Privacy statement

This privacy statement complies with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and with the applicable Belgian data protection legislation.

For readability, we use the masculine form for terms designating people. In the interests of equality, these terms apply to all genders.

Are you covered by this statement?

This statement applies to you if you are:

• one of our clients or in a contractual relationship with us;
• accompanying one of our clients;
• interested in our products or services and provide us with your personal data (for example via our website, our applications, our agencies, our events or our contact forms).

If you provide us with the personal data of other people (e.g. family members, accompanying minors), you must inform them of this disclosure and recommend that they read this statement. We endeavour to do so directly when we have their contact details.

1. How can you control our processing of your personal data?

You have the following GDPR rights: access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent where processing is based on it.

To exercise these rights, contact us:

By e-mail: info@move-and-study.com
By post: MOVE & STUDY BELGIQUE – Residence Palace, 155 rue de la Loi, 1040 Brussels

We will reply within one month (extendable by two months in complex cases).

You may request the portability of your data (a structured, commonly used and machine-readable copy, transferable to a third party where technically possible).

For any question: info@move-and-study.com.

2. Complaint to the Data Protection Authority

You may lodge a complaint with the competent supervisory authority:

Data Protection Authority (APD)
Rue de la Presse 35, 1000 Brussels
Tel.: +32 (0)2 274 48 00
E-mail: contact@apd-gba.be
Site: www.autoriteprotectiondonnees.be

3. Purposes and legal bases of the processing

We process your personal data mainly for:

Performance of the contract (art. 6.1.b GDPR) or pre-contractual measures:

• Client registration, conclusion and performance of the contract (language course abroad, exchange programme, etc.);
• Provision of the services (school/accommodation/transport bookings, on-site assistance, invoicing, debt recovery);
• Handling of requests, communications, client support;
• Access to digital platforms;
• Access control/security during agency visits.

Legitimate interest (art. 6.1.f GDPR) – after balancing against your rights:

• Improvement of our services/products and cybersecurity;
• Management and maintenance of IT systems;
• Automation and optimisation of processes (e.g. request tracking, client satisfaction);
• Defence of rights in court or management of disputes;
• Organisation of competitions, promotions, satisfaction surveys (unless you object);
• Direct marketing for offers similar/complementary to your previous services (opt-out possible at any time).

Consent (art. 6.1.a GDPR) – revocable at any time:

• Sending marketing offers that are not similar, or partner offers;
• Advanced profiling for personalised offers;
• Transfer of sensitive data to third parties (e.g. foreign schools) where not covered by the contract.

4. Categories of data collected

• Contact details (name, address, e-mail, telephone);
• Identification data (date of birth, nationality, passport, sex);
• Travel data (dates, destinations, accommodation, carriers, specific requests, companions);
• Health data (specific needs, allergies, etc. – sensitive data);
• Financial data (payments, bank card – processed via secure providers);
• Technical data (IP, device, connection logs);
• Lifestyle/interests (if provided for personalisation).

5. Sources of collection

Mainly directly from you. Sometimes:

• Clients (e.g. information about accompanying persons);
• Partners (schools, accommodation providers, carriers);
• Public sources (official registers, public social networks where relevant).

6. Recipients of the data

• Providers for the stay (schools, hotels, airlines, transfers, guides);
• Processors (IT, payment, marketing, logistics);
• Lawyers, insurers, auditors (where necessary);
• Authorities (e.g. embassies for visas, legal obligations);
• Marketing/survey partners (with consent or opt-out).

7. International transfers

Transfers outside the EEA may take place (e.g. United States, destination countries).

• If the country is adequate (EU Commission decision) → direct transfer.
• Otherwise: EU standard contractual clauses (SCC), EU-US Data Privacy Framework (DPF – certified where applicable), or contractual derogation (e.g. performance of the contract).

For the United States: some providers (Google, Meta, etc.) may be DPF-certified. We use appropriate safeguards. Contact us for copies of the documents.

8. Retention period

Your data is kept for as long as necessary for the contract + legal obligations (e.g. accounting 7-10 years, evidence in disputes), then deleted or anonymised.

9. Data security

Technical/organisational measures (256-bit SSL/TLS encryption on the site, access controls, etc.). Transmission over the internet carries inherent risks.

10. Cookies and tracking technologies

We use cookies and technologies (Google Analytics, Google Ads, Facebook Pixel, etc.) for operation, statistics, personalisation and advertising.

Granular consent is required via a banner (except for essential cookies).

Details in our cookie policy (separate link on the site).

Google Fonts, Google Maps, YouTube, etc.: see Google's policies.

11. Live chat and other tools

Tawk.to for chat (see their GDPR policy).

Social network plug-ins: activated on click (responsibility of the platform thereafter).

12. Updates

We review this statement regularly. The current version is on our site. We will inform you of major changes.

Data controller

MOVE & STUDY BELGIQUE (SPRL)
Residence Palace, 155 rue de la Loi, 1040 Brussels
Privacy contact: info@move-and-study.com