Privacy Policy

PathLance is an international education and relocation consultancy with a head office in Dalarna, Sweden and a regional office in Lahore, Pakistan. This policy explains what personal data we collect through this website and our advisory services, why we collect it, who we share it with, and the rights you have over it.

PathLance is the data controller for the personal data described here. Because our head office is in Sweden, we handle personal data in line with the EU General Data Protection Regulation (GDPR) and Swedish data protection law, and we apply the same standard to the work our Lahore office does.

When you submit a consultation enquiry

Our enquiry form asks for:

• Full name, email address and phone or WhatsApp number
• Target country, study level (e.g. Bachelors, Masters, PhD, work or visit visa)
• Preferred intake, and anything you choose to write in the message box

We also record the IP address the enquiry came from and the time it was received. That is used only to block spam and abuse (we limit how many submissions one address can send per hour).

When you book a paid consultation

• Name, email address and phone number
• Your chosen destination country, university of interest and study level
• Your selected slot, the call duration and the time zone your browser reports
• A booking reference, the amount and currency, the payment status, and the identifiers Stripe returns for the payment session
• The meeting link for the call, and any notes you add to the booking

We never see or store your full card number, CVC or expiry date. Card details are entered on Stripe’s own secure checkout and are processed by Stripe as an independent controller of that payment data.

During an advisory engagement

If you go on to work with us, you may share documents needed for an application — academic transcripts and certificates, CV, personal statement, passport details, references, proof of funds, language test results, and previous visa or travel history. Some of this can be sensitive, so we ask you to send only what a specific application actually requires, and only when we have asked for it.

Automatically, when you browse

• Standard server log data — IP address, browser and device type, pages requested, referring page, date and time — kept for security and troubleshooting.
• Fonts on this site are served by Google Fonts, which means Google receives your IP address when a page loads.
• Our blog runs on WordPress and may set functional cookies (for example if you leave a comment).

We do not run advertising trackers or sell profiling data. If we add analytics in future, we will update this policy and, where consent is required, ask for it first.

• To answer your enquiry and deliver the consultancy you asked for — assessing your profile, shortlisting programmes, preparing documents, running the call. Legal basis: performance of a contract, or steps taken at your request before entering one.
• To take payment and keep accounting records. Legal basis: performance of a contract, and our legal obligation to retain financial records.
• To submit or support an application to a university or immigration authority — only for the applications you have asked us to work on. Legal basis: performance of a contract and, for sensitive details, your explicit consent.
• To protect the site and prevent abuse — spam filtering, rate limiting, security logging. Legal basis: our legitimate interest in a secure service.
• To send you service messages — booking confirmations, reschedules, reminders and replies. Legal basis: performance of a contract.
• To send occasional updates about intakes, deadlines or services — only if you have opted in. Legal basis: consent, which you can withdraw at any time.
• To publish a success story or testimonial — never without your separate, written consent, and you can ask us to take it down at any time.

We do not sell your personal data, and we never share it for advertising. We share it only with:

• Universities, admission portals, embassies, immigration authorities and visa application centres — only where you have instructed us to submit or support a specific application. Each of them then handles your data under its own rules, and their decisions are entirely their own.
• Stripe, our payment processor, to take and reconcile card payments.
• Our hosting, email and communication providers, who process data on our instructions under written agreements.
• Service partners you ask us to involve — translators, attestation services, couriers, insurers or accommodation providers.
• Professional advisers or authorities, where we are legally required to disclose, or need to establish or defend a legal claim.

Our PathLance advisers in Sweden and Pakistan may both access your file, so that whichever office handles your case has the context it needs. Only the team members who need access have it.

Because we operate in Sweden and Pakistan and help students apply worldwide, your data may be transferred outside the EU/EEA — for example to our Lahore office, or to a university or immigration authority in the country you are applying to.

Where we transfer data to a country without an EU adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with access controls and encryption in transit. Transfers to an immigration authority or university as part of an application you asked us to make are carried out on your explicit instruction. You can ask us for details of the safeguards in place for your case.

• Enquiries that do not become clients: up to 24 months from your last contact, then deleted — students often come back a year or two later.
• Client files and application documents: for the duration of the engagement and up to 3 years afterwards, so we can support follow-up applications, appeals or extensions.
• Payment and accounting records: 7 years, as Swedish bookkeeping law requires.
• Server and security logs: typically up to 12 months.
• Marketing consent records: until you withdraw consent, plus a short period to evidence the withdrawal.

You can ask us to delete your data earlier — see your rights below. We will do so unless we are legally required to keep it (for example accounting records) or need it for a live legal claim.

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Delete your data where we no longer need it (“right to be forgotten”).
• Restrict or object to processing based on our legitimate interests.
• Receive your data in a portable format, or have it sent to another provider.
• Withdraw consent at any time, where our processing relies on consent. This does not affect processing carried out before you withdrew it.

Email info@pathlance.com to exercise any of these. We respond within one month, free of charge, and may ask you to verify your identity first.

If you are unhappy with how we handled your data, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the supervisory authority in your own country. We would appreciate the chance to put it right first.

• Traffic to this site and our booking flow is encrypted in transit (HTTPS).
• Payments run entirely through Stripe’s PCI-compliant checkout — card data never touches our servers.
• Our lead and booking systems sit behind authentication, and access is limited to advisers who need it.
• Advisers are briefed on confidentiality, and document sharing is kept to what is necessary.

No system is completely secure. Please do not email highly sensitive documents unprompted — ask us for a secure way to send them. If a breach ever affects your rights, we will notify you and the supervisory authority as the GDPR requires.

This site does not use advertising or profiling cookies. What we do use is limited to keeping the site working:

• Essential storage — for example, holding your progress through the booking steps, and keeping an admin session signed in. This clears when you close the tab.
• Stripe sets its own cookies on its checkout pages, for fraud prevention and to complete payment.
• Our WordPress blog may set functional cookies, for example if you leave a comment.

You can block or delete cookies in your browser settings. Blocking essential storage may stop the booking flow from working.

Our services are aimed at prospective students aged 16 and over. If you are under 18, a parent or guardian must review these terms, give consent, and be involved in the enquiry. If we learn that we have collected data from a child without appropriate consent, we will delete it.

We update this policy when our services or the law change; the “last updated” date shows the current version. Where a change materially affects how we use your data, we will tell you directly.

For anything about this policy or your data, write to info@pathlance.com, or contact the office handling your case — Sweden (Dalarna, head office) at sweden@pathlance.com, Pakistan (Lahore, regional office) at pakistan@pathlance.com. Addresses and phone numbers are on our contact page, and the terms governing our services are in our Terms & Conditions.