Welcome to Applywise ("we", "us", "our"). We are an education technology and overseas counselling company headquartered in Lahore, Pakistan, with an additional office in Austin, Texas, USA. We help students worldwide plan and apply to universities in the UK, Australia, USA, Canada, the Netherlands, Germany, Finland, Sweden, UAE, Malaysia, and other destinations.
Because our work spans many countries and legal systems, we are committed to the highest available standard of data protection — not just the minimum required in any one jurisdiction. This Policy explains what personal data we collect, how we use and protect it, and what rights you have, wherever you are in the world.
1. Global Compliance Framework
We design our data practices to comply with all applicable privacy and data protection laws in the countries where our students and partners are located, including:
| Jurisdiction | Applicable Law(s) | Supervisory Authority |
|---|---|---|
| United Kingdom | UK GDPR & Data Protection Act 2018 | Information Commissioner's Office (ICO) |
| EU (incl. Netherlands, Finland, Sweden, Germany) | EU General Data Protection Regulation 2016/679 | Your local DPA (e.g., Datatilsynet, Autoriteit Persoonsgegevens, Finnish Office of the Data Protection Ombudsman) |
| Australia | Privacy Act 1988 & Australian Privacy Principles (APPs) | Office of the Australian Information Commissioner (OAIC) |
| United States | FERPA; CCPA/CPRA (California residents) | U.S. Dept. of Education (FERPA); California Privacy Protection Agency (CCPA/CPRA) |
| Canada | PIPEDA & provincial equivalents | Office of the Privacy Commissioner of Canada |
| Malaysia | Personal Data Protection Act 2010 (PDPA) | Department of Personal Data Protection (PDPD) |
| Pakistan | Personal Data Protection Act 2023 (PDPA 2023) | National Commission for Personal Data Protection (NCPDP) |
Where laws conflict, we apply the most protective standard relevant to the individual concerned.
2. Data We Collect
We only collect data that is necessary to deliver our services. The categories below describe what we may hold about you.
a. Personal & Identity Information
- Full legal name, date of birth, gender, nationality, country of residence
- Passport number, national identity card details
- Contact details: email address, phone number, residential address
- Photographs (where required by institutions or visa processes)
b. Academic Information
- Academic transcripts, certificates, diplomas, and degrees
- Curriculum Vitae (CV) and personal statements / statement of purpose
- English language proficiency scores: IELTS, TOEFL, Duolingo English Test, Cambridge
- Other standardised test results: SAT, ACT, GRE, GMAT, A-Level results
- Course syllabi submitted for credit-transfer assessments
- Letters of recommendation and referee contact information
c. Immigration & Visa Information
- Visa history, current immigration status, travel history
- UK: Confirmation of Acceptance for Studies (CAS) reference numbers and UKVI-related data
- Australia: Confirmation of Enrolment (CoE), Genuine Student documentation
- Canada: Provincial Attestation Letter (PAL), Study Permit details
- EU countries: Residence permit data, national visa application materials
- USA: F-1/J-1 visa documentation, I-20 / DS-2019 records
d. Financial & Sponsor Information
- Bank statements and proof of financial means
- Sponsor letters and third-party funding declarations
- Tuition fee receipts, scholarship award letters
- Payment transaction records (processed securely via Flywire)
e. Technical & Usage Data
- IP address, browser type and version, device and operating system
- Pages visited, time on site, referral source, click paths
- Cookie identifiers and analytics data (see Section 11)
3. Lawful Basis for Processing
Under GDPR and equivalent frameworks, we must have a lawful basis before processing your personal data. We rely on the following:
| Basis | When we rely on it |
|---|---|
| Performance of a Contract (Art. 6(1)(b) GDPR) | Processing your academic, identity, and financial data to prepare and submit university applications, process enrolment, and arrange visa applications on your behalf. |
| Legal Obligation (Art. 6(1)(c) GDPR) | Compliance with UKVI requirements under the Immigration Rules, Australian Home Affairs obligations under ESOS, Canadian IRCC requirements, and equivalent immigration law in other destinations. |
| Legitimate Interests (Art. 6(1)(f) GDPR) | Internal record-keeping, fraud prevention, quality assurance of our counselling services, and operating our IT systems — provided our interests do not override your rights. |
| Consent (Art. 6(1)(a) GDPR) | Sending marketing emails, newsletters, or promotional content. You may withdraw consent at any time by clicking "Unsubscribe" or emailing hello@applywise.io. Withdrawal does not affect prior processing. |
| Vital Interests / Special Categories (Art. 9 GDPR) | We do not routinely process special category data (e.g., health, biometric). If such data is ever required (e.g., for disability-related adjustments), we will seek explicit consent and handle it under strict additional safeguards. |
4. How We Use Your Data
- Assessing your academic profile and building a personalised university shortlist
- Preparing, submitting, and tracking your university applications
- Applying for scholarships, bursaries, and financial aid on your behalf
- Coordinating visa and immigration documentation with the relevant authorities
- Arranging student accommodation through our Amber Students partnership
- Processing tuition fee payments via Flywire
- Communicating service updates, offer letters, and deadlines
- Sending marketing or promotional content — only where you have given consent
- Complying with legal and regulatory obligations
- Improving our internal systems and counselling quality through anonymised analytics
5. International Data Transfers
Because Applywise operates globally, your data may be transferred to — and processed in — countries other than your own. For example, a student based in Malaysia applying to a UK university will have their data shared with institutions in the UK, and potentially processed on servers in the European Economic Area or Pakistan.
- Standard Contractual Clauses (SCCs) — for transfers from the EU/EEA and UK to third countries without an adequacy decision (including transfers to Pakistan and the USA).
- UK International Data Transfer Agreements (IDTAs) — for transfers from the UK post-Brexit.
- Adequacy Decisions — where applicable (e.g., transfers within the EEA).
- Contractual obligations on recipients — all universities, agents, and third-party partners we share data with are required by contract to implement data-protection standards equivalent to the GDPR.
By engaging Applywise's services, you acknowledge that your data will be transferred internationally as described above and confirm that you have been informed of the safeguards in place.
6. How We Share Your Data
We do not sell or rent your personal information. We share it only in the following circumstances:
Universities & Application Platforms
We submit your data to universities, colleges, and application portals (e.g., UCAS, Common App, university portals) as required to complete your applications — with your knowledge and authorisation.
Immigration Authorities
We share relevant data with UKVI, Australian Home Affairs (DOHA), Immigration, Refugees and Citizenship Canada (IRCC), and equivalent bodies as required to process your visa or study permit.
Trusted Service Partners
- Flywire — international tuition fee payment processing
- Amber Students — student housing coordination
- British Council — IELTS testing and language preparation
- Cloud & IT providers — hosting, email, CRM (bound by data processing agreements)
- Analytics providers — receive only anonymised or pseudonymised data
Legal Compliance & Protection
We may disclose data when required by law, court order, or government authority, or where necessary to protect the rights, property, or safety of Applywise, our clients, or the public.
Business Transfers
If Applywise is involved in a merger, acquisition, or asset sale, personal data may be transferred to the successor entity, subject to the same protections described in this Policy.
7. Your Rights
Depending on where you reside, you may have some or all of the following rights. We will respond to all verified requests within 30 days (or 45 days where legally permitted with prior notice).
| Right | What it means |
|---|---|
| Access | Obtain a copy of the personal data we hold about you and information on how it is used. |
| Rectification | Ask us to correct inaccurate or incomplete data. |
| Erasure ("Right to be Forgotten") | Request deletion of your data where it is no longer necessary, consent has been withdrawn, or processing is unlawful — subject to legal retention obligations. |
| Restriction | Ask us to suspend processing while accuracy is contested or while you object to our legitimate-interests basis. |
| Data Portability | Receive your data in a structured, commonly used, machine-readable format for transfer to another controller. |
| Objection | Object to processing based on legitimate interests, including direct marketing (where we will always stop). |
| Withdraw Consent | Withdraw any consent at any time — this will not affect prior lawful processing. |
| Opt-out of Sale / Sharing (CCPA) | California residents may opt out of the sale or sharing of personal information (note: we do not currently sell personal data). |
How to Exercise Your Rights
Submit a request to hello@applywise.io with the subject line "Privacy Rights Request". We will verify your identity before processing the request.
Supervisory Authority Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority:
| Location | Authority |
|---|---|
| United Kingdom | Information Commissioner's Office (ICO) — ico.org.uk |
| Finland | Office of the Data Protection Ombudsman — tietosuoja.fi |
| Netherlands | Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl |
| Sweden | Integritetsskyddsmyndigheten (IMY) — imy.se |
| Germany | Your State Data Protection Authority (Landesdatenschutzbehörde) |
| Australia | Office of the Australian Information Commissioner (OAIC) — oaic.gov.au |
| Canada | Office of the Privacy Commissioner — priv.gc.ca |
| USA (California) | California Privacy Protection Agency — cppa.ca.gov |
| Malaysia | Department of Personal Data Protection — pdp.gov.my |
8. Children's Privacy
Applywise regularly works with high school students, many of whom are under the age of majority in their jurisdiction. We take this responsibility seriously.
Parents and guardians may contact us at hello@applywise.io to review, modify, or request deletion of a minor's data at any time.
If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will delete that data promptly.
9. Ethical Recruitment & Agent Quality Commitments
As an international education agent, Applywise voluntarily commits to the highest ethical standards in student recruitment. Our commitments span every jurisdiction in which we operate.
🇬🇧 UKVI Agent Quality Framework (AQF)
We adhere to the UK Home Office's Agent Quality Framework and the British Council's National Code of Ethical Practice for UK Education Agents. We commit to honest, accurate information, transparent fees, and never encouraging visa misrepresentation.
🇦🇺 Australian National Code (ESOS Act)
We comply with the Australian National Code of Practice for Providers of Education and Training to Overseas Students (National Code 2018) and the obligations set out by the Department of Education and the Tertiary Education Quality and Standards Agency (TEQSA).
🇨🇦 Canada — IRCC Expectations
We follow the Government of Canada's guidelines on authorised representatives and student recruitment. We provide complete and accurate information and never charge impermissible fees for immigration-related services.
🇺🇸 USA — NACAC Code of Ethics
We align with the National Association for College Admission Counseling (NACAC) Code of Ethics and Professional Practice, ensuring honest and fair treatment of all prospective students.
🇪🇺 European Standards
We apply the ICEF Code of Ethics and the British Council guidelines for agents in European markets, including Finland, the Netherlands, Germany, and Sweden, ensuring compliance with each country's higher-education admission norms.
🌐 Universal Pledges
Across all markets, we pledge to: actively combat document fraud and misrepresentation; provide honest, unbiased advice in the student's best interest; protect student confidentiality at all times; and ensure all staff involved in recruitment hold current, verified training certifications.
Students, parents, or partner institutions may report concerns about our conduct by emailing hello@applywise.io. All reports are treated confidentially and investigated promptly.
10. Data Security & Retention
Security Measures
- Encryption in transit: All data transmitted between your browser and our services uses TLS/SSL (HTTPS).
- Encryption at rest: Sensitive files and records stored in our cloud environment are encrypted at rest using AES-256.
- Access controls: Staff access to personal data is role-based and granted on a need-to-know basis. Access logs are maintained and reviewed.
- Multi-factor authentication (MFA): Required for all staff accounts with access to client data.
- Secure cloud storage: Data is hosted on reputable, ISO 27001-certified cloud providers with data residency controls.
- Incident response: We maintain a documented data breach response plan. In the event of a breach likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours (as required under GDPR).
- Staff training: All Applywise staff undergo mandatory data-protection training on joining and annually thereafter.
Retention Periods
| Data Category | Retention Period |
|---|---|
| Active client files (applications, documents) | Duration of the counselling agreement + 3 years after final enrolment/visa outcome |
| Financial transaction records | 7 years (to meet legal and tax obligations) |
| Marketing consent records | Until consent is withdrawn or 3 years after last interaction, whichever is sooner |
| Website analytics (anonymised) | 26 months |
| Unsuccessful enquiries / leads | 12 months from last contact |
At the end of the applicable retention period, data is securely deleted or anonymised so that it can no longer identify you.
11. Cookies & Tracking Technologies
Our website uses cookies and similar technologies to operate correctly and understand how visitors use the site. The types of cookies we use include:
- Strictly necessary: Required for the website to function (e.g., session management). These cannot be disabled.
- Analytics: Help us understand page popularity, traffic sources, and user journeys (e.g., Google Analytics). Data collected is aggregated and anonymised where possible.
- Marketing / targeting: Used only where you have given explicit consent. You may withdraw consent at any time.
You can modify or withdraw your cookie preferences at any time through your browser settings. Disabling certain cookies may affect website functionality. For UK/EU visitors, we display a cookie consent notice on your first visit.
12. Third-Party Links
Our website may contain links to third-party websites, including partner university portals and application platforms. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal information.
13. Changes to This Privacy Policy
We may update this Policy from time to time to reflect changes in our services, legal requirements, or best practices. We will notify you of material changes by posting the revised Policy on this page with an updated "Last reviewed" date at the top, and — where appropriate — by email.
Your continued use of our services after a material update constitutes acceptance of the revised Policy. If you do not agree with any changes, you should cease using our services and contact us to request deletion of your data.
14. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
By engaging with Applywise's services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and transfer of your personal data as described herein.
