Privacy Policy (International) — Study in Türkiye / Study in China / Study in Spain, the Student Portal and the SIT Connect Hub

The data controller (also called the "personal information handler" under China's PIPL, "controlador" under Brazil's LGPD, or "veri sorumlusu" under Türkiye's KVKK) responsible for your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], [COUNTRY].

You can reach us about privacy, or to exercise any of your rights, at [PRIVACY EMAIL] or by post at the address above. Where we have appointed one, our Data Protection Officer / Privacy Officer / Encarregado can be contacted at [DPO EMAIL].

Where we are required by law to designate a local representative or contact point, their details are: EU representative under GDPR Article 27 — [EU REP NAME / ADDRESS / EMAIL]; UK representative under UK GDPR Article 27 — [UK REP NAME / ADDRESS / EMAIL]; Türkiye data controller representative (VERBİS) — [TR REP DETAILS]; China PIPL Article 53 dedicated entity/representative — [CHINA REP DETAILS]. Some of these may not be applicable to us; where they are, they are named here.

We collect the personal data you give us directly through our enquiry, consultation, and application forms, the Student Portal, live chat, email, and similar channels, together with limited technical data collected automatically when you use our sites.

• Identity and contact details: your name, email address, phone/WhatsApp number, country of residence and nationality.
• Study preferences and background: the level, subject, destination and programs you are interested in; academic history; and similar information you choose to share.
• Application information: the details and supporting documents needed to prepare and submit an application to a university, which can include passport/identity and, in some cases, financial-account details required by the institution.
• Message content: anything you write in a free-text message, chat, or note, which you should avoid using to share sensitive details you do not want us to process.
• Technical and usage data: IP address, device and browser information, and interactions with our sites collected through cookies and similar technologies (see "Cookies and similar technologies").
• Marketing preferences: your consent choices and whether you have subscribed to or opted out of our communications.

We try to avoid collecting sensitive data. Depending on your country's law, some information can be treated as sensitive — for example information revealing racial or ethnic origin, religious or philosophical beliefs, or health; passport/government-ID numbers and financial-account details; citizenship or immigration status; and any personal data about a child. Sensitive data can also appear unintentionally in free-text messages or uploaded documents.

Where we process sensitive data and the law requires it, we do so only on a permitted condition — typically your explicit or specific consent, or another lawful condition — and, where required (for example under China's PIPL or Brazil's LGPD), we obtain your separate, specific and highlighted consent and tell you why the processing is necessary and how it affects you. Please do not include sensitive information in free-text fields unless it is necessary.

We use your personal data for the purposes below. Different laws describe the lawful grounds for processing differently: the EU/UK GDPR and Brazil's LGPD use enumerated "legal bases"; Türkiye's KVKK uses Article 5 grounds; China's PIPL relies mainly on consent and contract necessity and has no "legitimate interests" basis; and US state laws work on a notice-and-transparency (mostly opt-out) model rather than legal bases. The grounds we rely on, as applicable to you, are shown for each purpose.

• To respond to your enquiry and give you guidance — on the basis of taking steps you request before any contract and/or our legitimate interests (GDPR/UK GDPR/LGPD); contract-necessity or legitimate interest (KVKK); your consent and/or contract necessity (PIPL); and as a disclosed business purpose (US).
• To match you with suitable universities and programs, and to prepare and forward your application to the universities you choose to apply to — on the basis of performance of the service you request (contract/pre-contractual steps) and, where required for a specific institution or transfer, your consent.
• To operate, secure, maintain and improve our websites, the Student Portal, and our services, and to prevent fraud and abuse — on the basis of our legitimate interests (where that basis exists) or, where it does not (e.g. PIPL), your consent or another permitted ground.
• To send you marketing communications (such as newsletters, offers and study updates) and to run non-essential analytics and advertising cookies — only with your consent, which you can withdraw at any time; in the US, subject to your right to opt out of "sale"/"sharing"/targeted advertising.
• To comply with our legal, tax, accounting and regulatory obligations and to establish, exercise or defend legal claims — on the basis of legal obligation and/or our legitimate interests.
• We do not use your data for a new, incompatible purpose without giving you further information and, where required, obtaining your consent.

We may use tools that help match you to relevant programs or prioritise follow-up. We do not intend to make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Where any such solely-automated decision-making were to occur, you have rights to be informed about it, to obtain an explanation, to express your point of view, and to request human review or to object, to the extent your local law provides (for example GDPR/UK GDPR Article 22, PIPL Article 24, LGPD Article 20, Quebec Law 25, and applicable US state profiling opt-outs).

For any marketing driven by automated profiling, you can opt out at any time.

We share personal data only as needed for the purposes above and under appropriate contracts and safeguards. We do not sell your personal data for money.

• Universities and program providers you choose to apply to or ask us to contact — so your application or enquiry can be considered. Many of these institutions are located outside your country.
• Service providers (processors) that support our operations — for example website hosting, the Student Portal, CRM, email delivery, analytics, and communications tools — under written contracts that limit their use of your data to providing services to us.
• Professional advisers, and public authorities or law-enforcement bodies, where we are legally required or permitted to do so, or to protect our rights or the safety of others.
• In connection with a business reorganisation, merger or transfer, subject to this policy and applicable law.

Because we help students apply to universities around the world, we transfer personal data across borders — both to the universities you choose and to service providers that help us run our sites, some of which are located outside your country and outside the EEA, the UK, Türkiye, and China. Different regimes require different transfer mechanisms, and where more than one applies to you we apply each one cumulatively.

When we transfer personal data internationally, we rely, in order of preference, on: (1) a recognised adequacy decision covering the destination (for example an EU or UK adequacy decision, including the EU-US Data Privacy Framework for certified US recipients); or (2) appropriate safeguards — most commonly the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) for EEA-origin data, the ICO's International Data Transfer Agreement or the UK Addendum for UK-origin data, the KVKK Board's standard contract for Türkiye-origin data, and the China Standard Contract (filed with the CAC) or certification for PIPL-covered data, together with a documented transfer risk/impact assessment and supplementary measures such as encryption where needed; or (3) Binding Corporate Rules for intra-group transfers.

In limited cases — for example when you ask us to send your application to a specific university in a country not covered by one of the above mechanisms — we may transfer your data because it is necessary to perform the service you requested, or on the basis of your explicit, informed consent after we have explained the risks. Under China's PIPL and Brazil's LGPD, where applicable, we will additionally inform you of the overseas recipients and obtain your separate/specific consent before transferring. You can ask us for a copy of the safeguards we use, or details of the mechanism relied on for a given destination, by contacting us at [PRIVACY EMAIL].

We keep personal data only for as long as necessary for the purposes described in this policy and to meet legal, accounting and dispute-related obligations, after which we securely delete or anonymise it. We set retention periods per category of data; the periods below are templates to be confirmed against our actual retention schedule and applicable law.

• Enquiry / consultation data that does not lead to an application: retained while your enquiry is active and for a limited follow-up window afterwards (e.g. up to [12–24] months from last contact).
• Application data: retained for the duration of the recruitment relationship plus a defined period afterwards to handle re-applications, references, and disputes (e.g. [X] years).
• Marketing-consent records: retained until you withdraw consent and for a short period afterwards as proof of consent.
• Cookie / analytics data and consent logs: retained per the lifetimes stated in our cookie information and as needed to demonstrate a valid consent or transfer basis (commonly 12–24 months).
• Accounting / tax and other legally-mandated records: retained for the statutory period required by applicable law.

We implement technical and organisational measures appropriate to the risk — including encryption in transit and (where appropriate) at rest, access controls, staff training, vendor due diligence, and incident-response procedures — to protect personal data against unauthorised access, loss, misuse, or alteration.

Where required by applicable law, we will notify the competent authority and affected individuals of a personal-data breach or security incident within the timeframes and thresholds set by that law.

We use cookies and similar technologies (such as pixels, SDKs, and local storage) to run our sites, remember your preferences, measure traffic, and — where you allow it — support analytics, advertising and personalisation.

Strictly necessary cookies that are essential to provide a service you have requested do not require consent. We only set non-essential cookies and trackers (analytics, advertising, personalisation) with your prior consent, given through our cookie banner. You can give, refuse, or change your choices at any time using the "Manage cookies" / "Your Privacy Choices" control, and "Reject all" is offered as prominently as "Accept all". Where required, we recognise browser-based opt-out signals such as Global Privacy Control (GPC). Withdrawing consent does not affect processing carried out before you withdrew it. A detailed cookie table listing categories, purposes, providers and durations is available at [COOKIE POLICY LINK].

Our services are intended for people who are old enough to apply to higher education and are not directed at young children. Because applicants can nonetheless be minors, we apply heightened protection: we minimise the data we collect from minors, avoid using their data for behavioural advertising or marketing profiling, and present information in clear, age-appropriate language.

The age at which a young person can consent on their own varies by country. Where we rely on consent, a person below the applicable age may only use consent-based features with the authorisation of a parent or guardian, and we make reasonable, risk-proportionate efforts to verify this. The applicable thresholds include, among others: 16 by default in the EEA (lowered by some countries to as low as 13, e.g. 14 in Spain); 13 in the UK; under-14 parental consent under China's PIPL (where a minor under 14's data is treated as sensitive) and under Brazil's LGPD for "children" under 12; under-13 parental consent under US COPPA and opt-in rules for selling/sharing the data of consumers under 16 in California; and under-13 (rest of Canada) / under-14 (Quebec) under Canadian law. Where a stricter rule applies to you, that rule governs. If we learn we have collected a minor's data without the required consent, we delete it promptly.

Depending on where you live, you have some or all of the rights below. The specific rights that apply to you, and the exact way they work, are set out in the "Your rights by region" section that follows.

To exercise any right, contact us at [PRIVACY EMAIL]. We may need to verify your identity, and where the law allows it you may use an authorised agent. We respond within the timeframe required by your applicable law (for example, generally within one month under GDPR/UK GDPR, 30 days under KVKK, and the periods set by US state and other laws), and normally free of charge. We will not discriminate or retaliate against you for exercising your privacy rights.

• Be informed about, and access a copy of, your personal data.
• Correct / rectify inaccurate or incomplete data.
• Delete / erase your data, and restrict or object to certain processing, subject to legal exceptions.
• Data portability, where applicable.
• Withdraw consent at any time (without affecting processing already carried out), and opt out of marketing at any time.
• Opt out of the "sale" or "sharing"/targeted advertising of your personal information, and limit the use of sensitive personal information (US states).
• Object to, or seek human review of, solely-automated decisions that significantly affect you, where applicable.
• Complain to your local data-protection or privacy authority (see the region sections below).

We may update this policy from time to time to reflect changes in our practices or the law. We will post the updated version here with a new "Last updated" date and, where required, notify you or seek fresh consent. We review this policy at least every 12 months.