Gradix Privacy Policy

Gradix Pte. Ltd. ("Gradix.io", "we", "us", "our") operates a B2B platform connecting recruitment agencies, local institutions, and international universities through a technology-driven ecosystem for international student admissions. We are committed to protecting the privacy and security of all personal data processed through our platform.

This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard personal data. It is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, Singapore's Personal Data Protection Act 2012 (PDPA), Canada's PIPEDA, the California Consumer Privacy Act (CCPA/CPRA), Australia's Privacy Act 1988, and other applicable data protection laws.

By accessing gradix.io, creating a partner account, or submitting information to our platform, you acknowledge that you have read and understood this Policy.

This Policy applies to:

• Visitors to gradix.io and related subdomains
• Recruitment agency partners, sub-agents, and counsellors using the Gradix Portal
• Local institutions and international university partners
• Prospective and current students whose application data is submitted to the platform by our partners
• Applicants for employment with Gradix

This Policy does not apply to third-party websites, university portals, or partner systems linked from our platform.

Gradix.io acts in different capacities depending on the data:

Where we act as a Processor, our processing is governed by a Data Processing Agreement executed with the relevant partner.

Certain data we process may constitute special category data under Article 9 GDPR or sensitive personal data under the PDPA and other regimes. This may include:

• Racial or ethnic origin (inferred from nationality or passport data)
• Health data or disability disclosures submitted for reasonable adjustment purposes
• Religious affiliation, where disclosed in scholarship or accommodation applications
• Criminal conviction data, where required for visa compliance declarations

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment balancing our interests against your rights and freedoms. You may request a summary of this assessment.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

We use personal data to:

1. 1 Create, authenticate, and administer partner accounts and sub-agent networks
2. 2 Receive, validate, and process student applications through structured admissions workflows
3. 3 Perform AI-assisted document intelligence, including completeness checks, cross-document consistency verification, and compliance flagging
4. 4 Transmit application packages to international university partners
5. 5 Track application progress across counsellors, branches, intakes, countries, and stages
6. 6 Calculate, verify, and remit partner commissions
7. 7 Provide visa counselling support, training resources, and counsellor enablement
8. 8 Send transactional notifications, status updates, and service communications
9. 9 Detect and prevent fraudulent applications, document forgery, and misuse of the platform
10. 10 Comply with legal, regulatory, and contractual obligations, including those imposed by education regulators and immigration authorities
11. 11 Generate aggregated, anonymised analytics to improve platform performance and reporting
12. 12 Respond to enquiries, disputes, and legal claims

Gradix.io uses artificial intelligence and automated systems to support admissions processing, including:

These systems assist human decision-makers; they do not make final admissions decisions. No solely automated decision-making producing legal or similarly significant effects is carried out on students within the meaning of GDPR Article 22. All flagged applications are subject to human review by qualified staff before any adverse action is taken.

Data subjects have the right to obtain human intervention, express their point of view, and contest any output of these systems.

We do not use personal data submitted through the platform to train third-party general-purpose AI models without a lawful basis and appropriate contractual safeguards.

We disclose personal data only to the categories of recipients below.

Gradix.io operates a global network spanning multiple jurisdictions, including the United Kingdom, Canada, Australia, the United States, Germany, the United Arab Emirates, Singapore, Malaysia, Turkey, Hungary, South Korea, and Pakistan. Personal data will therefore be transferred across borders.

Where personal data is transferred from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we implement one or more of the following safeguards:

• Standard Contractual Clauses adopted by the European Commission
• The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
• Transfer Impact Assessments evaluating the legal environment of the destination country
• Supplementary technical measures, including encryption in transit and at rest, pseudonymisation, and access controls
• Binding contractual commitments and, where available, certification mechanisms

Transfers under Singapore's PDPA comply with the Transfer Limitation Obligation.

You may request details of the safeguards applied to a specific transfer by contacting us at operations@gradix.io.

We retain personal data only for as long as necessary for the purposes described in this Policy, and in accordance with our contractual obligations to university partners and the statutory requirements of relevant education regulators, immigration authorities, and accounting law.

Retention periods vary by data category and by the jurisdiction and institution to which an application relates. Where we act as a Processor, retention is determined by the partner Controller's documented instructions, subject to our statutory minimums.

Upon expiry of the applicable period, data is securely deleted or irreversibly anonymised.

You may request information about the retention period applicable to a specific category of data by contacting operations@gradix.io.

Subject to applicable law and verification of identity, you have the right to:

Additional rights apply in certain jurisdictions. California residents have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and be free from discrimination for exercising these rights. Singapore residents may withdraw consent and request access and correction under the PDPA. Canadian residents may challenge our compliance and access personal information held. Australian residents have rights under Australian Privacy Principles 12 and 13.

We use the following categories of cookies:

Non-essential cookies are set only after affirmative consent, in accordance with the ePrivacy Directive and GDPR. You may modify or withdraw consent at any time through your cookie preferences or by configuring your browser settings.

We honour Global Privacy Control signals as a valid opt-out of sale or sharing where applicable.

We implement appropriate technical and organisational measures to protect personal data, including:

No system is entirely secure. While we apply industry-standard safeguards, we cannot guarantee absolute security of data transmitted over the internet.

In the event of a personal data breach:

• We will notify the relevant supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals' rights and freedoms
• We will notify the Personal Data Protection Commission of Singapore where the notification thresholds under the PDPA are met
• We will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Where we act as a Processor, we will notify the relevant partner Controller without undue delay

We maintain an internal breach register documenting all incidents, their effects, and remedial action taken.

Our platform is a B2B service not directed at children. However, applicants for international education may occasionally be under 18.

Where personal data of a minor is submitted, the submitting partner is responsible for obtaining verifiable parental or guardian consent as required by applicable law. We apply enhanced safeguards, including restricted access and exclusion from marketing communications. We do not knowingly collect data directly from children under 16 without appropriate authorisation.

If you believe a minor's data has been submitted without proper authorisation, contact operations@gradix.io for immediate review and deletion where appropriate.

Our website and platform contain links to university websites, partner portals, and external resources. We are not responsible for the privacy practices or content of these third parties. We encourage you to review their privacy policies before submitting personal data.

If you believe your data protection rights have been infringed, please contact us first at operations@gradix.io so we may resolve the matter.

You also have the right to lodge a complaint with a supervisory authority, including:

We may update this Policy to reflect changes in law, technology, or our services. Material changes will be communicated by posting the revised Policy at gradix.io with an updated "Last Updated" date, and by notifying registered partners by email at least 30 days before the changes take effect. Where required, we will obtain fresh consent.

Continued use of the platform after the effective date of changes constitutes acceptance, except where consent is legally required.

© 2026 Gradix Pte. Ltd. All rights reserved.