasonably necessary for its stated purpose, contractual administration, applicable record-keeping requirements, security or the establishment, exercise or defence of legal claims.  Retention depends on the relationship, record type, sensitivity, applicable limitation periods and any ongoing dispute or legal hold. Different periods may apply to enquiry records, institutional evidence, research responses and financial records. We delete or anonymise information when retention is no longer justified. Anonymised findings may be retained for research and benchmarking where individuals cannot be identified.

​

9. Security

We apply appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure. Access is limited according to role and need. No electronic transmission or storage system can guarantee absolute security. Where a personal information breach occurs, we assess it and notify affected individuals and authorities as required by applicable law.

​

10. Your rights and choices

Depending on applicable law, you may have rights to access, correct, delete or receive your information; restrict or object to processing; withdraw consent; or opt out of certain uses.  UK rights may include portability and objection to processing based on legitimate interests. You may object to direct marketing at any time. Where applicable, US state rights may include opting out of sale, targeted advertising or certain profiling, limiting specified sensitive-information uses, and appealing a request decision. Indian DPDP rights, when the relevant provisions apply, may include access to information, correction, erasure, grievance redressal and nomination.

​

Send requests to privacy@eqscglobal.com. We may reasonably verify your identity and authority before responding. We respond within applicable legal deadlines and explain any lawful limitation, refusal or extension. We do not discriminate against individuals for exercising protected rights.

​

Deletion is not automatic where records must lawfully be retained. Withdrawing consent does not affect earlier lawful processing, but may prevent us from continuing an activity that requires that consent.

 

11. Cookies and communications

Our Cookie Policy explains the technologies used, their purposes and available choices. Where consent is required for optional technologies, they are activated only after the appropriate consent.

​

You may unsubscribe from promotional communications using the instructions provided or contact privacy@eqscglobal.com. Necessary service messages may continue while an institutional relationship remains active.

Browsing the website does not constitute consent to every use of personal information.

​

12. Children and sensitive information

Our institutional services are primarily directed to organisations and adult professional contacts. Where a project requires children’s information or sensitive personal information, we establish the required lawful basis, notices, permissions and safeguards before processing it. Such information should not be submitted through a general enquiry form unless specifically requested through an appropriate process.

​

13. External services and liability

External websites and independently operated services have their own privacy practices. EQSC is responsible for its own processing and its legally applicable responsibilities concerning appointed providers. Any contractual limits on liability apply only where lawful. This policy does not exclude liability, compensation rights or regulatory remedies that cannot legally be excluded.

​

14. Complaints and contact

For privacy enquiries, requests or complaints, contact privacy@eqscglobal.com. We investigate complaints and respond within applicable requirements. You may also contact the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or the competent US or Indian authority where the relevant complaint mechanism is legally available. Contacting EQSC does not remove your right to seek a regulatory or judicial remedy.

​

15. Policy updates

We may revise this policy to reflect changes in our activities or applicable law. Revised versions show their actual update date. Material changes are communicated where required, and fresh consent is obtained where necessary.