Privacy Policy

1.1This Privacy Policy is issued by StudyInSG, run by [company legal name to be confirmed] ("StudyInSG", "we", "us" and "our"). It explains how we collect, use, disclose, store and protect personal data when students, education agents, institutions and visitors use our website, our platform and our communications.

1.2This policy applies to the StudyInSG website, to the student, agent, institution and administrator portals (together, the "Platform"), and to the e-mails, notices and messages that we send in connection with them. It forms part of our Terms and should be read together with them.

1.3The main law that applies to the personal data we handle is the Personal Data Protection Act 2012 of Singapore (the "PDPA"). Where another law also applies to you, for example because you live in another country, we will respect it as far as it applies to us.

1.4If you have a question about this policy, or want to use any of the rights it describes, please contact us at [data protection contact e-mail to be confirmed].

2.1The personal data we collect depends on who you are and how you use the Platform. A student who prepares an application gives us the most; an agent or institution gives us mainly business and contact details.

2.2For students, we may collect the following:

2.3For agents and institutions, we may collect the names, work e-mail addresses and phone numbers of the people who use the Platform, the name and registration details of the agency or institution, licences and references we need for approval, and records of their activity on the Platform.

2.4For everyone who signs in, we also collect device and log-in data, such as the time and date you signed in, the type of browser or device you used, and the internet address (IP address) from which you connected. We use this to keep your Account safe.

2.5We do not collect health data on the Platform. We do not ask for it, and our forms do not have a place for it. Please do not put health information in your messages or in documents that you do not need to upload. If a document you upload happens to contain such information, we use it only to process the application it belongs to.

3.1Most of the personal data we hold comes directly from you, when you sign up, fill in forms, upload documents, give or withdraw consent, and send messages.

3.2If you apply through an agent, the agent may give us your personal data, including documents, on your behalf. The agent must have your consent to do so, and you give the consent that covers our use of that data yourself in your own portal.

3.3Institutions give us personal data about your application, such as its status, requests for further information, and the outcome of a decision.

3.4We create some personal data ourselves. When we check an application, we record what we found, such as which documents are missing, whether a document looks complete and genuine, and the notes of our staff.

3.5We also collect data automatically through your log-in, for example when we record that you signed in or that you changed a record. We do not buy personal data from data brokers and we do not collect it from social media.

4.1We use personal data for the following purposes:

4.2The PDPA allows an organisation to collect, use and disclose personal data when the person has given consent, when consent is deemed to have been given because the person voluntarily provided the data for an obvious purpose, or when an exception in the PDPA applies, for example where the use is required by law or is necessary for a legitimate interest that outweighs any adverse effect on the person. We rely on your consent for the central purposes of preparing and sending your application. We rely on the other bases only where they properly apply, for example to keep records the law requires or to protect the Platform from fraud.

4.3A student gives consent in his or her own portal, in a step that explains who will receive the data and why. We keep a record of the consent as evidence. No agent can give this consent for an adult student.

4.4You may withdraw your consent at any time by using the withdrawal option in your portal or by contacting us. Please be aware of what this means. If you withdraw consent that is needed for an application, we will not be able to continue to prepare or send that application, and an application already sent to an institution may need to be withdrawn. We will tell you about the likely effect before we act. Withdrawal does not affect what we did lawfully before you withdrew, and we may keep a record of the withdrawal itself and the data we must keep by law.

4.5We will not use your personal data for a new purpose that is unrelated to the purposes above unless we first tell you and, where the law requires it, obtain your consent.

5.1We share personal data only with those who need it for the purposes in this policy. We share only what is necessary.

5.2The college or institution to which you apply receives your application, your personal details and the application documents needed for it to decide. The institution then handles that data under its own privacy obligations.

5.3An agent who is linked to you can see your application and the documents they need to look after you. If you apply directly through the StudyInSG Direct Desk, our staff act for you and no agent has access.

5.4We may disclose personal data to government agencies, courts, regulators and law-enforcement bodies where the law requires it, or where a lawful order or request makes it necessary. We check that a request is proper before we answer it.

5.5We use service providers who handle personal data on our behalf and only for our purposes. They fall into these categories:

5.6We do not sell personal data. We do not share it with advertisers or use it for advertising. If our business is sold or reorganised, personal data may be passed to the new owner, who must continue to protect it under this policy.

6.1Your personal data does not stay only in Singapore. Our database and file storage are hosted in India, and the e-mails we send pass through a provider in the United States. When you apply to an institution or work with an agent in another country, your data goes there as well.

6.2When we send data overseas, we take steps to make sure that it receives a standard of protection comparable to the standard under the PDPA. These steps include written contracts with our providers that require them to protect personal data and use it only for our instructions, and security measures such as access controls, private storage and encryption in transit.

6.3You may ask us for more information about these safeguards, and about where your data is held, by contacting us at the address below.

7.1We protect personal data with reasonable security arrangements. These include the following:

7.2No system is perfectly secure, and we cannot promise that personal data will never be accessed without permission. You help to protect your data by keeping your password private, by not sharing your Login and by telling us at once if you think your Account has been misused.

8.1We keep personal data only for as long as we need it for the purposes in this policy or for legal or business reasons.

8.2If you have made an application, we keep your personal data for two years after the last application ends. If an application was approved, we keep it until the program ends, if that is later than the two years.

8.3If you have an Account but have made no application, we keep your data for two years after your last activity on the Platform.

8.4At the end of the retention period, we erase the personal data or make it anonymous so that it can no longer identify you.

8.5We may keep some data for longer where the law requires it, where we need it to deal with a dispute, claim or investigation, or to protect our legal rights. We keep the record of your consent, and of its withdrawal, as evidence for as long as we might need to show that we acted properly.

8.6You may ask us to erase your data earlier. We will do so, except where we have to keep something for the reasons above, and we will tell you what we kept and why.

9.1Under the PDPA, you have the following rights:

9.2To use these rights, please write to us at [data protection contact e-mail to be confirmed] or use the options in your portal. Please tell us what you want us to do and give enough detail for us to find your data.

9.3We will answer within about 30 days. If we need longer, we will tell you within that time and give you a date by which we expect to respond.

9.4Before we release or change personal data, we may need to confirm who you are, so that we do not give your data to the wrong person. We may ask for proof of identity.

9.5The PDPA allows an organisation to charge a reasonable fee for an access request, and to refuse access in certain cases, such as where the data is protected by legal privilege or where giving access would reveal the personal data of another person. If we plan to charge a fee, we will tell you what it is before we act. If we refuse a request, we will explain why, unless the law prevents us.

9.6If you are not satisfied with how we handle your request or your data, please let us know first. You may also raise a concern with the PDPC, whose details are on its website.

10.1We do not allow a person under 18 to sign up on the Platform directly, and we do not knowingly collect personal data directly from children.

10.2A student under 18 may apply only through an agent who looks after the student. The agent must involve a parent or legal guardian, who must understand and agree to how the student's personal data will be used, in the way the law and the institution require.

10.3If we find that we have collected personal data from a person under 18 without a parent's or guardian's involvement, we will take steps to stop using it and, where appropriate, delete it. A parent or guardian who has a concern can contact us at the address below.

11.1A cookie is a small file that a website stores in your browser. Similar technologies, such as local storage, do the same job. We use only what is needed to keep you signed in and to keep the Platform secure.

11.2We do not use advertising cookies, we do not use cookies to follow you across other websites, and we do not allow third-party advertisers to place their cookies on the Platform.

11.3You can clear or block cookies and site data in your browser settings. If you do, you will be signed out and may not be able to sign in again until you allow the cookies that the Platform needs.

12.1We use simple, rule-based checks to help our staff. For example, a check looks for missing documents in an application, and another looks for e-mail addresses, phone numbers and links in messages so that they can be stopped.

12.2These checks only flag matters. They do not decide whether an application is accepted or refused, and they do not make a decision that has a legal or similarly significant effect on you. A person decides what happens next.

12.3If you disagree with a result that comes from a check, you can ask us for a review by a person by contacting us at the address below.

13.1We rely on the information you give us. Please make sure that it is accurate and complete, because wrong details can delay or harm an application.

13.2Please keep your details up to date in your portal, and tell us if your name, contact details, passport, qualifications or other details change. You can also ask us to correct your data using the process in the section on your rights.

14.1If we find a data breach, we will act at once to contain it and assess whether it is likely to cause significant harm to the people affected or is of significant scale.

14.2Where the breach is notifiable under the PDPA, we will notify the PDPC within the time the law sets, and we will tell the affected people as soon as practicable. We will explain what happened, what data is involved, what we have done, and what you can do to protect yourself.

14.3We require our service providers, and expect agents and institutions who receive personal data through the Platform, to tell us promptly if they find a breach that affects it.

15.1Different organisations are responsible for different personal data. For a student who applies directly through the StudyInSG Direct Desk, StudyInSG is the organisation responsible for the personal data we collect and use to handle the application.

15.2For a student who applies through an agent, the agent is a separate organisation with its own relationship with the student. The agent is responsible for the personal data the agent collects and keeps, and for explaining to the student how the agent uses it. StudyInSG is responsible for the personal data on the Platform that we control and use for our own purposes.

15.3An institution that receives an application becomes responsible for the personal data it holds from that point, under its own privacy policy and the laws that apply to it.

15.4Agents must follow their own duties under the PDPA and other privacy laws, as well as the Terms. These duties include getting the proper consent, keeping students' data confidential, using it only for the student's application, protecting it with reasonable security, and telling us promptly of any breach or withdrawal of consent.

16.1We may update this policy from time to time to reflect changes in the law, in the Platform or in the way we handle personal data. Each version has a version number and an effective date, which appear at the top of this page.

16.2We will tell you about a change through a notice in the Platform and, where we hold your e-mail address, by e-mail. If a change affects how we use your personal data in a significant way, or if the law requires it, we will ask for your consent again before the change applies to you.

17.1Our data protection contact is [data protection officer name to be confirmed], at [data protection contact e-mail to be confirmed], or by post at [registered business address to be confirmed].

17.2If you have a concern about how we handle your personal data, please write to us first, and we will look into it and reply within about 30 days. If you are not satisfied, you may raise a concern with the Personal Data Protection Commission of Singapore.