Privacy policy

Eudoxia Worldwide Education Specialists Inc., 4388 St-Denis #418, Montréal, QC, Canada. Contact: privacy@eudoxiaeducation.net

Through our contact and application forms, we collect: full name, email address, phone number (WhatsApp), country of residence, study project description, and any document you voluntarily attach. We also collect anonymous browsing data (pages visited, language, device type) via privacy-respecting analytics.

To respond to your inquiry and provide a personalised education consultation.

To prepare your application file with the relevant universities and partner institutions.

To send you transactional updates regarding your file (no marketing without consent).

To improve our services through aggregated, non-identifying analytics.

Your consent (checkbox at form submission) and our legitimate interest in providing the service you requested.

Active candidate files: for the duration of the engagement plus 3 years after last contact.

Inquiry data (no follow-up): 24 months from submission.

Anonymous analytics: 12 months.

Eudoxia staff in Montréal, Tunis and Dubai under confidentiality agreements.

Partner institutions (universities, embassies) — only with your explicit prior authorisation for each.

Technical providers (Cloudflare for hosting, MailChannels/Resend for email) acting strictly under our instructions.

Some processing happens in Canada (servers, staff). When required, data may transit through Cloudflare's global edge network. All transfers rely on adequacy decisions or standard contractual clauses.

We use only essential cookies (session, language preference). No third-party advertising cookies. If we later add analytics cookies, you will see a consent banner.

Under GDPR and Quebec Law 25, you can request: access to your data, rectification, erasure, portability, restriction or objection. To exercise these rights, write to privacy@eudoxiaeducation.net. You also have the right to lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or your local data protection authority.

Data is encrypted in transit (TLS/HTTPS) and at rest. Access is restricted on a need-to-know basis. Security incidents are notified within 72 hours where required by law.