Privacy Policy

This draft covers identifiable information used through iStudyMate’s website and international-student services: enquiries, accounts, applications to Chinese institutions, and separately agreed visa or arrival assistance.

The proposed responsible entity is iStudyMate Consulting Co., Ltd. For privacy enquiries, contact service@istudymate.com. We use “we”, “us” and “our” to refer to the entity operating the service, once its identity is verified.

Universities, scholarship bodies, authorities and independent service providers may determine how they use information for their own functions. Their privacy notices govern that independent processing. Linking to another website does not remove our responsibilities for information we disclose.

We limit collection to the stage and purpose involved, identify required fields, and explain which task cannot proceed without necessary information. Optional fields must remain optional.

We do not treat acceptance of the Terms of Service as unlimited permission to use information. Under Chinese law, “legitimate interests” is not a general standalone ground. Where consent is our ground, it must be informed, voluntary and specific. Changes require assessment and renewed consent where legally required.

Sensitive information includes categories protected by applicable law, such as health information, financial-account information, biometrics, location trails and information about children under 14 under Chinese law. Identity documents and application materials may also contain sensitive information or create serious risks if misused.

Before requesting sensitive information, we explain the particular purpose, why it is necessary, the categories involved, relevant recipients and potential effects on your rights. We apply the stricter protection required by law. Where processing relies on consent, we obtain separate consent and written consent where required. A checkbox accepting this whole policy is not a substitute for a required separate choice.

Please redact unrelated details where the recipient’s requirements permit. We should offer a suitable submission route and explain any necessary alternative verification. Refusing an optional sensitive-data request should not block unrelated services; refusing information essential to a specific application may prevent that particular task.

Information may come from you, an authorised representative, or an institution or provider involved in your request. Before using information obtained indirectly, we check its source, the authority to provide it, and the notice or consent needed. Public availability does not permit unrestricted reuse.

Provide another person’s information, such as referee or emergency-contact details, only where necessary and you are entitled to share it. We may need to notify that person separately. Please do not upload another person’s identity document without an established requirement and authority.

A parent, sponsor, recruiter, agent or person paying your fees does not automatically receive your application documents, health details, messages or account access. We verify their legal authority or your specific authorisation and limit access to that scope. You may change an authorisation, subject to applicable law and actions already properly completed. Special guardian rules apply to children and are explained below.

We share only the information necessary for an identified purpose and lawful ground. An entrusted processor handles information on our documented instructions under appropriate contractual restrictions and oversight. An independent personal-information handler or controller determines its own purposes and means. The actual arrangement determines the role.

• Selected institutions and scholarship bodies: normally assess applications and make their own admissions or award decisions.
• Authorities and authorised application channels: may receive information needed for a specific lawful visa, residence or regulatory process.
• Service providers: hosting, communication, application administration, payment or other providers may be involved only where actually used and justified.
• Optional support providers: accommodation, travel or arrival providers receive information only for support you request.
• Legal or organisational events: a lawful demand, restructuring or business transfer may require limited disclosure, with applicable notice and continuing protections.

Before a disclosure requiring recipient-specific notice or separate consent, we provide that information and obtain the required consent. General wording about “partners” is insufficient.

Your application may involve information moving between your location, iStudyMate’s confirmed operating locations, selected Chinese institutions and other expressly identified recipients. Access by staff or a service provider from another country may also constitute a cross-border transfer. Server location alone does not settle transfer requirements.

Before a regulated transfer, we identify the destination and overseas recipient, its contact details, the purposes and methods of processing, information categories, and how you can exercise rights with that recipient. We assess necessity and risk, provide required notices, obtain separate consent where required, and use the applicable lawful transfer mechanism.

A transfer-mechanism exemption does not automatically remove transparency, security, impact-assessment or required-consent duties. We do not claim all information stays in China or a safeguard is already completed.

Essential technologies may support functions such as a requested session, security or remembering your privacy choice. Any analytics, advertising, profiling or other non-essential technology must be assessed separately. Under this proposed design, non-essential technologies remain off by default until you make the choice required by applicable law.

A live preference panel should make rejection and withdrawal as straightforward as acceptance, allow category choices, and avoid preselected optional permissions. Refusing optional tracking should not prevent ordinary access to public information. Browser settings can also manage cookies, although blocking essential technologies may affect a requested function.

The cookie notice must identify the actual technology or provider, purpose, first- or third-party status, information involved, duration and controls. Embedded videos, chat widgets and social features must be included where deployed.

Promotional messages should use a separate, optional choice with clear communication channels and an accessible unsubscribe method. Service messages needed for your active request, such as a missing-document notice, are different from promotional messages. We do not add promotional content to a mandatory message to bypass your choice.

Publicity using your name, image, testimonial, interview, result or offer screenshot requires specific permission covering materials, channels and use. Sensitive information, document numbers, contact details and unrelated people must be removed unless there is a justified and lawful reason otherwise. Admission support is not conditional on granting publicity permission.

You may withdraw consent for future consent-based use. We explain limits on recalling distributed materials and take required removal steps.

If AI-assisted or automated tools are introduced, we first assess the provider, information use, retention, training settings, security, transfer implications and lawful ground. Our proposed operating rule prohibits staff from uploading identifiable passport, health, financial or other sensitive application documents into unassessed public AI tools.

Study recommendations and document assistance should receive appropriate human review. An output is not an admission or scholarship decision. We explain any profiling or automated decision-making affecting you as required by applicable law, including its significant effects and available review options.

Where the law gives you a right to an explanation or to refuse a decision based solely on automated processing with a significant effect on your rights, we provide a practical way to exercise it. Personalised marketing must include the alternatives or rejection controls required by applicable law.

Information about children under 14 is sensitive personal information under Chinese law. Before knowingly collecting it, we require an appropriate guardian-led process, verified guardian consent, specific necessity and separate child-information rules. An adult’s casual statement that they are a guardian is not sufficient verification.

Until that process and the dedicated rules are established, this proposed policy does not authorise self-service collection from children under 14. A guardian may contact us to discuss the correct route without sending the child’s identity or sensitive documents. If such information is received unexpectedly, we restrict its use and assess deletion or lawful guardian involvement promptly.

Applicants aged 14–17 are not automatically subject to the same under-14 consent rule. We consider applicable minor-protection rules, the applicant’s capacity, guardian authority and the particular contract or institutional requirement. Notices should be understandable and access limited to justified purposes.

We retain personal information for the shortest period necessary for its stated purpose unless law requires a different period. Retention depends on the record, service status, applicable legal obligations and a documented need to address a complaint or dispute.

• Enquiries that do not progress: retain only for a justified follow-up period, then delete or genuinely anonymise.
• Active applications and service records: retain while needed for the agreed service and a separately justified post-service purpose.
• Identity, health and other sensitive documents: reassess promptly after the relevant verification or submission; do not retain full copies merely because they might be useful.
• Transaction and accounting records: retain the records legally required for the applicable statutory period.
• Consent, complaints, security and suppression records: retain a proportionate record needed to demonstrate choices, resolve matters, protect the service or honour an opt-out.

Deletion requests may leave limited records where retention is legally required. Where deletion is technically difficult, we restrict further processing as required by law and explain the position. Backups require a defined deletion or expiry process and must not become a reason for indefinite reuse.

Subject to the conditions and exceptions in applicable law, you may request:

• Information about our processing, and access to or a copy of your personal information.
• Correction or completion of inaccurate or incomplete information.
• Deletion when the relevant legal conditions are met.
• Withdrawal of consent for future consent-based processing.
• Account closure where an account is provided.
• Restriction, refusal or objection to processing to the extent the applicable law provides.
• Transfer of your information to a designated recipient where the legal and technical conditions for that right are met.
• An explanation or human consideration concerning qualifying automated decisions, and the right to refuse solely automated significant decisions where provided by law.

Withdrawal does not invalidate earlier lawful consent-based processing. We explain any effect on dependent tasks; optional consent is not required for unrelated services. Closing an account does not automatically cancel a separate service contract or erase records we must lawfully retain.

We do not penalise you for exercising protected rights. If we cannot fulfil a request fully, we explain the applicable reason and available review or complaint route.

Email service@istudymate.com with the subject “Privacy request”. Describe the request and provide the contact information you used with us. Do not include a full passport, bank record or medical document in your first message.

We may request proportionate information to confirm identity and protect against unauthorised disclosure. We prefer information already available to us where sufficient. Representatives may need authority evidence. We should not demand excessive information or unjustified fees.

Requests must be handled promptly and within deadlines imposed by applicable law. If clarification, a lawful extension or partial refusal is necessary, we explain it. You may complain to an appropriate competent authority or seek other remedies available under applicable law.

We are responsible for implementing appropriate organisational and technical measures required by applicable law. The proposed programme includes limiting access to authorised roles, staff confidentiality and training, controlled document handling, supplier oversight, secure transfer and storage appropriate to risk, and procedures for responding to incidents.

Specific measures must be verified before they are advertised. We do not claim a certification, encryption configuration, continuous monitoring capability or absolute security guarantee merely by publishing this policy. Use a unique account password and promptly report suspected misuse.

If a personal-information incident occurs, we assess it, take required remedial measures, preserve appropriate records, and notify affected people and competent authorities when and as required by law. Security limitations do not exclude mandatory duties or liability.

We publish an effective date and version when a policy is approved for use. Material changes receive an appropriate prominent notice, and we seek renewed consent when the law requires it. Continued browsing alone does not replace a required new or separate consent.

Changes cannot retrospectively legitimise incompatible use or undo a withdrawal. Prior versions should remain accessible or available on reasonable request.

Contact service@istudymate.com for privacy questions, rights requests or concerns about a representative’s access. Include only necessary information. Additional notices for a particular form, institution, sensitive-data request or transfer should explain the relevant processing without reducing mandatory rights.

This section applies only where the EU GDPR or UK GDPR applies to our processing. Mere worldwide access to the website, or an applicant’s nationality, does not by itself determine applicability. Establishment, offering services to people in the relevant territory, or monitoring their behaviour there may be relevant.

Where applicable, the regional notice must identify the controller, each actual processing purpose and lawful basis, any specific legitimate interest relied upon, and the additional condition for special-category data. It must identify international-transfer safeguards, retention criteria, required representatives or officers, and how to contact the relevant supervisory authority.

You may have rights of access, rectification, erasure, restriction, portability, objection, consent withdrawal and safeguards concerning automated decisions. Objection to direct marketing must be honoured. Requests are normally answered within one month under these regimes, with extensions only where legally permitted and appropriately notified. Cookie and marketing requirements also need a separate assessment under applicable regional rules.