Data Handling Policy

1. Identity & Contact Details

The data controller responsible for the personal data you provide to this platform is:

For EU/UK GDPR purposes Aruksworld LLC acts as the data controller. For processing activities carried out on our behalf by third parties, those parties act as data processors.

2. Scope & Applicable Laws

This policy applies to all personal data processed through the Aruksworld website, mobile interfaces, APIs, and any associated services (collectively, the "Platform"). It addresses obligations under:

Where the requirements of multiple laws overlap, we apply the most protective standard.

3. Personal Data We Collect

3.1 Data You Provide Directly

• Account data — name, email address, username, password (hashed), country, and user type (student / professional / admin)
• Profile data — academic background, study interests, target degree level, preferred countries
• Communication data — messages sent via contact forms, live chat, or support tickets
• Payment data — billing name and address; card details are tokenised by Stripe and never stored on our servers
• Newsletter & consent data — email subscription status and marketing preferences

3.2 Data Collected Automatically

• Log data — IP address, browser type, operating system, referring URL, pages visited, timestamps
• Device data — device identifiers, screen resolution, language settings
• Analytics data — session duration, click-stream, search queries entered on the Platform
• Ad interaction data — advertisement impressions, clicks, and deduplication tokens (per-IP, TTL 30 min)
• Cookie data — see Section 17

3.3 Data from Third Parties

• Social login (Meta / Google) — when you authenticate via a social provider we receive the profile fields you have authorised: user ID, name, email address, and profile picture. We do not receive passwords or private posts.
• Public academic data — university names, programme details, rankings, and tuition information sourced from publicly available databases and institutional websites

4. Legal Basis for Processing

We rely on the following legal bases under GDPR Article 6 (and equivalent provisions in other applicable laws):

For users in Brazil (LGPD), the equivalent bases are contract performance, legitimate interest, legal obligation, and consent. For users in Canada (PIPEDA), we rely on express or implied consent as applicable.

5. How We Use Personal Data

• Operating, maintaining, and improving the Platform
• Personalising university and programme recommendations based on your stated interests
• Delivering AI-powered study-abroad guidance and consultation services
• Processing payments securely via Stripe
• Sending service notifications (account events, application alerts)
• Sending newsletters and promotional emails (with your consent)
• Detecting and preventing fraudulent ad interactions (click-fraud protection)
• Monitoring platform performance and diagnosing technical issues
• Complying with legal obligations and responding to lawful authority requests
• Enforcing our Terms of Service

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you without your explicit consent.

6. Data Sharing & Disclosure

We share personal data only in the following circumstances:

6.1 With Your Consent

When you request information from a university or programme, we may share your name and contact details with that institution at your explicit direction.

6.2 With Data Processors

We engage third-party service providers who process data on our behalf (see Section 7). These providers are contractually bound to process data only as instructed and to implement appropriate security measures.

6.3 Business Transfers

If Aruksworld LLC is involved in a merger, acquisition, or sale of all or part of its assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform before any such transfer, and you will have the right to object.

6.4 Legal Obligations

We may disclose personal data where required by law, regulation, court order, or other legal process. See Section 16 for our detailed policy on government requests.

6.5 We Do Not Sell Personal Data

7. Data Processors & Service Providers

The following entities act as data processors on our behalf. Each has been assessed for adequate security and data protection standards, and we maintain a Data Processing Agreement (DPA) or equivalent contractual safeguard with each.

We review our processor list at least annually and update this policy to reflect any changes. Upon written request, we can provide a more detailed list of processors and the relevant DPAs.

8. Meta / Social Platform Data

8.1 What Platform Data We Receive

When you choose to log in or connect your account via Meta (Facebook/Instagram) we receive only the permissions you explicitly authorise, which may include: your Meta user ID, public name, email address, and profile picture. We do not receive your password, private messages, friend lists, or any data you have not specifically granted.

8.2 How We Use Platform Data

• To authenticate you and create or link your Aruksworld account
• To pre-populate your profile fields (with your consent)
• We do not use Meta Platform Data for ad targeting, third-party sharing, or any purpose beyond the authenticated session

8.3 Data Controller Responsibility

8.4 Sub-processors with Access to Platform Data

No sub-processors receive raw Meta Platform Data. Our hosting infrastructure has indirect access to all application data as the platform on which our database runs; this is governed by our hosting provider's Data Processing Agreement.

8.5 Deletion of Platform Data

You may disconnect your Meta account at any time via your Aruksworld profile settings, which will remove the stored Meta user ID and associated token. You may also request full deletion under Section 12.

9. International Data Transfers

Aruksworld is based in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data-transfer restrictions, your data may be transferred to and processed in the United States and other countries that may not provide the same level of data-protection law as your home country.

We safeguard such transfers using one or more of the following mechanisms:

• EU Standard Contractual Clauses (SCCs) — adopted in agreements with EU-based processors
• UK International Data Transfer Agreement (IDTA) — for transfers to and from the UK
• Adequacy decisions — where the European Commission or UK ICO has recognised the destination country as providing adequate protection
• Data Privacy Framework (DPF) — we work preferentially with US processors certified under the EU-US DPF and UK Extension

You may obtain a copy of the relevant transfer safeguards by contacting privacy@aruksworld.com.

10. Retention & Deletion

At the end of each retention period, data is securely deleted or anonymised so it can no longer be linked to an individual.

11. Security Measures

We implement technical and organisational measures appropriate to the risk, including:

12. Your Data Rights

Depending on your location, you may have some or all of the following rights. To exercise any right, contact privacy@aruksworld.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice).

13. California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (as amended by CPRA) provides you with specific rights regarding your personal information:

Categories of Personal Information Collected (Cal. Civ. Code § 1798.100)

• Identifiers — name, email address, IP address, account ID
• Internet or other electronic network activity — browsing history on the Platform, search queries, ad interactions
• Geolocation data — country inferred from IP (coarse; not precise GPS)
• Commercial information — consulting services purchased
• Inferences — educational preferences drawn from your profile and search history

Your CCPA Rights

• Right to Know — request disclosure of the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties with whom it is shared
• Right to Delete — request deletion of personal information we have collected from you
• Right to Correct — request correction of inaccurate personal information
• Right to Opt Out — opt out of the sale or sharing of personal information (we do not sell data)
• Right to Limit Use of Sensitive Personal Information — limit use of sensitive PI to what is necessary for the service
• Right to Non-Discrimination — we will not penalise you for exercising any CCPA right

To submit a verifiable consumer request, email privacy@aruksworld.com with the subject line "CCPA Request". We respond within 45 days, extendable by a further 45 days where necessary.

You may designate an authorised agent to make a request on your behalf. We will require written proof of authorisation and may verify your identity directly.

14. Children's Privacy (COPPA)

The Platform is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13 years old, please do not use the Platform or submit any personal information.

If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at privacy@aruksworld.com.

For users between 13 and 18 years old, we encourage parents and guardians to be involved in their online activities. Parental consent may be required for certain features.

15. Educational Records — FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records maintained by educational institutions. As a discovery platform — not an educational institution — Aruksworld does not directly maintain FERPA-protected records.

However, where users voluntarily share information about their educational background:

• We treat such information with the same care as other personal data under this policy
• We do not share academic background data with third parties without your consent
• If you are a student whose institution uses Aruksworld under an institutional agreement, your institution remains the primary FERPA-responsible entity; we act as a service provider under their data use agreement

16. Government & Law-Enforcement Requests

16.1 Disclosure Record

16.2 Our Policies for Handling Authority Requests

When we receive any request from a government body or law-enforcement agency for user data, we apply the following policies:

16.3 User Notification

Where legally permitted, we will notify affected users prior to disclosing their data in response to a government request, giving them an opportunity to seek legal protection. We will not notify users where we are legally prohibited from doing so (e.g., by a non-disclosure order), but we will record that a request was made.

17. Cookies & Tracking Technologies

We use cookies and similar technologies (local storage, session tokens) on the Platform. The categories we use are:

You can manage or withdraw cookie consent at any time via your browser settings or our consent manager. Blocking necessary cookies may impair Platform functionality.

18. Policy Changes

We may update this Data Handling Policy from time to time to reflect changes in our practices, legal obligations, or regulatory requirements. When we make material changes, we will:

• Update the "Last Reviewed" date at the top of this page
• Post a notice on the Platform for at least 30 days
• Send a notification email to registered users where the change materially affects their rights or how their data is used

Your continued use of the Platform after notice of changes constitutes your acceptance of the revised policy. If you disagree with the revised policy, you may request account deletion before the effective date.

19. Contact & Complaints

Supervisory Authority Complaints

If you are in the EEA and believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your local data protection authority (e.g., the Irish Data Protection Commission if you are in Ireland, or the CNIL if you are in France). A full list of EEA supervisory authorities is available at edpb.europa.eu.

UK residents may contact the Information Commissioner's Office (ICO). California residents may also contact the California Privacy Protection Agency (CPPA).