Effective date: 23 October 2026 | Version: 1.0 | Last reviewed: 23 October 2026
Key points at a glance
This notice explains how the QS Group ("QS", "we", "us" and "our") handles personal data. We have tried to keep it clear and easy to navigate. Start with the summary below, then go to the section that best describes your relationship with us.
| Topic | In short |
|---|---|
| Who we are | QS Quacquarelli Symonds Limited, a UK company, and its Group companies (section 2). We publish the QS World University Rankings and run websites such as TopUniversities, TopMBA, 1Mentor and QS.com. |
| Our two roles | Most of the time we decide how and why your data is used, which makes us a controller. When we provide software or services to universities, employers or governments, we usually act on their instructions as a processor, and their privacy notice applies (section 4). |
| What we collect | It depends on how you interact with us: for example, your study interests if you use TopUniversities, your professional details if you are a client contact, or your survey answers if you take part in our reputation surveys. |
| Sharing with universities | If you ask us to, or agree to it, we share your details with universities and other institutions so they can tell you about their courses, meet you at events or consider your application (section 6). |
| Artificial intelligence | We use AI or similar technologies to recommend courses and careers, match students with institutions, and help our teams work efficiently. People review important outcomes, and we only make decisions with legal or similarly significant effects about you by automated means alone where the law allows it or you have consented (section 17). |
| Marketing | You can opt out of marketing at any time using the unsubscribe link in our messages, your account settings, or by emailing the unsubscribe contact listed in the email message (section 18). |
| International transfers | We are a global organisation. Your data may be processed in countries outside your own, and when it is, we put appropriate safeguards in place (section 21). |
| Your rights | Depending on where you live, you can ask to access, correct, delete or move your data, object to or restrict its use, and withdraw consent (section 25). Additional rights apply in some countries (sections 28–31). |
| Employees | Section 14 explains how we use personal data about our employees, workers and contractors. |
| Contact | Our Group Privacy Office: [email protected] (section 5). |
How this notice is organised
This notice is in four parts. Part A applies to everyone. Part B has sections for different groups of people; read the one or more that apply to you. Part C applies to everyone and covers matters common to all our processing. Part D contains extra information required by the laws of particular countries and regions.
Part A – About this notice
1. About this notice
QS is committed to protecting your personal data and to being open about how we use it. This notice describes how we collect, use, share and protect personal data when you visit our websites, use our apps and platforms, attend our events, take part in our surveys and research, work with us as a client, partner or supplier, apply for a job with us, or work for us.
We wrote this notice to meet the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018 (together, "UK GDPR") and the EU General Data Protection Regulation ("EU GDPR"). Because we operate globally, we also follow other data protection laws that apply to us. Part D explains additional rights and information for people in particular countries and regions.
This notice does not cover personal data we process only on behalf of a university, employer, government body or other client (see section 4). Section 14 explains how we handle personal data about our own employees, workers and contractors; local employee handbooks and policies may give further detail.
2. Who we are
QS Quacquarelli Symonds Limited is a company registered in England and Wales (company number 02563879) with its registered office at 1 Tranley Mews, Fleet Road, London NW3 2DG, United Kingdom. It is the parent company of the QS Group (QS Quacquarelli Symonds Limited and its subsidiary companies, together the "QS Group"). Where another QS company provides the service, you are using, or communicates with you, that company is the independent controller for that purpose. A full, up-to-date list of QS Group companies can be found QS Group Companies List | QS
In this notice, "QS", "we", "us" and "our" mean QS Quacquarelli Symonds Limited and its subsidiary companies. Each QS company that decides how and why your personal data is used for a particular service is a controller for that service. Where two or more QS companies jointly decide how your data is used, they share responsibility as joint controllers, and you can contact any of them, or our QS Group Privacy Office, to exercise your rights. The essence of these arrangements is available on request from [email protected].
3. Our websites, apps and services
This notice applies to the following websites, apps and services, and to any other QS website or service that links to it:
| Website, app or service | Who it is for | What it does |
|---|---|---|
| TopUniversities (topuniversities.com) and TopMBA (topmba.com) | Prospective students, students, parents and anyone researching universities and business schools | Our main student-facing websites: rankings, university and course information, course matching and career tools, student accounts, events, scholarships information and newsletters |
| QS Apply (including services formerly known as StudentApply and QS Admissions Services) | Prospective international students and education agents | Free counselling, eligibility checks, university and course recommendations, and help with applying to partner universities |
| QS student recruitment events (including QS Discover, QS Connect, QS Connect Plus, high school tours, webinars and virtual fairs) | Prospective students and participating institutions | In-person and online fairs, one-to-one meetings between students and universities, and information sessions |
| QS Partner Discovery | Universities, higher education institutions and staff responsible for international partnerships | An online platform where institutions create profiles, showcase existing partnerships, publish and discover partnership opportunities, express interest and connect with potential partner institutions |
| QS.com (qs.com), QS Hub and the QS Portal | Universities, governments, employers and other organisations | Information about our solutions, rankings participation and data submission, analytics products, insights and publications |
| QS conferences and summits (including Reimagine Education, EduData Summit, QS Higher Ed Summits, Global Skills Week and regional forums) | Higher education leaders, academics, government officials, sponsors and speakers | Sector conferences, networking, matchmaking and awards |
| QS Insights Magazine, QS Yearbook and other publications | Subscribers and readers | Newsletters, articles, reports and downloads |
| QS MoveON and QS MoveIN | Universities and their students, applicants and staff | Software for international mobility, partnerships and admissions (we act as a processor – see section 4) |
| QS Enrolment Solutions services | Universities and their prospective students and applicants | Enquiry management, offer conversion, admissions and compliance support, and regional recruitment (we act as a processor – see section 4) |
| 1Mentor (1mentor.io) | Students, graduates, job-seekers, universities, employers and governments | Career exploration, skills and course recommendations, and curricular, alumni and labour-market analytics |
| QS China (qs-topuniversities.cn) | Students and families in China | Chinese-language rankings and study-abroad information, and study-abroad advisory services |
| Future17 and the Responsible AI Consortium | Students, academics, mentors and employers from member institutions | Collaborative challenge programmes and academic networks |
| QS I-GAUGE (igauge.in) | Indian institutions | Ratings of colleges and universities |
Some QS websites have their own privacy notices or supplementary notices. Where they do, those notices apply alongside this one. If there is any inconsistency, the more specific notice applies to that service.
4. When we act on behalf of others (controller and processor)
Data protection law draws a distinction between a controller, which decides why and how personal data is used, and a processor, which handles personal data on a controller's behalf and in line with its instructions.
Where QS is a controller
QS is a controller when we decide why and how your personal data is used, for example when you create a TopUniversities account, register for a QS event, use QS Apply, take part in our academic or employer reputation surveys, or are a contact at one of our clients or suppliers. This notice applies to that processing.
Where QS is a processor
We provide software and services to universities, employers, governments and other organisations. When we do, we usually process personal data on their behalf as a processor. Examples include:
QS MoveON and QS MoveIN, which universities use to manage student mobility, partnerships and admissions;
QS Enrolment Solutions services, where our advisers contact prospective students, manage enquiries and support admissions in the university's name;
1Mentor deployments provided to a university, employer or government for its students, alumni, employees or citizens;
QS Reputation Manager, which universities use to manage the academic and employer contacts they nominate;
consulting projects, such as graduate outcome surveys, focus groups and market research we carry out for a client; and
webinars, email campaigns and lead generation activities we run for, and on the instructions of, a university using the university's own data.
In these cases the organisation we work for is the controller, and its own privacy notice explains how your data is used. If you have questions or want to exercise your rights, please contact that organisation first. If you contact us, we will pass your request to the organisation and help it respond.
Where we act as a processor but also use some data for our own purposes
Even when we act as a processor, we may act as a controller for a limited amount of personal data that we need to run and protect our own services. This includes:
registering and managing user accounts and log-ins for our platforms, and keeping records of user sessions;
recording IP addresses, device information and system logs to keep our services secure, prevent fraud and misuse, and investigate incidents;
providing customer support, training and service communications to client staff;
maintaining our business relationship with the client, including contracting, billing and account management; and
creating anonymised or aggregated information (which no longer identifies you) to improve our products, produce benchmarks and insights, and develop new services, where our contract with the client allows this.
This notice applies to that processing.
Sometimes QS and a university or other organisation each make decisions about the same personal data for our own purposes. For example, when you ask us to share your profile with a university at a QS event, QS is a controller for running the event and the university becomes a separate controller of the details it receives. The university's own privacy notice then applies to its use of your data.
5. Contact us
If you have any questions about this notice or how we handle your personal data, or if you want to exercise your rights, please contact us:
| Purpose | Contact details |
|---|---|
| QS Group Privacy Office (all QS companies) | Email: [email protected] Post: QS Group Privacy Office, QS Quacquarelli Symonds Limited, 1 Tranley Mews, Fleet Road, London NW3 2DG, United Kingdom |
| Exercising your rights | [email protected] |
| Unsubscribing from marketing | use the link in any marketing message or your account settings |
| EU representative (for people in the European Economic Area) | QS Unisolution GmbH acts as our representative in the EU for the purposes of Article 27 of the EU GDPR. |
| UK representative (for non-UK QS companies) | QS Quacquarelli Symonds Limited acts as our representative in the UK for the purposes of Article 27 of the UK GDPR. |
| Country-specific contacts | See Part D (for example, our grievance officer in India and our personal information protection contact in China) |
Part B – Information for specific people
How to read the tables in this notice
In Part B we set out, for each group of people, the purposes for which we use personal data and our "legal basis" under data protection law. The legal bases we rely on are:
Contract – the processing is needed to perform a contract with you, or to take steps you have asked for before entering into one (for example, registering you for an event or providing a service you requested).
Legitimate interests – the processing is needed for our legitimate interests or those of a third party (such as a university you are interested in), and your interests and rights do not override those interests. You can ask us for more information about how we have balanced these interests.
Consent – you have given us clear permission, for example to receive marketing by email or SMS, to share your details with a university, or to place non-essential cookies. You can withdraw consent at any time; this does not affect processing that took place before you withdrew it.
Legal obligation – we must process the data to comply with the law, for example tax, accounting or immigration requirements.
Where we process special categories of personal data (such as health information, disability, or racial or ethnic origin) or information about criminal convictions, we do so only where an additional legal condition applies, such as your explicit consent or where the processing is needed for legal claims. Where you give us this information voluntarily, we tell you why we need it and ask for your explicit consent.
If we need personal data to comply with the law or to perform a contract with you, and you do not provide it, we may not be able to provide the service you asked for (for example, register you for an event or submit your application). We will tell you when information is mandatory.
Please read the section or sections that describe your relationship with QS. Many people fall into more than one group: for example, a university staff member may be a client contact, a conference delegate and a survey respondent.
6. Students, prospective students and website users
This section applies if you visit TopUniversities, TopMBA, QS China or another QS student-facing website; create an account; use our course matching or career tools; sign up for newsletters; register for or attend a QS student recruitment event or webinar; use QS Apply or QS Teli; or take part in our student surveys. It also applies to parents, guardians and school counsellors who use these services.
6.1 What personal data we collect
| Type of data | Examples |
|---|---|
| Identity and contact details | Name, email address, mobile number, WhatsApp or WeChat ID, country and city of residence, nationality, gender, date of birth or age |
| Account details | Username, password (stored in encrypted form), account identifiers and, where you choose to use it, details from a social log-in such as Google or Facebook |
| Education and career profile | Highest qualification, current institution, subjects studied, grades and test scores (for example GMAT, GRE, IELTS or other English language tests), graduation year, languages, work experience, current employer and industry, job title, career aspirations, CV or LinkedIn profile and, on TopMBA, whether you are a US armed forces veteran |
| Study preferences | Intended level and mode of study, subjects and specialisations of interest, preferred destinations and universities, intended start date, budget, funding source and interest in scholarships |
| Application information (QS Apply only) | Passport details, visa history (including any refusals), address and emergency contacts, education history and study gaps, personal statements, references, research proposals and supporting documents. With your explicit consent, it may also include disability status, criminal or academic suspension history, ethnic origin and health information where a university or immigration authority requires it |
| Event information | Events you register for or attend, ticket and QR code details, check-in times, the institutions you meet or whose staff scan your QR code, meeting schedules and outcomes, and photographs or video taken at events |
| Communications | Emails, SMS, WhatsApp, WeChat and chat messages, records of calls with our advisers and, where enabled and you are told in advance, call recordings and transcripts |
| Preferences and consents | Marketing and communication preferences, consent records, subscription status and opt-out (suppression) records |
| Technical and usage data | IP address, approximate location, device and browser information, cookie and advertising identifiers, session identifiers, pages viewed, searches, clicks, referral source and campaign (UTM) information |
| Survey and feedback responses | Your answers to our surveys, which may include household income, employment status and views on study destinations |
| Information we derive | Audience segments, course and career recommendations, university matches, eligibility outcomes, and engagement, fit and priority scores (see section 17) |
| Payment information | Where you pay for a service, payment and transaction details (card details are handled by our payment providers) |
6.2 Where we get your personal data from
We collect most of this information directly from you when you complete forms, create an account, register for events, use our tools or communicate with us. We also collect information automatically through cookies and similar technologies (section 19). In addition, we may receive information about you from:
universities and partner platforms, for example when you agree to share your details with QS through a university's chat platform such as Unibuddy;
social media and advertising platforms, such as Meta, Google, LinkedIn and TikTok, when you complete a QS lead form on those platforms;
education agents and referral partners who refer you to QS Apply or QS Teli with your agreement;
partner organisations who promote our webinars and events to their audiences; and
other QS Group companies, where you have used more than one QS service.
6.3 How we use your personal data and our legal basis
| Purpose | Legal basis |
|---|---|
| Running our websites: delivering our websites and their features, remembering your settings, keeping our services secure and preventing spam and misuse (for example using reCAPTCHA) | Legitimate interests (operating secure and functional websites); contract where you are logged in |
| Understanding how our websites are used: analytics, measuring the performance of content and products, and asking visitors to tell us what best describes them (for example student, parent or academic) so we can improve our services | Consent for non-essential cookies and similar technologies, where the law requires it; otherwise legitimate interests (improving our services) |
| Your account and profile: creating and managing your account, saving your shortlist and preferences, and linking your earlier browsing activity to your profile when you register | Contract |
| Personalisation: maintaining a connected profile of your interests and activity across our student services, so we can show you relevant content, universities, events and opportunities | Legitimate interests (providing a relevant, personalised service); consent where the law requires it for tracking technologies. You can object at any time |
| Course matching and career tools: generating course, programme, university and career recommendations based on the information you provide (see section 17) | Contract (providing the tool you asked to use); legitimate interests for related analytics |
| Marketing from QS: sending newsletters and information about QS events, webinars, counselling services, scholarships, rankings and other QS products by email, SMS, WhatsApp, WeChat or telephone | Consent, or legitimate interests where the law allows marketing to existing users without prior consent. You can opt out at any time (section 18) |
| Messages about universities: sending you information from or about universities and partners relevant to your study interests, including messages we send to our own subscribers on a university's behalf | Consent |
| Events: registering you for events, issuing tickets and QR codes, sending confirmations and reminders (including reminders to complete an unfinished registration), managing check-in and attendance, and arranging one-to-one meetings | Contract; legitimate interests (helping you complete your registration and get the most from the event) |
| Matching you with institutions: assessing your profile against participating institutions' requirements so we can suggest suitable institutions and meetings (for example our automated matching and booking at QS Connect events) | Legitimate interests (helping students and institutions find suitable matches); contract where this is part of the event service you registered for |
| Sharing your details with universities: sharing your profile with institutions you meet, whose staff scan your QR code, whose information you request, or to which you agree your details may be sent (section 6.4) | Consent |
| Advertising: showing you QS and university advertising on social media and other websites, including by securely matching your contact details with advertising platforms (custom and similar audiences), and measuring campaign performance | Consent |
| QS Apply – guidance: assessing your eligibility, recommending universities and programmes, prioritising and routing your enquiry to a suitable adviser, providing counselling and keeping in touch about your application journey (see section 6.5) | Legitimate interests (responding to your enquiry and providing the guidance you asked for); consent for marketing and nurture messages |
| QS Apply – applications: preparing and submitting your applications and supporting documents to universities, and communicating with you and the university about your application | Contract; explicit consent for any special category or criminal records information |
| QS Apply – enrolment and commission: confirming your enrolment with the university so that we, and any education agent who referred you, can be paid | Legitimate interests (receiving payment for our services); legal obligation (financial record-keeping) |
| Additional services you request: putting you in touch with accommodation, finance or other partners where you ask us to | Consent |
| Scholarships: processing applications for QS-managed scholarships, such as the QS ImpACT Scholarship and TopMBA scholarships, and sharing shortlisted applications with sponsors or partner schools | Contract; legitimate interests |
| Surveys and research: inviting you to give feedback on our events and services, and to take part in research such as the QS International Student Survey and data collection for the QS Best Student Cities ranking, producing aggregated insights from the results and, where offered, sending you a participation incentive through our incentive provider | Legitimate interests (improving our services and producing research); consent where we ask for it |
| Support: answering your questions and complaints, helping with password resets and account closure, and handling requests to unsubscribe or delete your data | Legitimate interests; contract; legal obligation (responding to rights requests) |
| Payments: processing payments for services you buy from us | Contract |
| Event photography and filming: taking photographs and video at events for reporting, promotion and our archive (we tell you when filming is taking place and you can ask not to be photographed) | Legitimate interests (promoting and reporting on our events); consent where the law requires it |
| Product development and insights: analysing how our services are used and creating anonymised or aggregated statistics to improve our services and produce insights about student behaviour and preferences | Legitimate interests (developing our services and research) |
| Legal and compliance: keeping records, complying with legal obligations, preventing fraud, enforcing our terms and defending legal claims | Legal obligation; legitimate interests (including establishing, exercising or defending legal claims) |
6.4 When we share your details with universities and other institutions
Connecting students with universities is central to what we do. For student recruitment purposes, we share your personal data with a university, business school or other education provider only when:
you register for a QS event and agree that your details can be shared with participating institutions;
you meet an institution at an event, or allow an institution's representative to scan your QR code;
you request information from, or submit an enquiry to, a specific institution through our websites (for example through an institution's profile page) or through a lead form that names the institution;
you have opted in to receive information from institutions relevant to your study preferences; or
you ask QS Apply to submit an application on your behalf.
We share the information needed for that purpose, typically your name, contact details, country, nationality, study interests and, if you provided them, your academic background, work experience and CV or LinkedIn profile. We keep a record of which institutions have received or accessed your details. With your consent, we may also share event registration details with local partners involved in an event, such as government education agencies (for example EducationUSA or Austrade), test preparation organisations and career coaches.
Once an institution receives your details, it uses them as a separate controller under its own privacy notice. Some institutions are located outside your country (section 21). Universities pay QS for many of these services. If you no longer want us to share your details, tell us and we will stop future sharing; to have an institution delete details it already holds, please contact that institution directly.
Separately, if QS Apply submitted your application, we share the enrolment information needed to confirm your enrolment and claim our fees with that university and, if you were referred by an education agent, with the agent (section 6.5).
We do not share details from past events with institutions that were not part of your original consent unless we have checked that this is permitted and, where required, asked you again.
6.5 QS Apply
QS Apply offers free guidance to prospective international students and helps them apply to partner universities. When you complete our online eligibility and study preference form, we use your answers to assess your eligibility against criteria for different universities and destinations, generate recommendations, and give your enquiry a priority rating so that the right adviser can contact you promptly. A QS adviser reviews all recommendations, qualification outcomes and decisions about how your enquiry progresses before further action is taken.
If you decide to apply, we create an applicant record and ask for the information each university needs. Some universities and immigration authorities require information about disability, health (for example tuberculosis screening), criminal convictions or academic suspensions. We collect this only where it is required or you choose to provide it, we use it only to process your application, and we ask for your explicit consent. You can decline to provide optional information, although this may affect your application.
If you are referred to QS Apply by an education agent, the agent may create your profile and see the progress of your application, and we share enrolment and commission information with them. Even if you opt out of marketing, we will still send you essential messages about an application you have started.
6.6 QS China and QS Teli
If you use QS China websites or QS Teli advisory services in China, your personal data is handled in line with this notice and the China section in Part D (section 29). QS Teli advisers use your name, phone number, WeChat ID, academic background and case progress to provide study-abroad advice and to manage your enquiry. We may receive your details from social media and from referral partners with your agreement. Our legal basis is your consent and performance of our advisory contract with you.
6.7 Who else we share your data with
In addition to the institutions described above, we share personal data with our service providers, such as our customer relationship management, event management, messaging, analytics, advertising, payment and cloud hosting providers, and with other QS Group companies. Section 20 has more detail.
7. Students and applicants of universities we support
This section applies if you are a prospective student, applicant, student or member of staff at a university or other institution that uses QS services such as QS MoveON, QS MoveIN, QS Enrolment Solutions (including enquiry management, offer conversion, admissions and compliance, student success and regional recruitment services) or university-branded webinars and campaigns run by QS.
In these cases, the institution is the controller and QS acts as its processor (section 4). We process your personal data only on the institution's documented instructions and under a contract that requires us to protect it. The institution's privacy notice explains how your data is used and your rights. Please contact the institution first with any questions or requests.
To give you an idea of what this involves, on behalf of institutions we may:
answer your enquiries by email, telephone, SMS, WhatsApp, WeChat or live chat in the institution's name, using approved templates and AI-assisted drafting tools that our advisers review before sending;
contact you about incomplete applications or offers, and run outbound call campaigns;
process applications, check documents and finances, carry out pre-CAS credibility interviews and genuine student checks, and process health or family documents where required for immigration purposes;
send email campaigns and nurture messages, build web forms and run webinars;
apply statistical and machine-learning models, such as lead scoring and conversion prediction, to help the institution plan its recruitment (the institution, not QS, makes any admissions decision); and
host and support the institution's software, including fixing technical issues.
As explained in section 4, QS remains a controller for limited data about the users of our platforms, such as log-in records and security logs, for monitoring the quality of our advisers' work and training them, for internal operational reporting, and for anonymised or aggregated statistics. If you contact us directly about a service we provide to your institution, we will pass your request to the institution and help it respond.
8. 1Mentor users
1Mentor is a QS company whose platform helps students, graduates, job-seekers and employees explore careers, identify skills and find relevant courses and jobs. It also provides universities, employers and governments with curricular, alumni and labour-market analytics.
When you access 1Mentor through an organisation
Most people use 1Mentor because their university, employer or a government programme provides it. In that case the organisation is the controller and 1Mentor acts as its processor. The organisation's privacy notice applies, and you should contact the organisation first about your rights.
What 1Mentor does with your data
To provide the service, 1Mentor processes your profile and account details, education and employment history, skills and interests, the CV you upload and your activity on the platform. We use automated tools to extract structured information from your CV (for example skills, qualifications and job titles) and to generate personalised career, course and job recommendations (section 17). We keep CV data until your account is deleted.
1Mentor acts as a controller when it uses platform data to keep the service secure, to understand how the platform is used (using analytics tools such as Mixpanel), and to create anonymised or aggregated insights about skills, careers and labour-market trends. Aggregated insights do not identify you. Our legal basis is our legitimate interests in operating, securing and improving the platform and in producing labour-market research.
Job, course and alumni data
1Mentor uses information about job postings, courses and online learning programmes to power its recommendations and analytics. Our alumni and labour-market analytics may use publicly available professional profile information (such as job titles, employers and education history) to produce aggregated or identifiable reports for institutions. Where we do this you can exercise your rights at any time by contacting [email protected].
9. Academics, employers and survey respondents
This section applies if you are invited to take part in, or respond to, the QS Academic Reputation Survey or the QS Employer Reputation Survey. The results of these surveys are important indicators in the QS World University Rankings and our other rankings, and they inform our analytics products and consulting work.
9.1 What we collect and where it comes from
We collect your name, email address, organisation, country, job title and seniority, field of expertise and, for academics, your ORCID identifier. For employer respondents we may also collect your industry, the size of your organisation, whether you manage staff, your educational background and the institution you graduated from, your LinkedIn profile and your organisation's website. We may ask for your gender for statistical analysis. When you respond, we collect your survey answers together with technical information such as your IP address, approximate location (latitude and longitude derived from your IP address) and device and browser configuration, which we use to validate responses.
You may have signed up to take part yourself. Alternatively, your contact details may have been provided to us by a university or organisation that nominated you, for example through QS Reputation Manager. Institutions use QS Reputation Manager to manage their nominations, and once a nomination is submitted for our surveys QS uses it as a controller. We may also obtain contact details of academics from publicly available sources, such as institutional websites and research databases, and from reputable third-party list providers. We record how your details reached us.
9.2 How we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Inviting you to take part in our surveys and sending reminders | Legitimate interests (producing independent rankings and research); consent where you signed up or where the law requires consent for email invitations |
| Administering the survey and validating responses, including detecting duplicate, fraudulent or manipulated responses | Legitimate interests (protecting the integrity of our rankings) |
| Producing rankings, performance insights and research. We publish and share only aggregated results; we never publish individual responses or identify you as a respondent | Legitimate interests |
| Creating derived datasets for our analytics products and consulting projects, and carrying out longitudinal research (comparing results over time) using pseudonymised data | Legitimate interests |
| Sending you information about the outcomes of the survey and inviting you to future surveys | Legitimate interests; consent where required |
9.3 Sharing
Your individual responses are available only to authorised QS teams (such as our rankings, data operations, analytics and consulting teams) and to our survey and data platform providers (such as Qualtrics and Snowflake). We do not tell the institution that nominated you how you answered. You can opt out of future surveys at any time using the link in our invitations.
10. Universities, clients and other business contacts
This section applies if you work for a university, government body, employer, company or other organisation that is a client, prospective client, partner or rankings participant of QS, or if you use QS.com, the QS Hub, the QS Portal or our analytics products.
10.1 What we collect and where it comes from
We collect your name, job title, department, organisation, work email address and telephone number, country, area of responsibility and, where relevant, your signature and authority to sign contracts. If you use our platforms, we collect your account details and how you use the platform. We also keep records of our communications with you, your participation in our webinars, training and events, your interactions with our emails and website (such as opens, clicks, pages visited and form submissions), and billing and payment details for your organisation.
We collect this information from you, from colleagues at your organisation, and from publicly available sources such as institutional websites and professional networking sites (including LinkedIn Sales Navigator). We also use data enrichment and validation providers (such as Clay) to check and update professional contact details, and we may receive lists of attendees from the organisers of third-party conferences where we exhibit.
10.2 How we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Rankings participation: managing your institution's participation in QS rankings, including access to the QS Hub for data submission and validation, and sending you fact files, results, methodology updates and data collection reminders | Legitimate interests (producing accurate rankings and keeping participating institutions informed) |
| Providing our products and services: giving you access to our platforms, analytics products, QS Stars and AI assessments, consulting and other services, and providing onboarding, training (including online courses) and customer support | Contract with your organisation; legitimate interests in respect of you as its representative |
| Managing our relationship: preparing proposals, quotes, contracts and renewals, account management and keeping our customer relationship management (CRM) and finance systems up to date | Legitimate interests; contract |
| Billing and payments: invoicing, processing payments, credit control and debt collection, and handling refunds | Contract; legal obligation (tax and accounting); legitimate interests (recovering debts) |
| Feedback: asking for your views on our products, services and events through surveys | Legitimate interests (improving our services) |
| Business development and marketing: identifying relevant contacts at organisations, checking that contact details are accurate, segmenting contacts, and sending you information, insights, invitations to webinars and events, and offers about QS products and services | Legitimate interests (promoting our products to relevant organisations); consent where the law requires it for electronic marketing |
| Understanding engagement: tracking how you interact with our emails, website and content so we can prioritise follow-up and improve our campaigns | Legitimate interests; consent for non-essential cookies where required |
| Publications and downloads: providing reports, the QS Yearbook, QS Insights Magazine and other content you request, and reporting aggregated readership statistics to sponsors | Contract; legitimate interests |
| Platform security and product improvement: keeping our platforms secure, monitoring use, and analysing anonymised usage data to improve our products | Legitimate interests |
| Compliance: carrying out checks we are required to carry out, keeping records and responding to authorities | Legal obligation; legitimate interests |
10.3 Consortia and collaborative programmes
If you take part in Future17, the Responsible AI Consortium or a similar QS programme as a member institution's lead, faculty member, mentor, employer or student, we use your name, contact details, organisation, role and location to register you, match you with projects and working groups, and introduce you to other participants. Other participants in your project or group will see your name, organisation and email address. Our legal basis is our legitimate interests in running the programme and, where applicable, the contract between QS and your institution.
11. Conference delegates, speakers, sponsors and event participants
This section applies if you register for, speak at, sponsor, exhibit at or attend a QS conference, summit, webinar, awards event or student recruitment event as a professional, including as a university representative at a QS Discover or QS Connect event. It also applies if you visit a QS stand at a third-party event.
11.1 What we collect
Depending on the event and your role, we collect your name, job title, organisation, contact details, country, area of responsibility and professional interests; your biography, photograph and LinkedIn profile if you are a speaker or exhibitor; dietary and accessibility requirements; payment details; and information about your attendance, meetings, use of the QS Leads App and badge scans. We may find potential speakers through web searches and professional networks. Where we help with visas, travel or security clearance, we may also collect your date of birth, nationality, passport details and copy, travel itinerary, emergency contact details and, if you choose to provide it, health information relevant to your travel or participation.
11.2 How we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Registering you, issuing passes and processing payments for the event | Contract |
| Organising logistics and catering, including sharing your name and dietary requirements with the caterer | Contract; explicit consent for dietary or accessibility information that reveals health or religious beliefs |
| Providing visa support letters, arranging travel and accommodation where QS has agreed to do so, and obtaining event licences or security clearance from venues, host institutions or government authorities (for example, some events in the United Arab Emirates and India) | Contract; legal obligation; legitimate interests (meeting host and venue requirements) |
| Managing speakers and publishing the agenda, including your name, title, organisation, photograph and biography on event websites and materials | Contract; legitimate interests |
| Sharing the delegate list (name, job title, organisation and country) with sponsors who have purchased this entitlement. We do not include delegates who have told us they do not want their details shared | Legitimate interests; consent where required |
| Arranging one-to-one meetings between delegates, speakers and sponsors | Consent |
| Enabling exhibitors and university representatives to capture leads at student events using the QS Leads App, and recording which representatives attend and use the app | Contract with your organisation; legitimate interests |
| Scanning the badges of people who visit QS stands at third-party events, so that our sales team can follow up | Legitimate interests; consent where required |
| Running event WhatsApp groups to share updates, logistics and emergency information before, during and after an event. Other group members can see your name, number and profile information | Consent (joining the group is optional) |
| Taking photographs and video for reporting, promotion and our archive | Legitimate interests; consent where the law requires it |
| Collecting feedback and sending post-event information and marketing | Legitimate interests; consent where required for marketing |
| Reporting aggregated statistics (for example delegates by role and country) to sponsors | Legitimate interests |
We use event platforms (such as Cvent, Zoom and HubSpot), payment providers (such as Stripe), messaging services, travel providers and caterers to run our events. We keep sponsor attendee registration details for five years and delegate marketing details until you unsubscribe. Passport and visa documents are deleted immediately once they are no longer required for the purposes for which they were collected.
12. Education agents, partners and suppliers
This section applies if you are an education agent or a member of staff at an agency or referral partner that works with QS Apply or QS Teli, or if you or your organisation supplies goods or services to QS (including contractors and in-country representatives).
We collect your name, job title, business contact details, organisation, company website and social media handles, platform log-in details, the institutions you work with, contract and signatory details, invoices, commission statements, tax and registration information, and bank account details. For individual contractors, we may also collect identification documents, a photograph, attendance records and remuneration details.
| Purpose | Legal basis |
|---|---|
| Onboarding you or your organisation, checking suitability, signing non-disclosure and partnership agreements | Contract; legitimate interests |
| Giving agent and partner users access to the QS Apply platform and managing their profiles | Contract |
| Preparing commission statements, reconciling enrolments and paying commissions, invoices and fees | Contract; legal obligation |
| Verifying changes to bank details and preventing fraud (for example, by calling back on a known number) | Legitimate interests (preventing fraud); legal obligation |
| Carrying out know-your-customer, anti-money laundering, sanctions and tax checks where required | Legal obligation; legitimate interests |
| Managing contractors engaged by QS, including contractors we engage to deliver services for our clients | Contract; legal obligation |
| Audit, accounting and statutory reporting | Legal obligation |
We share this information with our banks and payment providers, auditors, tax authorities and professional advisers where needed, and with universities where this is necessary to confirm enrolments.
13. Job applicants
This section applies if you apply for a job, internship or contractor role with QS, or if a recruiter puts you forward to us. If you join QS, section 14 will apply to you.
We collect your name, contact details, CV, cover letter, work history, qualifications, current salary and expectations, interview notes, references, and publicly available professional information (for example from LinkedIn). For some roles we ask you to complete online assessments of cognitive abilities and working style (using our provider Criteria) or to record answers to screening questions by video (using Hireflix). Right-to-work and background check information for successful candidates. We may ask you to provide equality and diversity information; this is optional and is used only in anonymised form to monitor our recruitment.
| Purpose | Legal basis |
|---|---|
| Assessing your application, arranging and conducting interviews, assessments and video screenings, and making hiring decisions | Legitimate interests (recruiting suitable people); steps at your request before entering into a contract |
| Taking up references and verifying your qualifications and experience | Legitimate interests |
| Checking your right to work and carrying out any background checks required for the role | Legal obligation; legitimate interests |
| Making reasonable adjustments to the recruitment process. | Legal obligation; explicit consent for health information |
| Equality monitoring | Explicit consent or substantial public interest (equality of opportunity), as permitted by local law |
Assessment results help our hiring managers, but they do not make hiring decisions automatically; a member of our team always reviews your application.
14. Employees, workers and contractors
This section applies to current and former employees, workers, interns, directors, consultants and contractors of QS Group companies worldwide, including people engaged through an employer-of-record provider. The QS company that employs or engages you is the controller of your personal data. Where group-wide HR systems are used, confirm whether QS Quacquarelli Symonds Limited is a joint controller. Your local employee handbook and policies may give further detail for your country. Section 13 covers the recruitment stage.
14.1 What personal data we collect
| Type of data | Examples |
|---|---|
| Identity and contact details | Name, work and personal email addresses, phone numbers, home address, date of birth, gender, nationality, photograph and employee ID |
| Government identifiers and right to work | Passport and national identity numbers (for example National Insurance number, NRIC, Aadhaar, PAN or Resident Identity Card), tax file and social security or pension numbers (for example CPF, KWSP/EPF, SOCSO, UAN or superannuation), and visa and immigration status |
| Employment details | Job title, department, manager, work location, contract terms, start and end dates, employment status, working hours, timesheets and project assignments |
| Pay, benefits and expenses | Salary and salary history, bonus and commission, bank account details, payslips, tax forms, pension and benefit contributions, expense claims, corporate card transactions and enrolment in benefits such as wellbeing apps |
| Performance and development | Probation records, objectives, mid-year and year-end reviews, training records, sales activity and performance metrics, sales training videos and quiz results, and the results of voluntary development assessments |
| Attendance and absence | Holiday and other leave, attendance records, sickness absence, fit notes and medical reports |
| Business travel | Travel itineraries, flight and hotel bookings, passport and visa details, dietary and accessibility requirements and emergency contacts |
| Dependants and emergency contacts | Names and contact details of your emergency contacts and, where relevant to pay or benefits, your dependants |
| Systems and security | User accounts and access permissions for QS systems (such as our finance, CRM and bank portals), system and security logs, building access records and CCTV images and any monitoring of email, devices or internet use. |
| Special category data | Health information (for sickness absence, adjustments and occupational health); equality monitoring information such as racial or ethnic origin and sexual orientation, which you provide voluntarily; and, in some offices, biometric data (facial recognition or fingerprints) used for time recording and office access. |
| Directors and bank signatories | Passport, proof of address, signature and other information required for "know your customer" checks and bank mandates |
| Employee relations | Records of disciplinary, grievance and whistleblowing matters. |
14.2 Where we get it from
We collect most of this information from you, during recruitment and throughout your employment or engagement. We also receive information from your manager and colleagues, referees, payroll, pension and benefits providers, employer-of-record providers, government authorities, and the IT systems you use in your work.
14.3 How we use your personal data and our legal basis
| Purpose | Legal basis |
|---|---|
| Employment administration: onboarding, managing your contract, keeping personnel files and administering changes such as promotions, transfers and leaving | Contract; legal obligation |
| Right to work and immigration: checking your right to work and supporting visa applications and sponsorship | Legal obligation |
| Pay and tax: paying salaries, bonuses and commission, making tax and social security deductions, providing payslips and tax forms, and recording payroll in our accounts | Contract; legal obligation |
| Pensions and benefits: administering pensions, statutory and retirement benefits, insurance and wellbeing benefits | Contract; legal obligation; consent for optional benefits |
| Expenses and travel: reimbursing expenses, managing corporate cards and booking business travel, including visas | Contract; legitimate interests (running our business efficiently) |
| Time, attendance and absence: recording working time, leave and sickness absence | Contract; legal obligation; for health information, our obligations under employment and social security law |
| Biometric time recording and access (some offices only) | Explicit consent, with a non-biometric alternative offered, or another condition permitted by local employment law. |
| Performance and pay: setting objectives, conducting probation and performance reviews, analysing sales performance and setting targets, calculating commission and reviewing and benchmarking pay | Contract; legitimate interests (managing performance and rewarding people fairly) |
| Learning and development: providing training and online learning, and offering voluntary development assessments. Development assessment results are not used for performance management, promotion or pay decisions | Legitimate interests (developing our people and teams) |
| Workforce planning and reporting: budgeting, headcount and capacity planning, finance reporting and audit | Legitimate interests; legal obligation |
| Equality, diversity and inclusion: monitoring equality of opportunity and statutory reporting such as UK gender pay gap reporting. | Legal obligation; explicit consent or substantial public interest for special category data, as permitted by local law |
| Health, safety and wellbeing: managing health and safety, occupational health and reasonable adjustments | Legal obligation; employment law obligations and occupational health conditions for health information |
| IT, security and acceptable use: giving you access to systems, protecting our networks and data, and investigating security incidents and monitoring as described in our IT policies. | Legitimate interests (protecting our systems, data and people); legal obligation |
| Governance and banking: know-your-customer checks for directors and signatories, bank mandates and statutory registers | Legal obligation |
| Employee relations and legal matters: handling grievances, disciplinary matters and whistleblowing reports, and establishing, exercising or defending legal claims. | Legal obligation; legitimate interests |
| Internal communications: staff directories, intranet profiles and photographs, internal news and events | Legitimate interests |
| Emergencies and business continuity: contacting you or your emergency contact in an emergency | Legitimate interests; vital interests |
| References and former staff: confirming your employment to future employers and keeping records after you leave | Legitimate interests; legal obligation |
14.4 Who we share it with
We share employee data with other QS Group companies where needed for group-wide HR, finance and IT; payroll providers and payroll software; pension, social security and housing fund bodies (for example Aware Super, CPF, KWSP/EPF and the India Provident Fund); tax authorities; HR, performance and learning platforms (such as BambooHR, Workday, Workleap, LinkedIn Learning and Allego); employer-of-record providers (such as Remote and Oyster); travel and expenses providers (such as Perk and SAP Concur); benefits and wellbeing providers (such as Calm); pay benchmarking providers (such as Aon Radford); assessment providers (such as Criteria); banks, insurers, auditors and professional advisers; and government bodies and regulators where required. If you work on a client project, we may share your name, role and contact details with the client.
14.5 Your rights
You have the rights described in section 25, although some rights are limited by employment law. To exercise them, contact the People Team at [email protected] or our QS Group Privacy Office at [email protected].
15. Visitors to our offices
If you visit a QS office, we may record your name, organisation, the person you are visiting and the time of your visit, and issue you with a visitor pass. Some of our offices and shared buildings use closed-circuit television (CCTV) and access control systems for safety and security. If you use our guest Wi-Fi, we collect technical information about your device and connection. We do this for our legitimate interests in keeping our premises, people and systems safe. Some buildings are managed by landlords who operate their own CCTV under their own privacy notices.
16. Other people whose information we receive
We sometimes receive personal data about people who do not deal with us directly. For example:
Parents and guardians: if a user tells us they are under 18, we may ask a parent or guardian to give consent (section 24). Parents and guardians also attend our events and contact us on behalf of their children.
Emergency contacts and next of kin: employees, applicants, event participants and travellers may give us details of a person to contact in an emergency, and employees may give us details of dependants for pay and benefits purposes.
Referees: applicants to universities through QS Apply, and applicants for jobs with QS, may give us the details of referees.
People mentioned in communications or documents: for example, a family member named in a financial document supporting a visa application, or a colleague copied into an email.
Journalists and media contacts: we keep the contact details of journalists and media professionals who report on our rankings and research, so that we can respond to enquiries and share news.
People who interact with our social media pages: see section 26.
If you give us information about another person, please make sure they know you are doing so and point them to this notice. We use their information only for the purpose for which it was provided, on the basis of our legitimate interests or, where relevant, to comply with our legal obligations.
Part C – How we handle personal data
17. Artificial intelligence and automated decision-making
We use artificial intelligence (AI), machine learning and other automated tools to make our services more useful and to help our teams work efficiently. This section explains where we use them, the safeguards we apply and the choices you have.
17.1 Our approach
Human oversight. AI supports our people; it does not replace their judgement. Important outcomes, such as QS Apply recommendations and lead prioritisation, are reviewed by a member of our team, and admissions decisions are always made by universities, not QS.
Transparency. We tell you when you are interacting with an AI system such as a chatbot, and we label AI-generated content where the law requires it.
Assessment before use. We assess new AI uses for privacy, security, fairness and accuracy risks before we deploy them, and we carry out data protection impact assessments where required.
Data minimisation and security. We give AI tools only the personal data they need, use de-identified or pseudonymised data where possible, and use AI providers under contracts that protect your data.
17.2 Where we use AI and automated tools
| Use | What it does | Human involvement and your choices |
|---|---|---|
| Course matching and recommendations (TopUniversities, TopMBA and others) | Suggests courses, programmes and universities based on your study level, subject interests, preferred destination, start date and how you use our websites | Recommendations are suggestions only; you decide what to explore |
| Career Match | Suggests possible career pathways and related universities based on your assessment answers and interests, linked to QS subject ranking data | Suggestions only |
| Personalisation and segmentation | Groups users with similar interests and tailors the content, emails and offers we show you | You can object to this profiling and opt out of marketing at any time |
| Event matching (for example automated matching and booking at QS Connect events) | Compares your profile with participating institutions' criteria to suggest one-to-one meetings | You choose whether to accept meetings; institutions decide whom to meet |
| QS Apply eligibility and prioritisation | Assesses your eligibility against predefined criteria, recommends universities, programmes and destinations, and calculates fit and engagement scores and a priority rating to route your enquiry to the right adviser | A QS adviser reviews all recommendations and progression decisions before further action; you can ask for an explanation or a review |
| Chatbots and AI assistants | Answers common questions and directs you to the right support. Our advisers also use AI assistants to help draft replies, which they review before sending | You can ask to speak to a person. Conversations may be logged for quality, security and support |
| Predictive models for universities | When we act for a university, statistical and machine-learning models (such as lead scoring and conversion prediction) help it plan its recruitment | The university controls this processing and makes all admissions decisions (section 7) |
| CV and document analysis (1Mentor) | Extracts skills, qualifications and job titles from CVs to build profiles and recommend careers, courses and jobs | You can review and edit your profile |
| Research tools | AI-assisted interviews and transcription in market research projects, with outputs reported in aggregated form | Participation is voluntary and based on your consent |
| Business contact data enrichment | Automated tools, including AI agents, help our sales teams find and validate professional contact details and company information | You can object at any time (sections 10 and 25) |
| Software features for clients | For example, generating reports and charts in QS MoveON from requests typed by university staff | Used by and for our university clients |
| Advertising platforms | Social media and search platforms use their own algorithms to decide who sees QS and university adverts and to measure performance | Based on your consent; you can also manage advertising settings with each platform |
| Recruitment and development assessments | Online tests score cognitive abilities and working style for job applicants and, on a voluntary basis, for employees | Results inform, but never replace, decisions by our hiring team; employee development results are not used for performance, promotion or pay decisions |
| Workplace analytics and transcription | Tools that analyse sales activity and performance and transcribe or summarise meetings and review conversations. | Managers make all decisions about employees; tools support, not replace, their judgement |
| Workplace productivity tools | Our staff use approved AI tools, such as Microsoft Copilot, Anthropic Claude, and OpenAI ChatGPT to draft, summarise and analyse information in their day-to-day work | Used under enterprise terms that protect confidentiality |
17.3 Automated decisions
We may make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you where permitted by data protection law or based on your consent. Where we make such decisions, we will tell you in advance, explain the logic involved and the likely consequences, and give you the right to make representations, to have a person review the decision and to challenge it.
We do use profiling, for example to personalise our marketing and to prioritise enquiries. You have the right to object to profiling that we carry out on the basis of our legitimate interests, and an absolute right to object to profiling for direct marketing (section 25).
17.4 Your data and the training of AI models
We do not use your personal data to train general-purpose AI models made available by third parties, and our contracts with AI providers do not allow them to use personal data we give them to train their own models. We may use de-identified or pseudonymised information to develop, test and improve QS's own recommendation and matching models. We do this on the basis of our legitimate interests, with safeguards such as access controls and testing for accuracy and bias, and you can object. Where we act as a processor, we use client data in this way only if our contract with the client allows it.
18. Marketing and your choices
We would like to keep you informed about our rankings, events, services and opportunities from universities. We send marketing by email, SMS, WhatsApp, WeChat, social media, post and telephone. We do this with your consent or, where the law allows, on the basis of our legitimate interests, for example when you are an existing user or business contact.
We do not share your contact details with universities or other organisations for their own marketing unless you have agreed to this (section 6.4).
You can stop receiving marketing at any time by:
clicking the unsubscribe link in any marketing email;
replying "STOP" to an SMS, or following the opt-out instructions in a WhatsApp or WeChat message;
updating the preferences in your account; or
emailing [email protected].
When you opt out, we keep a record of your email address or phone number on a suppression list so that we do not contact you again. We will still send service messages, such as confirmations of event bookings, account notifications and essential updates about an application you have started.
19. Cookies and similar technologies
We use cookies, pixels, software development kits and similar technologies on our websites, apps and emails. They help our websites work, keep them secure, remember your preferences, help us understand how our services are used, and support personalisation and advertising.
| Type | Purpose | Consent |
|---|---|---|
| Strictly necessary | Essential for our websites to work, for example to keep you logged in, remember your cookie choices and protect against fraud | Not required |
| Analytics and performance | Help us understand how visitors use our websites so we can improve them (for example Google Analytics, Mixpanel and HubSpot) | Required where the law says so. In the UK, confirm whether QS will rely on the statistical-purposes exemption. |
| Functional and personalisation | Remember your preferences and tailor content and recommendations | Required where the law says so |
| Advertising and social media | Measure the performance of our adverts and show you relevant QS and university adverts on other websites (for example Meta, Google, LinkedIn and TikTok. | Required |
The QS Group websites, apps and services listed in section 3 each use cookies and similar technologies. Some present their own cookie banner and cookie settings, but they all form part of QS and follow the approach described in this notice. Setting your cookie choices on one QS site does not change your choices on another, so please set your preferences on each QS site you use. You can accept, reject or change your choices at any time using the cookie settings link at the bottom of our websites. We also use tracking pixels and links in our emails to understand whether they are opened and clicked; you can block these by turning off image loading in your email software or unsubscribing.
20. Who we share personal data with
We share personal data only where we have a legitimate reason to do so and in line with this notice. Depending on how you interact with us, we may share personal data with:
| Recipient | Why we share personal data |
|---|---|
| QS Group companies | To provide our services globally. For example, teams in India and Romania provide technology development, client support and operations for the whole group |
| Universities and other institutions | When you ask us to or agree to it, or to submit your applications (section 6.4); and to return data to clients for whom we act as a processor |
| Education agents and partners | To support applications referred by an agent, confirm enrolments and pay commissions (sections 6.5 and 12) |
| Service providers who act on our behalf | Providers of services including:
They may use the data only to provide services to us and must keep it secure |
| Advertising and social media platforms | With your consent, to show you relevant adverts, to create custom and similar audiences, and to measure campaign performance. These platforms may be separate or joint controllers for some of this processing |
| Event partners | Venues, caterers, host institutions, licensing and government authorities, and, with your consent, local partners involved in student events (section 11) |
| Sponsors | Aggregated statistics about audiences, and delegate lists where sponsors have purchased this entitlement (section 11) |
| Payroll, pension, benefits and employment providers | To pay and support our employees and contractors, including payroll providers, pension and social security bodies, benefits providers and employer-of-record providers (section 14) |
| Professional advisers, auditors, banks and insurers | To obtain advice, carry out audits, process payments and manage risk |
| Authorities, regulators and courts | Where required by law, or to protect our rights, our users or the public, including tax, immigration and law enforcement authorities |
| Buyers and investors | If we sell, buy, merge or reorganise all or part of our business, personal data may be transferred to the other party, subject to confidentiality obligations |
A list of the sub-processors we use to deliver our software services to clients is available here.
21. International transfers
QS is a global organisation headquartered in the United Kingdom, with offices that may span across Europe, Asia-Pacific, Africa, the Middle East and the Americas. Our service providers, and universities you ask us to share data with, are also located around the world. As a result, your personal data may be transferred to, stored in or accessed from countries other than the one where you live, including the United Kingdom, member states of the European Economic Area (EEA), India, the United States, Australia and China. Some of these countries may not have data protection laws equivalent to those in your own country.
When we transfer personal data from the UK, the EEA or Switzerland to another country, we make sure it is protected by:
transferring it to a country that the UK Government or the European Commission has found provides an adequate level of protection;
using standard contractual clauses approved by the European Commission, the UK International Data Transfer Agreement or Addendum, or equivalent mechanisms, together with additional safeguards where needed;
relying on a recipient's certification under the EU–US Data Privacy Framework and its UK Extension, where applicable; or
an intra-group data transfer agreement between QS Group companies
Where none of these is available, we may transfer data where it is necessary to perform a contract with you or at your request (for example, to send your application to a university you have chosen), or with your explicit consent. Countries such as China, India and Brazil also have their own transfer rules, which we describe in Part D. To find out more about the safeguards we use, contact [email protected].
22. How long we keep personal data
We keep your personal data only for as long as we need it to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. When deciding how long to keep personal data, we consider its amount, nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, as well as applicable legal requirements.
Where we need to keep personal data to establish, exercise or defend legal claims, we keep it until the end of the relevant retention period or until those claims have been settled.
We set the specific periods for which we keep different types of personal data in an internal data retention policy. If you would like more information about how long we keep a particular type of personal data, please contact us at [email protected]
.
When we no longer need your personal data, we securely delete or destroy it in accordance with applicable laws and regulations.
23. How we protect personal data
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, access, alteration or disclosure. These include encryption, access controls based on job role, single sign-on and multi-factor authentication, logging and monitoring, secure development practices, the use of anonymised data for testing where possible, regular staff training, and due diligence and contractual controls for our service providers.
No method of transmitting or storing data is completely secure. If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify you and the relevant regulator where the law requires us to do so.
24. Children and young people
Our student services are designed for people considering higher education, which includes some secondary school students. They are not intended for children under 16 and we do not knowingly collect personal data from children under that age. Higher age thresholds apply in some countries; for example, anyone under 18 is treated as a child in India, and personal data of children under 14 is treated as sensitive in China.
If you tell us you are under 18 or below the age at which you can consent under the law where you live, we will ask for verifiable consent from your parent or guardian before we create your account, send you marketing or share your details with universities. We do not use the personal data of users we know to be under 18 for targeted advertising. If you are a parent or guardian and believe your child has given us personal data without your consent, please contact [email protected] and we will take appropriate steps.
25. Your rights
Depending on where you live, you have some or all of the following rights. Some rights apply only in certain circumstances, and some have exceptions.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you and information about how we use it |
| Rectification | Ask us to correct inaccurate data or complete incomplete data |
| Erasure | Ask us to delete your personal data, for example where we no longer need it or you withdraw consent |
| Restriction | Ask us to limit how we use your data, for example while we check its accuracy |
| Portability | Ask us to provide data you gave us in a structured, machine-readable format, or to transfer it to another organisation |
| Objection | Object to processing based on our legitimate interests, including profiling. You can always object to direct marketing |
| Withdraw consent | Where we rely on consent, withdraw it at any time. This does not affect processing already carried out |
| Automated decisions | Not to be subject to decisions based solely on automated processing that significantly affect you, and to obtain human review (section 17) |
| Complain | Complain to us and to a data protection regulator (section 32) |
To exercise your rights, email [email protected]. We may need to verify your identity before we respond. We will respond within one month, which we may extend by up to two further months for complex requests; shorter or different timescales apply in some countries (Part D). We do not usually charge a fee. In some countries you can ask an authorised agent to make a request for you.
If we process your data as a processor for a university or other organisation (section 4), please send your request to that organisation. If you send it to us, we will forward it to them.
26. Links to other websites and social media
Links between QS Group websites, apps and services (listed in section 3) are not third-party links: they are all part of QS and are covered by this notice, including the cookie approach described in section 19. The rest of this section applies only to websites and services that are not part of the QS Group.
Our websites contain links to universities' and other organisations' websites, embedded content (such as videos) and social media features. These third parties have their own privacy and cookie notices, set their own cookies and similar technologies, and manage their own consent. We are not responsible for how they use your personal data or for their cookies. Please read their notices before giving them your information or accepting their cookies.
We have pages on social media platforms such as LinkedIn, Facebook, Instagram, X, YouTube, TikTok, WeChat and Weibo. When you interact with our pages, the platform collects your data under its own privacy notice. For some platforms, QS and the platform are joint controllers for page statistics ("insights") and we rely on our legitimate interests in understanding how our pages are used. If you log in to TopMBA with Google or Facebook, we receive basic profile information from that provider.
27. Changes to this notice
We review this notice regularly and update it when our services or the law change. The effective date at the top shows when it was last updated. If we make significant changes, we will tell you by placing a prominent notice on our websites or, where appropriate, by emailing you.
Part D – Country and regional information
The sections below add to the rest of this notice for people in particular countries and regions. If there is a conflict between this Part D and the rest of the notice, Part D applies to people in the relevant country or region.
28. United States
This section applies to residents of US states with comprehensive consumer privacy laws, including but not limited to California, It does not apply to personal information we process as a service provider or processor for a university or other organisation (section 4).
28.1 Personal information we collect, use and disclose
In the last 12 months we have collected personal information, from the sources and for the purposes described in Part B.
"Sell" and "share" have broad meanings under US state privacy laws. Disclosing personal information to universities that pay us for student recruitment services and allowing advertising partners to collect information through cookies and similar technologies for targeted advertising, may count as selling or sharing. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only for purposes permitted by law, such as providing the services you request, and not to infer characteristics about you.
28.2 Your rights
Depending on your state, you may have the right to:
know what personal information we collect, use, disclose, sell and share, and access a copy of it;
correct inaccurate personal information;
delete personal information;
receive your personal information in a portable format;
opt out of the sale or sharing of your personal information, targeted advertising and profiling that produces legal or similarly significant effects;
limit the use of sensitive personal information (we do not use sensitive personal information in a way that gives rise to this right);
appeal our decision on your request; and
not be discriminated against for exercising your rights.
Opting out of selling, sharing and targeted advertising. You can opt out at any time by using the Cookie banner on our websites, or by emailing [email protected]. We also treat browser-based opt-out signals, such as Global Privacy Control, as a valid request to opt out for that browser and, where we can link it to you, for your account. We do not ask you to verify your identity to opt out.
Other requests. To exercise your other rights, email [email protected]. We will verify your identity by matching information you provide with information we hold. You may use an authorised agent, who must show us your signed permission. If we decline your request, you can appeal by emailing [email protected] with the subject “Privacy Appeal”; if you are not satisfied with the outcome of your appeal, you can contact your state Attorney General.
From time to time, QS may offer voluntary incentives to individuals participating in research, surveys, events or promotional activities. These may include gift cards, payments for research participation, prize draws, complimentary products or services, and discounts. Where an incentive involves the collection of personal information, we may collect your name, contact details, event registration information, research responses or other information necessary to administer the offer. Participation is voluntary, and the applicable offer terms will explain how to participate, the benefit available and any eligibility conditions. You may withdraw from an incentive programme at any time by contacting us using the details in this Privacy Notice, although withdrawal may affect your eligibility to receive the benefit.
29. China
This section applies to the handling of personal information of individuals in mainland China under the Personal Information Protection Law (PIPL), including through QS China websites, QS Teli services and QS events in China.
| Topic | Information |
|---|---|
| Personal information handler | QS (Shanghai) Education Technology Company Limited for QS China websites and QS Teli; QS Quacquarelli Symonds Limited for our global websites and services |
| Representative in China | QS (Shanghai) Education Technology Company Limited (酷思教育科技（上海）有限公司) |
| Personal information protection contact | [email protected] |
29.1 Sensitive personal information
Sensitive personal information includes identity document numbers, financial account information, health information, criminal records and the personal information of children under 14. We handle sensitive personal information only for a specific purpose where it is necessary, for example to submit an application to an overseas university, and with your separate consent. When we ask for this consent, we will explain why the information is needed and how it may affect you.
29.2 Separate consent
We will ask for your separate consent before we (a) handle your sensitive personal information; (b) provide your personal information to another handler, such as a university or partner, which will use it for its own purposes; (c) transfer your personal information outside mainland China; or (d) publicly disclose your personal information.
29.3 Transfers outside mainland China
To provide our services, we transfer personal information to QS Quacquarelli Symonds Limited in the United Kingdom, to universities you choose, and to our service providers, as set out below. We make these transfers using the mechanisms permitted under PIPL, such as the standard contract or a recognised exemption (for example, where the transfer is necessary to perform a contract with you).
| Overseas recipient | Contact | Purpose and method | Categories of personal information |
|---|---|---|---|
| QS Quacquarelli Symonds Limited (United Kingdom) | [email protected] | Operating our global services, CRM and events; secure network transfer | Identity and contact, education profile, study preferences, communications |
| Universities and institutions you choose (various countries) | As notified when you give consent | Information requests, event meetings and applications; secure transfer or portal upload | As described in section 6.4 and, for applications, section 6.5 |
You can exercise your rights against overseas recipients by contacting [email protected].
Employees in China. We may process employee personal information without consent where this is necessary to perform your employment contract or for human resources management under lawfully established labour rules and collective contracts. We still ask for your separate consent where PIPL requires it, for example for sensitive personal information or before transferring your information outside mainland China to group HR systems.
29.4 Your rights
You have the right to know about and decide on the handling of your personal information; to restrict or refuse its handling; to access and copy it; to request its transfer to another handler; to correct and supplement it; to request its deletion; to ask us to explain our handling rules; to withdraw your consent; and to close your account. The close relatives of a deceased person may exercise certain of these rights in respect of the deceased's personal information for their own lawful interests.
Where we use automated decision-making to push information or recommendations to you, we will also provide options that are not based on your personal characteristics, or an easy way to refuse. If you are under 14, we need the consent of your parent or guardian before we handle your personal information. You can complain to the Cyberspace Administration of China or its local office.
A Chinese-language version of this notice is to be published for users in mainland China.
30. Asia-Pacific
30.1 Australia
We comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth). QS is responsible for personal information collected by our Australian operations. You can usually deal with us anonymously or using a pseudonym when making a general enquiry, but we need your details to provide most services. We may disclose personal information to recipients in the United Kingdom, India, the United States, other countries where our group companies and service providers operate, and to universities in the countries you choose. You can ask to access and correct your personal information. If you have a complaint, please contact us first; we aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. From 10 December 2026, section 17 also describes the kinds of decisions made using computer programs that use your personal information.
30.2 India
Under the Digital Personal Data Protection Act 2023 (DPDP Act) and the Digital Personal Data Protection Rules 2025, QS acts as a "data fiduciary" for the processing described in this notice. Part B sets out the personal data we process and why. Where we rely on your consent, you can withdraw it as easily as you gave it, including through a registered consent manager when these become available. You have the right to access a summary of your personal data and the processing we carry out, to correct, complete, update and erase your personal data, to have your grievances addressed, and to nominate another person to exercise your rights if you die or become incapacitated. For employees, we may also process personal data without consent for the employment-related legitimate uses permitted by section 7 of the DPDP Act. If you are under 18, we will obtain verifiable consent from your parent or lawful guardian, and we do not track, monitor the behaviour of or target advertising at children.
If you are not satisfied with our response, you can complain to the Data Protection Board of India.
30.3 Japan
We handle personal information in accordance with the Act on the Protection of Personal Information (APPI). When we provide personal data to a third party in a foreign country, we do so with your consent or where the recipient has put in place measures equivalent to the APPI, and you can ask us for information about the recipient country's data protection system and those measures. You may request disclosure, correction, suspension of use, deletion and records of third-party provision of your retained personal data. You can contact the Personal Information Protection Commission (PPC) if you have concerns.
30.4 Malaysia
We process personal data in accordance with the Personal Data Protection Act 2010, as amended. You can request access to and correction of your personal data, withdraw consent, ask us to stop processing for direct marketing and request data portability. If you do not provide personal data that we tell you is mandatory, we may not be able to provide the service you requested. You can contact our QS Group Privacy Office at [email protected] or complain to the Personal Data Protection Commissioner. A Bahasa Malaysia version of this notice can be made available upon request.
30.5 Singapore
We comply with the Personal Data Protection Act 2012. You may request access to and correction of your personal data and withdraw consent by contacting our QS Group Privacy Office at [email protected]. We will not send marketing messages to Singapore telephone numbers registered on the Do Not Call Registry unless you have given us clear and unambiguous consent. You can contact the Personal Data Protection Commission (PDPC) if you have concerns.
30.6 Other Asia-Pacific countries
If you live in another Asia-Pacific country or territory, such as Hong Kong, Indonesia, New Zealand, the Philippines or Thailand, you may have similar rights under local law. Please contact [email protected] to exercise them.
31. Middle East, Africa and Latin America
31.1 Other Middle Eastern and African countries
If you live in another country in these regions, such as Bahrain, Egypt, Qatar or South Africa, you may have similar rights under local law. Please contact [email protected] to exercise them.
31.2 Brazil
We process personal data in accordance with the General Data Protection Law (Lei Geral de Proteção de Dados – LGPD). The legal bases described in Part B correspond to the legal bases in the LGPD. Our QS Group Privacy Office acts as our encarregado (data protection officer) and can be contacted at [email protected]. You have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about the entities with which we share your data, information about the possibility of refusing consent and its consequences, revocation of consent, and review of decisions taken solely on the basis of automated processing. We transfer personal data outside Brazil using the standard contractual clauses approved by the National Data Protection Authority (ANPD) or another valid mechanism. You can complain to the ANPD.
31.3 Colombia and other Latin American countries
1Mentor and other QS services are used by universities, employers and government programmes in Colombia and elsewhere in Latin America. In Colombia, we process personal data in accordance with Law 1581 of 2012 and its regulations, and you can exercise your rights to know, update and correct your data, request proof of authorisation and revoke it, and complain to the Superintendence of Industry and Commerce (SIC). Where we act on behalf of an organisation, its own data processing policy applies. If you live in another Latin American country, such as Argentina, Chile, Mexico or Peru, you may have similar rights under local law; please contact [email protected].
31.4 Other countries
If you live in a country not listed above, you have the rights described in section 25 as provided by your local law, and you can complain to your local data protection regulator (section 32).
32. Right to complain
If you have a concern about how we handle your personal data, please contact us first at [email protected] so that we can try to resolve it. We will acknowledge your complaint within 30 days, investigate it without undue delay, and keep you informed of our progress and the outcome.
You also have the right to complain to a data protection regulator, in particular in the country where you live or work or where you think an infringement has occurred.
This notice was last updated on 23 October 2026.