Data Processing Terms

These Data Processing Terms (“DPA”) apply where GLLS Teleporto Technologies LTD (“Univenter”) processes personal data on behalf of a business customer, a Partner or an Institution (the “Customer”), as its processor under Article 28 of the EU General Data Protection Regulation (“GDPR”). They form part of the Customer’s agreement with Univenter: for Partners, the Univenter Partner Agreement; for Institutions, their signed agreement. If that agreement contains its own data processing terms, those prevail.

1. When Univenter is a processor and when it is a controller

The DPA covers only processing that Univenter carries out on the Customer’s instructions. It does not cover processing that Univenter carries out as an independent controller, which our Privacy Policy describes.

• Partners. Univenter is the Partner’s processor when it stores student records and documents in the Partner account before that student’s first application, prepares and stores programme proposals for the Partner, and runs AI matching, drafting and messages to a student at the Partner’s request. Once an application is sent, Univenter also uses the student’s data as an independent controller, to pass it to the Institution, record progress, attribute the student, prevent fraud and pay rewards.
• Institutions. Each Institution is an independent controller of applications from the moment it receives them. Univenter is the Institution’s processor for data the Institution itself adds to the platform for its own purposes, such as its staff accounts, internal notes, documents it issues, templates and messages, to the extent Univenter does not use that data for its own purposes.

2. Details of the processing

Subject matter and duration	Provision of the Univenter platform for the term of the Customer’s agreement and until deletion under Section 9.
Nature and purpose	Hosting, storage, organisation, retrieval, transmission at the Customer’s request, AI-assisted matching and drafting, and deletion, to provide the platform functions the Customer uses.
Data subjects	Students and prospective students, their parents, guardians and sponsors; the Customer’s staff and team members.
Personal data	Identity and passport data, contact details, date of birth, nationality, education history, language certificates, uploaded documents, messages and notes. Where an Institution or visa process requires it: health information and police certificates.

3. Instructions

Univenter processes the personal data only on the Customer’s documented instructions. The Customer’s agreement, these terms and the Customer’s use and settings of platform functions are its complete instructions. Univenter tells the Customer if it believes an instruction breaks data protection law, and processes the data otherwise only where EU or Member State law requires it, telling the Customer first unless that law forbids it.

4. Confidentiality

Everyone at Univenter who is authorised to process the personal data is bound by a duty of confidentiality.

5. Security

Univenter maintains technical and organisational measures appropriate to the risk, including at least:

• encryption of data in transit and at rest;
• role-based staff access on a least-privilege basis, with multi-factor authentication;
• separation of each Customer’s data through access controls in the database;
• access logs and an audit log of significant actions;
• regular backups;
• limits on repeated failed sign-in attempts and two-factor authentication for users;
• a documented procedure for handling security incidents.

Univenter may update these measures as long as the overall level of protection does not decrease.

6. Sub-processors

The Customer authorises Univenter to use the sub-processors listed in Section 7 of our Privacy Policy. Univenter gives at least 14 days’ notice of a new sub-processor on the platform or by email. During that period the Customer may object on reasonable data protection grounds by writing to info@univenter.me with the subject “Data protection”. If the objection is not resolved within 30 days, the Customer may stop using the affected function or end its agreement without penalty. Univenter imposes data protection terms on each sub-processor that are at least as protective as these terms and remains responsible to the Customer for them. Univenter does not allow AI providers to use the Customer’s personal data to train their general models.

7. International transfers

Where Univenter or a sub-processor transfers the personal data outside the European Economic Area to a country without an EU adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or another safeguard the GDPR allows.

8. Assistance and breaches

• Univenter helps the Customer, through platform functions where possible, to answer requests from data subjects. The platform lets Partners view, correct and delete their student records.
• Univenter forwards to the Customer, within 5 business days, any request from a data subject that concerns the Customer’s processing.
• Univenter notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of a personal data breach affecting the data it processes for the Customer, with the information the Customer needs to meet its own obligations.
• Univenter provides reasonable help with data protection impact assessments and consultations with supervisory authorities, to the extent it has the information.

9. Deletion

Within 90 days after the Customer’s account is closed, Univenter deletes the personal data it holds only as the Customer’s processor, unless the law requires it to keep the data. Before closing its account, the Customer may ask us for a copy of its data. Data that Univenter holds as an independent controller is kept as described in the Privacy Policy.

10. Audits

Univenter makes available the information reasonably needed to show compliance with these terms and first answers the Customer’s written questionnaires. If those answers are not enough, the Customer may have an independent auditor, bound by confidentiality, carry out an audit once in any 12 months, on 30 days’ notice, during business hours and at the Customer’s own cost.

11. The Customer’s responsibilities

The Customer is responsible for having a lawful basis for the personal data it uploads, for giving data subjects the information the law requires (for Partners, including the Student Disclosure), for obtaining parental consent for students under 18 where required, and for uploading special category data only where an Institution or visa process requires it.

12. Supervisory authority and law

The lead supervisory authority for Univenter is the Commissioner for Personal Data Protection, Cyprus. These terms are governed by the law of the Republic of Cyprus, and disputes are resolved as the Customer’s agreement provides.

13. Contact

Data protection questions: info@univenter.me, subject “Data protection”.

GLLS Teleporto Technologies LTD
Peiraios 30, 1st floor, Flat/Office 1, Strovolos 2023, Nicosia, Cyprus
Email: info@univenter.me
Phone / WhatsApp: +44 7458 164888

---

GLLS Teleporto Technologies LTD, incorporated under the laws of the Republic of Cyprus · Organization number 623549 · Record number 35690886 · Registration number HE 448695 · Peiraios 30, 1st floor, Flat/Office 1, Strovolos 2023, Nicosia, Cyprus