Privacy Policy

01Introduction

Leggio respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect your personal data when you:

• visit or use our website, platform or student portal;
• create an account;
• complete an enquiry, eligibility or application form;
• book or attend a consultation, webinar, meeting or information session;
• register for a course, programme or pathway;
• communicate with us by email, telephone, WhatsApp, social media or another channel;
• respond to one of our advertisements;
• request support with an educational application or related service;
• participate in a survey, event, promotion or feedback activity; or
• otherwise interact with Leggio.

This Privacy Policy also explains your rights under applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

02Who We Are

The controller responsible for your personal data is:

In this Privacy Policy, “Leggio”, “we”, “us” and “our” refer to Leggio path OÜ.

Leggio provides educational guidance, student pathway support, professional skills preparation, online learning services and introductions to relevant education and service partners.

03Personal Data We Collect

The information we collect depends on how you interact with us and which services you request.

3.1 Identity and contact information

This may include:

• full name;
• date of birth;
• nationality;
• country of residence;
• residential address;
• email address;
• telephone or WhatsApp number;
• preferred language;
• passport or national identification details;
• profile photograph; and
• emergency contact information.

3.2 Educational information

This may include:

• academic qualifications;
• schools, colleges or universities attended;
• academic certificates and transcripts;
• grades and degree classifications;
• subjects studied;
• English-language proficiency;
• IELTS, TOEFL, PTE or other language-test results;
• professional qualifications;
• curriculum vitae;
• personal statements;
• reference letters; and
• preferred institution, destination, programme or field of study.

3.3 Application and eligibility information

This may include:

• intended programme and intake;
• application status;
• passport validity;
• document availability;
• previous applications;
• admission decisions;
• study objectives;
• preferred destination;
• information relating to previous visa applications or refusals;
• proposed travel dates; and
• information required to assess your preliminary suitability for a programme or service.

3.4 Financial information

Where relevant to the service requested, we may collect:

• payment information;
• invoices and transaction records;
• funding source;
• available study budget;
• sponsorship information;
• education-loan information;
• scholarship information;
• evidence of financial capacity; and
• bank statements or other proof-of-funds documentation.

Payment-card details may be processed directly by an authorised payment provider. Leggio may not receive or retain your complete payment-card information.

3.5 Employment and professional information

Where you request career-related preparation or support, we may collect:

• employment history;
• professional experience;
• occupation;
• employer details;
• skills and certifications;
• curriculum vitae;
• preferred role or industry;
• availability;
• interview information; and
• career objectives.

Leggio does not guarantee employment or placement.

3.6 Communication information

We may keep records of communications with you, including:

• emails;
• telephone or video-call notes;
• WhatsApp and social-media messages;
• consultation notes;
• support requests;
• webinar participation;
• enquiries, complaints and feedback; and
• your communication preferences.

Where a call, webinar or meeting is recorded, we will notify participants where required by law.

3.7 Account and learning information

When you use our platform or student portal, we may collect:

• username and account details;
• login and security information;
• enrolled courses;
• attendance;
• course progress;
• assignment submissions;
• examination or assessment results;
• tutor communications;
• certificates;
• consultation bookings; and
• platform activity.

3.8 Technical and usage information

When you use our website or platform, we may collect:

• internet protocol address;
• browser type and version;
• device type;
• operating system;
• time zone and approximate location;
• pages visited;
• referring website;
• date and time of access;
• session information;
• cookie identifiers;
• interaction and conversion information; and
• diagnostic, security and performance information.

3.9 Information received from third parties

We may receive personal data from:

• universities, colleges and training providers;
• authorised education agents and referral partners;
• tutors and academic service providers;
• language-testing providers;
• payment providers;
• visa or relocation support providers;
• professional advisers;
• advertising platforms such as Meta, Facebook, Instagram, Google or LinkedIn;
• event, webinar and appointment-booking platforms; and
• individuals who refer you to Leggio.

If another person provides your information to us, that person must have a lawful basis for doing so and must inform you that your information may be shared with Leggio.

04How We Use Your Personal Data

We may use your personal data to:

• respond to your enquiry;
• create and manage your account;
• provide consultations and eligibility assessments;
• understand your educational or professional objectives;
• recommend potentially suitable courses, programmes or pathways;
• support your application to an educational institution;
• check whether application documents are complete;
• assist with document preparation;
• deliver courses, training and student-support services;
• arrange information sessions, webinars, interviews and meetings;
• communicate application updates and next steps;
• introduce you to universities, colleges, training providers or other relevant partners;
• process payments, invoices, refunds and financial records;
• provide customer and technical support;
• manage our relationship with you;
• improve our website, platform, courses and services;
• send service-related communications;
• send marketing communications where permitted;
• measure the performance of our advertising;
• prevent fraud, misuse and security incidents;
• establish, exercise or defend legal claims;
• comply with legal, regulatory, tax and accounting obligations; and
• protect the rights, safety and property of Leggio, our users and third parties.

We will not use your personal data for a materially different purpose without informing you and establishing an appropriate legal basis.

05Legal Bases for Processing

Under the GDPR, we must have a lawful basis for processing personal data. Depending on the circumstances, we may rely on one or more of the following:

5.1 Performance of a contract

We process personal data where it is necessary to provide a service you have requested or to take steps before entering into a contract with you.

This may include providing a consultation, creating an account, enrolling you in a course, processing a payment or supporting an educational application.

5.2 Legitimate interests

We may process personal data where this is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• responding to enquiries;
• managing our services and relationships;
• improving our platform and customer experience;
• maintaining network and information security;
• preventing fraud and misuse;
• keeping appropriate business records;
• measuring service performance; and
• communicating with existing clients about relevant services.

5.3 Consent

We may rely on your consent when:

• sending certain marketing communications;
• using non-essential cookies;
• collecting information through optional advertising forms;
• recording a meeting or webinar where consent is required;
• sharing your information with an optional third-party service provider; or
• processing certain sensitive information when no other lawful basis applies.

You may withdraw your consent at any time. Withdrawal will not affect processing that occurred lawfully before your consent was withdrawn.

5.4 Legal obligation

We may process personal data when necessary to comply with legal, tax, accounting, regulatory or law-enforcement obligations.

5.5 Legal claims and vital interests

In limited circumstances, we may process information to establish, exercise or defend legal claims, or to protect someone’s vital interests.

06Sensitive Personal Data

Some documents connected with educational, travel or visa processes may contain information regarded as sensitive or as a special category of personal data under the GDPR.

This may include information concerning health, disability, racial or ethnic origin, religious beliefs or other protected characteristics.

We do not request sensitive information unless it is reasonably necessary for a specific service or application. Where we process such information, we will use an additional legal condition required by applicable law, such as your explicit consent, the establishment or defence of legal claims, or another legally permitted basis.

A passport photograph is not used by Leggio for facial recognition or biometric identification unless you are expressly informed otherwise and an appropriate legal basis exists.

07Facebook, Instagram and Other Advertising Forms

Leggio may advertise its services through Meta platforms, including Facebook and Instagram, and through other advertising providers.

If you complete a lead form on one of these platforms, the platform may provide Leggio with the information you entered, such as your:

• name;
• email address;
• telephone or WhatsApp number;
• country or city;
• educational background;
• programme preference;
• financial-readiness information; and
• answers to eligibility questions.

We use this information to respond to your request, conduct a preliminary eligibility assessment and provide relevant information about our services.

The advertising platform also processes your information under its own privacy policy. Leggio does not control how the platform processes data for its independent purposes.

08Marketing Communications

We may send you information about programmes, courses, events, application deadlines and related services where:

• you have given your consent;
• you have requested such information; or
• applicable law otherwise permits us to contact you.

You may unsubscribe at any time by:

• selecting the unsubscribe option in an email;
• replying “STOP” where that option is provided;
• changing your account preferences; or
• contacting us at hello@leggio.io.

Opting out of marketing will not prevent us from sending essential communications relating to an active account, contract, payment, application or service.

We do not sell personal data to third parties for their own marketing purposes.

09Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

• operate essential website functions;
• maintain secure user sessions;
• remember preferences;
• understand how visitors use the website;
• improve performance;
• measure enquiries and conversions; and
• support advertising and remarketing activities.

Strictly necessary cookies may be used without consent where permitted by law. Analytics, advertising and other non-essential cookies will be used only after obtaining consent where required.

You can manage your preferences through our cookie-consent tool and your browser settings.

Further information should be provided in Leggio’s separate Cookie Policy or cookie-preference centre, including the names, purposes, providers and retention periods of the cookies used.

10When We Share Personal Data

We may share personal data only where reasonably necessary and legally permitted. Recipients may include:

10.1 Educational and training partners

This may include universities, colleges, schools, training providers, tutors and examination or language-testing organisations.

We will share information needed to assess or process an application, enrolment or service request.

10.2 Application and support providers

Where requested or authorised, we may share data with service providers supporting documentation, visas, travel, insurance, accommodation, relocation or arrival preparation.

Any visa-related support does not influence or guarantee the decision of an immigration authority.

10.3 Technology and operational providers

This may include providers of:

• website hosting;
• cloud storage;
• customer-relationship management systems;
• learning-management systems;
• email and communication services;
• appointment scheduling;
• webinars and video conferencing;
• electronic signatures;
• document management;
• analytics;
• cybersecurity; and
• payment processing.

These providers may process personal data only for authorised purposes and under appropriate contractual and security obligations.

10.4 Professional advisers and authorities

We may disclose personal data to accountants, auditors, insurers, lawyers, courts, regulators, tax authorities, law-enforcement bodies or other public authorities where legally required or reasonably necessary.

10.5 Business transactions

If Leggio is involved in a merger, acquisition, restructuring, financing, sale or transfer of business assets, relevant personal data may be disclosed to professional advisers and prospective parties under appropriate confidentiality safeguards.

11Educational Institutions and Independent Controllers

A university, college, testing organisation, visa-support provider or other partner may process your information as an independent data controller.

Once your personal data has been transferred to an independent controller, that organisation is responsible for explaining how it uses and protects your information.

You should review the privacy policy of each institution or service provider before submitting an application or entering into a separate agreement.

Where Leggio and another organisation jointly determine how and why personal data is processed, we will provide appropriate information about the joint-controller arrangement where required.

12International Data Transfers

Leggio is established in Estonia and may work with students, service providers and educational partners located inside and outside the European Economic Area (“EEA”).

Your personal data may therefore be transferred to, accessed from or processed in a country outside the EEA.

Where the destination country does not benefit from an adequacy decision by the European Commission, we will use an appropriate transfer safeguard where required, such as:

• the European Commission’s Standard Contractual Clauses;
• legally recognised contractual safeguards;
• approved certification or transfer mechanisms; or
• a specific legal exception permitted under the GDPR.

Where appropriate, we also assess whether additional contractual, organisational or technical measures are required.

You may contact us for further information about the safeguards relevant to your personal data.

13Data Security

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• unauthorised disclosure; and
• unlawful destruction.

These measures may include access controls, password protection, encryption where appropriate, secure hosting, backups, staff confidentiality obligations, monitoring and limited access based on business need.

14Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, accounting, security and dispute-resolution purposes.

Our retention periods generally depend on the nature of the relationship and may include:

At the end of the applicable retention period, personal data will be securely deleted, anonymised or retained only where continued storage is legally required.

15Automated Processing and Profiling

We may use rules, filters or CRM tools to organise enquiries and identify applicants who appear to meet preliminary criteria, such as:

• educational background;
• document readiness;
• programme preference;
• language level;
• passport status;
• application timeline; and
• stated financial readiness.

These tools may help our team prioritise enquiries, but they do not guarantee eligibility or determine admission or visa outcomes.

Leggio does not intend to make decisions producing legal or similarly significant effects solely through automated processing without appropriate legal safeguards.

Where applicable, you may request human intervention, express your point of view and contest an automated decision.

16Accuracy of Information

You should ensure that the information and documents you provide are accurate, complete and current.

Please notify us if your information changes. Providing false, misleading or incomplete information may affect our ability to provide services and may affect an application submitted to a third party.

Leggio may request clarification or updated documentation where reasonably necessary.

17Your Data Protection Rights

Subject to applicable law, you may have the right to:

To exercise your rights, contact hello@leggio.io.

We may request reasonable evidence of identity before responding. This is intended to ensure that personal data is not disclosed to an unauthorised person.

We generally respond within one month, although the period may be extended where permitted by law due to the complexity or number of requests.

These rights are not absolute, and we may refuse or limit a request where permitted or required by law. If this happens, we will explain the reason where legally allowed.

18Complaints

We encourage you to contact us first so that we can attempt to resolve your concern.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

Depending on where you live or where an alleged infringement occurred, you may also be entitled to complain to another competent supervisory authority in the European Union or European Economic Area.

19Children’s Privacy

Our Master’s programmes, professional pathways and related services are generally intended for adults.

We do not knowingly collect personal data directly from children under the age of 16 without appropriate authorisation or consent where required by law.

If you believe that a child has provided personal data to us improperly, please contact hello@leggio.io so that we can investigate and take appropriate action.

For services involving a person under 18, we may request the involvement and authorisation of a parent or legal guardian.

20Third-Party Websites and Services

Our website may contain links to universities, colleges, payment services, social-media platforms, booking services and other third-party websites.

Leggio does not control the privacy, security or content of independent third-party services. This Privacy Policy does not apply to their processing activities.

You should review the privacy policy of the relevant third party before providing personal data.

21Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• changes to the technology or providers we use;
• legal or regulatory developments; or
• changes to how we process personal data.

The current version will be published on our website with the date of the latest update.

Where a change materially affects how we use your personal data, we will provide additional notice where reasonably possible or legally required.

22Contact Us

If you have questions about this Privacy Policy, wish to exercise a data protection right or want to raise a privacy concern, please contact: