Privacy Policy - Smapse Education

1. About This Policy

This Privacy Policy explains how smapse.com collects, uses, and protects personal data in connection with the services provided through our website. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

For any questions about this Policy or your personal data, please contact us at: mail@smapse.com

2. What Personal Data We Collect

2.1 Data you provide directly

Full name, email address, phone number
Date of birth, nationality, country of residence
Passport or identity document details (for visa and enrolment applications)
Educational background and qualifications
Payment details (processed via third-party payment providers; we do not store full card numbers)
Communications you send us (enquiry forms, emails, chat messages)

2.2 Data collected automatically

IP address and approximate location
Browser type, operating system, device identifiers
Pages visited, time spent on site, referral URLs
Cookie identifiers and similar tracking technologies (see Section 8)

2.3 Data about minors

Where a parent or legal guardian submits data on behalf of a child under 18, we collect the child's name, date of birth, nationality, and educational information. We rely on the parent's or guardian's explicit consent for all processing of a minor's personal data. We do not knowingly collect data directly from children under 13 without verified parental consent.

3. How and Why We Use Your Data

We process your personal data for the following purposes and on the legal bases set out in Article 6 UK GDPR:

Purpose: Providing advisory and education-placement services

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR)

Purpose: Processing enquiries, callback requests, and applications to educational institutions

Legal basis: Performance of a contract / pre-contractual steps (Article 6(1)(b))

Purpose: Processing payments and issuing invoices

Legal basis: Performance of a contract (Article 6(1)(b))

Purpose: Sending marketing communications (newsletters, promotions)

Legal basis: Consent (Article 6(1)(a)) — you may withdraw at any time

Purpose: Website analytics and performance improvement

Legal basis: Legitimate interests (Article 6(1)(f)) — improving our service; data anonymised where possible

Purpose: Legal and regulatory compliance, fraud prevention

Legal basis: Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f))

Purpose: Visa and enrolment application processing (including special category data where required)

Legal basis: Explicit consent (Article 9(2)(a) UK GDPR) and, where applicable, Article 9(2)(g)

4. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of recipients:

Educational institutions: Schools, universities, language schools, and camps you have applied to — necessary to process your application.

Payment processors: PayPal, Stripe, and card payment networks — to process transactions securely.

Analytics and marketing services: Google Analytics, Google Ads, and similar platforms — subject to your cookie consent.

IT service providers: Hosting, CRM, and email delivery providers acting as data processors under contract.

Legal and regulatory bodies: Where required by law, court order, or to protect our legal rights.

All processors are required to handle your data in accordance with UK GDPR and DPA 2018.

5. International Transfers of Personal Data

smapse.com operates internationally and may transfer your data to recipients outside the United Kingdom, including educational institutions in the EEA, USA, Canada, UAE, and elsewhere.

Where we transfer data outside the UK to a country without an adequacy decision, we ensure appropriate safeguards are in place, including:

UK International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses, or
The recipient country benefits from UK adequacy regulations, or
Your explicit consent, where appropriate.

mail@smapse.com.

6. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes described in this Policy:

Enquiry and correspondence data: 3 years from last contact
Application and enrolment records: 6 years from the date of transaction (required for UK tax and contract law purposes)
Marketing consent records: until consent is withdrawn plus 1 year
Website analytics data: up to 26 months (anonymised after 14 months where possible)

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under UK GDPR

mail@smapse.com. We will respond within one calendar month.

Right of access: Request a copy of the personal data we hold about you.

Right to rectification: Ask us to correct inaccurate or incomplete data.

Right to erasure: Request deletion of your data where there is no overriding legal reason to retain it.

Right to restriction: Ask us to restrict processing while accuracy is disputed or while an objection is considered.

Right to data portability: Receive your data in a structured, machine-readable format where processing is based on consent or contract.

Right to object: Object to processing based on legitimate interests or for direct marketing purposes.

Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

Rights related to automated decision-making: We do not make solely automated decisions with significant effects on individuals.

We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

8. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies in accordance with the UK Privacy and Electronic Communications Regulations 2003 (PECR).

8.1 What are cookies?

Cookies are small text files placed on your device when you visit our website. They help us recognise your device and improve your experience.

8.2 Categories of cookies we use

Strictly necessary: Essential for the website to function. No consent required.

Analytics/performance: Help us understand how visitors use our site (e.g., Google Analytics). Require your consent.

Marketing/targeting: Used to show relevant advertisements (e.g., Google Ads). Require your consent.

8.3 Managing cookies

When you first visit our website, you will be asked to provide consent via our cookie banner. You may withdraw or change your preferences at any time by clicking 'Cookie Settings' in the website footer, or by adjusting your browser settings.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS)
Access controls and authentication requirements for staff
Regular review of our security practices and third-party processors
Staff training on data protection obligations

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.