Chinaward Education Privacy Policy

1. About this Policy

Chinaward Education respects your privacy and is committed to handling personal data lawfully, fairly, transparently and securely.

This Privacy Policy explains:

• what personal data we collect;
• why and how we use it;
• when we disclose or transfer it;
• how long we retain it;
• how we protect it; and
• the rights and choices available to you.

This Policy should be read together with the Chinaward Education Platform Service Agreement and any separate application service agreement, application authorisation, payment terms or notice presented to you for a particular service.

2. Who is responsible for your personal data

The principal operator of the Services and the data user or principal controller responsible for your personal data is:

CHINAWARD EDUCATION HOLDINGS LIMITED

Chinese name: 蒞華教育控股有限公司

Address: RM H11, 1/F, KAISER EST PHASE 2, NO. 51 MAN YUE ST, HUNG HOM, HONG KONG

CHINAWARD EDUCATION HOLDINGS LIMITED engages the following company as a service provider and data processor:

Hangzhou Chinaward Education Technology Co., Ltd.

Chinese name: 杭州莅华教育科技有限公司

Address: Room A123, 12th Floor, Building 4, Hengqi Business Center, Shangcheng District, Hangzhou City, Zhejiang Province, China

The Hangzhou company may perform authorised technology development, marketing support, consultancy services, university relationship development and maintenance, customer support, and related operational work on behalf of the Hong Kong company. It may process personal data only within the authorised scope and subject to access controls, confidentiality and security requirements.

For privacy enquiries and requests, contact inquiry@chinawardeducation.ai.

3. Services covered by this Policy

This Policy applies when you use or communicate with us through:

• www.chinawardeducation.ai;
• www.chinawardeducation.com;
• www.eastwardeducation.com;
• the Chinaward Education app;
• Chinaward Education web pages, H5 pages and mini programs; and
• our official customer communication channels on email, telephone, SMS, WhatsApp, WeChat, Facebook and Instagram.

If a particular product or activity has a separate privacy notice, that notice supplements this Policy and prevails for that particular activity to the extent of any inconsistency.

4. Who may use the Services

The Services are generally available to users worldwide, subject to applicable laws, sanctions, export-control requirements, payment-provider restrictions, institutional requirements and our risk-control policies. We may decline, restrict or suspend service where providing the Service would be unlawful or not reasonably practicable.

Children under 14 may not independently register, submit personal data or use the Services. Users aged 14 to under 18 generally may not independently register, purchase a service or enter into a service agreement. Where legally permitted and accepted by us, a parent or legal guardian must complete the required authorisation and contracting process.

5. Personal data we collect

The information we collect depends on the features and services you choose.

5.1 Account and contact data

We may collect:

• name;
• email address;
• country or region;
• password credentials in protected form;
• phone number, required for registration, account security and service communications;
• gender, if voluntarily provided; and
• Facebook or Instagram contact details, if voluntarily provided.

Phone number is required for basic registration. Gender, Facebook and Instagram details are optional. Company-owned social media accounts displayed through the Services are public business information and are not part of your registration data.

5.2 Assessment and education-profile data

When you request an initial assessment, programme matching or consultation, we may collect:

• current country or region and nationality or passport-issuing country or region;
• age range or year of birth;
• current or highest level of education;
• enrolment or graduation status and year;
• current or previous field of study;
• grades, GPA, average score and grading scale;
• Chinese-language level and HSK results;
• English-language level and IELTS, TOEFL or other results;
• intended study level, programme, course, intake, city or region;
• estimated budget range and scholarship preferences;
• application-preparation status;
• the questions or objectives for which you request assistance; and
• your choice about consultant contact and preferred contact method.

Assessment fields may change as our features develop. We will keep the collection notice and Personal Data Collection List consistent with the fields actually shown to you.

5.3 Application documents

If you enter an application service, you may provide:

• passport or other identity documents;
• identification photographs;
• diplomas, certificates and transcripts;
• language-test certificates and results;
• curriculum vitae, personal statements, study plans and portfolios;
• recommendation letters;
• health or medical certificates;
• criminal-record certificates;
• visa or residence documents;
• financial, sponsorship or funding evidence; and
• other documents required by the institution or service selected by you.

The above categories are illustrative rather than exhaustive. For a selected institution, programme or service, we may request other information, evidence or materials that the institution formally requires at the time of application or that are reasonably necessary to prepare, submit or follow up that application. We will identify the additional item and its purpose at or before collection. This paragraph does not authorise collection of unrelated data.

Some of these documents may contain sensitive personal data. We collect them only for a specific purpose where they are relevant and reasonably necessary for a service you request and apply stricter access and security controls.

Where applicable law requires separate consent for sensitive personal data, we will present a separate notice and affirmative choice before the relevant upload or processing. The notice will identify the sensitive-data category, purpose, necessity, principal recipient category, relevant cross-border processing and possible effect on your rights. A consent for sensitive-data processing does not by itself authorise submission to a particular institution; the separate application-submission confirmation remains required.

5.4 Communications and service records

We may retain enquiries, consultant communications, customer-support records, appointment records, service instructions, application status, submission receipts, email notifications, complaints and other records relating to our relationship with you.

5.5 Payment and transaction data

When you purchase a service, we may process:

• order and service details;
• payer name and billing contact details;
• amount, currency and payment status;
• institution application fees, seat reservation or seat-confirmation fees and other authorised third-party charges;
• transaction reference and receipt information;
• refund status; and
• information necessary for fraud prevention, compliance and accounting.

Payments may be made only to (a) an account held in the name of CHINAWARD EDUCATION HOLDINGS LIMITED, or (b) another account or payment channel expressly authorised and designated by that company in an official order, invoice or payment notice. Enabled payment services may include Airwallex, Apple Pay and Google Pay. Payment providers independently process certain payment credentials under their own terms and privacy policies. We do not intend to store full payment-card details unless expressly stated at the point of collection.

5.6 Device, log and usage data

When you use the Services, we may automatically collect IP address, device and browser type, operating system, language, app version, device identifiers where permitted, access time, pages or features used, referral source, crash diagnostics, security logs and interaction events.

We may use AppsFlyer and other attribution or analytics tools actually enabled and identified in our current Third-Party Personal Data Sharing List, and Firebase modules actually enabled in the app. Before production release, the active tools, modules and corresponding data practices will be disclosed in that list and the relevant app-store disclosures.

6. How we use personal data

We may use personal data to:

• create, authenticate, maintain and secure your account;
• provide information about studying and learning in China;
• conduct initial assessments and provide programme, course, study or service suggestions;
• provide consultancy, application preparation, document review and submission support;
• operate Study in China, Scholarship Application, Profile Development, HSK Prep, CSCA Prep, Learn Chinese, Study Tour and China Services when those services are available;
• recognise documents, populate forms and check document completeness;
• communicate with you and provide customer support;
• process orders, payments, refunds and accounting records;
• provide application submission receipts and status notifications;
• maintain, troubleshoot, analyse and improve the Services;
• prevent fraud, misuse and security incidents;
• comply with legal, regulatory, tax, accounting and dispute-resolution obligations; and
• send direct marketing only in accordance with applicable law and your choices.

We will not use application documents to train a general-purpose model, sell personal data, or create unrelated advertising profiles without a lawful basis and any consent required by applicable law.

7. Document recognition and assessment tools

Application documents uploaded by you may be processed using document-recognition functions provided through Alibaba Cloud international services. These functions may extract text and structured fields for form completion, document checks and application support.

When an intelligent translation, grammar review, formatting, information-extraction or preliminary matching feature is actually enabled, we may use an approved third-party model or intelligent-processing service. We will apply data minimisation, access restrictions, encryption in transit and retention controls appropriate to the configured service. The current provider, purpose, data categories, processing location, retention arrangement and model-training arrangement will be identified in the Third-Party Personal Data Sharing List. Without a lawful basis and any consent required by applicable law, we will not permit a third party to use application materials to train a general-purpose model for other customers.

Automated extraction may be inaccurate. You should review important information before submission, and authorised staff may conduct a human review. Our assessments and suggestions are preliminary and based on information supplied by you and information reasonably available to us. They are not admission, scholarship, examination, visa or qualification decisions.

We do not intend to make a solely automated decision that produces legal or similarly significant effects on you. Where applicable law gives you a right to request an explanation or human review, you may contact us.

8. When we disclose personal data

We may disclose personal data only as reasonably necessary to:

8.1 Our authorised processor

The Hangzhou company may access personal data according to role-based permissions to perform work for the Hong Kong company. Sensitive information should be masked where full details are not necessary. Downloading is restricted to specifically authorised personnel using company-approved devices. Where a local working copy is required for an authorised task, it must be deleted from the device within one day after the task is completed, except for a record that must lawfully be preserved in an approved system.

8.2 Institutions and application recipients

Under the separate service agreement and application authorisation accepted by you, we may disclose the authorised information to a selected university, college, scholarship body, testing organisation or another service recipient necessary for your application. We will provide a submission receipt, email notification or another appropriate record after submission.

The recipient will independently assess the application under its own rules. Registration alone does not authorise us to submit your documents to any institution.

8.3 Technology and operational service providers

We may engage hosting, storage, backup, document-recognition, communications, security, analytics and payment providers to process data for specified purposes. Current providers and tools that process personal data will be identified in the Third-Party Personal Data Sharing List. Service providers must not use the data for unrelated purposes.

8.4 Legal and corporate matters

We may disclose information where required by applicable law, legal process or a competent authority, or where reasonably necessary to establish, exercise or defend legal claims, protect users and systems, investigate fraud or respond to an emergency.

If our business is reorganised, merged, financed, acquired or transferred, personal data may be disclosed to professional advisers and relevant parties subject to confidentiality, due diligence and applicable notice requirements.

9. International and cross-border processing

Our Alibaba Cloud international production environment, databases, files, logs and backups are hosted in Singapore.

Personal data may therefore be transferred among or remotely accessed from:

• Singapore, where the cloud environment is hosted;
• Hong Kong, where the principal operator is established;
• Mainland China, where the authorised Hangzhou processor performs contracted work; and
• the country or region of a university, payment provider or other recipient selected or required for your service.

We will use contractual, organisational and technical safeguards appropriate to the transfer, including purpose limitation, access control, confidentiality, security requirements, incident notification, retention and deletion obligations, and restrictions on onward transfer.

For personal data collected or generated in Mainland China and provided outside Mainland China, we will comply with applicable Mainland Chinese requirements. Depending on the data category, volume, purpose, recipients and applicable exemptions, this may include a personal-information protection impact assessment, notice, separate consent, a personal-information export standard contract and filing, personal-information protection certification, a data-export security assessment or another lawful route. Where a statutory exemption from a filing, standard-contract, certification or security-assessment mechanism applies, we will continue to apply the notice, consent, impact-assessment and security duties that remain legally applicable.

10. Direct marketing

We may use your name and contact details to provide essential account, identity-verification, security, transaction and active-service communications. These communications are part of operating the account or providing a service you request and are not direct marketing.

Registration alone does not constitute consent to direct marketing. Where the registration or another interface presents a separate, unticked direct-marketing choice, selecting that choice records your consent or indication of no objection to our use of the identified contact data, such as your name, email address and phone number, through the identified channels, such as email, SMS, telephone, WhatsApp, WeChat or app notifications, to promote the identified classes of Chinaward Education services. Those classes may include Study in China, Scholarship Application, Profile Development, HSK Prep, CSCA Prep, Learn Chinese, Study Tour and China Services. The interface will identify the data, channels and service classes that actually apply.

Our direct-marketing messages will identify the sender and provide a reasonably accessible way to stop future marketing. We will not make consent to non-essential marketing a condition of creating an account or receiving an unrelated service.

You may withdraw a marketing choice at any time and without charge through the unsubscribe function in the message, available account settings or by contacting inquiry@chinawardeducation.ai. We will honour the request as soon as reasonably practicable. Opting out of marketing does not prevent essential account, security, transaction or active-service communications.

We will not provide your personal data to another person for that person's direct marketing without satisfying applicable notice and consent requirements.

11. Cookies and similar technologies

We may use essential cookies or similar technologies for account login, security, session management and user preferences. With any consent required by applicable law, we may also use analytics or attribution technologies to understand performance and improve the Services.

Details of active technologies, providers, purposes, durations and available controls will be presented through the cookie settings and Third-Party Personal Data Sharing List. You may reject non-essential technologies where the relevant choice is available; essential functions may not operate properly if essential storage is blocked.

11A. App stores, platform integrations and advertising tools

11A.1 App-store disclosures and device permissions

Our Google Play Data safety answers, Apple App Privacy answers, permission descriptions and in-app disclosures must accurately reflect the app version and the third-party code actually in use. We will review and update those disclosures when our data practices, permissions or integrated software development kits change.

We will request access to device permissions only when reasonably necessary for a disclosed feature and will use the least intrusive permission or system method reasonably available. Where personal or sensitive data is not reasonably expected for the feature, we will provide a prominent in-app disclosure and obtain clear affirmative consent before the relevant access or collection. Refusing an optional permission may limit the related optional feature but will not prevent access to unrelated functions.

11A.2 Apple devices and tracking

On Apple devices, if we or an integrated third party seek to track your activity across apps or websites owned by other companies, or access an advertising identifier for tracking, the app will first request permission through Apple's App Tracking Transparency framework where required. We will not represent that consent as mandatory for unrelated functionality, use device fingerprinting to bypass your choice, or treat silence as consent. You can change tracking permission in your device settings.

11A.3 Google Play account deletion

Where the Android app allows account creation, it will provide a readily discoverable in-app path to request deletion and an external web resource identified in the Google Play listing. Account deletion means deletion of the account and associated user data, not merely suspension or deactivation, except for information that we must or are lawfully permitted to retain. We will identify retained categories, reasons and applicable periods and will restrict retained information from unrelated use.

11A.4 Meta and Facebook platform features

If we enable Facebook Login, Instagram or Facebook APIs, Meta Pixel, App Events, Conversions API, Custom Audiences or another Meta Business Tool, we will identify the enabled tool and its actual data practices in our current Third-Party Personal Data Sharing List and consent interface before use where required.

Data obtained through a Meta platform feature will be requested only to provide or secure the feature disclosed to you, will not be sold, and will not be transferred or used for an unrelated purpose contrary to the applicable Meta terms. You may disconnect the relevant Meta account through the available account or Meta settings. We will maintain the data-deletion instructions, callback or URL required for the enabled Meta feature and will delete or restrict the relevant data when required after disconnection or a valid deletion request, subject to lawful retention duties.

If we use a customer-list audience or similar advertising audience, we will use only contact data for which we have the necessary rights, permissions and lawful basis, honour applicable advertising opt-outs, remove opted-out persons from the audience as required, and apply the technical protections required by the advertising platform. We will not provide passport documents, health information, criminal-record information, application documents or other sensitive application data to an advertising platform for audience creation, ad personalisation or ad measurement.

11A.5 Third-party protection and responsibility

We require analytics, advertising, attribution and other third parties that receive personal data from the app to provide protection consistent with this Policy and applicable platform requirements. We remain responsible for accurately disclosing integrated third-party code and will take reasonable steps to review provider terms, data flows, security and deletion mechanisms before enabling them.

12. Retention and deletion

We apply the following general retention periods unless a shorter or longer period is required by law, a valid dispute, a regulatory requirement, or the nature of a service:

• for a user who has not purchased a paid service: up to three years from the user's last active date;
• for a user who has purchased a paid service: up to seven years from the user's last active date; and
• business, accounting and transaction records: for at least the period required by applicable Hong Kong law, which may be seven years from the relevant transaction.

“Last active date” means the most recent date on which you log in, update your profile, complete an assessment, upload or change application materials, engage in substantive service communication, submit an application, purchase a service, carry out an order activity, or actively contact customer support. Automated advertising impressions, general promotional email delivery and system-generated messages do not by themselves renew the period.

Sensitive application documents may be deleted earlier where they are no longer necessary. They will not be retained merely because another category of business record must be preserved. Deletion from active systems may take time to propagate through protected backups; data in backups will be removed through the applicable backup rotation and will not be restored for ordinary business use after a valid deletion request.

When a retention period expires, we will delete or anonymise the relevant personal data unless continued retention is lawfully required.

13. Security

We use measures appropriate to the nature and risk of the data, which may include encryption in transit and at rest, role-based and least-privilege access, masking of sensitive fields, approved-device controls, restrictions on downloading and screen capture, audit logs, backup protection, staff confidentiality obligations, security training and incident-response procedures.

No internet or storage system is completely secure. If a personal data incident occurs, we will take reasonable remedial action and provide notices or reports where required by applicable law.

14. Your rights and choices

Depending on applicable law, you may have the right to:

• ask whether we hold your personal data;
• request access to or a copy of it;
• request correction or completion;
• request deletion where the data is no longer required or processing is otherwise unlawful;
• withdraw consent where processing relies on consent;
• object to or restrict certain processing;
• opt out of direct marketing;
• request information about recipients and cross-border processing; and
• complain to a competent privacy or data-protection authority.

To protect your data, we may verify your identity and ask for information reasonably necessary to understand the request. Hong Kong data-access and correction requests will be handled within the period required by the Personal Data (Privacy) Ordinance, subject to applicable exceptions.

You may request account closure through the in-app account-closure process or the publicly accessible deletion-request channel identified in the relevant app-store listing. If that web channel is not yet available, you may submit the request to inquiry@chinawardeducation.ai. The 15-business-day processing period begins when you complete the closure application, including the required identity verification. We will explain any information that must be retained and will restrict it from unrelated use.

Our app-store privacy disclosures, permission prompts, prominent disclosures and consent flows must accurately reflect the data practices described in this Policy. If a particular feature requires access to personal or sensitive data that a user would not reasonably expect, we will provide an appropriate disclosure and obtain any required consent before the relevant collection or access.

Submit requests to inquiry@chinawardeducation.ai.

15. Changes to this Policy

We may update this Policy to reflect changes in the Services, data practices or applicable law. We will display the updated date and provide a prominent notice where a change materially affects your rights or the way we use personal data. Where renewed consent is required, we will request it before carrying out the relevant processing.

16. Language, law and contact

This Policy is published in English. Any translation into another language is for internal reference only and is not a version provided to users. This does not affect any mandatory language or disclosure requirements under applicable law.

This Policy is governed by the laws of the Hong Kong Special Administrative Region, without excluding any mandatory protection that applies to you and cannot lawfully be waived by agreement.

For questions, requests or complaints, contact: