국제 데이터 이전 고지
본 문서는 검토를 위해 준비된 버전 1.0 초안입니다. 당사의 검증된 기술 및 데이터 보호 관행을 반영하나 경영진 및 법률 최종 승인을 대기 중입니다. 일부 조항은 여전히 경영진 또는 법률 검토 중인 항목을 포함하므로 최종 정책으로 신뢰해서는 안 됩니다.
This notice explains how personal data may move across borders between the data subject, the tenant, EDUMOVIA (operated from the Republic of Korea) and destination institutions, and the legal mechanisms applied to each route.
시행일: 2026년 8월 31일 · 버전 v1.0
Purpose of this notice
EDUMOVIA is operated by Castle Consulting Company Co., Ltd. (주식회사 캐슬컨설팅), Business Registration No. 664-87-03141, based in Gimpo-si, Gyeonggi-do, Republic of Korea. Because education mobility is inherently cross-border, personal data may move between the data subject’s country, the tenant (an education agency or institution), EDUMOVIA’s operating environment, destination institutions and a small number of service providers. This notice explains those flows and the legal mechanism applied to each.
Three distinct concepts
We separate three ideas that are often confused. (1) Data-subject jurisdiction — the privacy law that protects the individual, based on where they are. (2) Operator jurisdiction — the Republic of Korea, where the operating entity is established. (3) Destination / application country — the country of the university or partner a student applies to. The privacy law that governs a person’s data is determined by concept (1); it is NOT determined by the destination country.
Transfer routes and legal mechanisms
EEA → Korea: the European Commission adopted an adequacy decision for the Republic of Korea under Article 45 GDPR on 17 December 2021 (first periodic review confirmed in 2026), so transfers from the EEA to Korea do not require additional Standard Contractual Clauses. UK → Korea: UK restricted transfers rely on a UK adequacy regulation where one applies, or otherwise on the ICO International Data Transfer Agreement (IDTA) or Addendum together with a Transfer Risk Assessment [LEGAL REVIEW REQUIRED to confirm current UK adequacy status for Korea]. Türkiye → abroad: under KVKK Article 9 as amended by Law No. 7499 (effective 1 September 2024), transfers follow a three-tier hierarchy — adequacy decision, then appropriate safeguards (Board Standard Contract, Binding Corporate Rules or written undertaking), then narrow derogations. Explicit consent (açık rıza) is only a derogation for incidental transfers and is not the default basis for systematic flows. Korea (PIPA): overseas transfer requires informed consent and/or adequate protection with appropriate safeguards. Central Asia and Mongolia: consent- and/or adequacy-based — see the relevant country addendum.
Destination-country disclosure
When a student applies to an institution in another country, the destination country is disclosed to the student as part of the application flow, reusing EDUMOVIA’s existing Country Pack. The safeguards for that specific transfer are recorded against the application. The student’s own privacy law continues to govern their data regardless of the destination.
Your choices and contact
You can exercise your data-subject rights, including any applicable objection or withdrawal, through the contact channels in the Global Privacy Notice. Provider details are listed in the Sub-processors register.
본문에 표시된 일부 항목(감독 기관 연락처, 데이터 보호/개인정보 보호책임자, 관할권별 법적 사항)은 EDUMOVIA 경영진과 법률 자문이 확정 중이며 향후 개정판에서 업데이트됩니다.
법률 및 데이터 보호 관행에 대한 문의는 연락 주세요.
문의하기