1.Who we are

This Privacy Policy explains how MULTIPATH EXPERT S.R.L. (“MultiPath Expert”, “we”, “us”) collects and uses personal information when you visit multipath.expert, send us a consultation enquiry, or otherwise ask us for information about studying in Australia.

MULTIPATH EXPERT S.R.L. is the data controller for the processing described in this policy.

2.Scope of this policy

This policy applies to:

• the website multipath.expert and its pages, including the consultation enquiry form and the confirmation page shown after you submit it;
• enquiries you send us about studying in Australia and the advisory services we provide in response;
• related communications by email, telephone and messaging services.

It applies wherever you are located. Some sections describe rights or rules that apply only in particular jurisdictions; where that is the case, we say so.

Our events website, events.multipath.expert, has its own privacy policy. This policy also does not cover websites operated by universities, education providers or other third parties, even where we link to them. Those organisations have their own privacy policies.

3.Information we collect

Information you provide through our enquiry form. Our consultation enquiry form is built with Contact Form 7. It asks for your first and last name, email address, telephone or WhatsApp number including the international dialling code, country of residence, preferred study level, an optional message, and your confirmation that you agree to be contacted about your study options. Please provide only the information the form asks for.

When you submit the form, the information is stored in the website’s database (using the Flamingo plugin) and delivered by email to our team so that we can respond. It is not passed to any advertising or analytics service.

Communications. If you contact us by email, telephone, WhatsApp, Telegram or another messaging service, we process the contact details and the content of that communication in order to respond. Messaging services process your information under their own privacy policies.

Information you give us during a consultation. If you go on to work with us, we may collect the additional information needed to advise you and to support an application, such as your academic history, the courses and institutions you are interested in and, where applicable, documents you choose to share with us. We will tell you what is needed at the time and ask for only what is relevant.

Technical and usage information. When you visit the website, our hosting infrastructure processes technical information such as your IP address, browser and device type, the pages you visit and the page that referred you to us. Our web server keeps access logs for security and troubleshooting.

We do not ask for, and you should not submit through our website form, sensitive information such as health data, passport or identity-card numbers, or information about your immigration status.

4.Purposes and legal bases

We use personal information for the following purposes. For visitors in the EU/EEA and other jurisdictions with similar requirements, the corresponding legal basis under the GDPR is indicated.

• Responding to your enquiry and providing our advisory services — to answer your questions, arrange a consultation and provide the guidance you request. Legal basis: performance of a contract, or steps taken at your request before entering into one (Art. 6(1)(b) GDPR).
• Follow-up connected with your enquiry — after you contact us, we may send you information reasonably connected to what you asked about, for example study options, scholarships or events relevant to your enquiry. Legal basis: our legitimate interest in following up on your enquiry (Art. 6(1)(f) GDPR), or your consent where we ask for it on the form. You can object to or opt out of this follow-up at any time (see sections 10 and 11).
• Broader direct marketing — if we wish to send you marketing that goes beyond follow-up connected with your enquiry (for example a general newsletter), we will do so only where permitted by applicable law, including obtaining your consent where the law requires it, and always with the option to opt out.
• Website operation, security and troubleshooting — to operate, secure and debug the website. Legal basis: our legitimate interest in running a secure and reliable website (Art. 6(1)(f) GDPR).
• Legal compliance — to comply with legal obligations that apply to us, such as accounting rules or responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Providing the required details on the enquiry form is necessary for us to respond to you; if you do not provide them, we cannot process the enquiry.

5.Universities and education providers

Sending us an enquiry does not mean that your contact details are distributed to universities or other education providers. Your enquiry remains with MultiPath Expert.

We share relevant information with a university, college or other education provider only where you ask us to introduce you, ask us to make an enquiry on your behalf, ask us to assist with an application, otherwise authorise the disclosure, or where another appropriate lawful basis applies. In that case, the institution processes your information under its own privacy policy, and we will tell you which institution is involved.

6.Cookies, measurement and third-party content

Website analytics (Google Analytics 4). We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC, to understand how the website is used: which pages are visited, how visitors arrive (for example from a search engine or a link), how long they stay, and whether an enquiry form is sent. Google Analytics uses cookies (_ga, _ga_G0YP049SDE) and collects your truncated IP address, approximate location, browser and device information and the pages you view. We have not enabled Google Signals, we do not send your name, email address or telephone number to Google Analytics, and the information you type into our enquiry form is not sent to Google. In the EU/EEA, the United Kingdom, Switzerland, Norway, Iceland and Liechtenstein, Google Analytics runs only after you have given your consent through the cookie notice (Art. 6(1)(a) GDPR and, in the United Kingdom, the UK GDPR). In other countries the cookie notice applies the consent or opt-out mechanism described under “Cookie notice and your choices”, in line with the law that applies to you.

How long Google keeps analytics data. We have configured Google Analytics with a 2-month retention period for event data and a 14-month retention period for user data. These settings limit the availability of user- and browser-linked data for detailed analysis. Aggregated statistics in standard Analytics reports may remain available beyond these periods.

Google Consent Mode. Until you make a choice in the cookie notice, and if you decline, the Google tags on this site run in “consent mode” with all permissions set to denied: Google does not set Analytics or advertising cookies and receives only limited, cookieless measurement signals, as described in Google’s Consent Mode documentation, which it uses for aggregated and modelled measurement. If you accept, the tags are switched to granted and the cookies described in this section are set.

Google Ads. The Google tag used on this website is also connected to our Google Ads account. When you accept marketing cookies, the tag sets the Google Ads conversion-linker cookie _gcl_au, which Google keeps typically for up to 90 days and which allows Google to attribute a visit to a click on one of our Google Ads, if any. We do not build remarketing audiences from this website, and no form content is sent to Google Ads.

Tag management (PixelYourSite). The analytics tag is loaded by the PixelYourSite plugin, which runs on our own server. When you accept analytics cookies, it sets short-lived first-party cookies that remember the page you arrived on and the source of your visit (pys_first_visit, pys_landing_page, last_pys_landing_page: 7 days; pys_session_limit: 60 minutes; pys_start_session: until you close your browser) so that this information can be attached to the analytics events described above.

Cookie notice and your choices (ConsentMagic). We use the ConsentMagic consent-management tool, which runs on our server. Depending on your location it shows one of three notices: in the EU/EEA, the United Kingdom, Switzerland, Norway, Iceland and Liechtenstein, and whenever your location cannot be determined, nothing other than strictly necessary cookies is set until you choose Allow all, Disable all or More options; in the United States you are informed and can opt out; elsewhere you are informed and can change your preferences at any time. Your choice is stored in cookies on your device (cs_viewed_cookie_policy, cs_enabled_cookie_term_*, cs_user_preference and related cs_ cookies) for 180 days, after which we ask you again. You can change or withdraw your choice at any time using the “My Consent Preferences” link shown at the bottom of every page; withdrawing consent stops further collection but does not affect processing that took place before. You can also delete or block cookies in your browser; the website and the enquiry form continue to work without non-essential cookies.

Proof of consent. To be able to demonstrate that consent was given (Art. 7(1) GDPR), ConsentMagic records the date and time of your choice, your IP address, the type of notice shown, the categories you allowed or refused and the page on which you made the choice. These records are kept for 360 days and then deleted; a cookie referencing your record (cs_stored_consent_for) is kept for the same period.

Telephone and country fields. The telephone field on our enquiry form lets you choose your international dialling code, and the country field lets you choose your country of residence. These fields work entirely in your browser; they do not contact any geolocation service.

Location detection for the cookie notice. To show the correct notice for your region, our server looks up the country of your IP address in a copy of the MaxMind GeoLite2 database stored on our own server. The lookup takes place entirely on our server; your IP address is not transmitted to MaxMind or to any other third party for this purpose. The database copy is refreshed from MaxMind about once a month, and that update does not include any visitor data.

Content loaded from third parties. The Poppins web font used on this site is served from our own server. The ICEF Accredited Agency badge shown in our accreditation section is delivered by ICEF GmbH from its own servers, which receive your IP address and standard browser information in order to deliver it, so that you can verify our accreditation.

Caching and performance. Our web server and caching software (LiteSpeed) use technical means to deliver pages quickly. These are necessary for the operation of the site and do not profile you.

7.Service providers and other recipients

We share personal information with a limited number of recipients:

• Namebox SRL (Romania) — hosts our website and its database, including form submissions, and delivers our email notifications through its infrastructure, as our processor.
• Google Ireland Limited / Google LLC — provides Google Analytics 4 and the Google tag described in section 6 (analytics and conversion measurement, only after your consent where consent is required), and provides the email service used by our team (Google Workspace), where messages to and from you are stored.
• ICEF GmbH — delivers the accreditation badge described in section 6.
• Universities and education providers — only in the circumstances described in section 5.

We may also disclose information where required by law, to protect our legal rights, or in connection with a business reorganisation, in which case this policy will continue to apply to your information.

8.International transfers

We are based in Romania and our website and its database are hosted in Romania, in the European Union. Some recipients described above may process information outside the EU/EEA, including in the United States (for example Google). Where personal information is transferred from the EU/EEA to countries that the European Commission has not recognised as providing adequate protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or, where the recipient is certified, the EU–U.S. Data Privacy Framework. Google Analytics data may be processed by Google LLC in the United States; Google LLC is certified under the EU–U.S. Data Privacy Framework, and Google’s Standard Contractual Clauses also apply to that processing.

Where you ask us to introduce you to a university in Australia, your information is transferred to that institution in Australia on the basis of your request and, where applicable, the institution’s own safeguards. You can ask us about the safeguards applied to a specific transfer at privacy@multipath.expert.

9.Retention

We keep personal information only as long as needed for the purposes above:

• Enquiries — generally kept for up to 12 months after our last meaningful interaction with you, and then deleted or anonymised. We may retain particular information for longer where this is necessary for legal, regulatory, contractual, dispute-resolution, security or other legitimate purposes.
• Client files — where you engage us to support an application, the related records are kept for as long as needed to provide the service and to meet our legal and contractual obligations, and then deleted or anonymised.
• Correspondence — kept as long as needed to manage our communication with you, following the same general standard where the correspondence relates to an enquiry.
• Cookie-consent choice — stored in your browser for 180 days, after which we ask again.
• Proof-of-consent records — 360 days, then deleted.
• Website analytics (Google Analytics 4) — subject to the retention settings described in section 6: 2 months for event data and 14 months for user data; aggregated reporting may remain available beyond these periods.
• Server access logs — kept for security and troubleshooting, and no longer than necessary for those purposes.
• Records we must keep by law (for example accounting records) — kept for the statutory period.

10.Marketing choices

Where we send you communications about study opportunities or events, you can opt out at any time by using the unsubscribe option in the message or by writing to privacy@multipath.expert. Opting out of marketing does not affect messages that are necessary to respond to your enquiry or to provide a service you have asked for.

11.Your rights

Depending on your location, you have rights over your personal information. If you are in the EU/EEA (and in many other jurisdictions with similar laws), these include the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• restrict or object to processing, including an absolute right to object to direct marketing;
• receive your information in a portable format;
• withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal.

You can withdraw your cookie consent at any time without contacting us, by clicking “My Consent Preferences” at the bottom of any page.

To exercise any of these rights, contact privacy@multipath.expert. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

If you believe we have not handled your information properly, we would appreciate the chance to resolve it — but you also have the right to complain to a supervisory authority. In Romania, this is the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. If you are in another EU/EEA country, you may complain to your local authority.

12.Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls on our systems and limiting the personal information our systems record. No internet transmission is completely secure, but we work to protect your information against unauthorised access, loss or misuse.

13.Children and younger students

Our services are intended for prospective students and their families. Prospective university students are sometimes under 18; where that is the case, we encourage younger students to involve a parent or guardian in their enquiry and in decisions about studying abroad. If you are a parent or guardian and have questions about information your child has provided to us, contact privacy@multipath.expert.

14.Jurisdiction-specific information

European Union / EEA / Romania. The GDPR applies to our processing, and this policy is written to it. Sections 4, 8 and 11 describe the legal bases, transfer safeguards and your rights.

Kazakhstan. If you are in Kazakhstan, local data-protection legislation may give you additional or different rights, and additional requirements may apply to the processing of your personal information under local law. To ask how they apply or to exercise your rights, contact privacy@multipath.expert.

Uzbekistan. If you are in Uzbekistan, local personal-data legislation may give you additional or different rights, and additional requirements may apply under local law. To ask how they apply or to exercise your rights, contact privacy@multipath.expert.

Other countries. Where local law grants you rights over your personal information, you may exercise them by contacting privacy@multipath.expert.

15.Changes to this policy

We may update this policy from time to time, for example when we add services, introduce measurement tools or change providers. The current version, with its effective date, will always be published at this address. For significant changes affecting how we use your information, we will take reasonable steps to bring the change to your attention.

16.Contact