This Privacy & Cookie Policy describes how Aptitude Migration Pty Ltd trading as Aptitude Migration collects, holds, uses, discloses, stores, transfers and otherwise processes personal information. Please read it carefully.
PRIVACY & COOKIE POLICY
Effective date: 7 October 2026
1. Introduction
Aptitude Migration Pty Ltd trading as Aptitude Migration ("Company", "we", "our", or "us") is an Australian education and migration consultancy providing international education, admissions, visa, migration, and related support services.
We recognize the importance of protecting personal information and generally seek to handle such information in a responsible, transparent and secure manner, having regard to applicable privacy and data protection laws.
This Privacy Policy describes our general practices regarding the collection, holding, use, disclosure, storage, transfer and other processing of personal information when you:
- visit or interact with our website;
- submit an enquiry or request information;
- book or attend a consultation;
- communicate with our counsellors, migration advisers, employees, contractors or representatives;
- apply to an education provider through us;
- engage us for education, admissions, visa, migration or related support services;
- participate in English language preparation services;
- enquire about or request assistance regarding Overseas Student Health Cover (OSHC), Overseas Visitor Health Cover (OVHC), travel insurance or similar services;
- register for seminars, webinars, exhibitions or other events;
- subscribe to newsletters or other communications; or
- otherwise interact with Aptitude Migration.
Depending upon the services requested, our services may include, without limitation:
- international education counselling;
- study abroad guidance;
- university and college admissions assistance;
- course and institution selection;
- scholarship information;
- student visa assistance;
- Australian migration and visa related services;
- skills assessment guidance;
- Genuine Student preparation assistance;
- document review;
- Overseas Student Health Cover (OSHC);
- Overseas Visitor Health Cover (OVHC);
- travel insurance related assistance;
- IELTS and PTE preparation;
- pre departure support; and
- other related education, migration or consultancy services.
Our privacy practices are generally designed having regard to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), to the extent applicable to our business activities.
Where a particular service, individual or processing activity is subject to another applicable privacy or data protection law, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018 or similar legislation, we generally seek to take those requirements into account where reasonably applicable.
Nothing in this Privacy Policy is intended to create contractual rights or obligations beyond those arising under applicable law. This Privacy Policy is intended to describe our general privacy practices and may be updated from time to time to reflect changes in our business operations, service offerings, technologies, legal requirements or regulatory guidance.
2. Who We Are / Contact Us
Company Name
Aptitude Migration Pty Ltd trading as Aptitude Migration
Registered Address
Office #3, Level 1, 37 Queen Street
Auburn, New South Wales
Australia
Email
info@aptitudemigration.com.au
Telephone
+61 432 710 739
Website
www.aptitudemigration.com.au
If you have questions regarding this Privacy Policy or wish to make a privacy related enquiry, request or complaint, you may contact us using the details above. We will generally endeavor to respond within a reasonable period, having regard to the nature of the enquiry and any applicable legal requirements.
3. Personal Information We May Collect
The type and amount of personal information we may collect will depend on your circumstances, the nature of the services requested, the information you choose to provide, and any applicable requirements of education providers, government agencies, migration authorities, insurers, service providers or other relevant organisations.
Where reasonably necessary and lawful, the information we may collect can include the following.
3.1 Identity and Contact Information
Depending on your circumstances, we may collect information such as:
- full name;
- date of birth;
- gender, where relevant;
- nationality or citizenship;
- passport information or copies of passports;
- national identity card information, where applicable;
- photographs;
- residential or postal addresses;
- telephone numbers;
- email addresses;
- marital or relationship status, where relevant;
- emergency contact details; and
- details relating to parents, guardians, spouses, partners, dependents, sponsors or other family members where reasonably relevant to the requested service.
3.2 Academic and Education Information
Where relevant to the requested service, we may collect information including:
- academic certificates;
- transcripts;
- degrees;
- diplomas;
- academic results;
- grading information;
- enrolment or completion records;
- preferred courses or institutions;
- personal statements;
- statements of purpose;
- Genuine Student statements or similar supporting information;
- curriculum vitae or résumés;
- references or recommendation letters;
- explanations regarding education gaps; and
- English language test results, including IELTS, PTE Academic, TOEFL, Cambridge English, Duolingo English Test or other recognized English language assessments.
3.3 Employment and Professional Information
Where relevant, information may include:
- employment history;
- employer details;
- job titles;
- duties and responsibilities;
- remuneration or salary information;
- pay slips;
- employment contracts;
- professional qualifications;
- licenses;
- professional memberships;
- references; and
- evidence of professional experience.
3.4 Visa, Migration and Immigration Information
Depending on the services requested, we may collect information such as:
- current or previous visa information;
- immigration status;
- visa application history;
- previous visa refusals or cancellations;
- previous immigration decisions;
- travel history;
- residency information;
- immigration correspondence;
- Confirmation of Enrolment (CoE) information;
- Confirmation of Acceptance for Studies (CAS) information;
- UK immigration share codes, where applicable;
- visa grant notifications;
- application reference numbers or identifiers;
- sponsorship or nomination information;
- skills assessment documentation; and
- other information reasonably required for education, visa, migration, immigration or citizenship related services.
3.5 Financial Information
Where reasonably necessary for providing services, assessing eligibility, meeting education provider requirements or complying with applicable legal obligations, we may collect information including:
- bank statements;
- evidence of available funds;
- sponsor financial information;
- sponsorship letters;
- financial guarantees;
- employment or income evidence;
- business related information;
- property or asset documentation;
- tuition fee receipts;
- payment or transaction records; and
- other information reasonably relevant to demonstrating financial capacity.
We do not ordinarily request financial information unless it is reasonably relevant to the requested service or required by an education provider, government authority, insurer or other authorized Organisation.
3.6 Sensitive Information
Some services may require the collection or handling of sensitive information. Subject to applicable law, and where reasonably necessary for the requested service, this may include information relating to:
- health or medical conditions;
- disability or accessibility requirements;
- racial or ethnic origin;
- religious beliefs, where relevant;
- criminal history or character related matters;
- biometric information where required by relevant authorities;
- family or relationship information; and
- other sensitive information that may be reasonably required for education, migration, visa or related government processes.
Where required under applicable law, we generally seek to collect or otherwise process sensitive information with the individual's consent or another lawful basis.
3.7 Website and Technical Information
When you access or interact with our website or other digital platforms, certain technical information may be collected automatically by us or by service providers acting on our behalf. Depending on the technologies in use from time to time, this information may include:
- IP address;
- browser type and version;
- operating system;
- device type;
- approximate geographic location derived from technical information;
- referring website or source;
- pages viewed;
- links selected;
- interactions with online forms;
- session duration;
- dates and times of website access;
- cookie identifiers;
- analytics information;
- advertising attribution information; and
- other similar technical or usage information.
The information collected through our website may vary depending on browser settings, device configuration, cookies, user preferences and technologies used at the relevant time.
4. How We Collect Personal Information
We may collect personal information directly from you, from persons authorized by you, from organisations involved in providing requested services, or from other lawful sources, depending on the nature of your enquiry or the services requested.
Information may be collected directly when you:
- submit an online enquiry or contact form;
- complete a consultation, eligibility assessment or other questionnaire;
- book or attend an appointment;
- submit an education, visa or migration related application;
- provide documents or supporting information;
- communicate with us by email;
- contact us by telephone;
- communicate with us through WhatsApp or other messaging platforms;
- communicate through social media platforms;
- visit one of our offices;
- attend a seminar, webinar, exhibition or other event;
- register for IELTS, PTE or similar preparation services;
- enquire about OSHC, OVHC, travel insurance or related services;
- subscribe to newsletters or other communications; or
- otherwise choose to interact with Aptitude Migration.
Where reasonably necessary and lawful, information may also be obtained from third parties including:
- parents or guardians;
- spouses or partners;
- family members;
- financial sponsors;
- authorized representatives;
- referral partners;
- employers;
- schools;
- universities;
- colleges;
- education providers;
- government departments or agencies;
- immigration authorities;
- skills assessing authorities;
- English language testing organisations;
- insurers or health cover providers;
- accommodation providers;
- publicly available sources;
- service providers assisting in the delivery of requested services; or
- other persons or organisations authorized by you or otherwise permitted by applicable law.
Where personal information is provided to us by a third party, we generally expect that the third party has the authority or legal basis to provide that information to us. We may, where appropriate, take reasonable steps to verify that authority if circumstances reasonably require.
We are not responsible for the privacy practices of independent third parties from whom information is obtained or who receive information in connection with requested services. Such organisations remain responsible for complying with their own legal and regulatory obligations.
5. How and Why We Use Personal Information
Subject to applicable law, we may collect, hold, use and disclose personal information for purposes reasonably connected with our business activities, the services requested by you, or otherwise permitted or required by law.
Depending on the circumstances, personal information may be used to:
- respond to enquiries;
- arrange consultations or appointments;
- assess academic, professional or migration related information;
- better understand your education, career or migration objectives;
- assess potential eligibility for services or pathways;
- identify education providers, institutions or courses that may be suitable;
- prepare education related applications;
- submit applications to education providers where authorized;
- communicate with education providers regarding applications or enrolments;
- assist with scholarship enquiries or applications;
- facilitate offer, acceptance and enrolment processes;
- assist with student visa documentation;
- prepare Genuine Student related documentation or supporting material;
- facilitate Australian immigration assistance through appropriately authorized persons where required;
- assist with skills assessment matters;
- review or verify documents provided to us;
- identify information that may be incomplete, inconsistent or require clarification;
- facilitate OSHC, OVHC or travel insurance related services;
- provide IELTS, PTE or similar preparation services;
- arrange interviews, events or consultations;
- process payments or refunds;
- maintain business, client and administrative records;
- communicate updates relating to requested services;
- respond to enquiries, complaints or disputes;
- comply with contractual, legal, professional or regulatory obligations;
- assist in preventing, detecting or investigating suspected fraud, misuse, unlawful activity or document irregularities;
- improve our services, systems or website;
- undertake internal reporting, planning or business administration;
- perform analytics or statistical analysis using information that may be aggregated or de-identified where appropriate;
- measure the effectiveness of marketing or advertising activities;
- send newsletters, updates or marketing communications where permitted by applicable law;
- establish, exercise or defend legal rights; or
- for any other purpose reasonably related to the services requested, where permitted by applicable law.
Where practicable, we may use de-identified, anonymized or aggregated information for internal reporting, service improvement, statistical analysis or business planning. Such information is not intended to identify any individual.
We generally seek to use personal information only for purposes that are reasonably related to the purpose for which it was collected, where consent has been provided, or where another lawful basis exists under applicable law.
Nothing in this Privacy Policy limits our ability to use, disclose or retain information where such action is authorized, required or otherwise permitted by applicable law, a court order, regulatory requirement or other lawful authority.
The particular ways in which personal information is handled may vary depending on the services requested, the jurisdictions involved, applicable legal requirements and our operational practices from time to time.
6. Legal Basis for Processing
The lawful basis on which personal information is collected, used or otherwise processed may vary depending on the nature of the services requested, the individual concerned, the jurisdiction involved and the applicable law.
6.1 Australia
Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to our activities, we generally seek to handle personal information in a manner that is reasonably consistent with those requirements, taking into account the nature and scope of our business operations.
Nothing in this Privacy Policy should be interpreted as creating rights or obligations beyond those arising under applicable law.
6.2 United Kingdom and European Union
Where the UK GDPR, EU GDPR or other comparable privacy legislation applies to a particular processing activity, personal information may be processed on one or more lawful grounds available under the applicable legislation, including where appropriate:
- consent;
- taking steps at an individual's request before entering into a contract;
- performance of a contract;
- compliance with a legal obligation;
- legitimate interests, where available under applicable law and appropriately balanced against the rights and interests of the individual;
- protection of vital interests in limited circumstances; or
- any other lawful basis recognized under applicable legislation.
Where sensitive, special category or criminal record information is processed, additional legal requirements or safeguards may apply depending on the relevant jurisdiction and circumstances.
The applicable lawful basis may differ between individuals and services and may change where permitted by law.
8. International Data Transfers
Aptitude Migration provides education, admissions, migration and related services across multiple jurisdictions. Personal information may therefore be transferred to, accessed from or processed in a country other than the country in which it was collected where this is reasonably necessary to provide the requested service, operate our business or comply with law.
Depending on the matter, overseas recipients may be located in Australia, the United Kingdom, countries in the European Union or European Economic Area, New Zealand, Canada, the United States, Pakistan, the United Arab Emirates, or another country in which an education provider, government authority, assessment body, insurer, service provider or other relevant recipient is located.
Where applicable privacy law requires safeguards for an international transfer, we use an appropriate mechanism available under that law. This may include contractual protections, an adequacy or comparable-protection mechanism, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, informed authorisation where legally permitted, or another lawful transfer mechanism.
International transfers may involve countries whose privacy laws differ from those of Australia or the country where an individual is located. We do not rely on this Privacy Policy alone as consent to an international transfer where the applicable law requires a separate consent, authorisation, notice or safeguard.
Further information about jurisdiction-specific transfer requirements is set out in Section 13 below. Where a person is entitled by law to information about the safeguards used for a particular transfer, they may contact us at info@aptitudemigration.com.au.
9. Data Security
We recognize the importance of protecting personal information and generally seek to implement administrative, organizational and technical measures that we consider reasonable and appropriate, having regard to the nature of the information held, the services provided, and the size and operational requirements of our business.
The security measures adopted by us may vary over time and may include, where appropriate:
- access controls based on operational requirements;
- password protected systems or accounts;
- secure cloud based or hosted services;
- encryption or secure transmission technologies where available and appropriate;
- multi factor authentication where implemented;
- confidentiality obligations applicable to employees, contractors or service providers;
- document access controls;
- backup or recovery processes;
- system monitoring or security reviews; and
- other measures considered appropriate in the circumstances.
No method of transmitting information over the internet, electronic storage system or security technology can be guaranteed to be completely secure or error free. Accordingly, while we generally seek to protect personal information using measures we consider appropriate, we do not warrant or guarantee the absolute security, availability or integrity of any information, system or transmission.
Individuals are also responsible for taking reasonable steps to protect their own devices, passwords and account credentials where applicable.
The particular security measures implemented may change from time to time without notice as technologies, operational requirements and legal obligations evolve.
10. Data Breaches
We maintain procedures to identify, assess and respond to suspected or actual data security incidents involving personal information.
Where a security incident occurs, the steps taken by us will depend upon the nature and circumstances of the incident, the information involved, the applicable legal requirements and any practical operational considerations.
Where the Australian Notifiable Data Breaches scheme or another applicable law requires notification of an eligible data breach, we generally intend to comply with those legal obligations as they apply to our business.
Nothing in this Privacy Policy should be interpreted as guaranteeing that every security incident will be detected immediately, prevented entirely or result in notification where notification is not legally required.
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for a related lawful purpose, or as required or permitted by applicable law, professional obligations, contractual requirements or legitimate recordkeeping needs.
Our general retention schedule is set out below. A longer or shorter period may apply where required or permitted by law, where a regulator or professional obligation applies, where a matter remains active, where a complaint or dispute is unresolved, or where records are subject to a legal hold.
| Record category | General retention period / approach |
|---|---|
| Australian migration client files | 7 years after the last action on the client file where the Migration (Migration Agents Code of Conduct) Regulations 2021 apply. |
| Education, admissions and related client files | Generally 7 years after the matter is completed or the last substantive action, unless a different period is required by law, contract, an education provider arrangement or a continuing complaint, commission, audit or legal issue. |
| Enquiries that do not become client matters | Generally up to 24 months after the last meaningful contact, after which the information is deleted or de-identified unless a lawful reason requires further retention. If the person separately remains subscribed to marketing, limited marketing information may be retained under the marketing rule below. |
| Financial, accounting and transaction records | Generally 7 years from the relevant transaction or financial year, or longer where an applicable tax, corporations, audit or other law requires it. |
| Marketing consent, preferences and contact records | For as long as marketing is lawfully sent and the information remains reasonably necessary. If a person withdraws consent or opts out, we retain only the minimum suppression information needed to respect the opt-out or another lawful purpose. |
| Privacy requests, complaints and disputes | For the time reasonably necessary to deal with the request, complaint or dispute and generally for up to 7 years after closure where needed for accountability, legal claims or regulatory purposes. |
| Legal holds, investigations and regulatory matters | For the duration of the hold, investigation or regulatory requirement and for any additional period required or permitted by law. |
| System backups and recovery copies | Until overwritten or deleted through the normal backup and disaster-recovery cycle. Information retained only in backup media is not used for ordinary business purposes and remains protected against inappropriate access or use. |
When information is no longer required, we take reasonable steps to securely destroy or de-identify it. A request for deletion does not override a legal, professional or regulatory requirement to retain a record. If we cannot fulfil a deletion request, we will explain the reason where required by applicable law.
12. Marketing Communications
We send marketing communications only where permitted by applicable law and obtain consent where required.
You may unsubscribe at any time using the unsubscribe facility or opt-out instructions in our messages, or by emailing info@aptitudemigration.com.au.
Where processing relies on consent, you may withdraw that consent at any time, free of charge, by contacting us. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing carried out before withdrawal.
We may continue processing where a separate lawful basis applies, including necessary service communications or legally required recordkeeping. If withdrawal affects our ability to provide a requested service, we explain this to you.
Unsubscribing from marketing does not prevent necessary communications concerning an active application, appointment, payment or service. We may retain minimal suppression information to respect your marketing preferences.
12A Your Privacy Rights
Depending on the law applicable to you and our processing of your personal information, you may have rights to request access to or correction of personal information and may have additional rights such as erasure, restriction of processing, objection to processing, data portability and withdrawal of consent.
The availability and scope of these rights depend on the applicable law, the nature of the processing and the lawful basis relied upon. Rights may be subject to lawful exceptions, including professional and statutory recordkeeping obligations and the establishment, exercise or defence of legal claims.
To exercise a privacy right, contact us at info@aptitudemigration.com.au. You do not need to use particular legal terminology or a prescribed form unless applicable law requires otherwise. We may request proportionate information to verify your identity, authority or the scope of your request.
We respond within the period required by the privacy law applicable to the request. Where a lawful extension, fee, limitation or refusal applies, we will explain this and advise you of available complaint options where required.
Additional rights and regulator information for particular jurisdictions are set out in Section 13.
12B Automated Processing, Artificial Intelligence and Profiling
We may use software, algorithms and artificial intelligence-assisted tools to support administrative processing, document review, course searching and matching, workflow management, quality checks, communications and the identification of potential education or migration options.
These tools may assist our staff or generate recommendations, but Aptitude Migration does not make decisions about individuals based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects.
Where appropriate, outputs produced by automated or artificial intelligence-assisted systems are subject to meaningful human review. Australian immigration assistance and migration advice are provided or reviewed by an appropriately authorised person, including a registered migration agent where required by Australian law. Education and admission matters are reviewed by the staff responsible for the relevant service.
Final admission, visa, immigration and other governmental decisions are made by the relevant education provider, government authority or other independent decision-maker under its own procedures. Any automated processing undertaken independently by those organisations is governed by their own privacy notices and applicable law.
If our use of automated decision-making materially changes, we will update this Privacy Policy and provide any additional notice, rights or safeguards required by applicable law before the relevant processing is undertaken where required.
12C Privacy Complaints
We take privacy complaints seriously. If you have concerns about our handling of your personal information, contact our Privacy Contact at info@aptitudemigration.com.au or write to:
Aptitude Migration Pty Ltd
Office #3, Level 1, 37 Queen Street
Auburn, New South Wales, Australia
Where UK data protection law applies, we provide a means for individuals to submit data protection complaints electronically, including by email to info@aptitudemigration.com.au. We will acknowledge a data protection complaint within 30 days of receipt and will take appropriate steps, without undue delay, to investigate and respond to the complaint and keep the complainant appropriately informed, as required by applicable UK law. For complaints governed by another jurisdiction, we will respond within the timeframe required by the applicable law.
13. Country and Jurisdiction-Specific Privacy Provisions
The provisions below supplement the rest of this Privacy Policy. They apply only to the extent that the identified law applies to Aptitude Migration, the individual or the relevant processing activity. If a jurisdiction-specific provision conflicts with a mandatory requirement of applicable law, the mandatory legal requirement prevails.
13.1 Clients in Australia and Australian Privacy Law
Aptitude Migration Pty Ltd is an Australian company and provides services to clients who are located in Australia as well as clients overseas. Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply, we handle personal information in accordance with those requirements.
Australian privacy requirements may apply to the collection, use, disclosure, security, access, correction and overseas disclosure of personal information. We take reasonable steps to ensure the personal information we hold is protected from misuse, interference and loss and from unauthorised access, modification or disclosure.
You may request access to personal information we hold about you and may request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading, subject to applicable exceptions. We do not charge for making an access or correction request. A reasonable, non-excessive charge may apply to providing access where permitted by law, and we will give advance notice where applicable.
Where we disclose personal information from Australia to an overseas recipient and APP 8 applies, we take the steps required by Australian law before the disclosure, subject to applicable exceptions. Depending on your matter, overseas recipients may include education providers, government authorities, assessment bodies, insurers, technology providers, related operations and other service providers.
Where the Notifiable Data Breaches scheme applies and an eligible data breach occurs, we will comply with applicable assessment and notification obligations.
For matters within the Australian privacy regulator's jurisdiction, you may contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/privacy/privacy-complaints
13.2 Australian Migration Services and Registered Migration Agents
Where Aptitude Migration provides Australian immigration assistance through a registered migration agent, additional duties apply under the Migration Act 1958 and the Migration (Migration Agents Code of Conduct) Regulations 2021, as amended from time to time.
A registered migration agent must create and maintain a client file for the relevant migration matter and must keep records required by the Code of Conduct. Depending on the matter, the client file may include copies of applications and immigration matters, service agreements and variations, written communications, contemporaneous records of relevant oral communications, invoices and receipts, personal documents and evidence concerning the safe return of original documents.
Where the Code of Conduct applies, we take all reasonable steps to ensure that the migration client file is kept for 7 years after the last action on the file for the relevant client.
Client documents are kept securely and migration client information is subject to applicable confidentiality obligations. Personal information may nevertheless be disclosed where required or authorised by law, including where the Office of the Migration Agents Registration Authority is lawfully entitled to access a client file for the performance of its functions.
Migration matters may require us to collect and handle identity documents, passport and visa information, immigration history, family and relationship information, education and employment records, financial information, health information, character or police information and other material relevant to the immigration matter. The privacy rights in this Policy continue to apply, subject to any overriding legal or professional obligation requiring a record to be retained or disclosed.
13.3 United Kingdom
Where the UK GDPR, the Data Protection Act 2018 or other applicable United Kingdom data protection legislation applies to our processing, including as amended by the Data (Use and Access) Act 2025 where relevant, we process personal data on an available lawful basis described in Section 6 and provide the transparency information required by applicable law.
Subject to applicable conditions and exemptions, individuals may have the right to:
- be informed about the collection and use of their personal data;
- access their personal data;
- have inaccurate personal data rectified and incomplete data completed;
- request erasure in circumstances where the right applies;
- request restriction of processing in circumstances where the right applies;
- object to processing in circumstances where the right applies, including an absolute right to object to direct marketing;
- receive eligible personal data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
- exercise applicable rights relating to automated decision-making and profiling.
We do not currently make solely automated decisions about individuals that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by applicable UK law.
Where a transfer of personal data from the United Kingdom is a restricted transfer under UK data protection law, we use an applicable transfer mechanism where required, which may include UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful mechanism.
Where UK data protection law applies, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/
13.4 European Union and European Economic Area
Where the EU General Data Protection Regulation (EU GDPR) applies, we process personal data on an available lawful basis described in Section 6 and comply with the transparency requirements applicable to the relevant processing.
Subject to applicable conditions and exemptions, individuals may have rights to access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and rights relating to qualifying automated decision-making and profiling.
Where personal data subject to the EU GDPR is transferred internationally and Chapter V of the EU GDPR applies, we use an applicable mechanism such as an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism. Where required, we will provide information about the applicable safeguard or how to obtain a copy.
You may have the right to lodge a complaint with the data protection supervisory authority in the EU or EEA country where you live, where you work, or where you consider an infringement to have occurred. Where the EU GDPR requires us to appoint an EU representative, the representative's details will be made available through an appropriate privacy notice or our website.
13.5 Switzerland
Where the Swiss Federal Act on Data Protection (FADP) applies, we handle personal data in accordance with the applicable Swiss requirements, including applicable transparency, security, access and cross-border disclosure obligations. International disclosures are made using an available lawful mechanism where required. Individuals may exercise rights available under applicable Swiss law and may contact the Federal Data Protection and Information Commissioner (FDPIC) where appropriate: https://www.edoeb.admin.ch/
13.6 New Zealand
Where the New Zealand Privacy Act 2020 applies, we handle personal information consistently with the Information Privacy Principles (IPPs), subject to applicable exceptions.
If we collect personal information directly from an individual, the applicable collection-notice requirements apply. If we collect personal information indirectly from another person or organisation and IPP 3A applies, we take reasonable steps to notify the individual of the indirect collection and the matters required by law as soon as reasonably practicable, unless an exception applies. IPP 3A applies to relevant indirect collections from 1 May 2026.
Individuals may request access to and correction of their personal information, subject to applicable exceptions. Where IPP 12 applies to a disclosure outside New Zealand, we use a permitted basis for the overseas disclosure, which may include comparable legal protections, contractual safeguards, another permitted basis, or informed authorisation where the recipient may not be required to provide comparable safeguards.
Where a privacy breach is notifiable under New Zealand law, we will comply with the applicable notification obligations. Complaints may be made to the Office of the Privacy Commissioner New Zealand: https://www.privacy.org.nz/your-rights/how-to-complain/
13.7 Canada
Where Canadian private-sector privacy law applies, including the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable substantially similar provincial legislation, we apply the requirements relevant to the particular processing activity and province.
These requirements may include accountability, meaningful consent where required, limiting collection to appropriate purposes, limiting use, disclosure and retention, maintaining safeguards, openness and providing individuals with access to and an opportunity to correct personal information, subject to applicable exceptions.
Personal information relating to Canadian individuals may be transferred to or processed in Australia or another jurisdiction relevant to the requested service. While information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access by courts, law-enforcement or government authorities. We remain responsible for personal information transferred to a service provider for processing to the extent required by applicable Canadian law.
Where federal PIPEDA applies, concerns may be raised with the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/report-a-concern/
13.8 United States
The United States has federal sector-specific privacy laws and a growing number of state privacy laws. Where a United States federal or state privacy law applies to Aptitude Migration and the relevant processing, we provide the rights and notices required by that law.
Depending on the applicable state law and whether statutory thresholds are met, rights may include the right to know or access personal information, correct inaccuracies, request deletion, obtain a portable copy, opt out of certain sales or sharing, targeted advertising or qualifying profiling or automated decision-making, limit certain uses of sensitive personal information, appeal a rights-request decision, and exercise rights without unlawful discrimination or retaliation.
We do not sell personal information as part of our ordinary business operations. If our practices change in a way that creates a statutory sale, sharing, targeted advertising or other opt-out right under an applicable United States law, we will provide the notices and opt-out mechanism required by that law.
For California residents, where the California Consumer Privacy Act (CCPA), as amended, applies to Aptitude Migration, applicable rights may include rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and exercise applicable rights concerning automated decision-making technology. These rights apply only where the CCPA applies to us and to the relevant processing.
13.9 Other Jurisdictions
We provide services involving countries beyond those listed above. Where another privacy or data protection law applies to our handling of personal information, we will comply with the mandatory requirements of that law to the extent applicable. The rights available to an individual may therefore vary depending on location, the service requested and the legal relationship between the parties.
15. Children and Applicants Under 18
Some of our education related services may involve individuals who are under 18 years of age.
Depending on the circumstances, and where considered appropriate or required by applicable law, personal information relating to a minor may be collected from:
- the individual;
- a parent or legal guardian;
- an authorized representative;
- an education provider; or
- another person who is authorized or permitted to provide the relevant information.
Where reasonably appropriate, we may take steps that we consider suitable to verify the authority of a parent, guardian or authorized representative.
Where consent is required under applicable law, we generally seek to obtain consent from the person authorized to provide it.
The manner in which information relating to minors is collected, used or disclosed will depend upon the particular circumstances, the requested services and the applicable legal requirements.
Nothing in this Privacy Policy should be interpreted as creating an obligation to independently verify the identity, authority or legal capacity of every person providing information on behalf of a minor.
16. Third Party Websites and Services
Our website, communications or services may include links to, integrate with, or otherwise refer to third party websites, applications, platforms or services, including those operated by universities, government agencies, insurers, education providers, testing organisations, social media platforms or other independent organisations.
These third-party services operate independently of Aptitude Migration. Except where required by applicable law, we do not control, monitor or accept responsibility for:
- the privacy practices of third parties;
- the content of third-party websites;
- the availability of third-party services;
- the security of third-party systems; or
- the collection, use or disclosure of information by independent third parties.
Individuals should review the applicable privacy policies, terms and conditions and other relevant documents published by those third parties before providing personal information directly to them or using their services.
The inclusion of a link, reference or integration does not necessarily constitute an endorsement, recommendation or representation regarding any third-party Organisation, product or service.
17. Changes to This Privacy Policy
We may amend, replace or update this Privacy Policy at any time to reflect changes including, but not limited to:
- our business operations;
- services;
- technology;
- internal systems;
- service providers;
- legal or regulatory requirements;
- industry practices; or
- operational considerations.
The most recent version of this Privacy Policy may be made available through our website or by other appropriate means.
Unless otherwise required by applicable law, any revised Privacy Policy will take effect from the date it is published or otherwise made available.
Continued use of our website or services after an updated Privacy Policy becomes effective may constitute acknowledgement of the revised Privacy Policy to the extent permitted by applicable law.
Where applicable law requires a different notification process or additional consent before changes become effective, we will generally seek to comply with those legal requirements.
18. General Provisions
This Privacy Policy is intended to provide a general description of Aptitude Migration's privacy practices and should be read together with any applicable client agreement, service agreement, engagement terms, consent form or other documentation provided in connection with particular services.
Nothing contained in this Privacy Policy is intended to:
- create contractual rights or obligations beyond those imposed by applicable law;
- limit any rights, protections or remedies available to Aptitude Migration under applicable law;
- waive any legal privilege, defense or immunity available to Aptitude Migration or its directors, officers, employees, contractors or representatives; or
- prevent Aptitude Migration from complying with any applicable law, court order, regulatory requirement or lawful direction.
To the extent permitted by applicable law, if any provision of this Privacy Policy is found to be invalid, unlawful or unenforceable, the remaining provisions will continue to operate.
This Privacy Policy should not be interpreted as guaranteeing uninterrupted services, absolute data security, specific technical standards or any particular operational procedure unless expressly required by applicable law.
© 2026 Aptitude Migration Pty Ltd. All rights reserved.
Privacy & Cookie Policy — Aptitude Migration