Gateway Educonnect Privacy Policy

Effective Date: 11th August 2026

Last Updated: 11th August 2026

1. Who We Are and Scope of This Privacy Policy

Gateway EduConnect Pvt Ltd, a company registered in India, under the name Gateway EduConnect, referred to as Gateway EduConnect, we, us, or our, is an education counselling and student recruitment firm that provides prospective students with enquiry, counselling, courses and institutions short-listing, application preparation, document preparation, submission of applications to universities and education partners, visa-support, and post offer services.

This Privacy Policy provides information about the manner in which we, Gateway EduConnect Pvt Ltd, collect, use, store, share, transfer, protect and delete personal information in any form with respect to prospective students, applicants, students, parents, guardians, sponsors, education partners, channel partners, web site users and other individuals who interact with us.

Unless otherwise declared in this Privacy Policy, the terms gateway EduConnect, we, our and us refer to Gateway EduConnect Pvt Ltd.

Legal entity: Gateway EduConnect Pvt Ltd

Registered office: N 10, Shree Niketan, Road Number 10, Ashok Nagar, Udaipur, Rajasthan, 313001.

Corporate Identification Number (CIN): U80902RJ2020PTC067618

Email: info@gatewayeduconnect.in

Website: https://gatewayeduconnect.com/

2. Applicable Data Protection Laws

This policy is intended to ensure that it complies with the UK GDPR and Data Protection Act 2018 where processes by Gateway EduConnect involve personal data that is linked to UK institutions or the UK-based recruitment process; the Privacy and Electronic Communications Regulations where electronic marketing and cookies are used; the Digital Personal Data Protection Act, 2023 and Indian rules where Gateway EduConnect processes involve digital personal data in India; and contractual obligations as required by partner universities, pathway providers, payment processors, CRM providers, and cloud providers as well as professional advisers.

3. Key privacy principles

Gateway EduConnect applies the following principles of working with personal data: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage, security, confidentiality, accountability, and respect of personal rights. We never gather personal information on the idea that it would be helpful in the future. Additionally, we've only gathered the data needed to serve the student recruitment, counselling, application, visa support, partnership, compliance, or communication purposes described in this policy.

4. Important definitions

5. Our Role in Processing Personal Data

Gateway EduConnect Pvt Ltd can be a data controller, a data processor on behalf of another controller, or a joint controller depending on the specific processing activity and the contractual arrangements which apply. We are only going to play a role based on who decides the purposes and methods of processing the concerned personal data.

5.1 Gateway EduConnect Pvt Ltd as a Data Controller

Gateway EduConnect Pvt Ltd generally acts as a controller where we determine the purposes and means of processing personal data for our own business and service-delivery purposes. This may include:

• Accepting email, WhatsApp, telephone, event, social media, walk-in inquiries, and referrals
• Maintaining and developing CRM databases of possible parents, students, education partners, and sponsors.
• Evaluating the English language, original academic, intake, and course preferences before the selection of a particular institution by a student;
• Offering counselling, updates on the intake, appointment notices, service updates, application assistance, and document checklists
• Organising marketing preferences, invitees to webinars, newsletters, consent records, and event registration;
• Lead allocation, running internal reporting, audits, service quality monitoring, fraud prevention, complaint handling, legal compliance, and security.

5.2 Privacy liability

Where Gateway EduConnect Pvt Ltd processes personal data on behalf of a university, pathway provider or other education partner and that organisation decides the purposes and means of the corresponding processing, we can be a processor on its behalf.

Under these conditions, we process personal data on the agreed conditions, written instructions of the respective controller, admissions-platform requirements and relevant data protection requirements.

This processing can involve the preparation or formatting of application documents, uploading information to admissions portals, transferring supporting documents, responding to admissions related requests and supporting application administration.

The respective data-protection responsibilities of Gateway EduConnect Pvt Ltd and the relevant education partner will depend on the particular processing activity and applicable contractual arrangements.

5.3 Joint Controller Arrangements

Under specific conditions, the purpose and method of processing specific personal data may be decided by Gateway EduConnect Pvt Ltd and another organisation. This can occur, such as with some co-branded events, collaborative recruitment work or other collaborative projects.

In the event that Gateway EduConnect Pvt Ltd and another organisation are two joint controllers under the relevant data protection law, the parties will set their respective responsibilities on compliance, including responsibilities in transparency, individual rights, security and handling privacy-related enquiries, as per relevant law.

6. Personal data we collect

Gateway EduConnect does not gather any personal information on an unnecessary basis. When we are provided with too many documents, or sensitive information that is not relevant to us, then we will reduce, black out, send back, destroy or tighten the access to such information, where necessary.

6.1 Special health, welfare, visa-health, and disability category of data.

Gateway EduConnect handles special category data only when strictly required, due to a specific purpose, like disability support at the university, reasonable adjustments, welfare support, accommodation support, visa medical requirements, complaints management, protection, or legal requirements. Processing of such information is done where it is absolutely necessary and to authorised personnel with a legitimate purpose of operation.

Examples could be disability data, healthcare or welfare data that an applicant voluntarily submits, health-related visa data or data required by a university support staff. We will not ask wide medical histories where a more specific document suffices, and we will censor, isolate, limit or delete sensitive data where it is not needed.

6.2 Children, children under 18, parents and guardians.

Gateway EduConnect can assist applicants who are below 18, pathway/foundation applicants or applicants who need parent, guardian or sponsor support. Grounded in the law or required by the institutional regulations, the safeguarding expectation, service necessity, the Gateway EduConnect will collect or submit minor applicant data by obtaining or verifying parent/guardian involvement or permission as needed by such law or institution regulation. We will proactively avoid subjecting children to unnecessary direct marketing, and we will take extra precautions regarding the identity material, welfare data, contact information and messages with minors.

In cases where safeguarding, welfare, emergency-contact, accommodation or student-support matters come into play, Gateway EduConnect can disseminate the minimum information required by the appropriate institution, parent/guardian, sponsor, authority or professional adviser where there is an appropriate lawful basis, and there is an operational necessity.

7. Why We Process Personal Data and Our Lawful Bases

Gateway EduConnect Pvt Ltd handles personal data with the appropriate purpose and legitimate basis within the context of the data protection law.

In the UK, where the GDPR is applicable, we can make use of:

• Consent - Article 6(1)(a): a valid consent you have provided on a particular purpose including some marketing.
• Contract - Article 6(1)(b): where it is required to process in order to provide the requested counselling, application support, visa-support coordination or other services, or to perform actions at your request prior to the conclusion of a contract.
• Legal requirement -Article 6(1)(c): where processing is required to meet the necessary legal or regulatory requirements.
• Legitimate interests - Article 6(1)(f): in the event that processing is required due to legitimate purposes, including administration of the services, quality enhancement, security, prevention of fraud, record keeping or business operation, so long as your rights and interests do not override the interests.

In countries where Indian data protection law is applicable, such as the Digital Personal Data Protection Act, 2023 and relevant rules, we use personal data on a legal basis that is authorised by the law.

7.1 Main Purposes of Processing

We can use personal data as follows:

7.2 Partners in education and Universities.

Where individual information is given to a university, college, pathway provider or other education partner, that organisation may be an independent controller and decide its purpose and legal grounds on which it is being processed.

In the event that Gateway EduConnect is processing personal data on behalf of such an organisation only, we might be the processor pursuant to the relevant contract or written directives.

7.3 Special category personal data.

We process health, disability, welfare or other special category data where the data is needed either to provide access support, accommodation, safeguarding, complaints or visa-related purposes.

In the case of UK GDPR applicability, we will find a proper Article 6 lawful basis and Article 9 condition to be used and put further restrictions to such information.

7.4 Marketing and Consent

In cases where marketing or other processing needs consent, we will acquire proper consent. You can revoke consent or not participate in direct marketing.

Revocation of consent has no impact on the legality of pre withdrawal processing.

8. Legitimate interests assessment summary

In cases where Gateway EduConnect is dependent on legitimate interests, we use a three-part test:

• Purpose test: the processing has to be in support of an authoritative business, service, safety, anti-fraud, quality, security, communication or compliance purpose related to education, counselling and student recruitment.
• Necessity test: the purpose is not possible to be fulfilled in a less obtrusive manner, and only the least amount of personal data is acted upon.
• Balancing consideration: Gateway EduConnect considers a weighing between its interest and the rights, expectations, age, vulnerability, relationship to us, sensitivity of the data and the impact on the individual. Our defences include access controls, minimisation of data, opt-out, audit trail, human review and retention limits.

9. Automated profiling, AI, decision making, and automation.

9.1 AI usage disclosure

Very little automation can be deployed by Gateway EduConnect, and it can automate certain tools with AI providers, permitting them to be deployed internally by satisfying the organisation's administrative requirements. This can involve assignment of CRM leads and scheduling of intake reminders, detection of duplicate records, use of document checklists, translations, non-final communications drafting and internal service analytics. Gateway EduConnect will not employ AI to come up with final admissions, visa, scholarship, eligibility or rejection decisions regarding a student.

Approved AI-enabled voice calling or conversational automation tools can also be used by the Gateway EduConnect to call prospective students who have enquired, registered for counselling, attended an event, or otherwise provided contact information to enable follow-up by the Gateway Educonnect Pvt Ltd. Such AI-assisted calls may be used to collect the area of interest of the student, the place of study they want to pursue their studies, course level, admission date, their budget level, their academic background, their English language status, their work experience, their visa-history indications, and other high-level eligibility criteria required in preliminary counselling. This is to channel the enquiry to the right counsellor, prepare a human counselling session, save on habitual data collection, and conduct the preliminary profile pre-qualification.

There are no final admissions, visa, scholarship, financial, offer, rejection, or counselling decisions made by AI-enabled voice calls. Any pre-qualification, score, tag, transcript, summary and recommended next step generated as a result of an AI voice interaction is considered an internal administrative expression and needs to be checked by entitled Gateway EduConnect personnel before any advice, application submission or recommendation is provided to the student. Students can seek human consideration, have them call them on the phone, correct their calls, prohibit automated profiling, or choose not to use artificial intelligence to make calls using the contact privacy information in this policy.

By providing a tool that utilises personal data, which includes an AI tool, we will further make certain that it is utilised solely on intended functions that have an adequate lawful foundation, security audits, and controls, human supervision, vendor due diligence and data reduction by making sure that the vendor provides sufficient information in the latter statement. We will not knowingly post special category information, scans of passports, bank statements, or records of visa refusals into unrestricted or untrained AI applications.

Gateway EduConnect does not knowingly permit applicant personal data submitted through approved AI tools to be used to train public or unrelated AI models where such use would be inconsistent with our contractual arrangements or applicable data-protection requirements. AI-generated outputs used in counselling, application preparation, document review or student communications are subject to appropriate human review. Human staff remain responsible for final advice, application-related actions and communications.

9.2 Automated decision-making disclosure

Gateway EduConnect does not engage in automation of decision-making, which results in legal effects or any other profound effects on individuals. There are further applications, such as automated workflows, we can use to sort enquiries, route leads to counsellors, find missing documents, compare basic profile information with freely available or offered by the institution entry information, or give reminders. These processes are only administrative aids.

All critical evaluations, such as the appropriateness of a course, advice on the admissions process, intensification of an ineligible profile, a final decision to submit an application, complaint response, and other individual decisions impacting service delivery, are all human reviewed by Gateway EduConnect staff. Contacting the privacy contact noted in this policy can enable the students to request human review, appeal an automated classification, give more information, and seek an explanation.

10. Privacy notices of universities and partners.

When Gateway EduConnect discloses the personal data of an applicant to a university, college, pathway provider or other education partner, the applicant shall be shown or emailed the privacy notice of the relevant institution and shall be shown the link where Gateway EduConnect exercises control over the workflow of submission before or at the time of submission. Gateway EduConnect will issue the corresponding link of a notice in the following ways:

• Within the application form or consent/authorisation form;
• In the email confirmation or a WhatsApp message of the application;
• Through the majority of the Gateway EduConnect application portal or CRM consent screen;
• Via the official admissions portal of the institution, prior to submitting it;
• In an upheld internal table of partner privacy notice links utilised by counsellors.

In case an institution changes its privacy notice, the Gateway EduConnect will make reasonable efforts to change the link in its records. The applicants, too, are expected to read the privacy notice posted on the official site of the institution since the institution has the power to decide on how it manages the information regarding the applicant once it receives the application.

Applicant Privacy Notice: Gateway EduConnect will take reasonable measures to make an applicant aware of the privacy notice of the respective institution, before or at the time at which an application is submitted to a university or education partner. Where feasible, we can offer a connection to the privacy notice of the institution in our application process, communications or the admissions portal of the institution.

11. Who we share personal data with

12. International transfers

Gateway EduConnect Pvt Ltd is based in India and can send personal data to the United Kingdom and European Economic Area (EEA) and other countries as needed to deliver our services to universities, education partner and service provider.

International transfers can be used in the case of student counselling, processing applications, admissions communications, volume hosting of the visa, communications and legal or regulatory compliance.

In case the applicable data protection law demands further safeguards to an international transfer, we will ensure that we safeguard personal data. They can consist of accepted contractual protections, data-processing contracts, access controls, encryption, data minimisation and other reasonable security practices.

In cases where the UK GDPR is relevant, and the personal data is exported to a country that does not enjoy relevant adequacy regulations, we will apply a suitable transfer mechanism where necessary, either the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We implement reasonable measures to make sure that whenever personal data is transferred across borders, it is entitled to an adequate degree of protection as per the relevant data protection legislation.

13. Security and confidentiality.

• Role-based access wherein only authorised staff can view student records required in their work;
• Where applicable, key systems must have multi-factor authentication;
• Encryption at rest and in transit, where the platform supported them;
• Protected CRM and cloud storage with access history where possible;
• Limited work with the passports, financial evidence, visa files, and special category information;
• Confidentiality of staff and privacy training;
• Core system vendor due diligence of systems that process personal data;
• Data breaches of suspected personal information;

Personal data breach process: Gateway EduConnect will have a work policy breach escalation procedure regarding potential accidental or illegal destruction, loss, change, unauthorised disclosure of or accessing personal data. Teammates and consultants need to report on any suspected cases to the Data Protection Lead. Gateway EduConnect will determine the type of data, individuals impacted, risk probability, mitigation measures, and notification roles.

Where the law allows, Gateway EduConnect will inform individuals and other regulators who may be affected where reportable personal data breaches have happened. Reportable breaches will be evaluated against the ICO notification threshold where UK GDPR applies and where notified, in accordance with the data breach notification requirement, without undue delay and, where practicable, within 72 hours of learning about it. Where Indian law is in play, DPDP Act/rules will be adhered to at Gateway EduConnect and any Data Protection Board or sectoral reporting.

14. Data retention

Gateway EduConnect Pvt Ltd will maintain personal data as long as is reasonably necessary to the purpose of its collection, or as long as necessary to the extent necessary or authorised by law, contract or regulation, or to establish, maintain or defend legal claims.

The retention period varies based on the nature of the personal data, the reason behind the processing of the data and nature of the relationship that we may have with you and any other legal, regulatory or contractual obligations.

As a general guide:

• Enquiry records: as a rule, kept not more than 12 months following the last significant contact, unless an enquiry proceeds to active counselling or an application.
• Counselling and onboarding records: records are usually kept up to 2 years following the last meaningful contact in which no application is made.
• Application records: can be held in general up to 6 years after the completion of the application or service to which they relate, when reasonably necessary to keep a record, in contract, complaint or legal matters.
• Financial, payment, tax and audit records: kept as long as it is necessary according to the applicable accounting, tax and other legal requirements.
• Complaint, dispute and legal records: kept as long as reasonably necessary to control the issue and to fulfill relevant legal or regulatory provisions.
• Marketing records: held until the marketing permission is changed. In the cases where one chooses not to do so, we can keep some suppression data to honor the choice and to show that he or she did so.
• Security and technical records: retained for an appropriate period based on security, fraud-prevention, audit and incident-response requirements.

In case a university or education partner has another retention period in which the information process is done on its behalf, we can keep or erase the information in question in line with the current contractual guidelines and legal provisions.

We shall ensure that in cases where personal data is not necessary any actions will be taken to ensure that we are able to securely delete, anonymise or otherwise dispose of such data, where we are not obliged to do so by any outstanding legal, regulatory or contractual obligation.

We also review our retention practices periodically to assist in making sure that personal data is not retained longer than it is reasonably necessary.

15. Individual rights

You might be entitled to some rights concerning your personal data depending on the law or regulation that applies to data protection and the situations under which this processing occurs.

These may be:

• Right to be informed: You might be entitled to obtain clear information as to how we collect, use, share, store and protect your personal data.
• Right of access: You have the right to receive information as to whether we use your personal data, and, where possible, a copy of such data.
• Right to rectification: You have a right to correct personal data that is inaccurate or fill in information that is not complete.
• Right to erasure: You can ask us to delete your personal information when there is no longer a legal purpose to us to keep or use it. This right can be subject to legal, regulatory or contractual or other exceptions.
• Right to limit processing: Under some conditions, you can ask us to restrict our use of your personal data, as a problem related to its accuracy, legality or purpose is under consideration.
• Right to data portability: You have the right to data portability, where appropriate, you can request some personal data in a structured, commonly used and machine-readable format or can ask it to be sent to a different controller where technically feasible.
• Right to object: In the event that the processing is founded on legitimate interests, you might have the right to object to the processing in specific situations. We shall take into account the objection as per the applicable law.
• Right to refuse direct marketing: You can refuse the use of your personal data in direct marketing at any moment. We are going to cease the corresponding direct-marketing communication and change our marketing preferences.
• Right to withdraw consent: In the case of processing on the basis of your consent, you can withdraw it at any time. The lawfulness of processing which has been undertaken prior to the withdrawal of consent will not be impacted.
• Rights to automated decision-making: In some cases, you can be entitled to rights to automated decision-making that involves making the legal or other similarly important decisions based on automated processing alone. Gateway EduConnect does not rely on automated processing to make final admission, visa, scholarship or any other important decisions. You can also ask to have for human review an automated classification utilized in relation to our services where there is reason to do so.
• Right to complain: You can contact Gateway EduConnect in case you are concerned about the treatment of your personal data. As appropriate, you might also possess the right to complain to the applicable data protection or the supervisory authority.

These rights are not absolute and can be subject to change based on the law that applies, whether we are the controller or the processor, the purpose of processing and exemptions permitted by the law.

Where the personal data are processed by Gateway EduConnect on behalf of a university or any other organisation as controller, we can forward your request to that organisation or help it to respond to your request, as we deem it appropriate.

In Section 16 -How to Exercise Your Rights or Contact Us, information on how to exercise your rights and contact us is given.

16. How to Exercise Your Rights or Contact Us

If you wish to exercise a privacy right, ask a question about this Privacy Policy, request correction or deletion of personal data, withdraw consent where processing is based on consent, object to direct marketing, request human review of an automated classification or raise a privacy-related complaint, you may contact us using the details below.

Gateway EduConnect can provide evidence of identity prior to the release, correction, deletion, or transfer of data. We will react to the statutory period during which the request applies. This normally has a time limit of one month as per UK GDPR and may have an additional two months in case of a complicated request. Assuming that we are a university processor, we might be required to pass the request on to the appropriate university controller and help the controller to respond.

17. Supervisory authorities and complaints.

Gateway EduConnect will urge people to reach out to us initially so that we can enquire and address privacy issues. In UK GDPR-affected areas, it is also the right of individuals to complain to the UK Information Commissioner's Office:

Website: https://ico.org.uk/make-a-complaint/

Main website: https://ico.org.uk/

Telephone: 0303 123 1113

Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

In case of the Indian data protection law, any individual can also be remitted to the relevant Indian authority after the relevant mechanism is in place and is applicable to the processing.

18. Cookies, Website Analytics and Electronic Marketing

Cookies and other technologies: Gateway EduConnect Pvt Ltd might also employ cookies and other technologies in our site to aid in the functionality of the site, to learn how visitors navigate our site, to help enhance performance and, where feasible, to assist in marketing efforts.

Cookies may include:

• Essential cookies: These cookies are required to make the site operate correctly and cannot be turned off by our cookie controls.
• Analytics and performance cookies: These cookies assist us to see how people use our site and enhance its efficiency.
• Cookies: It is able to remember some of the selects or preferences to enhance the user experience.
• Cookies marketing: Can be applied to gauge campaigns, or give applicable advertising where allowed by law.

Where the law mandates consent to non-essential cookies or other technologies, we will seek the necessary consent prior to using such. Where it is available, you can control or withdraw your cookie preferences using the cookie controls on our site.

Additional details on cookies and other technologies that we use on our website, their purpose, and duration, can be found in our Cookie Policy or Cookie Notice.

18.1 Electronic Marketing

We can communicate information regarding our services, educational opportunities, events, webinars and more information where the law allows.

Where consent is to be given to electronic marketing, we shall seek proper consent before using electronic messages.

Direct marketing can be avoided at any time by following the unsubscribe or opt-out procedure that is offered in the message or by getting in touch with us through the contact information contained within this Privacy Policy.

Following a legitimate opt-out request, we will make reasonable efforts to cease the concerned marketing communications. We can hold some suppression or preference data where required as a sign of respect to your request and to show compliance.

18.2 AI-Assisted Communications

Approved AI-assisted tools can be used by Gateway EduConnect to conduct restricted communication and administration, like answer inquiries, schedule appointments, gather preliminary data or give service-related follow-up.

In situations where AI-assisted communications are implemented in conducting direct marketing, it will be done where it is authorised by the relevant law. Human touch or requests to cease relevant automated marketing messages can be made where justified.

19. Children and Applicants Under 18

The main services offered by Gateway EduConnect are those offered to higher education applicants. There are some applicants who can be below 18.

Where an applicant is a minor, we may gather and process personal data required to offer counselling, application support and other services as per the required law and the demands of the university or other education partner in question.

Where necessary, we can seek the participation, permission or approval of a parent or legal guardian. We can also handle restricted parent or guardian data, i.e., name, contact information, connection with the applicant and pertinent consent or authorisation documentation.

We do not unknowingly gather any additional personal information on children or minors beyond what is reasonable in the context of the service in question.

Should you feel that we have been given personal data referring to a child without proper authority or consent where necessary, then you should tell us using the contact details as given in Section 16 of this Privacy Policy.

20. Accuracy and Responsibility of Applicants

When availing the services of Gateway EduConnect, it is the responsibility of the applicants to ensure that the information and documents submitted are accurate, complete, authentic and up-to-date.

The applicants are not allowed to give a false, misleading, fraudulent, forged, altered or illegally obtained information or documents. It is the duty of the applicants to ensure that they notify Gateway EduConnect immediately when any information they have supplied becomes inaccurate or is in need of revision.

Under its counselling and application-support services, Gateway EduConnect can also conduct reasonable checks to detect missing information, discrepancies or apparent document problems. When needed, we can ask to receive extra information or other supporting documents before moving on an application or the service.

Where possible, the applicants have the responsibility of checking the accuracy and completeness of the application information and supporting documents before submission.

It is not the responsibility of Gateway EduConnect to ensure that any information or document is accepted, authentic or approved by a university, or an education partner, government authority or other third party. The decisions made by the respective institution or authority are independent in terms of admission, scholarship, visa, immigration and other decisions.

Where we have reasonable grounds to suspect fraud, forged documents or information that is materially false, we may suspend or terminate the service in question and, where necessary or authorised by law or contract, take further action.

21. Changes to This Privacy Policy

Gateway EduConnect Pvt Ltd can revise this Privacy Policy periodically to suit our changes in services, legal or regulatory mandates, business practices, partners, technology infrastructures, data-processing operations or data-retention processes.

The latest version of this Privacy Policy will be published on our website with the applicable “11/08/2026” date.

Where necessary, by the law or in situations where we materially change the way personal data is handled, we will make reasonable efforts to inform the affected individuals.