International Data Transfer Notice
This is a version 1.0 draft prepared for review. It reflects our verified technical and data-protection practices but is pending final management and legal approval. Some sections contain items still under management or legal review and should not be relied upon as final policy.
This notice explains how personal data may move across borders between the data subject, the tenant, EDUMOVIA (operated from the Republic of Korea) and destination institutions, and the legal mechanisms applied to each route.
Effective date: 31 August 2026 · Version v1.0
Purpose of this notice
EDUMOVIA is operated by Castle Consulting Company Co., Ltd. (주식회사 캐슬컨설팅), Business Registration No. 664-87-03141, based in Gimpo-si, Gyeonggi-do, Republic of Korea. Because education mobility is inherently cross-border, personal data may move between the data subject’s country, the tenant (an education agency or institution), EDUMOVIA’s operating environment, destination institutions and a small number of service providers. This notice explains those flows and the legal mechanism applied to each.
Three distinct concepts
We separate three ideas that are often confused. (1) Data-subject jurisdiction — the privacy law that protects the individual, based on where they are. (2) Operator jurisdiction — the Republic of Korea, where the operating entity is established. (3) Destination / application country — the country of the university or partner a student applies to. The privacy law that governs a person’s data is determined by concept (1); it is NOT determined by the destination country.
Transfer routes and legal mechanisms
EEA → Korea: the European Commission adopted an adequacy decision for the Republic of Korea under Article 45 GDPR on 17 December 2021 (first periodic review confirmed in 2026), so transfers from the EEA to Korea do not require additional Standard Contractual Clauses. UK → Korea: UK restricted transfers rely on a UK adequacy regulation where one applies, or otherwise on the ICO International Data Transfer Agreement (IDTA) or Addendum together with a Transfer Risk Assessment [LEGAL REVIEW REQUIRED to confirm current UK adequacy status for Korea]. Türkiye → abroad: under KVKK Article 9 as amended by Law No. 7499 (effective 1 September 2024), transfers follow a three-tier hierarchy — adequacy decision, then appropriate safeguards (Board Standard Contract, Binding Corporate Rules or written undertaking), then narrow derogations. Explicit consent (açık rıza) is only a derogation for incidental transfers and is not the default basis for systematic flows. Korea (PIPA): overseas transfer requires informed consent and/or adequate protection with appropriate safeguards. Central Asia and Mongolia: consent- and/or adequacy-based — see the relevant country addendum.
Destination-country disclosure
When a student applies to an institution in another country, the destination country is disclosed to the student as part of the application flow, reusing EDUMOVIA’s existing Country Pack. The safeguards for that specific transfer are recorded against the application. The student’s own privacy law continues to govern their data regardless of the destination.
Your choices and contact
You can exercise your data-subject rights, including any applicable objection or withdrawal, through the contact channels in the Global Privacy Notice. Provider details are listed in the Sub-processors register.
Certain items marked [MANAGEMENT INPUT REQUIRED] in the text (supervisory authority contact details, data protection / privacy officer, and jurisdiction-specific legal points) are being finalized by EDUMOVIA management and legal counsel and will be updated in a subsequent revision.
For questions about our legal and data protection practices, please contact us.
Contact us