Privacy Statement

PRIVACY POLICY OF DFAVO AS

When you use our services, register your interest in our services and visit our web page at https://dfavo.com, we process your personal data.

In this privacy policy you will find information about the processing of your personal data and what rights you have in relation to the processing of your data.

Dfavo AS is the controller for the processing of your personal data. Our contact information is:

Address: Oslo Science Park, Gaustadalléen 210349 Oslo, Norway

Email: [email protected]

Organization nr.: 925 402 168

If you have any questions concerning the processing of your personal data or your privacy, you may contact us using this information.

1. HOW DO WE PROCESS YOUR PERSONAL DATA AND WHY?

We collect and use your personal data for different purposes, depending on who you are and your interaction with us.

We collect personal data of users of our website, recruiters, and students that either use or wishes to use our
services. If you are a student and you have been recruited by a third party using the Dfavo Platform, we receive
your personal data from that third party.

In sections 1.1 to 1.4 we will explain how and why we process your personal data based on who you are.

1.1 RECRUITERS

If your sign up as a Recruiter and use our services, this table explain how and why we process your personal data.

Purpose	Description	Our legal basis
Set up a recruiter account so that we can communicate with you and identify you	We use your name, address, e-mail address and phone number to set up a personal recruiter account on our platform	GDPR Art. 6.1 b) Contractual obligation: the processing is necessary for the performance of our contract with you
Customize and optimize the service we provide by giving recruiters that work in a team an overview of the team’s effort	We share your contact information, performances, and conversion rate with recruiters in your team.	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in giving you high quality service
Customize and optimize the support we provide to you	We rate your performance as a recruiter so that we can give tailored customer service and support to you	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in giving you high quality service
To respond to legal requests and prevent harm	If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.	GDPR Art 6.1 c) Legal obligation

1.2 STUDENTS RECRUITED BY DFAVO

If your sign up as a Student and use our services, this table explain how and why we process your personal data.

Purpose	Description	Our legal basis
Create a user account in order to provide you our service	We collect your name, e-mail address, phone number, date of birth, gender, address, nationality in order to set up an account. If you choose to link your account with us to a third party account (such as your Google or Facebook or Whatsapp account), we use the information you allowed us to collect from those third parties to create a user account.	GDPR Art. 6.1 b) Contractual obligation: the processing is necessary for the performance of our contract with you
Prepare and secure your admission to your desired educational program	We use the information you upload to our platform to perform; (i) Document and verification screening, (ii) Financial due diligence, (iii) Application and admission to your desired educational Program, and (iv) Visa applications	GDPR Art. 6.1 b) Contractual obligation: the processing is necessary for the performance of our contract with you GDPR Art. 6.1 a) Explicit consent: when we collect a copy of your passport, this is based on your explicit consent.
To send you information about our services, products promotions, new features, etc. (marketing purposes)	We use your email and phone number to send you personalised emails and messages	GDPR Art 6.1 f) Legitimate interest: the processing is necessary based on our business interests in informing you about our service
To send you administrative information, such as changes to our terms and conditions, policies, etc.	We use your email and phone number to send you personalised emails and messages	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in informing you about our service
Deliver targeted advertising to you	We use your information to develop and display content and advertising (and work with third parties who do so) tailored to your interests and/or location and to measure its effectiveness.	GDPR Art. 6.1 b) Consent.
Request feedback to further develop, optimize and tailor the service we provide	We use your contact information to request feedback and to contact you about your use of our service	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in optimizing and tailoring the service to our customers
To respond to legal requests and prevent harm	If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.	GDPR Art 6.1 c) Legal obligation
Analyse your behaviour on the platform in order to identify user trends, determine the effectiveness of our promotional campaigns and improve and evaluate our service	Collect metadata.	GDPR Art. 6.1 a) Consent. Please see separate cookie policy

1.3 VISITORS OF DFAVO’S PAGE

If you are a user of our website or register your interest in our services at our website, this table explain how and
why we process your personal data.

Purpose

Description

Our legal basis

To give you tailored information about our services and products by setting up a call, meeting or sending you a personalized e-mail

When you are interested in our service and products, we collect your contact information
(such as name, phone number and email). We use this information to set up a call, meeting or send
you an email

GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business
interests in informing you about our service

GDPR Art 6.1 a) when required under applicable law marketing e-mail will be based on your consent.

Analyse your behaviour on the website in order to identify user trends, determine the
effectiveness of our promotional campaigns and improve and evaluate our service

Metadata.

Please see our separate cookie policy for more information about how we use cookies. The cookie
policy is available [here]

GDPR Art. 6.1 a) consent.

1.4 STUDENTS RECRUITED BY RECRUITERS

If you are a student and you have been recruited by a third party (Recruiter) using the Dfavo Platform, this table
explains how and why we receive your personal data:

Purpose	Category of data	Source of data	Description	Legal Basis
Create a user account in order to provide you our service	Contact information, such as name, address, nationality, mobile number and e-mail address	The recruiter you have entered into an agreement with	Your recruiter has shared with us your contact information, in order to set up an account.	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in providing you our service and ensure your admission to your desired educational program
Prepare and secure your admission to your desired educational program	Contact information, visa applications, passport details.	The recruiter you have entered into an agreement with	We use the information your recruiter uploads to our platform to perform; (i) Document and verification screening, (ii) Financial due diligence, (iii) Application and admission to your desired educational Program, and (iv) Visa applications	GDPR Art. 6.1 f) Legitimate interest: the processing is necessary based on our business interests in providing you our service and ensure your admission to your desired educational program GDPR Art. 6.1 a) Explicit consent: when we collect a copy of your passport, this is based on your explicit consent
To send you information about the admission process (marketing purposes)	E-mail address	The recruiter you have entered into an agreement with	We use your e- mail address and send you a personalised email	GDPR Art. 6.1 a) Explicit Consent.

If you are a student recruited by Recruiters, Dfavo AS is a joint controller with the Recruiter when Dfavo process
personal data of a Student for the purpose of fulfilling the agreement between the Recruiter and Dfavo when Dfavo
processes personal data of a Student for the purpose of fulfilling Dfavo’s agreement with the Participating
Educational Institutions.

In an agreement on joint controllership pursuant to Article 26 GDPR, Dfavo and Recruiter have determined how the
respective tasks and responsibilities in the processing of personal data are structured and who fulfills which data
protection obligations. This includes securing the appropriate level of security, ensuring transparency about the
processing, how potential data protection incidents can be monitored. This also includes ensuring that reporting and
notification obligations are fulfilled.

You may contact Dfavo in accordance with the aforementioned agreement pursuant to Article 26 GDPR in order to
exercise your rights as a data subject.

2. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

Please refer to our separate cookie policy as regards our use of cookies and other tracking technologies.

3. HOW YOUR PERSONAL DATA IS SHARED WITH THIRD PARTIES

We do not share your personal information with third parties unless we have a legal basis for transferring the data.
This may be an agreement with you, or a legal obligation prescribed by law.

Dfavo AS uses processors to collect, store and analyze your personal data. A processor is a separate third party that
acts on behalf of us. We have entered into an agreement with these third parties to ensure that your rights are
protected and that the processing of your personal data is compliant with relevant data protection laws.

We share information with the following parties (*):

(*): Data processors

Google AdSense for the purpose of Advertising, Direct Marketing, and Lead Generation
PayPal for the purpose of Invoice and Billing
Stripe for the purpose of Invoice and Billing
Dfavo Study Portal Private Limited (*) Hosting

4. IS YOUR DATA TRANSFERRED OUTSIDE THE EU/EEA?

We may access your personal data or transfer your personal data to a country outside the EU/EEA.

We transfer data to our supplier Dfavo Study Portal Private Limited located in India. We transfer this data based on the
Standard Contractual Clauses adopted by the Commission, and we have implemented appropriate or suitable safeguards to
protect your rights and interests.

To obtain further information about the SCC applied to our transfer the SCC is available upon request.

Dfavo Study Portal Limited has engaged Digital Ocean located in USA as sub-processor relating to website hosting.
Digital Oceans data processing addendum (DPA) with SCC is available: DPA with SCC.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep and store your personal data as long as it is necessary to fulfil the purposes outlined in this privacy policy
unless otherwise required by law (such as legal obligations on tax, anti-money laundering or other legal requirements).

This means that we will delete or anonymize your personal data when the legal basis for the processing of that data is
consent and you withdraw your consent. We will delete or anonymize personal data that was collected on the grounds of
our legitimate interest when we no longer pursue those interest. If the personal data was collected because it was
necessary to fulfil a contract with you, we will delete or anonymize that data if the contract is terminated or all our
obligations under the contract is fulfilled.

If it is not possible to delete or anonymize your personal data (for example, because your personal information has been
stored in backup archives), we will securely store and isolate your personal data until deletion is possible.

No purpose in this policy will require us keeping your personal information for longer than 1 year past the termination
of the user’s account.

6. YOUR PRIVACY RIGHTS

When we process your personal data, you are given the status as a data subject. This gives you the right to:

request access and obtain a copy of your personal data
obtain rectification of inaccurate personal data concerning you
obtain erasure of your personal data
restrict the processing of your personal data
data portability if applicable
object to the processing of your personal data if the legal basis for the processing is our legitimate interests

You may find more information about these rights at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en

To exercise your rights, you may contact us using the details provided above. We will answer your request as soon as
possible, and no later than 30 days.

If you want to opt out of our email marketing or unsubscribe from our marketing email list, you may at any time click on
the unsubscribe link in the emails we send, change your preferences in your account settings through our website login
or contact us using the details provided above.

If we are relying on your consent to process your personal data, you have the right to withdraw your consent at any
time. Please note that this will not affect the lawfulness of the processing before the withdrawal.

Upon your request to terminate your account, we will deactivate or delete your account and personal data from our
databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with
any investigations, enforce our Terms of Use and/or comply with legal requirements.

7. COMPLAINTS

If you believe we are unlawfully processing your personal data, you may lodge a complaint to your local supervisory
authority.

You may find more information about your local supervisory authority and how to lodge a complaint at
https://edpb.europa.eu/about-edpb/about-edpb/members_en.

8. UPDATES TO THIS PRIVACY POLICY

We will update this policy if our services change or if it is necessary to stay compliant with relevant data protection
laws.

The updated version will be indicated by an updated “Revised” date and the updated version will be effective as soon as
it is accessible.

If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such
changes or by directly sending you a notification.

Dfavo