Privacy Policy

1. Introduction

Asia Pathway ("we", "us", "our") operates the website asiapathway.com and a student application portal (together, the "Platform"). This Privacy Policy explains what personal information we collect, why we collect it, how we share it, and the rights you have over it.

2. Information We Collect

We collect information you provide directly and information generated as you use the Platform.

• Account and contact details: name, email, phone/WhatsApp, nationality, and country of residence.
• Application details: program interests, transcripts, personal statements, recommendation letters, and academic records.
• Identity and travel documents you upload: passport data, visas, financial proof, and health documents.
• Payment information: processed by Stripe. We do not store full card numbers.
• Communications: messages you send through forms, live chat, or email.

3. How We Use Your Information

We use your information to operate and improve the Platform.

• Process and manage your study-abroad applications and match you with programs and universities.
• Communicate with you about programs, documents, payments, and support.
• Provide advisory services and recommend resources.
• Maintain and secure the Platform, prevent fraud, and comply with legal obligations.
• Improve our services through analytics.

4. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or Brazil, we rely on the following lawful bases under the GDPR and LGPD: In Singapore, we process your personal data in accordance with the Personal Data Protection Act 2012 (PDPA), including on the basis of your consent, a contractual relationship, or other legitimate grounds recognised under the PDPA.

• Performance of the contract with you, to provide the services you request.
• Your consent, where we ask for it (for example, analytics).
• Our legitimate interests in operating and improving the Platform.
• Compliance with legal obligations.
• Protection of your vital interests or those of another person.

5. Sharing of Information

We share personal information only as necessary to provide our services.

• Universities and partner schools, to process your applications.
• Visa authorities and immigration services, where required.
• Service providers: hosting (Hetzner), payments (Stripe), email (Brevo), analytics (Umami), CRM (Twenty), newsletters (Listmonk), workflow automation (n8n), file storage (Backblaze), and translation (Azure).
• When you request a resource such as a visa report, study guide, or PDF download, or register for an event, we may add you to our newsletter list so we can send you the requested material; you can unsubscribe at any time.
• Legal and regulatory authorities when required by law.

6. International Data Transfers

Your information may be processed in countries outside your own, including the United States and the European Union. Where we transfer personal data covered by the GDPR or LGPD to a third country, we rely on appropriate safeguards such as Standard Contractual Clauses or the transfer partner's certification.

7. Cookies and Analytics

We use essential cookies for authentication, session management, and language preference. With your consent, we use Umami (self-hosted, privacy-friendly) and Google Analytics to understand site usage. See our Cookie Policy for details. You can withdraw consent at any time.

8. Data Security

We implement appropriate technical and organizational measures, including encryption at rest, TLS in transit, restricted access to authorized personnel, and regular backups. No method of transmission is 100% secure.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Application records are retained for a minimum of 3 years. You may request deletion at any time. After this period, where no active application, legal obligation, or dispute requires retention, your personal data will be anonymized or deleted.

10. Your Privacy Rights

Depending on your location (GDPR, LGPD, CCPA/CPRA), you may have the right to:

• Access and receive a copy of your personal information.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Object to or restrict certain processing.
• Data portability.
• Withdraw consent at any time.
• If you are in Singapore, request access to and correction of the personal data we hold about you, under the PDPA.

11. California "Do Not Sell or Share"

We do not sell or share personal information for cross-context behavioral advertising, and we do not collect or process sensitive personal information for purposes that require a right to limit under the California Consumer Privacy Act (CCPA/CPRA).

12. Children's Privacy

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

13. Third-Party Links

The Platform may link to third-party websites (universities, affiliates, government agencies). We are not responsible for their privacy practices. Review their policies before providing information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on the Platform or by email. The "Effective Date" at the top reflects the latest revision.

15. Contact Us

For privacy inquiries or to exercise your rights, contact us at [email protected] or by writing to Asia Pathway. We aim to respond within 30 days. For individuals in Singapore, you may also contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg. We respond to access and correction requests within 30 days as required by the PDPA.