MEGAPOLIS Privacy Policy

1. About this Policy MEGAPOLIS is an Australian education agency operated by Valentin Sibakov as a sole trader, ABN 79 223 361 238, in Melbourne, Victoria. This Policy explains how MEGAPOLIS collects, uses, stores and discloses personal information while providing education consulting and application support services. MEGAPOLIS handles personal information in accordance with applicable Australian law and this Policy. MEGAPOLIS does not provide migration advice and does not make enrolment or visa decisions. 2. Information we collect Contact details: name, country of residence, email address, phone number and preferred contact method. Education profile: education, work experience, English level, areas of interest, budget, preferred city and intended intake. Application information: academic records, evidence of English proficiency, identity documents and other documents genuinely required by the selected education provider or application platform. Interaction records: enquiries, consents, consultations, application status, next actions and the enquiry source or representative. * Technical data: IP address, device type, security logs, cookies and information about use of the website or online forms. We request sensitive information, such as health or disability information, only when it is necessary for a specific education-related purpose and with express consent or another lawful basis. 3. How we collect and use information We may collect information directly from a client through the website, forms, email, phone or consultations; from an authorised representative with the client's consent; or from an education provider or another party when needed to manage an application. We use information to respond to enquiries, assess education options, arrange consultations, prepare and support applications, communicate with education providers, maintain required business records, protect our services and improve client support. 4. Consent and marketing When information is collected, we explain the main purpose and any material disclosures. Consent to education support does not automatically include consent to marketing. Marketing messages are sent only where there is an appropriate basis, identify the sender and provide a way to opt out. 5. Who we may disclose information to We may disclose only the information needed to selected education providers; authorised representatives; organisations that help us provide and protect our services; professional advisers; regulators; or government authorities where required by law. MEGAPOLIS does not sell personal information. Disclosure for a new purpose occurs only with the client's consent or where permitted or required by law. 6. Overseas disclosure The main systems in which MEGAPOLIS stores personal information are located in Australia. Some technology providers (for example, notification and website delivery services) may process information in other countries, including the United States and countries in Europe and Asia. Information may also be sent to a client and their representative in their country of residence where needed to provide the services. Where practicable, MEGAPOLIS explains overseas disclosure when collecting the information or before disclosure and takes reasonable steps to support appropriate handling of the information. 7. Storage, security and retention We use reasonable organisational and technical measures to protect personal information from loss, misuse, unauthorised access, modification or disclosure. Access is limited to people who need it for the work. Information is kept only for as long as needed to provide services, manage an application, meet contractual and legal obligations, and resolve disputes. When information is no longer needed, it is securely deleted or de-identified unless a law or contract requires longer retention. 8. Access, correction, deletion and complaints A client may request access to, correction of or deletion of their information, or make a complaint about how it has been handled. To protect the information, MEGAPOLIS may ask the client to verify their identity. We usually respond within 30 days. Deletion may be limited by mandatory retention periods or the need to protect lawful claims. If the issue is not resolved, the client may contact the Office of the Australian Information Commissioner (OAIC) where its jurisdiction applies. 9. Data breaches If a data breach or unauthorised access is suspected, MEGAPOLIS contains the incident, assesses the risk, documents the decision and notifies affected individuals and the OAIC where required by law. 10. Clients under 18 If a client is under 18, MEGAPOLIS may require the involvement and consent of a parent or legal guardian, taking into account the client's age, the nature of the information and the education provider's requirements. 11. Contact and changes Privacy questions, requests and complaints: info@megapolis.au. This Policy may be updated when the law, our services or the systems we use change. The current approved version will be published on the MEGAPOLIS website. Material changes will be communicated in a reasonable manner.