Privacy Policy | Pacific Futures

Pacific Futures, LLC ("Pacific Futures," "we," "us," or "our"), respects your privacy and is committed to handling your personal information responsibly. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how we protect it, and your rights in relation to it.

This Policy applies to personal information we collect through our website (pacificfutures.org), through enquiry and application forms, through email and other correspondence, and in the course of providing our higher-education advisory and recruitment services.

This Policy is written to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the U.S. Family Educational Rights and Privacy Act ("FERPA") where applicable to records held on behalf of Title IV–participating institutions.

​

1. Who We Are

 

Pacific Futures, LLC is a limited liability company registered in California, United States, with its principal place of business at 421 Broadway, San Diego, CA, 92101. Pacific Futures is the data controller for the personal information described in this Policy.

​

For privacy-related questions or to exercise your rights under this Policy, you can contact us at:

​

• Email: hello@pacificfutures.org

• Postal address: 421 Broadway, San Diego, CA, 92101

​

2. Information We Collect

 

We collect personal information in the following categories:

​

2.1 Information you provide to us directly

​

• Contact details: name, email address, phone number, postal address, country of residence, date of birth.

• Educational background: academic transcripts, qualifications, test scores (SAT, ACT, GRE, GMAT, IELTS, TOEFL, etc.), school name and graduation date, references.

• Application materials: personal statements, essays, CVs, letters of reference, portfolios where relevant.

• Identification documents: passport, where required to support visa or admission processes.

• Financial information: limited information relating to funding plans and scholarships. We do not collect or retain bank account numbers or full payment-card data; payment processing, where relevant, is handled by our payment providers.

• Family and emergency contact details: where you choose to share these for pre-departure or in-country support.

• Health and accessibility information: only where you choose to share it for accommodation, visa, or pre-departure support purposes.

• Correspondence: emails, messages, call notes, and other communication with our team.

​

2.2 Information collected automatically when you visit our website

​

• Device and connection data: IP address, browser type and version, operating system, device identifiers.

• Usage data: pages visited, time spent, referring URLs, links clicked, and other interaction data.

• Cookies and similar technologies: see Section 9 below.

​

2.3 Information from third parties

​

• Partner universities: applicant status updates, admission decisions, and enrolment confirmations.

• School counsellors, agents, and educational consultants: where they introduce you to us with your knowledge.

• Publicly available sources: where relevant to verifying credentials or supporting your application.

​

2.4 Special category data

​

Some of the information we may collect — for example, health information, or information that reveals racial or ethnic origin in the context of equality-monitoring questions on application forms — is treated as "special category data" under GDPR and UK GDPR. We only process special category data with your explicit consent, or where another lawful condition under Article 9 GDPR applies.

​

3. Why We Process Your Information

 

We process your personal information for the following purposes:

​

• Providing our advisory and application support services: responding to enquiries, advising on university and program choice, supporting application preparation, liaising with partner universities, and providing pre-departure, in-country, and post-graduation support.

• Communicating with you: responding to questions, providing updates, and providing information about events, programs, and partner universities.

• Marketing: with your consent where required, sending information about our services and relevant opportunities. You can withdraw consent at any time.

• Improving our services: analysing how our website and services are used, conducting market research, and improving the user experience.

• Regulatory and contractual compliance: complying with our obligations to partner universities, U.S. Department of Education guidance applicable to recruitment for Title IV–participating institutions, and applicable laws.

• Protecting Pacific Futures and others: preventing fraud, protecting our rights, and ensuring the safety of our staff, students, and partners.

​

4. Legal Bases for Processing

 

Under GDPR and UK GDPR, we rely on the following legal bases for processing your personal information:

​

• Consent (Article 6(1)(a)): where you have given clear consent for us to process your information for a specific purpose, such as marketing communications or the processing of special category data.

• Contract (Article 6(1)(b)): where processing is necessary to provide our services to you, including responding to your enquiries and supporting your university applications.

• Legal obligation (Article 6(1)(c)): where we are required to process your information to comply with applicable law.

• Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate business interests, such as improving our services, maintaining our records, and ensuring the security of our systems, and these interests are not overridden by your rights and interests.

​

Where we rely on consent, you have the right to withdraw that consent at any time. Where we rely on legitimate interests, you have the right to object to our processing (see Section 8).

​

5. Who We Share Your Information With

 

We share your personal information only as necessary to provide our services and as described below. We do not sell your personal information.

​

5.1 Partner universities

​

We share applicant information — including contact details, academic records, application materials, and supporting documentation — with the university or universities you are applying to. Each university acts as an independent data controller for the personal information you provide to them through us and is responsible for handling your information in accordance with its own privacy notice and applicable law.

​

5.2 Service providers and processors

​

We use trusted third-party service providers to support our operations. These include:

​

• Cloud productivity and storage: Google LLC (Google Workspace) — for email, document storage, and collaboration.

• Customer relationship and database management: Airtable (Formagrid, Inc.) — for inquiry, applicant, and partnership records.

• Website hosting and analytics: Wix.com Ltd. — for our public-facing website.

• Forms and application intake: Fillout — for online enquiry and application forms.

• Email and communications providers: Google Mail, Google Meet, Mailchimp, Calendly, Zoom.

​

Each of these providers acts as a data processor, processes personal information only on our documented instructions, and is bound by a written Data Processing Agreement that incorporates appropriate safeguards including, where applicable, the EU and UK Standard Contractual Clauses.

​

5.3 Professional advisers

​

We may share personal information with our legal, accounting, insurance, and compliance advisers where this is necessary to obtain professional advice or to defend our legal rights.

​

5.4 Authorities and regulators

​

We may share personal information with government, regulatory, or law-enforcement bodies where we are required to do so by law, or where we believe in good faith that disclosure is necessary to comply with a legal obligation or to protect the rights, safety, or property of Pacific Futures, our students, or others.

​

5.5 In the event of a corporate transaction

​

If Pacific Futures is involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected individuals where required by law and ensure that any successor entity is bound by privacy commitments at least as protective as those in this Policy.

​

6. International Data Transfers

 

Pacific Futures is based in the United States. Many of our service providers, and several of our partner universities, are based in or transfer data to jurisdictions outside the European Economic Area, the United Kingdom, and other regions whose laws may differ from those where you are located.

​

Where we transfer personal information from the EEA, UK, or Switzerland to a country that has not been recognised by the European Commission, UK Government, or Swiss Federal Council as providing an adequate level of data protection, we rely on one or more of the following safeguards:

​

• The EU–U.S. Data Privacy Framework, the UK Extension to the Data Privacy Framework, and the Swiss–U.S. Data Privacy Framework, where the recipient is certified;

• The Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum, incorporated into our agreements with processors and partner universities;

• Other appropriate safeguards permitted under Articles 46 and 49 GDPR / UK GDPR, including supplementary technical, organisational, and contractual measures where required.

​

You can obtain a copy of the safeguards in place for any specific transfer by contacting us at hello@pacificfutures.org.

​

7. How Long We Keep Your Information

 

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, regulatory, or contractual requirements.

​

Our standard retention periods are as follows:

​

• Prospective student enquiries that do not progress to application: 12–24 months from last contact.

• Applicant records (whether the application succeeds or not): up to 7 years from the date of the application to support contractual obligations to partner universities and regulatory record-keeping.

• Enrolled student records and post-graduation engagement records: up to 7 years from the end of the student–university relationship, unless a longer period is required by applicable law.

• Marketing contact records: until you withdraw consent or for 24 months of inactivity, whichever is shorter.

• Website analytics data: typically 14–26 months depending on the analytics provider and your cookie preferences.

• Financial and tax records: as required by applicable U.S. and state law (typically 7 years).

​

When personal information is no longer required, we securely delete or anonymize it.

​

8. Your Rights

 

Depending on the laws applicable to you, you may have the following rights in relation to your personal information:

​

• Right of access: to receive confirmation of whether we hold personal information about you, and to receive a copy of that information.

• Right to rectification: to have inaccurate personal information corrected and incomplete information completed.

• Right to erasure ("right to be forgotten"): to have your personal information deleted in certain circumstances.

• Right to restriction of processing: to have our processing of your personal information restricted in certain circumstances.

• Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

• Right to object: to object to processing based on legitimate interests, and to object to direct marketing at any time.

• Right to withdraw consent: where we rely on consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

• Right not to be subject to automated decision-making: we do not currently use automated decision-making, including profiling, that produces legal or similarly significant effects on individuals.

​

California residents (CCPA/CPRA)

​

If you are a California resident, you also have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioural advertising), and the right to non-discrimination for exercising these rights.

​

Exercising your rights

​

To exercise any of these rights, please contact us at hello@pacificfutures.org. We will respond within one month (or as otherwise required by applicable law). We may need to verify your identity before responding.

​

Right to lodge a complaint

​

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in your country of residence. In particular:

​

• United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk.

• European Union: the data protection authority of your member state of residence.

• California: the California Privacy Protection Agency — cppa.ca.gov.

​

We would, however, appreciate the opportunity to address your concerns directly before you contact a regulator.

​

9. Cookies and Similar Technologies

 

Our website uses cookies and similar technologies to operate the site, remember your preferences, analyze usage, and support marketing activities. You may disable cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website.

​

10. How We Protect Your Information

 

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

​

• Encryption of data in transit and at rest where supported by our service providers.

• Access controls limiting personal information access to staff who need it.

• Secure password and multi-factor authentication policies.

• Due diligence on third-party service providers, including written data processing agreements.

• Regular review of our security practices.

​

No system can be guaranteed 100% secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.

​

11. Children's Privacy

 

Our services are intended for individuals aged 16 and over. We do not knowingly collect personal information from children under 16.

If you are under 16, please do not provide personal information to us without the involvement of a parent or legal guardian. If we become aware that we have inadvertently collected personal information from a child under 16 without appropriate consent, we will delete that information.

​

This age threshold reflects the most protective standard across jurisdictions in which we operate, including Article 8 GDPR. Some jurisdictions, including the United States under the Children's Online Privacy Protection Act, set a lower threshold (13). Where local law sets a different threshold, we will comply with the applicable local requirement.

​

12. Automated Decision-Making and Profiling

 

Pacific Futures does not currently use automated decision-making, including profiling, that produces legal effects on you or similarly significantly affects you. All application support and advisory decisions involve meaningful human review. If this changes in future, we will update this Policy and, where required, seek your consent or provide other appropriate safeguards.

​

13. Whether You Are Required to Provide Information

 

You are not legally required to provide your personal information to us. However, if you do not provide information that we need to provide our services — for example, information required by partner universities to consider an application — we may not be able to provide some or all of our services to you. We will tell you at the point of collection where information is required for a particular purpose.

​

14. Third-Party Websites

 

Our website may contain links to third-party websites, including partner universities and external resources. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any third-party website you visit.

​

15. Changes to This Policy

 

We may update this Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, notify you directly. We encourage you to review this Policy periodically.

​

16. Contact Us

​

If you have any questions, concerns, or requests relating to this Policy or our handling of your personal information, please contact us at:

 

Pacific Futures, LLC

421 Broadway, San Diego, CA, 92101

Email: hello@pacificfutures.org

Website: pacificfutures.org