ENZ processes personal data in accordance with Republic Act No. 10173, or the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, relevant issuances of the National Privacy Commission ("NPC"), and other applicable laws and regulations.

We observe the fundamental data privacy principles of transparency, legitimate purpose, and proportionality in processing personal data.

For purposes of the Data Privacy Act, ENZ Education Consultancy Services acts as a Personal Information Controller ("PIC") in relation to personal data for which ENZ determines the purpose and means of processing.

Depending on the service involved, ENZ may also engage third-party service providers or Personal Information Processors to process information on our behalf, subject to appropriate contractual, organizational, technical, and security safeguards.

The personal data we collect depends on your relationship with ENZ and the services you request.

We may collect personal information, including:

• Full name;

• Residential and mailing address;

• Email address;

• Mobile or telephone number;

• Date and place of birth;

• Nationality and citizenship;

• Civil status;

• Gender, where relevant to the requested service;

• Employment history and occupation;

• Educational background;

• Preferred institution, program, destination, and intake;

• Travel history;

• Contact details of authorized representatives or family members;

• Communications and correspondence with ENZ;

• Appointment, inquiry, assessment, and client records; and other information reasonably necessary to provide the requested service.

Depending on the service, ENZ may also process sensitive personal information as defined under the Data Privacy Act, including information relating to:

• Age and civil status;

• Educational records and academic history;

• Government-issued identification numbers and documents;

• Passport and travel documents;

• Visa and immigration records;

• Financial information and evidence of financial capacity;

• Health or medical information when required for an application or related process;

• Licenses, professional registrations, and government records; and other sensitive personal information necessary for an admission, visa, immigration, employment, or related application.

We only seek information that is reasonably necessary and proportionate to the purpose for which it is collected.

ENZ may collect personal data:

• Directly from you;

• Through our website and online forms;

• Through consultation and assessment forms;

• During appointments, telephone calls, email, SMS, messaging applications, or face-to-face consultations;

• Through our customer relationship management ("CRM") and client management systems;

• Through social media and advertising platforms where you voluntarily submit an inquiry;

• Through referral partners, educational institutions, or authorized representatives;

• From documents submitted for admissions, enrollment, visa, immigration, or related processing;

• During seminars, webinars, fairs, promotions, and events; and

• From other lawful sources where collection is permitted by applicable law.

Where information is obtained from another person, ENZ will process such information only when there is an appropriate lawful basis for doing so.

We may process personal data for legitimate and specified business purposes, including:

5.1 Inquiry and assessment. To respond to inquiries, conduct initial assessments, understand study or migration objectives, recommend potential programs or institutions, and arrange consultations.

5.2 Client onboarding and service delivery. To establish and manage the client relationship, verify information, communicate requirements, maintain client records, and provide agreed consultancy services.

5.3 Admissions and enrollment. To prepare, process, monitor, and facilitate applications to educational institutions and related organizations.

5.4 Visa and immigration-related assistance. Where included within the scope of our services, to assist in preparing, reviewing, organizing, and facilitating documents and applications and communicating relevant requirements and updates.

5.6 Payments and accounting. To process fees, issue receipts and invoices, maintain financial records, reconcile transactions, and comply with accounting, tax, and regulatory requirements.

5.7 Communication and client support. To provide application updates, reminders, document requests, appointment notifications, administrative messages, and other service-related communications.

5.8 Marketing and engagement. Where permitted by law and, where required, with your consent, to send information concerning educational opportunities, programs, events, promotions, webinars, services, and other relevant ENZ communications.

5.9 Business improvement and analytics. To analyze service performance, client experience, campaign effectiveness, operational trends, and other information necessary to improve ENZ's services.

5.10 Legal and regulatory compliance. To comply with applicable laws, lawful government requests, regulatory obligations, dispute resolution, audits, investigations, and the establishment, exercise, or defense of legal claims.

Depending on the circumstances and nature of the personal data, ENZ may process information based on one or more lawful grounds recognized under applicable Philippine law, including:

• Your consent;

• The performance of a contract or steps taken at your request before entering into a contract;

• Compliance with legal obligations;

• Protection of lawful rights and interests;

• Other lawful bases permitted under the Data Privacy Act and applicable regulations; and

• For sensitive personal information, the applicable conditions specifically permitted by law.

Where processing is based on consent, you may withdraw your consent subject to applicable legal, contractual, and operational limitations. Withdrawal does not affect processing lawfully undertaken before the withdrawal.

ENZ does not sell personal data.

Where necessary and lawful, personal data may be disclosed or transferred to appropriate recipients, which may include:

• Educational institutions and their authorized representatives;

• Admissions and enrollment platforms;

• Government agencies, immigration authorities, embassies, consulates, visa application centers, or other relevant authorities;

• Authorized education and professional partners;

• Payment processors, banks, and financial service providers;

• Information technology, CRM, cloud storage, communications, document management, and other service providers supporting ENZ's operations;

• Professional advisers, auditors, accountants, lawyers, or consultants;

• Regulators, courts, law-enforcement agencies, or government authorities when required or permitted by law; and

• Other parties specifically authorized by you or reasonably necessary to provide the requested service.

Third parties receiving personal data are expected to process the information only for legitimate and authorized purposes and to maintain appropriate safeguards as required by applicable law.

Because ENZ provides international education and related services, your personal data may need to be transmitted to or accessed by educational institutions, service providers, partners, or government authorities located outside the Philippines.

This may include countries in which you are seeking admission, enrollment, study, travel, or other services.

Where cross-border processing is necessary, ENZ will take reasonable steps to ensure that personal data is transferred for legitimate purposes and subject to appropriate safeguards consistent with applicable data privacy requirements.

With your consent where required, ENZ may communicate with you through email, SMS, telephone, messaging applications, social media, or other communication channels regarding:

• Study-abroad opportunities;

• Educational programs and institutions;

• Application and intake updates;

• Events and webinars;

• Promotions and offers;

• Relevant regulatory or industry developments; and

• Other ENZ services that may be relevant to your expressed interests.

You may withdraw your marketing consent or request to stop receiving promotional communications through the opt-out mechanism provided in the communication or by contacting ENZ.

Withdrawal from marketing communications will not prevent ENZ from sending necessary transactional, administrative, application, security, or service-related communications where these remain necessary.

When you visit our website or interact with certain online services, we may automatically receive limited technical information such as:

• IP address;

• Browser and device information;

• Operating system;

• Referring website or source;f

• Pages viewed;

• Date and time of access; and

• Website usage information.

Cookies and similar technologies may be used to operate and secure the website, understand website performance, analyze visitor activity, and improve our services.

Where required, appropriate consent mechanisms will be provided for non-essential cookies or similar technologies.

ENZ retains personal data only for as long as reasonably necessary to fulfill the purpose for which it was collected, comply with contractual and legal obligations, maintain appropriate business and transaction records, resolve disputes, establish or defend legal claims, and satisfy applicable regulatory requirements.

Retention periods may vary depending on the type of record, the nature of the client relationship, applicable laws, and legitimate operational requirements.

When personal data is no longer required, ENZ will take reasonable measures to securely delete, destroy, anonymize, or otherwise dispose of it in accordance with applicable policies and law.

ENZ implements reasonable and appropriate organizational, physical, and technical security measures designed to protect personal data against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, unauthorized access, misuse, and other unlawful processing.

Access to personal data is restricted to authorized personnel and service providers who require access for legitimate business purposes and are subject to appropriate confidentiality and data protection obligations.

While ENZ maintains appropriate safeguards, no information system or method of electronic transmission can be guaranteed to be completely secure.

Subject to the conditions and limitations provided by applicable law, you may exercise your rights under the Data Privacy Act, including the:

• Right to be informed about the processing of your personal data;

• Right to access personal data concerning you;

• Right to object to certain processing;

• Right to rectification of inaccurate or incomplete personal data;

• Right to erasure or blocking under circumstances provided by law;

• Right to data portability, where applicable;

• Right to damages where legally warranted; and

• Right to file a complaint with the National Privacy Commission.

You may also withdraw consent where consent is the lawful basis for processing, subject to applicable legal and contractual limitations.

These rights correspond with those identified by the NPC for Philippine data subjects.

Some educational services may involve applicants who are minors.

Where ENZ processes personal data relating to a minor, we will take appropriate measures to ensure that such processing has an appropriate lawful basis and, where required, obtain authorization or consent from the minor's parent, guardian, or other person legally authorized to act on the minor's behalf.

We will process information concerning minors only to the extent reasonably necessary for legitimate educational, admission, visa, administrative, or related purposes.

ENZ maintains procedures for assessing and responding to suspected or confirmed personal data breaches and security incidents.

Where notification is required under applicable law or NPC regulations, ENZ will take appropriate steps to notify affected data subjects and/or the National Privacy Commission within the applicable requirements.

Our website, communications, or services may contain links to websites, portals, payment systems, educational institutions, government agencies, or other platforms operated by third parties.

Once you access a third-party platform, its own privacy practices and terms may apply. We encourage you to review the relevant privacy notice before providing personal data directly to such third party.

ENZ may update this Privacy Statement from time to time to reflect changes in our services, processing activities, technology, regulatory requirements, or applicable law.

Material changes will be communicated through appropriate channels where required. The current version and its effective date will be published on our website.

Questions, concerns, requests, objections, withdrawals of consent, or complaints relating to your personal data may be directed to:

DATA PROTECTION OFFICER / COMPLIANCE OFFICER

Zoren Johnmar Singson

ENZ Education Consultancy Services

Email: [email protected]

Contact Number: 09171011112

When submitting a data subject request, ENZ may reasonably request information necessary to verify your identity and protect your personal data from unauthorized disclosure.

You also have the right to lodge a complaint with the National Privacy Commission concerning the processing of your personal data.