Transfer Abroad Network

Transfer Abroad Network ("TAN", "we", "us", or "our") is a US-based education technology platform that connects students with universities around the world. We are committed to protecting your personal information and respecting your privacy rights, regardless of where you live or where you study.

This Privacy Notice explains what personal information we collect, how we use it, who we share it with, how long we keep it, and what rights and choices you have. We apply consistent global privacy standards to all our users, meaning we treat your data to the highest applicable standard, whether you are in the United States, the United Kingdom, the European Union, Australia, or elsewhere.

We comply with applicable data protection laws including the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the United States Family Educational Rights and Privacy Act (FERPA) where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), Australia's Privacy Act 1988 and the Education Services for Overseas Students Act 2000 (ESOS) where applicable, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable national or regional laws.

Please read this notice carefully. If you have questions, contact us using the details at the end.

1. Who We Are

Transfer Abroad Network is operated by Study Abroad Enterprises Inc., a company registered in California, USA.

Email: info@transferabroadnetwork.com

Website: www.transferabroadnetwork.com

For UK and EU users: We do not currently have an appointed Data Protection Officer (DPO) as we are not required to under Article 37 of the UK/EU GDPR. Our privacy contact above handles all data protection matters and can route inquiries to senior leadership and our external advisors as needed.

2. Our Role: Controller or Processor

Whether TAN acts as a "data controller" or a "data processor" depends on the activity.

TAN is the data controller for personal information you provide directly to us when you create an account, set up your profile, browse universities, communicate with us, or use the platform's matching and recommendation features. We decide the purposes and means of processing this data.

TAN acts as a data processor when a partner university or community college instructs us to process specific personal information on their behalf, for example, when a university uses our admissions tools to evaluate applications you have formally submitted to them. In those cases, the institution is the controller and we process the data under their instructions and our written agreement with them.

Where TAN acts as a processor for a specific institution, that institution's own privacy notice will also apply to the data they receive.

3. Information We Collect

3.1 Information You Provide Directly

• Identity and contact details: name, email address, phone number, postal address, date of birth, country of residence, nationality.
• Academic information: current and previous institutions attended, GPA, transcripts and coursework, intended major or field of study, anticipated transfer term, English-language proficiency results, standardized test scores.
• Profile preferences: destination country preferences, program interests, budget range, scholarship needs, personal statement content where provided.
• Application materials: documents, essays, references, and other materials you upload or submit through the platform.
• Communications: messages exchanged with TAN staff, university representatives, or community college advisors through our platform.

3.2 Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, time zone, language preferences.
• Usage data: pages viewed, features used, time spent, search queries, clicks, referral source, session duration.
• Cookies and similar technologies: see Section 11 (Cookies) for details.

3.3 Information from Third Parties

• From your community college, where you have authorized them to share your academic record or transfer information with us.
• From universities you have applied to, regarding the status of your application.
• From service providers who help us verify identity, prevent fraud, or process payments.

3.4 Sensitive or Special Category Data

We do not intentionally collect special category data (such as racial or ethnic origin, religious beliefs, health information, or sexual orientation). If you choose to share this information voluntarily, for example in a personal statement or scholarship application, we will process it only with your explicit consent and only for the purpose for which you provided it.

3.5 Payment Information

If TAN charges fees for any service, payment information (card details, billing address) is collected and processed by our PCI-DSS compliant payment processor. We do not store full card details on our servers.

4. How We Use Your Information and Our Legal Bases

We process your personal information for the purposes and on the legal bases set out below. Where multiple legal bases apply, the most specific applies. Users in the UK, EU, and other GDPR-equivalent jurisdictions have the rights described in Section 9.

• 4.1 To provide and operate the platform. Legal basis (UK/EU GDPR): performance of a contract with you (Article 6(1)(b)).
• 4.2 To match you with universities. Legal basis (UK/EU GDPR): your consent (Article 6(1)(a)) for profile-based matching, which you can withdraw at any time in account settings.
• 4.3 To share your profile with universities. Legal basis (UK/EU GDPR): your consent (Article 6(1)(a)), given when you take the action that triggers sharing.
• 4.4 To communicate with you. Legal basis: contract performance for service messages; consent (Article 6(1)(a)) for marketing.
• 4.5 To improve and secure the platform. Legal basis (UK/EU GDPR): legitimate interests (Article 6(1)(f)).
• 4.6 To comply with legal obligations. Legal basis (UK/EU GDPR): compliance with a legal obligation (Article 6(1)(c)).

5. Who We Share Your Information With

We share personal information only as described in this notice. We do not sell your personal information, and we do not share it for cross-context behavioral advertising as defined under California law.

• 5.1 Universities and community colleges you engage with through TAN and where you have authorized us to coordinate.
• 5.2 Service providers (sub-processors) for hosting, infrastructure, communications, analytics, payment processing, and customer support, under written contracts.
• 5.3 Legal and regulatory authorities where required by law, legal process, or to protect legal rights.
• 5.4 Business transfers, including merger, acquisition, financing, or sale of assets, with notice and choices where required by law.

6. International Data Transfers

TAN is based in the United States, and partner universities are located across multiple countries. As a result, your personal information may be transferred to and processed in countries outside your country of residence.

• 6.1 Transfers from the UK: UK IDTA, UK Addendum to EU SCCs, or another lawful mechanism, with transfer risk assessments and supplementary measures where required.
• 6.2 Transfers from the EU/EEA: EU SCCs or another lawful transfer mechanism, with transfer risk assessments and supplementary measures where appropriate.
• 6.3 Transfers involving other jurisdictions: equivalent contractual and technical safeguards under applicable national requirements.

You can request a copy of the relevant transfer agreement (with commercially sensitive information redacted) by contacting info@transferabroadnetwork.com.

7. How Long We Keep Your Information

• Active accounts: retained while your account is active.
• Inactive accounts: if unused for 24 months, we notify you and may delete or anonymize the account.
• Closed accounts: deleted or anonymized within 90 days, except where retention is legally required (for example, financial records for up to 7 years).
• Application data: universities retain data under their own policies; TAN retains submitted application records for 3 years.
• Marketing consent records: retained for as long as consent is relied upon, plus 2 years.
• Backups and logs: may persist in encrypted backups for up to 90 days after deletion from primary systems.

8. How We Protect Your Information

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

• Encryption of data in transit (TLS) and at rest.
• Access controls and authentication for staff and service providers.
• Regular security reviews and vulnerability monitoring.
• Confidentiality obligations for personnel and contractors with access to data.
• Incident response procedures, including breach notifications within required legal timeframes (including 72 hours under UK/EU GDPR where applicable).

9. Your Rights and Choices

Your rights depend on where you live and which laws apply to your data. You can exercise rights by contacting info@transferabroadnetwork.com.

• 9.1 UK/EU GDPR rights: access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint rights.
• 9.2 CCPA/CPRA rights: know, delete, correct, opt out of sale/sharing, limit sensitive data use, and non-discrimination. TAN does not sell personal information.
• 9.3 Australian Privacy Act rights: access, correction, and complaint rights through OAIC.
• 9.4 Other laws: comparable rights may apply in Canada, Brazil, and other jurisdictions.
• 9.5 Identity verification: we may verify identity before fulfilling requests.

10. Profiling and Automated Decisions

We use your academic profile and stated preferences to suggest universities and programs. This is a recommendation system, not an automated decision-making process under Article 22 of the UK/EU GDPR. Recommendations are suggestions only, and universities make admissions decisions.

11. Cookies and Similar Technologies

We use cookies and similar technologies to operate the platform, remember preferences, analyze usage, and personalize content.

• Strictly necessary cookies.
• Functional cookies.
• Analytics cookies.
• Marketing cookies (if used, only with consent).

UK/EU users: non-essential cookies are set only with consent and can be managed through Cookie Settings. California users: do-not-sell/share controls are available in the footer, although TAN does not currently sell or share personal information for cross-context behavioral advertising.

For full details, see www.transferabroadnetwork.com/cookies.

12. Children and Young People

TAN is intended for users aged 16 and above. We do not knowingly collect personal information from children under age 13. In the UK, the minimum age for online services consent is 13. In the EEA, it varies by country (13 to 16). Where applicable, parental or guardian consent is required.

13. Sector-Specific Compliance

13.1 FERPA (United States): where TAN handles covered education records on behalf of an institution, we act as a school official with legitimate educational interest under institution direction.

13.2 ESOS (Australia): where TAN supports applications to Australian institutions, we comply with ESOS and the National Code requirements where applicable.

14. Changes to This Notice

We may update this notice from time to time. The current version is always available on our website with the effective date clearly stated. If we make material changes, we will notify you by email or through the platform before the changes take effect.

15. How to Contact Us

For privacy questions, requests, or complaints, contact info@transferabroadnetwork.com.

If you are not satisfied with our response, you may also contact your local data protection authority.