International Data Transfer Notice
Энэ нь хянан үзэхээр бэлтгэсэн хувилбар 1.0 ноорог юм. Манай баталгаажсан техник болон өгөгдөл хамгаалалтын үйл ажиллагааг тусгасан боловч удирдлага болон хуулийн эцсийн зөвшөөрлийг хүлээж байна. Зарим хэсэг нь удирдлага эсвэл хуулийн хяналтад байгаа зүйлсийг агуулсан тул эцсийн бодлого гэж үзэж болохгүй.
This notice explains how personal data may move across borders between the data subject, the tenant, EDUMOVIA (operated from the Republic of Korea) and destination institutions, and the legal mechanisms applied to each route.
Хүчин төгөлдөр болох огноо: 2026 оны 8-р сарын 31 · Хувилбар v1.0
Purpose of this notice
EDUMOVIA is operated by Castle Consulting Company Co., Ltd. (주식회사 캐슬컨설팅), Business Registration No. 664-87-03141, based in Gimpo-si, Gyeonggi-do, Republic of Korea. Because education mobility is inherently cross-border, personal data may move between the data subject’s country, the tenant (an education agency or institution), EDUMOVIA’s operating environment, destination institutions and a small number of service providers. This notice explains those flows and the legal mechanism applied to each.
Three distinct concepts
We separate three ideas that are often confused. (1) Data-subject jurisdiction — the privacy law that protects the individual, based on where they are. (2) Operator jurisdiction — the Republic of Korea, where the operating entity is established. (3) Destination / application country — the country of the university or partner a student applies to. The privacy law that governs a person’s data is determined by concept (1); it is NOT determined by the destination country.
Transfer routes and legal mechanisms
EEA → Korea: the European Commission adopted an adequacy decision for the Republic of Korea under Article 45 GDPR on 17 December 2021 (first periodic review confirmed in 2026), so transfers from the EEA to Korea do not require additional Standard Contractual Clauses. UK → Korea: UK restricted transfers rely on a UK adequacy regulation where one applies, or otherwise on the ICO International Data Transfer Agreement (IDTA) or Addendum together with a Transfer Risk Assessment [LEGAL REVIEW REQUIRED to confirm current UK adequacy status for Korea]. Türkiye → abroad: under KVKK Article 9 as amended by Law No. 7499 (effective 1 September 2024), transfers follow a three-tier hierarchy — adequacy decision, then appropriate safeguards (Board Standard Contract, Binding Corporate Rules or written undertaking), then narrow derogations. Explicit consent (açık rıza) is only a derogation for incidental transfers and is not the default basis for systematic flows. Korea (PIPA): overseas transfer requires informed consent and/or adequate protection with appropriate safeguards. Central Asia and Mongolia: consent- and/or adequacy-based — see the relevant country addendum.
Destination-country disclosure
When a student applies to an institution in another country, the destination country is disclosed to the student as part of the application flow, reusing EDUMOVIA’s existing Country Pack. The safeguards for that specific transfer are recorded against the application. The student’s own privacy law continues to govern their data regardless of the destination.
Your choices and contact
You can exercise your data-subject rights, including any applicable objection or withdrawal, through the contact channels in the Global Privacy Notice. Provider details are listed in the Sub-processors register.
Текстэд тэмдэглсэн зарим зүйл (хяналтын байгууллагын холбоо барих мэдээлэл, өгөгдөл хамгаалах / нууцлалын ажилтан, харьяаллын онцлогтой хууль зүйн зүйлс) EDUMOVIA-ийн удирдлага, хуульчдаар эцэслэгдэж байгаа бөгөөд дараагийн шинэчлэлд шинэчлэгднэ.
Хууль болон өгөгдөл хамгаалалтын талаарх асуултаар бидэнтэй холбогдоно уу.
Холбогдох