Cookie Policy

Last updated: 12 August 2026

This Cookie Policy explains how The Apply Group Ltd uses cookies and similar storage and access technologies across the websites and digital services covered by this Policy.

It should be read together with the The Apply Group Privacy & Data Processing Policy.

1. Who We Are

The Apply Group Ltd
Company No. 12938105
ICO Registration No. ZB327179
124 City Road
London EC1V 2NX
United Kingdom

2. Services Covered

This Cookie Policy applies to:

• TheApplyGroup.com;
• ApplyPal.io;
• app.ApplyPal.io;
• Institution-specific ApplyPal environments;
• ApplyPal widgets;
• ApplyForMedicine.com;
• ApplyForUniversity.com;
• ApplyForInternships.com; and
• associated TAG websites, subdomains or applications that link to this Policy.

ReferPool is a separate TAG service and may maintain separate cookie information appropriate to its functionality.

Not every technology described in this Policy is necessarily used on every Covered Service.

The Cookie Settings interface on the particular service should reflect the technologies actually enabled there.

3. What Are Cookies?

Cookies are small pieces of information stored on or accessed from a browser or device.

They can help a website or application:

• maintain secure sessions;
• keep users logged in;
• remember preferences;
• identify the correct service or Institution;
• maintain chat state;
• protect against fraud;
• understand how a service is used; and
• remember cookie choices.

Cookies may be:

Session cookies, which normally expire at the end of the browser session; or

Persistent cookies, which remain until deleted or until their expiry period ends.

4. Similar Technologies

This Policy also covers technologies that store information on, or access information from, a device, including:

• local storage;
• session storage;
• pixels;
• tags;
• scripts;
• web beacons;
• online identifiers;
• authentication tokens; and
• comparable technologies.

5. Categories of Technologies We Use

Strictly Necessary

These may be used for:

• authentication;
• secure login;
• account sessions;
• security;
• fraud prevention;
• tenant identification;
• ApplyPal chat sessions;
• consent records;
• privacy settings;
• cross-site request protection;
• application state; and
• other essential functionality.

Where permitted by law, these technologies do not require optional consent because they are necessary to provide or secure the requested service.

Blocking them may prevent parts of a Covered Service from operating correctly.

Functional

Functional technologies may remember:

• language;
• interface preferences;
• accessibility settings;
• display preferences;
• notification choices; or
• other optional settings.

Where consent is required, these technologies will not be activated until consent has been given.

Analytics and Performance

Analytics technologies may help us understand:

• pages viewed;
• navigation;
• user journeys;
• clicks;
• scrolling;
• device type;
• browser;
• approximate region;
• errors;
• performance;
• sessions;
• feature usage; and
• website engagement.

We use Hotjar on Covered Services where it is enabled.

Where consent is required, Hotjar and other non-essential analytics technologies should not operate before the appropriate analytics consent has been given.

Marketing and Attribution

Where enabled, these technologies may help us understand:

• referral source;
• marketing campaign performance;
• enquiry sources; and
• marketing conversion.

These are not required to use the core service.

Where consent is required, they will not operate until consent has been given.

TAG does not use children’s personal data for behavioural advertising.

6. Hotjar

TAG uses Hotjar, a Contentsquare service, on Covered Services where enabled to understand how people interact with our websites and applications.

Hotjar may support:

• heatmaps;
• session interaction analytics;
• click information;
• tap information;
• scrolling behaviour;
• navigation patterns;
• device and browser information;
• viewport information;
• approximate location; and
• related user-experience analysis.

Hotjar is used to help identify usability and service-performance issues.

It is not used by TAG for behavioural advertising.

Sensitive content

Hotjar suppresses keystroke information by default.

TAG does not use Hotjar for the purpose of reading private ApplyPal conversations.

Areas containing private messages, sensitive account information or other sensitive content should be excluded from or appropriately suppressed in Hotjar collection.

7. Authentication and Security Technologies

ApplyPal and other Covered Services may use cookies, browser storage or session identifiers to:

• authenticate users;
• maintain account sessions;
• protect accounts;
• identify Institution environments;
• secure forms;
• maintain chat state;
• prevent fraud;
• prevent unauthorised access; and
• maintain secure workflows.

These technologies will generally be categorised as Strictly Necessary.

8. ApplyPal Widgets

ApplyPal may be embedded on an Institution’s website.

An ApplyPal widget may use storage or access technologies where necessary to:

• identify the Institution;
• initialise ApplyPal;
• maintain chat or session state;
• prevent duplicate sessions;
• maintain authentication;
• preserve preferences;
• provide security; and
• deliver requested functionality.

The Institution remains responsible for cookies and scripts used independently on its surrounding website.

9. Platform Analytics That Do Not Depend on Cookies

Not all ApplyPal analytics use browser cookies.

Activity generated through use of an authenticated service may be recorded directly in ApplyPal systems.

This can include:

• profiles viewed;
• conversations started;
• responses;
• response times;
• searches;
• engagement activity;
• Ambassador performance;
• application-stage information; and
• conversion information.

This processing is described in the Privacy & Data Processing Policy and is separate from optional browser-based Hotjar analytics.

10. Social-Media APIs and Cookies

TAG may provide functionality involving LinkedIn or other social-media services.

A server-to-server API connection or authorised publishing action does not necessarily require that the social-media provider places tracking cookies on a TAG website.

Where a social-media SDK, pixel, embedded component or tracking technology is separately used on a Covered Service, it will be treated according to its actual purpose and listed in the applicable Cookie Settings interface.

Non-essential social-media tracking technologies will be subject to applicable consent requirements.

When you leave a Covered Service and visit LinkedIn or another social-media platform directly, that platform’s own cookie policy applies.

11. ReferPool

Covered Services may link to ReferPool.

Simply displaying or following a normal link to ReferPool does not mean that ReferPool cookies are automatically loaded on the original TAG website.

Once you use ReferPool, its applicable cookie and privacy information applies.

12. External Services

Covered Services may contain links to:

• social networks;
• Institution websites;
• meeting-booking services;
• application services;
• ReferPool; and
• other third-party websites.

An external service may set its own cookies once you visit or interact with it.

Its privacy and cookie policies apply to those technologies.

13. Consent

Where applicable, TAG provides controls allowing users to:

Accept optional technologies

Reject optional technologies

or

Manage preferences

Rejecting optional analytics or marketing technologies should not prevent access to the core service.

Strictly Necessary technologies may continue to operate because they are required to provide or secure the requested functionality.

Continuing to browse without making an affirmative choice is not treated as consent where valid consent is required.

14. Changing Your Preferences

You may change your choices through the Cookie Settings control on the relevant Covered Service.

Withdrawing consent does not affect processing that lawfully occurred before withdrawal.

Existing cookies may also be deleted through browser settings.

15. Browser Controls

Most browsers allow users to:

• view cookies;
• delete cookies;
• block cookies;
• restrict third-party cookies;
• clear local storage; and
• configure browser privacy controls.

Blocking all cookies may prevent functionality such as:

• login;
• ApplyPal messaging;
• account access;
• security controls; and
• saved preferences

from working properly.

16. Children

Some Covered Services may be used by people under 18.

TAG does not use cookie technologies to create behavioural advertising profiles of children.

Optional analytics involving children should be used proportionately and subject to appropriate consent and privacy safeguards.

17. Personal Data Collected Through Cookies

Information collected through cookies and related technologies can include personal data such as:

• IP address;
• online identifiers;
• session identifiers;
• account identifiers;
• device information;
• browser information;
• approximate region;
• referral information;
• usage information; and
• security data.

Where cookie information constitutes personal data, the Privacy & Data Processing Policy also applies.

18. Cookie Inventory

Because different TAG websites have different functionality, not every Covered Service uses the same technologies.

The Cookie Settings interface for each relevant service should provide the current operational inventory, including where applicable:

The inventory should be reviewed whenever a tracking technology, website platform or third-party integration changes.

19. International Processing

Some third-party technologies may involve processing outside the UK.

Where this involves a restricted international transfer of personal data, TAG applies appropriate safeguards as described in the Privacy & Data Processing Policy.

20. Changes to This Cookie Policy

We may update this Policy when:

• technology changes;
• Covered Services change;
• providers change;
• tracking practices change;
• law changes; or
• regulatory guidance changes.

The latest revision date will appear at the beginning of this Policy.

21. Contact

For questions about cookies or privacy:

The Apply Group Ltd
Company No. 12938105
ICO Registration No. ZB327179
124 City Road
London EC1V 2NX
United Kingdom