Privacy Policy

1. Who we are and how to reach us

Asia Pathway is a trade name of WonderMaple Inc., a corporation incorporated under the Canada Business Corporations Act ( Business No. 733789879RC0001), with its registered office at 28 Rosebank Drive, Toronto, Ontario, M1B 5Z1, Canada. In this Privacy Policy, "Asia Pathway", "we", "us" and "our" mean WonderMaple Inc., which is the organisation responsible for (the "controller" of) your personal information. This Policy explains what personal information we collect, how and why we use it, who we share it with, where it is stored and transferred, how long we keep it, and the rights you have. It applies to the asiapathway.com website, the student portal, and our related services. Please read it together with our Terms of Service and Cookie Policy. If you do not agree with it, please do not use the Platform or submit information to us. We can be reached about privacy at [email protected], by telephone at +1 647-237-3989, or by mail at the registered office above, marked for the attention of the Privacy Officer.

2. Our Privacy Officer

We have designated a person responsible for the protection of personal information and for compliance with applicable privacy law. You may contact our Privacy Officer with any question, request or complaint about your personal information: the Director, WonderMaple Inc., [email protected], or by mail. We will acknowledge privacy requests within a reasonable time and respond within the timeframes required by applicable law.

3. The personal information we collect

The personal information we collect depends on the services you ask for. It falls into the following categories.

• Identity and contact details: your name, date of birth, nationality and citizenship, passport and government identification details, email address, telephone number, postal address, and emergency-contact details.
• Application information: academic transcripts and records, diplomas and certificates, personal statements, references, language-test results, and your study and program preferences.
• Immigration information: passport and visa details, immigration and travel history, and any prior visa refusals, where relevant to an application.
• Financial information: proof-of-funds documentation and bank statements where an institution or visa authority requires them. Card payments are processed by Stripe; we do not receive or store your full card number.
• Account and usage information: login credentials, application status, documents you upload, messages you send us, and technical data such as IP address, device and browser type, and pages viewed (see our Cookie Policy).
• Information about others: where you provide information about a parent, guardian, referee or emergency contact, you confirm you are entitled to share it and have told them how it will be used.

4. Sensitive information

Some of the information we handle is sensitive, including passport and immigration data and financial documents, and in limited cases health or insurance information passed to a third-party provider you engage. We collect and use sensitive information only where it is necessary to provide the service you have requested (for example, to prepare a visa application), and we ask for your explicit consent at the point you provide it. We do not use sensitive information for any purpose other than the one for which it was collected without your further consent.

5. Why we use your information, and our legal basis

We use your personal information for the purposes below. Where the law requires a legal basis for processing (for example, under the EU/UK General Data Protection Regulation, which applies because our data is hosted in the European Union), the basis is noted. We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.

• To provide our services — matching you to programs, preparing and submitting applications, supporting visa documentation, and assisting with scholarships. Basis: performance of our agreement with you.
• To communicate with you about your applications, documents, payments and support requests. Basis: performance of our agreement, and our legitimate interest in responding to you.
• To take payment for services. Basis: performance of our agreement and compliance with tax and accounting law.
• To operate, secure and improve the Platform, and to prevent fraud and misuse. Basis: our legitimate interests, balanced against your rights.
• To send you marketing about our services, where you have consented or where permitted by law. You can withdraw consent or unsubscribe at any time.
• To comply with legal obligations, respond to lawful requests from authorities, and establish or defend legal claims. Basis: compliance with law and our legitimate interests.

6. When and with whom we share your information

We do not sell your personal information, and we do not share it with advertisers to target you. We share it only as described below.

• Educational institutions and their authorised representatives, to submit and progress your application, on your instructions.
• Government departments, embassies, consulates and visa authorities, where required for a visa, permit or scholarship application.
• Service providers who process data on our behalf under contract, including our hosting provider, our payment processor (Stripe), and our email, communication and analytics providers. They may only use the data to provide services to us and must protect it.
• Third-party providers you choose to engage, such as accommodation, insurance or travel providers, where you ask us to refer you or share your details. Your relationship with those providers is governed by their own terms and privacy policies.
• Professional advisers, auditors, insurers and regulators, where reasonably necessary.
• A successor organisation, in connection with a merger, reorganisation or sale of our business, subject to this Policy.
• Law enforcement or other parties where we are required or permitted by law, or to protect our rights, users or the public.

7. Where your information is stored and sent outside Canada

This is important, so please read it carefully. Our systems and files, including the documents you upload, are hosted on servers located in the European Union (Germany). This means your personal information is transferred to and stored in Germany, and is subject to the laws of the European Union and, where applicable, may be accessible to courts, law enforcement and regulatory authorities in that jurisdiction. The European Union is recognised by the Government of Canada as providing an adequate level of data protection. In addition, to deliver the service you ask for, we transfer relevant information to educational institutions and government or visa authorities in your destination country, as well as to service providers that may operate in other countries. Data-protection laws in those countries may differ from, and may be less protective than, the laws of Canada or the European Union, and your information may become subject to lawful access by authorities in those jurisdictions. Where we transfer personal information across borders, we take steps required by applicable law to protect it, such as contractual protections with the recipient, and we transfer only the information necessary for the specific purpose. By asking us to submit an application to an institution or authority in a destination country, you instruct and consent to the transfer of your information to that institution or authority for that purpose. If you would like more information about our cross-border transfers and the safeguards we apply, contact our Privacy Officer.

8. How we protect your information

We maintain administrative, technical and physical safeguards designed to protect personal information against loss, theft, and unauthorised access, use or disclosure. These include encryption of files at rest, encryption of data in transit using HTTPS/TLS, access controls that limit access to personnel who need it, and vetting of the service providers we use. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you also play a part by keeping your account credentials confidential and not sharing them.

9. If there is a data breach

We maintain procedures to detect, investigate and respond to security incidents. If a breach of security safeguards involving your personal information occurs and it creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada, and to any other regulator or individual required by applicable law, as soon as feasible. We keep records of security breaches as required by law.

10. How long we keep your information

We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law, after which we securely delete or anonymise it. Our general retention periods are below, and may be longer where the law requires or where information is relevant to an actual or anticipated legal claim. When you ask us to delete your information, we will do so except where we are required or permitted by law to retain it.

• Application and immigration records: up to 7 years after your last engagement with us, to support re-applications, respond to institution or authority queries, and defend potential claims.
• Financial and transaction records: at least 6 years, as required by Canadian tax law.
• Marketing contact records: until you unsubscribe or withdraw consent, plus a short period to record that withdrawal.
• Enquiries that do not become engagements: up to 24 months.
• Account information: for the life of your account, and then in accordance with the periods above.

11. Your rights and choices

Subject to applicable law, you have the right to do the following. To exercise any of these rights, contact our Privacy Officer at [email protected]. We may need to verify your identity before acting on a request. We will respond within the time required by law, normally within 30 days, and will tell you if we need longer or cannot fully comply, and why. Exercising these rights is free unless a request is manifestly unfounded or excessive.

• Access the personal information we hold about you, and ask how it is used and shared.
• Correct information that is inaccurate or incomplete.
• Withdraw your consent, or ask us to delete your information, subject to legal retention requirements and to the effect this may have on services we can provide.
• Object to or ask us to restrict certain processing, and (where the EU/UK GDPR applies) ask for a portable copy of information you provided to us.
• Unsubscribe from marketing at any time using the link in our messages or by contacting us.
• Complain to a regulator (see the next section).

12. How to complain

If you have a concern about how we handle your personal information, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to a data-protection authority. In Canada, that is the Office of the Privacy Commissioner of Canada (priv.gc.ca). If the EU or UK GDPR applies to you, you may also complain to your local supervisory authority or, in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

13. Children and young people

Some of our services are used by applicants under the age of 18, including for secondary-school and language programs. Where an applicant is under 18, we require that a parent or legal guardian provides consent and, where appropriate, is the person who engages our services. We collect only the information needed to provide the service, do not knowingly use young people's information for marketing based on their online behaviour, and give parents and guardians the ability to access, correct or delete their child's information by contacting our Privacy Officer. If you believe a child has provided us information without appropriate consent, contact us and we will take appropriate steps.

14. Cookies and analytics

We use essential cookies for authentication and session management, and, with your consent, analytics tools to understand how visitors use the Platform. We currently use Umami, a privacy-focused analytics tool, and Google Analytics. Google Analytics may transfer usage data outside Canada, including to the United States. You can control non-essential cookies through our cookie banner and settings. For full details, including how to withdraw consent, see our Cookie Policy.

15. Third-party links

The Platform may link to websites operated by institutions, providers and others. We are not responsible for the privacy practices or content of those websites. We encourage you to review their privacy policies before providing information to them.

16. Changes to this Policy

We may update this Policy from time to time. Every version carries an effective date and a version label, and we will post the current version on the Platform. Where changes are significant, we will take reasonable steps to notify you, for example by email or a notice on the Platform. Your continued use of the Platform after a change takes effect means you accept the updated Policy, except where your consent is required by law.

17. Contact

WonderMaple Inc. (o/a Asia Pathway), Attention: Privacy Officer, 28 Rosebank Drive, Toronto, Ontario M1B 5Z1, Canada. Telephone: +1 647-237-3989. Email: [email protected].