Privacy
and Policy
Data
1. Who we are
Controller | Asia Exchange Oy |
Address | Vuorikatu 3, 33100 Tampere, Finland |
Privacy Lead | Joonas Salo — Joonas@AsiaExchange.org |
Website | asiaexchange.org |
Asia Exchange Oy is a Finnish study abroad programme operator. We are the data controller for all personal data collected through our website, application forms, and communications. We are registered in Finland and our lead data protection supervisory authority is the Finnish Data Protection Ombudsman.
2. What data we collect, why, and for how long
The table below covers all personal data we process, the purpose, the legal basis under GDPR, and the retention period. We only collect what we need for the specific purpose stated.
What we process | Why (purpose) | Legal basis | Kept for |
Name, email, contact details, university, programme interest | Responding to enquiries and processing study abroad applications | Contract (Art. 6(1)(b)) — necessary to take pre-contractual steps | 7 years from semester start date |
Application data: passport details, date of birth, academic transcripts, emergency contacts | Enrolling you on a programme and providing support during it | Contract (Art. 6(1)(b)) | 5 years after programme end |
Health information voluntarily disclosed | Student welfare and emergency response during programme | Consent (Art. 9(2)(a)); Vital interests (Art. 9(2)(c)) in emergencies | Programme duration + 1 year |
Financial data (tuition payment records) | Programme administration and statutory accounting | Legal obligation (Art. 6(1)(c)) | 7 years from payment |
Name, email address, marketing preferences | Sending newsletters and programme updates to opted-in contacts | Consent (Art. 6(1)(a)) | Until consent is withdrawn, or 2 years from last engagement |
Name, CV, application materials | Recruitment and selection | Pre-contractual steps (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f)) | 6 months from decision date |
IP address, browser/device data, cookies | Website operation, analytics, and security | Consent (Art. 6(1)(a)) for non-essential cookies; Legitimate interests (Art. 6(1)(f)) for essential operation | See cookie notice on site |
Legitimate interests: where we rely on legitimate interests (Art. 6(1)(f)) — for example, for essential website operation and fraud prevention — we have assessed that our interests do not override your rights. You can object to this processing at any time (see Your Rights below).
Providing your data: for programme applications, providing your personal data is a contractual requirement — without it we cannot process your application or deliver the programme. For marketing emails, providing your data is voluntary. We will always make clear at the point of collection whether information is required or optional.
Automated decision-making: we do not use automated decision-making or profiling that produces legal or similarly significant effects about you. Our application and admissions decisions involve human review.
3. Who we share your data with
3.1 Service providers (processors)
We use the following third-party processors to store and process personal data on our behalf. Each is bound by a Data Processing Agreement requiring them to process data only on our instructions and to maintain appropriate security standards.
Processor | Role | Transfer mechanism |
Microsoft 365 / SharePoint (Microsoft Ireland) | Email, document storage, collaboration | Intra-EEA — EU data centres |
Zoho CRM (Zoho Europe, Netherlands) | Student and contact relationship management | Intra-EEA — EU data centres |
Jotform Inc. (USA) | Application and contact forms | EU SCCs (2021); EU data centre selected |
Zoom Video Communications Inc. (USA) | Video calls and online events | EU SCCs (2021) |
Dropbox Inc. (USA) | Supplementary file storage | EU SCCs (2021) |
SiteGround Spain S.L. (Spain/EU) | Website hosting | Intra-EEA |
CookieYes (EU) | Cookie consent management | Intra-EEA |
3.2 Partner universities and operational partners
To deliver study abroad programmes, we share necessary student data with the relevant host university and, where applicable, accommodation providers, insurance companies, and visa authorities. These organisations receive only the data necessary for their specific role and act as independent data controllers for their own processing.
3.3 Asiabroad Limited (group delivery entity)
Programme delivery is carried out by Asiabroad Limited, our sister company registered in Hong Kong SAR. Data transferred to Asiabroad Limited is governed by EU Standard Contractual Clauses (Module 1, Controller to Controller) — reference AE-SCC-M1-HK-001. Staff of Asiabroad Limited are located in Hong Kong SAR, Indonesia, and the Philippines.
3.4 Legal and regulatory disclosures
We will disclose personal data to public authorities or law enforcement where required by law. We review all such requests for legal basis before disclosing any data.
4. International transfers
Some of our processors are based outside the EEA or use infrastructure outside the EEA. Transfers to third countries are protected by the following mechanisms:
Jotform Inc. (USA) | EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914); EU data centre selected |
Zoom Video Communications (USA) | EU Standard Contractual Clauses (2021) |
Dropbox Inc. (USA) | EU Standard Contractual Clauses (2021) |
Asiabroad Limited (Hong Kong SAR) | EU SCCs Module 1 (C2C) — AE-SCC-M1-HK-001 — supported by Transfer Impact Assessment AE-TIA-05 |
You can request a copy of the applicable safeguards by contacting our Privacy Lead at Joonas@AsiaExchange.org.
5. Your rights
Under GDPR you have the following rights. To exercise any of them, contact us at Joonas@AsiaExchange.org. We will respond within one calendar month.
Your right | What it means |
Access (Art. 15) | Request a copy of the personal data we hold about you. |
Rectification (Art. 16) | Ask us to correct inaccurate or incomplete data. |
Erasure (Art. 17) | Ask us to delete your data where it is no longer needed, consent has been withdrawn, or processing was unlawful. |
Restriction (Art. 18) | Ask us to pause processing your data while a dispute is resolved. |
Portability (Art. 20) | Receive your data in a structured, machine-readable format where processing is based on consent or contract. |
Objection (Art. 21) | Object to processing based on legitimate interests at any time. Object to direct marketing at any time — we will stop immediately. |
Withdraw consent | Where we rely on consent, withdraw it at any time. Withdrawal does not affect processing already carried out. |
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman if you believe we have processed your data unlawfully:
Authority | Tietosuojavaltuutetun toimisto (Finnish Data Protection Ombudsman) |
Website | www.tietosuoja.fi |
tietosuoja@om.fi | |
Telephone | +358 29 566 6700 |
6. Cookies
We use cookies and similar technologies on our website. Essential cookies (required for the website to function) are placed without consent. All other cookies — including analytics, marketing, and social media cookies — are placed only with your consent, which you can give or withdraw at any time via the cookie banner on our website.
- Essential: website operation, security, and live chat function
- Analytics: Google Analytics, Hotjar — understanding how the site is used
- Marketing: Facebook Pixel, YouTube — conversion tracking and remarketing
- Social sharing: AddThis
Cookie consent is managed by CookieYes. You can change your preferences at any time via the cookie settings link in the footer of our website.
7. Security
We protect your personal data using appropriate technical and organisational measures, including encryption in transit (TLS) and at rest, access controls, and multi-factor authentication on all systems. Our key processors (Microsoft and Zoho) maintain ISO 27001 certification. No internet transmission is completely secure — if you believe your interaction with us has been compromised, contact us immediately.
8. Children
Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has submitted data to us without appropriate consent, contact us and we will delete it promptly.
9. Changes to this notice
We review this notice annually and whenever our processing activities change materially. When we make significant changes we will update the date at the top and, where appropriate, notify you directly. The current version is always available at asiaexchange.org/privacy-policy.
10. Contact us
Privacy Lead | Joonas Salo |
Joonas@AsiaExchange.org | |
Post | Asia Exchange Oy, Vuorikatu 3, 33100 Tampere, Finland |
General enquiries | info@asiaexchange.org |
We aim to respond to all privacy enquiries within 5 working days and to resolve them within one calendar month.
Asia Exchange Oy | Vuorikatu 3, 33100 Tampere, Finland | Joonas@AsiaExchange.org | asiaexchange.org
Asia Exchange Vuorikatu 3 L 3 33100 Tampere, Finland
- Customers
- Potential customers
- Website users
- Job applicants
Personal data related to e.g. application process, customer service and other information services such as webinars as well as for marketing purposes.
- To complete your application process to our study abroad programs
- Customer service
- Marketing
- Hiring
We collect data from applicants to our study abroad programs through the application forms on our website. Data from those interested in our services is collected in the following ways:
When you contact us through out website, a contact form
When you send an email to our customer service at info@asiaexchange.org
When you sign up to our mailing list, a newsletter subscription form
When you register for our webinars, a webinar registration form
The data from job applicants is collected through a job application form. Data about website users is collected through the use of cookies (see further below)
Our partner universities and/or other partners on a case by case basis, such as
- Study abroad agent organizations
- Sending universities
- Embassies
We also make use for various kinds of cloud services for the purpose of storing and processing your data.
- Our contact and application forms are provided by Jotform and the data from these forms are stored by Jotform. You can view Jotform’s privacy policy here: https://www.jotform.com/privacy/
- We use the live chat and visitor tracking system Zoho SalesIQ for live support to our website users. You can view Zoho’s privacy policy here: https://www.zoho.com/privacy.html
- For processing customer information we utilize Zoho CRM. You can view Zoho’s Privacy Policy here: https://www.zoho.com/privacy.html
- For sending out newsletters and communicating with customers, we use Mailchimp. You can view Mailchimp’s Privacy Policy here: https://mailchimp.com/legal/privacy/
- To host our webinars, we use Zoom. View Zoom’s privacy policy here: https://zoom.us/privacy
Customer data is stored as long as necessary for providing the agreed services or up to 6 months after the end of the semester/last contact, unless otherwise specified. After this, we may still store relevant, anonymized data for e.g. statistical purposes.
- With protected internet connection
- Firewall
- Encrypting information
- Limited access to data registers
- Confidentiality agreements with persons handling the data
- Access to the collected data
- Rectifying data
- Deleting data (right to be forgotten)
- Restricting data processing
- Data portability
1. Asia Exchange’s Role and Commitment to Privacy
Asia Exchange Ltd., Vuorikatu 3 L 3 33100 Tampere, Finland (henceforth “AE”) is committed to processing any personal data in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of personal data. AE is the controller of the personal data that is disclosed to us, and therefore responsible for the personal data under applicable laws. The privacy policy applies to all personal information collected by us, or submitted to us, both offline or online. By using our services, you are accepting and consenting to the practices described in this Privacy Policy. If you do not agree with any of the terms of this Privacy Policy, please do not use our services or submit any personal information to us.
2. Personal Information
The kind of personal information that we collect from you is information that could allow you to be personally identified such as:
- Name
- Postal address
- Phone number
- Email address
- Picture
- Country of residence
- IP Address
- Institute name and address
- Educational background
- Browser and device information
- Server log file information
- Information collected through cookies, pixel tags and other technologies
- Demographic information and other information provided by you
- Location information
- Other information provided in the application process, including passport number and date of birth
The ways in which we may collect personal information from you:
- Through the website: We collect personal information through our website, for example when you register for our services or contact us by using our contact form or live chat. For all our forms we use the online webform provider Jotform. All form submissions are stored in Jotform’s secure servers in Europe as well as stored in our CRM provided by Zoho Corporation with servers located in the United States, where the data is archived for potential future reference. Information such as contact information, home country, date of birth as well as other information, may be collected when you voluntarily provide this information. None of your details are shared with any third parties without your explicit consent. To view Jotform’s privacy policy, click here. You can view Zoho’s privacy policy here (applicable to all services provided by Zoho Corporation which are mentioned from now on).
- Live chat: As our live chat provider we use Zoho SalesIQ. Zoho SalesIQ automatically saves your IP address, location, browser and device information. You also have the option of providing your name and email address. If you do provide your name and email address, these will be connected with your browsing data on our website, as well as any other data you may have voluntarily provided us beforehand and will provide from that point onward, and stored in our customer database provided by Zoho Corporation for future reference. Your chat history will also be stored. Zoho only discloses data to third parties where disclosure is necessary to provide the services or as required to respond to lawful requests from public authorities.
- Through email: If you contact our Student Support Service using email, we will store your email address, your name (depending on your email provider) and your message solely for the purpose of handling your contact request. If you have previously provided us with your name and email address either through the contact form, the live chat or by filling out an application form for our study abroad programs, your emails will be associated with your other personal details in Zoho CRM for future reference.
- Offline: We may collect personal information from you offline, for example when you contact our Student Support Service via phone.
- Other Sources: We may receive your personal information from third parties such as your home university or other partners.
- Through your browser or device: Certain information is collected by most browsers or automatically through your device. We use this information for statistical purposes as well as to ensure that the sites function properly.
- Through server log files: Your IP Address is a number that is automatically assigned to the computer or device that you are using by your Internet Service Provider (ISP). An IP Address is identified and logged automatically in our server log files whenever a user visits the sites, along with the time of the visit and the page(s) that were visited.
- Using cookies: Cookies allow a web server to transfer data to a computer or device for recordkeeping and other purposes. Below is a list of the cookies used on this website:
First-Party Cookies
_ga, _gat, _utma, __utmb, __utmc, __utmz, __utmli, r/collect Purpose: Site Operations and Optimization, Ad Targeting Provider: Google Analytics These cookies of various duration (a mix of session and “permanent” cookies lasting 30 mins, 6 months, or 50 months) anonymously collect data about our website traffic, including the search terms used and referring sites. This data is used for improving the functionality of the website. The r/collect cookie collects data to measure efficiency of viewed or clicked ads and shows targeted ads. To opt out of being tracked by Google Analytics across all websites visit https://tools.google.com/dlpage/gaoptout and install the application. The Google Analytics opt-out browser add-on does not prevent information from being sent to the website itself or in other ways to web analytics services. _hj Purpose: Site Operations and Optimization Provider: hotjar.com Duration: max. 1 year Hotjar is an analytics and feedback tool that we use to understand how our website is used and to improve usability. Hotjar sets cookies to help us track user behavior across pages and to control visitor polls. The cookies by default carry no personally identifiable information. If you answer a poll or survey on our website which is powered by Hotjar, you will be asked separately for your consent to connect these cookies with the information you provided in the poll or survey. You can view Hotjar’s privacy policy here. If you wish to opt out from Hotjar tracking, you can do so here. tr, frPurpose: Conversion tracking, Optimization and Remarketing Provider: facebook.com Duration: up to 180 days. We use the Facebook Pixel to understand conversion tracking, for optimization and remarketing purposes. You can view Facebook’s privacy policy here. For information on how to opt out visit here. LS_CSRF_TOKEN Purpose: Visitor Identification for Website and Live Chat Optimization Page: salesiq.zoho.com, salesiq.zohopublic.com Duration:Session
Third-Party Cookies
__cfduid Purpose: Security Provider: jotform.eu Duration: 1 year. Used by the content network, Cloudflare, to identify trusted web traffic __atuvc, __atuvs, _at.cww, loc, uid, uvc, vc, xtc Purpose: Social Sharing and Tracking Provider: AddThis.com These cookies are mix of session and “permanent” cookies connected to the social sharing icons you can see in blog posts and some other pages. These cookies collect information from visitors, which are designed to identify the devices used by visitors as well their location on a state level. This information does not directly identify you as an individual. Some of these cookies also have the purpose of making sure the user sees the updated social share count if they share a page and return to it before our share count cache is updated. No data from that cookie is sent back to AddThis and removing it when disabling cookies would cause unexpected behavior for user. You can read the AddThis privacy policy here. If you wish to opt out from AddThis tracking, you can do so here. PREF, VISITOR_INFO1_LIVE, YSC Purpose: View Statistics and User Bandwith Estimation Provider: youtube.com Duration: From one session to up to 10 years. YouTube is used by the website to store and show video content. These cookies are set by YouTube to track usage of its services. The YouTube Cookies are only installed when you press play. To view YouTube’s privacy policy, click here.
How you can refuse or opt out of cookies
If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to decline the use of cookies. Below are links to instructions on how to do this on the most common browsers. The use of cookies will not be connected to your name, email or other personal information you have provided.
The ways in which we use your personal information
The information is collected and processed to provide services, to develop the services and customer care, and for statistical purposes. Without this personal data we are unable to provide our services for users. We shall only use your personal data for the purposes described in this Privacy Policy. We use your information:
- To complete your registration and offer you services, as well as communicate with you regarding your registration and provide you with Student Support Service.
- To respond to your inquiries and fulfill your requests, such as to send you newsletters or to respond to your questions and comments.
- To provide you with updates and announcements concerning your registration, our products and programs, and to send you invitations to participate in certain events.
- For our business purposes, such as business analysis, market research, developing new services, improving our website, services and products, identifying user trends, analyzing the effectiveness of our campaigns, improving the site experience and content based on your activities, and estimating customer satisfaction and providing Student Support Service.
- If necessary or appropriate under applicable law, to comply with legal process, to respond to requests from public authorities, to enforce our terms and conditions, to protect our operations or our rights, privacy, safety or property, and/or of our affiliates, you or other parties, and to allow us to pursue available remedies or limit the damages that we may sustain.
3. Security Measures
We use reasonable organizational, technical and administrative measures to protect personal information under our control. We use encryption when transmitting your personal information between your system and ours. We also employ firewalls to help prevent unauthorized persons from gaining access to your information. However, any data transmission over the Internet or data storage system cannot be guaranteed to be 100% secure. Physical access to your data is prevented by access control and other security measures. Access to your data requires sufficient rights and thorough identification. Only the authorized persons have the right to process and maintain information contained in our registers. All data processors are bound by confidentiality obligation. Back-ups are made securely of the register data. The level of information security constantly observed by us. If you have reason to believe that your interaction with us is no longer secure, please contact us.
4. Third Parties
AE may disclose your personal data to our business partners for e.g. marketing and/or organizational purposes as well as billing and accounting purposes. We may share your personal information with business partners with whom we offer services, or other third-party representatives who provide services on our behalf. We may also authorize third-party representatives to collect information on our behalf. Third parties have access to and may collect information only as needed to perform their functions and are not permitted to share or use the information for any other purpose. They are also required to follow the same data security practices that we adhere to. Your personal data will be processed by AE both within and outside the EU for the purpose of completing your registration, providing you with the services that you have signed up for and for Student Support Service and marketing activities. Because our teams are based in local offices globally, our headquarters is in Finland, and the universities where the customers take the classes are in different offices globally, we may share your personal data with our corporate affiliates and business partners both within and outside the EU. The partners that we share information with are only those that need access to the personal information to process your registration and offer you services. Partners will only receive the information necessary for that purpose. Please note that the business partners may change from time to time. AE processes your personal data in accordance with applicable privacy and data protection legislation. By using our services, you acknowledge and consent to these potential data transfers. You ought to be aware that countries outside the EU may not afford similar legal protections to personal information as countries within the EU. Data transfers will be made in accordance with the applicable legislation and all necessary measures will be taken to ensure that third parties involved will provide an adequate level of protection. Any future partner of ours will be required to do the same.
5. Data Access and Modification
To review, correct, modify, delete or otherwise limit our use of your information that has been provided to us, please use the “Contact Us” form and clearly describe your request. Please indicate the kind of information you request and how you would like to change it. If you wish to stop receiving marketing communications from us, you may use the “unsubscribe” feature in the marketing email you received. You may also inform us by emailing or writing to us using the contact information listed below in the “Contact Us” section. When making such a request, please indicate that you wish to stop receiving marketing emails from us. Opting out of marketing-related messages however will not opt you out of important administrative messages. We will aim to comply with your request as soon as reasonably practicable and no later than 30 days after we received your request. There may however be information that will remain in our databases and records, which cannot be removed or changed. We may need to retain certain information for record keeping/statistical purposes and/or to complete any actions that have been started before your request.
6. Retaining your personal information
We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy and to offer you services that you have registered for. Your data will be stored up to 6 months after the end of the study abroad semester or 6 months after your last contact, should you choose not to register for our services. We may continue to process your information to fulfill our legitimate business objectives as well as for statistical records and analytical purposes. We will only store and process information that is relevant for this purpose. This means that your data will be anonymized.
7. Sensitive Information
Any sensitive personal information (e.g. information related to racial or ethnic origin, political views, religion, health, criminal background etc.) will only be collected if deemed necessary to provide services. Any such information shall be processed with extra caution.
8. Children’s privacy
AE does not offer services directed to children under 18 years old. Should it come to our attention that a minor has provided any personal data for us, this data shall be deleted immediately.
9. Updates to the Privacy Policy
This Privacy Policy may change from time to time. Changes to this Privacy Policy will become effective when the revised Privacy Policy is updated on our website.
10. Contact Us
Please do not hesitate to contact us if you have any questions, comments or concerns about this Privacy Policy. You have the right to tell us if you:
- No longer want to be contacted by us
- Would like to know what kind of information we have about you, or if you would like a copy of the personal information record we have about you. An administration fee for providing you with the requested information may apply, to cover handling costs. Request for this information ought to be sent on a written notice. Your personal data shall be provided to you in an electronic form.
- If you think that any personal information we have about you is inaccurate, out-of-date or irrelevant.
- Want to remove any and all information related to you.
- Wish to report any breaches of the Privacy Policy.
If you have any questions or complaints about this Privacy Policy, please contact us by clicking here. We will investigate any feedback and notify you as soon as practicable after it is received. Asia Exchange Vuorikatu 3 L 3 33100 Tampere Finlandinfo@asiaexchange.org +358 45 322 1230