Privacy Policy

This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 (as amended), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and all other applicable Indian laws and regulations.

This policy governs the collection, storage, processing, transfer, and disclosure of personal data as defined under the DPDP Act, 2023. MyEduQuest acts as a Data Fiduciary as defined under Section 2(i) of the DPDP Act and is responsible for the lawful processing of your personal data. You, as the individual whose personal data is being processed, are the Data Principal under the DPDP Act.

Personal Data

We collect the following categories of personal data when you use our services:

• Identity data: Full name, date of birth, gender, nationality, passport number (when required for visa processing)
• Contact data: Email address, phone number (including WhatsApp), residential address
• Academic data: Educational qualifications, transcripts, test scores (IELTS, TOEFL, GRE, GMAT, PTE, etc.), certificates
• Financial data: Income details, bank statements, and financial documents required for scholarship or visa applications — collected only with your explicit, informed consent
• Communication data: Records of your enquiries, counselling session notes, and correspondence with us
• Profile data: Preferred study destinations, course preferences, career goals, and other information you provide voluntarily

Sensitive Personal Data

In the course of providing visa and application assistance, we may collect sensitive personal data including financial information and health-related information (where required by universities or immigration authorities). Such information is collected only with your prior, explicit, and informed written consent and is used solely for the stated purpose.

Automatically Collected Data

When you visit our website, we automatically collect technical data including your IP address, browser type and version, pages visited and time spent, referring website, device information, and data collected through cookies and similar tracking technologies.

In full compliance with Section 6 of the DPDP Act, 2023, we process your personal data only on the basis of your free, specific, informed, unconditional, and unambiguous consent. Before collecting your personal data, we will:

• Clearly describe the specific purpose for which your data is being collected
• Identify the categories of personal data being collected
• Disclose all third parties with whom your data may be shared
• Inform you of your rights as a Data Principal under the DPDP Act
• Provide a clear and easy mechanism for you to give or withdraw consent

How We Obtain Consent

Consent is obtained through our online forms, service agreements, and written communications. By submitting any form on our website or signing a service agreement, you are providing explicit consent for the processing described at the time of collection. Consent for sensitive personal data is always obtained separately and explicitly.

Right to Withdraw Consent

You have the absolute right to withdraw your consent at any time, without any detriment to you. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact our Data Protection Officer at privacy@myeduquest.com. Upon withdrawal, we will cease processing your data for the purpose for which consent was given, subject to our legal retention obligations.

We process your personal data on the following lawful bases under the DPDP Act, 2023:

• Consent (Section 6, DPDP Act): You have given explicit, informed consent for processing your personal data for specific purposes
• Contractual necessity: Processing is necessary to perform the consultancy services you have engaged us for
• Legal obligation: Processing is required to comply with applicable Indian laws, including tax laws, regulatory requirements, and court orders
• Legitimate uses (Section 7, DPDP Act): Processing for purposes such as fraud prevention, safety, and compliance with judicial orders

We use the information we collect strictly for the following purposes, and will not use it for any other purpose without your prior, explicit consent:

• To provide personalised study abroad counselling, guidance, and advisory services
• To process your enquiries and respond to your questions promptly
• To match you with suitable universities, courses, and study destinations
• To assist with university applications, visa applications, and required documentation
• To send you relevant updates about admission deadlines, scholarships, and study abroad opportunities
• To verify your identity and prevent fraud or misrepresentation
• To comply with legal obligations under Indian law and applicable regulations
• To improve our website and services based on usage patterns and feedback
• To send promotional communications — only with your prior, explicit consent, and you may opt out at any time
• To maintain records as required under applicable Indian laws

We do not sell, trade, or rent your personal data to any third party for commercial purposes. We may disclose your information only in the following limited and lawful circumstances, and only with your prior, explicit consent where required:

• Foreign universities and educational institutions: To submit applications on your behalf, strictly with your prior written consent. This includes sharing your academic records, personal statements, financial documents, and other application materials with universities in Australia, USA, UK, Canada, New Zealand, Ireland, Europe, Singapore, Japan, and other destination countries
• Visa and immigration authorities: As mandated by law for visa processing and immigration compliance. This includes sharing your personal, financial, and academic data with the relevant embassy, high commission, or immigration authority of the destination country
• Test preparation and language assessment bodies: Sharing relevant data with IELTS, TOEFL, GRE, GMAT, PTE, and similar bodies where required for your application
• Authorised service providers (Data Processors): Trusted third-party vendors including email service providers, cloud storage providers, CRM platforms, and payment processors who process data on our behalf under strict data processing agreements and confidentiality obligations
• Legal and regulatory authorities: When required by law, court order, government directive, or to protect the rights and safety of MyEduQuest or others
• Business transfers: In the event of a merger, acquisition, or sale of business assets, with prior notice to you and subject to equivalent privacy protections

Cross-Border Data Transfers

In the course of providing services, your personal data will necessarily be transferred to and processed in countries outside India — specifically when submitting applications to foreign universities or processing visa applications. Such transfers are made only when necessary for service delivery, with your explicit consent, and subject to adequate safeguards. We ensure that any third party receiving your data outside India is contractually bound to provide a standard of protection equivalent to the DPDP Act, 2023.

In compliance with Section 8(5) of the DPDP Act, 2023 and Rule 8 of the SPDI Rules, 2011, we have implemented reasonable and appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, destruction, or misuse. Our security measures include:

• SSL/TLS encryption for all data transmitted via our website
• Secure cloud storage with role-based access controls and multi-factor authentication
• Regular security audits, vulnerability assessments, and penetration testing
• Data minimisation — we collect only what is strictly necessary for the stated purpose
• Staff training on data protection, confidentiality, and information security
• Incident response procedures to address data breaches promptly
• Input sanitisation and validation to prevent injection attacks and data corruption

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the Data Protection Board of India as required under Section 8(6) of the DPDP Act, 2023, without undue delay.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Indian law. Our retention periods are as follows:

• Enquiry and counselling records: Retained for up to 5 years after your last interaction with us
• Application and visa documents: Retained for 7 years as required by applicable regulatory and tax obligations
• Financial records: Retained for 8 years in compliance with Indian accounting and tax laws
• Marketing preferences and communication records: Retained until you withdraw consent or request deletion
• Website usage data (cookies, logs): Retained for up to 12 months

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised so that it can no longer be associated with you. You may also request early deletion of your data as described in Section 9 below.

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

• Right to Access (Section 11, DPDP Act): Request a summary of the personal data we hold about you and the processing activities carried out on it
• Right to Correction and Updation (Section 12, DPDP Act): Request correction of inaccurate, incomplete, or outdated personal data
• Right to Erasure / Right to be Forgotten (Section 12, DPDP Act): Request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent, subject to our legal retention obligations
• Right to Grievance Redressal (Section 13, DPDP Act): Lodge a complaint with our Data Protection Officer if you believe your rights have been violated
• Right to Nominate (Section 14, DPDP Act): Nominate another individual to exercise your rights in the event of your death or incapacity
• Right to Withdraw Consent: Withdraw your consent to the processing of your personal data at any time, as described in Section 3 above
• Right to Object: Object to the processing of your data for direct marketing purposes at any time
• Right to Approach the Data Protection Board: If your grievance is not resolved by us, you have the right to file a complaint with the Data Protection Board of India

How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer in writing at privacy@myeduquest.com. We will acknowledge your request within 5 business days and endeavour to resolve it within 30 days, as required under the DPDP Act, 2023. We may need to verify your identity before processing your request.

Right to Data Deletion — Detailed Process

To request deletion of your personal data, please send a written request to privacy@myeduquest.com with the subject line 'Data Deletion Request'. Please include your full name, email address, and phone number used when registering with us. We will: (1) acknowledge your request within 5 business days; (2) verify your identity; (3) process the deletion within 30 days; and (4) confirm deletion in writing. Please note that we may retain certain data where required by law or for legitimate legal defence purposes.

In accordance with Section 13 of the DPDP Act, 2023 and Rule 5(9) of the SPDI Rules, 2011, we have appointed a Data Protection Officer (DPO) to address any complaints or concerns regarding the processing of your personal data.

You may submit your grievance in writing to the Data Protection Officer. We will acknowledge receipt of your grievance within 5 business days and resolve it within 30 days of receipt. If you are not satisfied with our response, you may approach the Data Protection Board of India as established under the DPDP Act, 2023.

We use cookies and similar tracking technologies to enhance your browsing experience and analyse website usage. The types of cookies we use include:

• Essential cookies: Strictly necessary for the website to function and cannot be disabled
• Analytics cookies: Help us understand how visitors interact with our website (e.g., Google Analytics) — used only with your consent
• Preference cookies: Remember your settings and preferences to personalise your experience
• Marketing cookies: Used to deliver relevant advertisements — used only with your explicit consent

You can manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our website. We obtain your consent for non-essential cookies in accordance with the DPDP Act, 2023.

Our website may contain links to third-party websites, including university portals, visa application portals, government websites, and partner organisations. We are not responsible for the privacy practices, content, or security of these external sites. We strongly encourage you to review the privacy policies of any third-party websites you visit before providing any personal information.

Our services are not directed to individuals under the age of 18. In accordance with Section 9 of the DPDP Act, 2023, we do not knowingly process the personal data of children without verifiable parental consent. If you are under 18, you must obtain prior consent from your parent or legal guardian before using our services or providing any personal information.

If we become aware that we have inadvertently collected personal data from a minor without appropriate parental consent, we will take immediate steps to delete such information. Parents or guardians who believe their child has provided us with personal data without consent should contact our Data Protection Officer immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or regulatory requirements, including updates to the DPDP Act, 2023 and its rules. We will notify you of material changes by posting the updated policy on our website with a revised 'Last Updated' date. For significant changes, we will also notify you by email at least 15 days before the changes take effect. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: