1. Policy Statement
Global Path is committed to protecting the privacy, confidentiality, and security of all personal and sensitive information entrusted to us by our students, their families, and other stakeholders. We adhere to the highest ethical standards in data handling and comply fully with the Data Protection Act [Chapter 11:12] of Zimbabwe and other relevant international regulations, including the General Data Protection Regulation (GDPR) for students applying to the European Union.

2. Scope
This policy applies to all staff (permanent, temporary, and contracted), partners, and any third-party service providers acting on Global Path’s behalf. It covers all personal data collected, processed, stored, and disposed of in any format (digital or physical) throughout the student engagement lifecycle.

3. Principles of Data Collection & Processing
We are guided by the following principles:

• Lawfulness, Fairness, and Transparency: Data is collected for specific, explicit, and legitimate purposes directly related to our services.
• Data Minimization: We only collect data that is strictly necessary for providing counselling, application, visa, and scholarship assistance.
• Purpose Limitation: Data collected for one purpose will not be repurposed without additional consent.
• Accuracy: We take reasonable steps to ensure personal data is accurate, complete, and kept up-to-date.
• Storage Limitation: Data is retained only for as long as necessary to fulfill the purpose for which it was collected, or as required by law.
• Integrity and Confidentiality: Data is processed with appropriate security, including protection against unauthorized or unlawful processing, loss, or damage.

4. Types of Data We Collect

• Personal Identification: Full name, date of birth, nationality, passport details, contact information.
• Academic History: Certificates, transcripts, diplomas, test scores (IELTS, TOEFL, SAT, etc.).
• Financial Information: Proof of funds, bank statements, scholarship applications, and details for fee payments (Note: We do not store full payment card details).
• Application Materials: Statements of Purpose (SOPs), letters of recommendation, resumes/CVs, portfolios.
• Communication Records: Correspondence via email, WhatsApp, and meeting notes.

5. How We Use Student Data
Data is used exclusively to:

• Assess academic profile and provide personalized counselling.
• Prepare and submit applications to universities and scholarship bodies.
• Provide guidance and documentation for student visa processes.
• Communicate important updates regarding applications, deadlines, and procedures.
• Facilitate pre-departure and arrival support services.

6. Data Sharing & Third Parties

• We do not sell, trade, or rent student data.
• Data is shared only with explicit, prior consent from the student, and only with entities critical to the application process (e.g., designated universities, accredited scholarship boards, and visa processing authorities).
• Any third-party service provider (e.g., secure cloud storage) is bound by strict contractual agreements to uphold equivalent data protection standards.

7. Data Security Measures

• Digital Security: Use of encrypted storage, secure password-protected systems, and firewalls. Access to data is restricted to authorized staff on a need-to-know basis.
• Physical Security: Secure locking systems for physical files. Documents are shredded before disposal.
• Procedural Security: Regular staff training on data protection. Clear internal protocols for data access, transfer, and breach response.

8. Data Subject Rights
Students have the right to:

• Access their personal data held by Global Path.
• Rectify inaccurate or incomplete data.
• Request deletion of their data where there is no compelling reason for its continued processing.
• Withdraw consent for data processing at any time.
• Lodge a complaint with the relevant data protection authority.

9. Data Retention
We retain student files for a period of five (5) years from the date of service completion to facilitate future support (e.g., for postgraduate applications) and for legal and regulatory purposes. After this period, all data is securely and permanently destroyed.

10. Policy Review & Breach Notification
This policy is reviewed annually. In the unlikely event of a data breach that poses a risk to an individual’s rights and freedoms, Global Path will notify the affected individuals and the relevant regulatory body within 72 hours, as required by law.

11. Contact
For any questions, to exercise your data rights, or to report a concern, please contact our designated Data Protection Officer at: