1. Roles
For data submitted through our websites, consultation forms and advisory engagements, Elite Study Group International Education & Consultancy Services acts as the data controller. Universities, language schools, government authorities and authorised service providers we collaborate with act as independent controllers or processors within their own remit.
2. Lawful bases
- Consent — for marketing communications and non-essential cookies.
- Contract — to deliver the advisory services you engage us for.
- Legal obligation — accounting, anti-fraud and regulatory record keeping.
- Legitimate interests — service quality, security and limited business analytics, balanced against your rights.
3. Your rights as a data subject
- Right of access to your personal data.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure (the “right to be forgotten”).
- Right to restriction of processing.
- Right to data portability in a structured, machine-readable format.
- Right to object to processing, including direct marketing.
- Right not to be subject to solely automated decision-making with legal effects.
- Right to withdraw consent at any time without affecting prior lawful processing.
4. Exercising your rights
Send requests to info@elitestudy.education with enough detail for us to verify your identity. We respond within one month, extendable by two further months for complex requests, and we do not charge a fee unless requests are manifestly unfounded or excessive.
5. International transfers
Where personal data is transferred outside the EEA / UK, we rely on European Commission adequacy decisions or the EU Standard Contractual Clauses (2021/914), supplemented by additional technical and organisational measures where appropriate.
6. Data Protection Authority
You have the right to lodge a complaint with your local supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens. A list of EEA authorities is available on the European Data Protection Board website.
7. Security and breach notification
We apply encryption in transit, access controls, vendor due diligence and regular reviews of our processing activities. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the competent authority within 72 hours and, where required, the affected individuals without undue delay.
8. Records of processing & DPO
We maintain records of processing activities under Article 30 GDPR. A formal Data Protection Officer is not statutorily required for our current activities; the privacy point of contact is reachable at info@elitestudy.education.