GESCO Website Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

“Controller”: means any natural or legal person, whether inside or outside Jordan, under whose custody Personal Data is held. For the purposes of this Privacy Policy, (GESCO) acts as the Controller in relation to the Personal Data it collects and holds in connection with the provision of its Services, unless otherwise stated.

“Processor”: means any natural or legal person responsible for processing Personal Data. This may include, where applicable, third-party service providers that process Personal Data in connection with services provided to the Company, such as IT, hosting, cloud storage, customer relationship management, or other service providers that process Personal Data on the Company’s behalf or in connection with the provision of their services.

“Recipient”: means any natural or legal person, whether inside or outside Jordan, to whom Personal Data is transferred or with whom such Personal Data is exchanged by the Company, depending on the Services requested. For the purposes of this Privacy Policy, Recipients may include universities, colleges, educational institutions, competent governmental or regulatory authorities, and other parties involved in providing the requested Services.

2. About Us

GESCO is a limited liability company registered in the Companies Control Department – Ministry of Industry, Trade & Supply, Jordan, under registration number (200193262) (hereinafter referred to as the “الشركة”).

GESCO is an educational consultancy that assists students in enrolling at universities abroad. Our head office is located at: Al Hijaz Towers, Office No. 305, 158 Mecca Street, Amman, Jordan. We also operate offices in London, Kuwait City, and Doha.

This website (hereinafter referred to as the “Website”) is specialized in providing educational consultancy and study-abroad information and support services, including information about universities, colleges, academic programs, study destinations, admission requirements, application procedures, and related educational opportunities (hereinafter referred to as the “الخدمات”).

3. About This Privacy Policy

Purpose: The Company, in the course of carrying out its business activities, processes personal data in various types of processing. Under Article (9) of the Jordanian Personal Data Protection Law No. (24) of 2023, the Company is required, before commencing the processing of Personal Data, to inform the Data Subject of certain information relating to such processing. Accordingly, this Policy aims to describe and inform the Data Subject how the Company collects, processes, uses, retains, protects, and shares his/her personal data when visiting, using, or adding documents to the Website or any services associated with it.

Conflicts: If there is a conflict between our Terms and Conditions and this Privacy Policy regarding the collection, use, processing, disclosure, or protection of your personal information, this Privacy Policy will apply to such matters, subject always to applicable data protection rules and regulations.

Policy changes and updates: This Policy may be amended or updated from time to time to reflect changes in our practices concerning the handling of personal data or changes in applicable law. Accordingly, we encourage you to read this Policy carefully and review it regularly to stay informed of any changes we may make in accordance with the terms of this Policy. Any amendments to this Policy will be published on our Website, and such amendments – unless material and changing the basis of processing or consent – shall become effective immediately upon publication on the Website, unless otherwise stated or required by applicable law.

4. Scope of Application

Personal Scope: This Policy applies to all natural persons who visit our Website or whose personal data is collected or processed by the Company in connection with the provision of its services or their interaction with the Company, including but not limited to, prospective and current students, parents and legal guardians, customers, and website visitors (hereinafter referred to as the “Data Subject”).

Material Scope: This Policy applies to all forms of Processing carried out in relation to the Personal Data of Data Subjects, including but not limited to, collection, use, processing, storage, and transfer of personal data carried out by or on behalf of the Company in connection with its Services and activities by any means, whether electronically or in physical form, in accordance with applicable data protection laws and regulations and professional standards.

5. Personal Data Processing Principles

The Company is committed to processing Personal Data in accordance with applicable data protection laws and regulations and the following principles:

Lawfulness and Transparency: The Company adheres to processing personal data lawfully, fairly, and transparently. Such processing will not take place before the data subject is provided with clear and accessible information regarding the collection and processing of their Personal Data, including the purposes and scope of such processing, in accordance with applicable laws and regulations.

Purpose Limitation: Personal data is collected by the Company for specific, clear, and legitimate purposes as set out in this Policy and shall not subsequently be processed in a manner incompatible with those purposes, unless otherwise permitted by applicable laws and regulations. Such purposes shall be clearly identified at the time the data is collected.

Data Minimization: The Company’s processing of personal data shall be adequate, relevant, and limited to what is necessary to achieve the purpose for which the data was collected.

Accuracy: The Company shall ensure that personal data is accurate and, where necessary, kept up to date. The Company shall take all reasonable steps to ensure that inaccurate data is corrected, deleted, or otherwise handled as required by applicable laws and regulations, without undue delay, taking into account the purposes for which the data is processed. Information collected or received, including its source, shall be accurately recorded.

Retention and Storage Period: Personal data shall be retained in a form that permits the identification of data subjects only for as long as necessary to fulfil the purposes for which it was collected, or for any longer period required or permitted under applicable laws and regulations. Upon expiry of the applicable retention period, Personal Data shall be deleted, destroyed, anonymized, or otherwise handled in accordance with applicable legal requirements, without prejudice to the Company’s legitimate rights and interests, to the extent permitted by applicable law, or its compliance with any applicable legal or regulatory obligations.

Confidentiality: Personal Data subject to Processing shall be treated as confidential, and the Company, as the Controller, and any Processor involved in the Processing shall maintain the confidentiality of such Personal Data in accordance with applicable data protection laws and regulations. The Company ensures its security and confidentiality, including protection against unauthorized or unlawful access or use, as well as accidental loss, damage, or destruction, through the implementation of appropriate technical, physical, and organizational measures.

Accountability: To implement the principle of accountability, the Company clearly assigns roles and responsibilities relating to the Processing of Personal Data and ensures that its authorized personnel understand their respective responsibilities. Any person who processes personal data in any manner on behalf of the Company shall comply with the principles and requirements of data protection and only within the scope of their authorization and in accordance with applicable legal requirements and the Company’s applicable policies and procedures.

6. What Personal Data We Collect – How We Collect Your Data

How we collect your data: We may collect personal data directly from you through our website, or other communication channels used in connection with our Services, or from a parent/legal guardian, university or educational institution, referee, sponsor, or service provider.

What personal data we collect: The personal data we collect depends on how you interact with us and the Services you request. The categories of personal data we may collect include, without limitation:

When You Contact Us:

When you contact us, request information about our Services, or submit an inquiry, we may collect your name, email address, telephone or WhatsApp number, preferred study destination, level of study you are interested in, and any other information you choose to provide in your message or communication with us.

When you become a client (when you use our Services):

If you engage us officially to provide our services, we may collect additional personal data necessary to provide the relevant services, including, where applicable:

Personal Data: information necessary to provide our educational consultancy and study-abroad services, including but not limited to, passport and identification documents, academic transcripts and certificates, English language test results, date of birth, nationality, where required for a university admission or visa application, and correspondence and communications between you and the Company, and any other Personal Data reasonably required to provide the Services you request.

Sensitive Personal Data: financial information and supporting evidence such as bank statements and sponsor letters, employment history where relevant, health, medical, physical, or disability-related information, and any other information that constitutes Sensitive Personal Data under applicable data protection laws. We will only collect and process Sensitive Personal Data where necessary and in accordance with applicable data protection laws and regulations.

Information collected automatically when you use the Website:

We may automatically collect certain technical and usage information, including your IP address, browser type, device information, pages visited, the website or source from which you accessed our Website, and information relating to your interaction with the Website.

7. Processing Activities and Map

The types of processing activities we carry out in relation to your Personal Data depend on how you interact with us and the Services you request, and may include, without limitation:

8. Legal Basis and Purpose of Processing

9. Who We Share Your Data With

Your personal data may be shared, only to the extent necessary and for the specified purposes, with the following parties where needed to provide the agreed services or comply with legal requirements:

• Universities and colleges to which you have asked us to submit applications, and their appointed admissions representatives.
• Embassies, consulates, and visa processing centers in the destination country.
• Accommodation providers, where you have asked us to arrange accommodation.
• English language testing bodies with which we register you for a test.
• Our offices in Jordan, the United Kingdom, Kuwait, and Qatar.
• Service providers that host our systems or handle our email services.
• Government authorities or competent authorities where disclosure is required by law or pursuant to an official order or request.

We will only disclose your personal data to the extent necessary and for the specified purpose, whether based on your consent, to perform a contract or provide a service you have requested, to comply with a legal obligation, or in other circumstances permitted by law.

We do not sell your personal data or share it with third parties for their own marketing purposes. We also take appropriate measures to maintain the confidentiality and security of your data and protect it against unauthorized access or disclosure.

10. Transfer of Data Outside the Kingdom

Providing our educational services and applying for study abroad may require us to transfer your personal data to one or more countries outside the Kingdom, including, depending on the study destination, the United Kingdom, European Union countries, Canada, Australia, the United States, Turkey, and others. As data protection laws and levels of protection may vary from one country to another, the Company is committed to implementing the necessary technical, organizational, and contractual measures to protect your data in accordance with applicable laws and internationally recognized professional standards. Your personal data will only be transferred outside the Kingdom where an adequate level of protection is available that is no less than the level of protection applicable in the Kingdom, or after obtaining your explicit consent to the transfer, following notification that an adequate level of protection is not available.

11. Data Security, Protection and Retention

The Company is committed to implementing appropriate technical, organizational, and administrative measures to protect your personal data against unauthorized access, use, disclosure, alteration, loss, or destruction, in accordance with applicable laws and regulations and relevant professional standards. Depending on the nature of the data, these measures include restricting access rights – including limiting access to a student file to the counsellor handling the application and staff who need access to perform their work – securing systems and databases, using appropriate technical safeguards, conducting backups, monitoring and periodic assessments, and taking appropriate action in the event of a suspected data breach or unauthorized access.

12. Data Retention and Storage

The Company retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or for as long as required by applicable laws and regulations or for legitimate purposes related to providing our services or protecting legal rights. Data is reviewed periodically to determine whether continued retention is necessary and is securely deleted or disposed of when the purpose for which it was collected has been fulfilled or there is no longer a legal or legitimate basis for retaining it.

In particular, copies of passports and identity documents will be deleted once the visa has been issued, unless their retention is required by law or for a legitimate purpose.

Personal data is stored in secure electronic or physical environments, as appropriate to the nature of the data, with appropriate measures in place to protect it and restrict access to authorized personnel only. Where third parties are engaged to store or process personal data, the Company will take appropriate measures to ensure that they provide the required level of protection.

13. Eligibility – Students Under 18

Some students we advise are under 18. Where this is the case, we require the consent of one of the student’s parents or legal guardian, or the consent of a judge upon the request of the Unit where this is required in the best interests of the student. We may share information with the parent or legal guardian as well as the student.

14. Rights of Data Subjects

We are committed to ensuring that data subjects are able to exercise their rights in relation to their personal data. These rights include:

• The right to be informed, access, and obtain the data held by the Controller.
• The right to withdraw prior consent.
• The right to correct, amend, add to, or update their data.
• The right to restrict processing within a specified scope.
• The right to erase or conceal their data in accordance with the provisions of the Law.
• The right to object to processing and profiling where such processing is not necessary to achieve the purposes for which the data was collected, is excessive in relation to those purposes, discriminatory, unfair, or unlawful.
• The right to transfer a copy of their data from one Controller to another Controller.
• The right to be informed of and aware of any breach, violation, or compromise of the security and integrity of their data.

Exercising Data Subject Rights: A data subject may submit a request to us to exercise any of the rights provided for under the Law. GESCO will provide reasonably accessible means for persons with disabilities to submit such requests, verify the identity of the requester, and acknowledge receipt of the request.

GESCO will respond to and implement the request within 15 business days from the day following its receipt. For justified reasons, this period may be extended once for an additional period of 15 business days, provided that the data subject is informed of the extension and the reasons for it, unless otherwise provided by applicable legislation.

15. Cookies and Website Analytics

We use cookies and similar technologies that are strictly necessary for the Website to function, including cookies used to remember your language preference (Arabic/English) and to support the security, stability, and performance of the Website.

At present, the Website does not use third-party analytics, advertising, or tracking cookies (such as Google Analytics or social media pixels). If we introduce such tools in the future, we will update this section of the Privacy Policy accordingly and, where required by applicable law, obtain your consent before any non-essential cookies are set.

You can control or disable cookies at any time through your browser settings. Please note that disabling essential cookies may affect the Website’s functionality.

16. Complaints

GESCO has established and published procedures for submitting and handling complaints relating to the processing of personal data. Complaints will be registered under a reference number, and the complainant will be provided with a means to follow up on the complaint.

GESCO will respond to the complaint within 10 days from the day following its submission. If no action is taken within this period, the complainant may refer the complaint to the Regulatory Unit for Personal Data Protection at the Ministry of Digital Economy, without prejudice to their right to seek judicial remedies. The complainant will be informed of the final outcome in clear and simple language and of their right to refer the matter to the Unit or the courts if they are not satisfied with the outcome.

Requests and complaints submitted by data subjects will be handled free of charge, and no conditions will be imposed that would hinder the complainant’s right to submit a complaint.

17. Acknowledgment

Please read this Privacy Policy carefully. By accessing or using our website, you acknowledge that you have read and understood this Privacy Policy, including how we collect, use, process, disclose, and otherwise handle your Personal Data as described herein. Your acknowledgment of this Privacy Policy does not, by itself, constitute Prior Consent to the Processing of your Personal Data where such consent is required under applicable law. Where Prior Consent is required, we will obtain it separately in accordance with applicable legal requirements.

18. Contact Us

If you have any questions or concerns regarding this Privacy Policy or the Processing of your Personal Data, or if you wish to exercise any of your rights under applicable data protection laws and regulations, you may contact us using the details below:

Data Controller: Modern International Education Consultancy Company (GESCO), Al Hijaz Towers, 158 Mecca Street, Office 305, Amman 11821, Jordan
Telephone: +962 79 221 1177
Email: info@gescoedu.com

آخر تحديث: 24 أغسطس 2026