PRIVACY POLICY

Who We Are

We are SRT International Ltd., a limited liability company incorporated under Bulgarian law, registered with the Bulgarian Commercial Register under No. 201439810, with headquarters and registered address at 11-13 Prof. Fridtjof Nansen St., 1142, Sofia city, Bulgaria (referred to as “SRT”, “the Company”, “we” or “us”). We act as data controller with respect to the processing of your personal data as described below in this Privacy Policy.

We operate the websites www.srtfairs.com and www.edu.srtfairs.com (each hereafter a “Website” and jointly, the “Websites”). Our business activity is focused on international student recruitment, partnering with top high schools and universities and the organisation and management in educational in-person and digital events.

Scope of the Privacy Policy

This Privacy Policy describes how we collect and process personal data in connection with the services we provide (“Services”), including through our Websites. This includes managing registrations for in‑person fairs, tours, and school visits, registrations for and participation in digital events such as e‑conferences and webinars, communications with clients, students, counsellors, speakers, and partners, marketing communications and the use of event‑related systems or third‑party tools SRT relies on to provide its Services.

When we collect, use and process personal data we are subject to the provisions of the EU General Data Protection Regulation (“GDPR”) and national implementing legislation, including the Bulgarian Personal Data Protection Act. Any terms not expressly defined in this Privacy Policy shall have the meaning assigned to them under the GDPR.

If you have any questions or requests regarding the processing of your personal data under this Privacy Policy, please contact: info@srtfairs.com.

Whose Personal Data Do We Process?

Depending on how you use our Services, you may fall into one of the following categories of data subjects whose personal data we process:

• Students – individuals registering for, or participating in, in‑person fairs, tours, school visits, digital events, webinars, or using our Websites to explore educational opportunities.
• School Counsellors / School Staff – representatives of educational institutions who communicate with us, register students, participate in events, or use our Services for professional purposes.
• University Representatives / Clients / Participants – representatives of higher education institutions, clients, exhibitors, and other participants engaging with our Services.
• Speakers / Panellists / Moderators – individuals contributing to our events, webinars, or digital programs in a speaking or moderation capacity.
• Website Users / Leads / Newsletter Subscribers – individuals visiting our Websites, filling in contact forms, subscribing to newsletters, or interacting with our online content and marketing materials.
• Other Business Contacts / Partners – representatives of suppliers, partners, service providers, and other stakeholders who engage with us for business or collaboration purposes.

What Personal Data Do We Process?

We process personal data to the extent necessary to deliver our Services. The specific personal data may vary depending on the event type, registration form, product format, or operational requirements. In particular, different categories of personal data may be collected depending on whether you participate in in‑person or digital event. In all cases, SRT ensures that any personal data collected are adequate, relevant, and proportionate to the stated purposes.

General Categories of Personal Data

Depending on your interaction with our Services, we may process the following categories of personal data:

• Identification Data – e.g. name, date of birth, gender (where relevant for event administration), etc.
• Contact Data – e.g. email address, phone number, country of residence, citizenship, etc.
• Profile and Preference Data – such as academic interests, study preferences, event selection, communication preferences, survey responses, information voluntarily provided by students to help match them with relevant institutions, etc.
• Website Usage and Technical Data – e.g. IP address, device and browser information, interaction data relating to use of our Websites, registration platforms, event tools, etc.
• Academic and Background Data – e.g. current school, expected graduation year, academic records, academic interests, extracurricular activities, etc.
• Marketing and Communication Data – e.g. stated preferences for receiving promotional content, newsletters, follow-ups, etc.
• Visual and Media Data – e.g. photographs or video recordings captured during our events for marketing, promotional, and event-documentation purposes. Any use of identifiable images of you for marketing or promotional materials will occur only with your explicit consent, which will be explicitly requested in advance and separately from event registration. If you are a student under the age of 14, your parental or guardian consent will be required. Consent may be withdrawn at any time, without affecting your participation in the event and without impacting the lawfulness of any prior processing.

For the avoidance of doubt, SRT does not collect students’ home addresses as part of standard registration or participation processes.

Depending on the event setup, we may use third‑party digital tools and service providers to support registration, communications, event delivery, collaboration, file storage, and analytics. These may include:

• Zoom for hosting virtual meetings and webinars;
• HubSpot for event registration, CRM functions, and communications;
• Google services for communications, collaboration tools, secure file storage, and, where applicable, website analytics and measurement.

Each provider’s role (Data Processor, independent Data Controller, or joint controller) varies depending on the specific service configuration and the nature of the processing. SRT ensures that all providers engaged as Data Processors operate under written agreements that meet the requirements of Article 28 GDPR and process personal data solely on SRT’s documented instructions. Where a service provider may act as a joint controller together with SRT, the parties will cooperate to put in place an arrangement that aligns with the requirements of Article 26 GDPR.

In-Person Events

For the purposes of organisation and management of In-Person Events (including registration, logistics, attendance administration, lead capture, and in-person event follow-up), we may collect:

• Identification data (e.g., name, preferred name)
• Contact data (e.g., email, phone number, country)
• Academic and background data (e.g., school name, academic interests)
• Profile and preference data relevant to the event
• Visual and media data (e.g., photographs taken at the venue)

Digital Events

For the purposes of organisation and management of Digital Events (including registration, login administration, live participation, interaction, recordings, reporting, and follow-up), we may collect:

• Identification data (e.g., name, user/account name used for login)
• Contact data (e.g., email address)
• Profile and preference data (e.g., session selections)
• Usage and technical data (e.g., IP address, device/browser, session logs)
• Participation and interaction data, such as comments, questions, and chat contributions, poll responses, feedback forms, etc.
• Recordings of online sessions, where applicable and in line with notice provided to participants.

Where you participate in an online event organized by SRT, certain limited personal data may be shared with:

• The online event platform provider, acting in its capacity as independent Data Controller and/or Data Processor (as applicable) for the purposes of enabling the event;
• SRT partner universities taking part in the online event/webinar, but only where you have given prior consent to receive follow-up communication or to be visible to the participating institutions.

Any sharing is limited to what is necessary for the functioning of the event and is carried out under appropriate contractual and security safeguards.

How Do We Collect Personal Data?

We collect information about you when you:

• access our Websites;
• request information to be sent to you;
• attend or register for an SRT (digital) event, e.g. an educational fair or high school visit;
• submit your test scores to us as part of the application process;
• interact with any SRT page or account on a social media platform, or when you use your social media account or credentials to log in to the Website.

Personal data is collected either directly (for example when you register with us, contact us, etc.) or indirectly (for example through the use of ‘cookies’ on our Websites – see Section 9 below).

Personal data may be provided to SRT by third parties as well (universities, high schools, other educational institutions, etc.). When we obtain personal data from third party sources, we will look to ensure that the third party has lawful authority to provide us with your personal data.

How Do We Use And Share Your Information?

We process personal data only for specified and legitimate purposes related to the delivery of our Services, in accordance with the terms of this Privacy Policy. Each processing activity is based on a lawful basis under Article 6 GDPR as set out in Section 7 below.

Your personally identifiable information will not be disclosed without your permission unless we are legally entitled or required to do so, such as by a legal process or to prevent fraud or another crime or if we believe that such action is necessary to protect and/or defend our rights, property or personal safety and/or those of our users/members or other individuals. We do not sell personal data to third parties.

We may share personal data only with:

• service providers acting on our behalf under contractual confidentiality and data-processing agreements (e.g. payment services providers that process event-related payments, etc.);
• partner universities or educational institutions, where necessary to facilitate student–university engagement and only where the student has opted-in;
• event partners or platform providers, where required for event administration;
• third parties such as authorities, where required by law or necessary to protect our rights.

Below, we outline how these general principles apply in practice across different types of interactions with SRT:

Students

We collect student data through event registration (e.g., university fairs and recruitment tours) and online forms to connect high school students with universities. If you have opted-in to be included in our list, SRT partner universities taking part in the event/webinar you register for may receive your contact information, and may follow-up with information regarding global study options. These communications may be sent electronically by email.

Events

For certain events, we may use an event app or share materials to promote networking. Where such tools are used, and where necessary for the functioning of the platform/app, your basic registration details (such as name, email and school) may be visible to other participants attending the event.

You will be informed in advance if an event involves networking functionality and can choose whether to participate.

Communications

We send regular communications in line with our contractual obligations and legitimate interests to inform you of the Services available as part of your membership, and to conduct SRT association business as noted in the membership agreement. You can manage your email preferences to opt in and out of specific communications according to your interests. This option can be found at the end of each communication under “Manage your preferences”.

Marketing & Promotion

If photographs or video recordings are taken at an SRT event, we may use such images for marketing and promotional materials, including on our Websites, social media, and printed publications. We may use any such images only upon obtaining your explicit prior consent, and you may withdraw your consent at any time. For students under the age of 14, parental or guardian consent will be required.

Lawful basis for processing your information

We process personal data only where a lawful basis under Article 6 GDPR applies. Different processing activities rely on different legal grounds, depending on the nature of the Services and your interaction with us. Where applicable, we indicate whether and why you must provide us with your personal data, as well as the consequences of failing to do so. If you do not provide personal data when requested, you may not be able to benefit from our Services if that information is necessary to provide you with the Services or if we are legally required to collect it.

Contract Performance or Pre-Contractual Steps (Art. 6(1)(b) GDPR)

We may process your personal data because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following purposes:

• to interact with you before you are enrolled as a student, as part of the admissions process;
• managing your registration for SRT events or services;
• once you have enrolled, to provide you with the Services (including access to digital or in-person events);
• administering attendance and participation;
• to deal with any concerns or feedback you may have;
• managing your account and associated services;
• for any other purpose for which you provide us with your personal data.

If you fail to provide information required for contractual purposes, we may be unable to provide the relevant Service.

Legitimate Interests (Art. 6(1)(f) GDPR)

We process certain personal data where this is necessary for SRT’s legitimate interests and where your rights and freedoms do not override those interests. These legitimate interests include:

• organising, managing, and improving our in-person or digital events and Services;
• enabling student–university engagement and facilitating meaningful outreach;
• promoting and developing our Services (excluding any activity requiring consent);
• ensuring network and information security;
• maintaining accurate internal records;
• obtaining professional advice and defending our legal rights;
• operating event tools, networking platforms, and lead-generation processes;
• monitoring Service performance and conducting analytics to improve user experience.

Compliance With Legal Obligations (Art. 6(1)(c) GDPR)

We may also process your personal data in relation to compliance with our legal and regulatory obligations. In this respect, we may use your personal data for the following:

• financial and other statutory audits;
• compliance with our regulatory and legal obligations (including without limitation, education-sector and data protection regulations);
• compliance with anti-fraud/anti-money laundering laws and safeguarding requirements;
• cooperating with competent authorities and law-enforcement bodies as may be required, including in relation to any investigations (including criminal investigations);
• responding to lawful requests or court orders;
• maintaining records required by applicable national laws.

Processing Based on Consent (Art. 6(1)(a) GDPR)

Certain processing activities rely on your freely given, specific, informed, and unambiguous consent, including:

• receiving and processing your personal data as a prospective student when you participate in school visits, educational fairs, or similar recruitment events and application cycle in Bulgaria or abroad;
• receiving marketing communications or newsletters;
• sharing your contact information with partner universities for follow-up communications;
• participation in optional promotional activities;
• the use of identifiable photographs or recordings in our marketing materials;
• any optional fields in registration forms that are not necessary for event participation.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You may exercise this right by contacting us using the details provided in this Privacy Policy.

For participants who are under the age of 14, consent will be obtained from a parent or guardian where required by Article 8 GDPR or applicable national law.

Retention of Your Personal Data

Retention periods vary depending on the category of data, the nature of the Services used, and any legal or regulatory obligations that apply. Our policy is to keep data only for as long as necessary to fulfil the originally intended purpose in accordance with the GDPR principles of purpose limitation and storage limitation.

We take measures to delete your Personal Data or keep them in a form that does not permit identifying you when these Personal Data are no longer necessary for the purposes for which we process them, unless we are required by law to keep them for a longer period.

Subject to any other notices that we may provide to you, we may retain your personal data for a maximum period of five years after your association with us has come to an end.

Certain categories of data may be retained for shorter or longer periods where:

• a specific statutory retention period applies;
• the data are required to resolve ongoing inquiries, complaints, or legal claims;
• retention is necessary to demonstrate compliance with contractual or regulatory obligations;
• consent‑based processing continues until consent is withdrawn.

In term of e-mail correspondence, SRT retains emails only for as long as necessary for day‑to‑day business communications, resolving inquiries, complying with legal or audit requirements, or establishing or defending legal claims. Email access is limited to authorised personnel and managed in line with SRT’s internal retention and security policies.

SRT reviews its retention schedules regularly to ensure that personal data are not kept longer than necessary and are deleted or anonymized in accordance with applicable legal requirements. Please contact info@srtfairs.com in case of any requests about the specific retention periods that apply to your personal data.

Cookies Policy

The SRT’s website uses cookies in order to learn more about the way you interact with our content and to help us to improve your experience when visiting our website. Cookies remember the type of browser you use and which additional browser software you have installed. They also remember your preferences, such as language and region, which become your default settings when you revisit the website. Some of the cookies we use are session cookies which last only until you close your browser; others are persistent cookies which are stored on your computer.

We will not use cookies to collect personally identifiable information about you. However, you can choose to reject or block the cookies set by SRT or the websites of any of our third-party suppliers by changing your browser settings. Note that most browsers automatically accept cookies, so if you do not wish cookies to be used, you may need to actively delete or block the cookies.

Some of the functions within our website link to third-party suppliers, for example, when you visit a page with videos embedded from or links to YouTube. These videos or links (and any other content from third party suppliers) may contain third party cookies. You can consult the policies of these third-party websites for information regarding their use of cookies.

Cookies we use

How Do We Store and Secure Information?

We have implemented technology and policies with the objective of protecting your data from unauthorized access and improper use and will update these measures as new technology becomes available. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees’ privacy responsibilities.

We work with several data processors to deliver services to members. These processors include, but are not limited to, event registration, and payment processors. For each data processor, we carefully review and monitor the vendor’s privacy policy and data security measures to ensure they uphold our high standards. These data processors will not use your personal information for any purpose other than what we have agreed with them.

What Are Your Rights In Relation To The Personal Data We Hold?

GDPR outlines six rights for individuals in relation to their data. If you would like to exercise one of these rights, the actions you can take are listed below.

We will respond to all requests within 30 days, however it may take longer to fulfill your request. If you are unsatisfied with how we handle your request you can contact your local data authority.

You have rights in respect of the way your personal data shall be managed, including the right to:

• request an access to your personal data we hold;
• rectify or erasure your personal data;
• restrict or object to processing concerning your data;
• request data transfer to other parties;
• withdraw consent at any time, without affecting the lawfulness of processing based on consent before this withdrawal;
• lodge a complaint with the supervisory authority – Commission for Personal Data Protection, address – 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

You may address your concerns or inquiries to e-mail: info@srtfairs.com

Children’s Privacy

Generally we do not knowingly collect, maintain, or use personal data from children under 14 years of age, and no part of the Service is directed to children under the age of 14.

Where it is necessary to collect, maintain, or use personal data from children under 14 years of age, for the legitimate purpose of providing Services to such a person, we do not proceed unless consent is given or authorized by the holder of parental responsibility over the child.

If you learn that your child has provided us with personal data without your consent, then you may alert us at info@srtfairs.com. If we learn that we have collected any personal data from children under 14, then we will promptly take steps to delete such information and terminate the child’s account.

International Data Transfers

Data we collect will (where necessary) be transferred to selected third parties (including certain educational institutions, service providers, or partner organisations), which may be located outside of the European Union as part of the Services offered to you. For example, some educational institutions we work with are located in countries outside of the EU.

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the “appropriate safeguards” for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission);
• a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection; or
• there exists another situation where the transfer is permitted under applicable law (e.g. where we have your explicit consent, where necessary for the performance of a contract, or where another derogation is available).

SRT is an organization that engages in activities worldwide. SRT staff, affiliates or contractors may access, store or process personal data you submit to us from countries outside the EU. In all such cases, we ensure that appropriate safeguards are in place to protect your personal data and that the level of protection is essentially equivalent to that within the EU.

Other Important Information

School Visits

When we are onsite for a school visit, we respect and adhere to local school policies including those related to data protection, including the distribution, use and storage of data, the rights of the individual, safeguarding and child protection, as well as statutory governmental policies and practices.

Restricted-Access Venues

In rare cases, certain venues, such as host institutions, government facilities, military bases, or other restricted-access locations, may impose additional security, access-control, or identity-verification requirements that apply to all visitors. These requirements are determined by the venue, the relevant competent authority or applicable national law and are not set by SRT.

If such a situation arises, SRT will:

• inform participants in advance of any access or identification requirements imposed by the venue;
• ensure that only the minimum necessary personal data required for venue access are collected and processed;
• collect such data only for the specific purpose of complying with venue-imposed rules;
• ensure that the data are processed securely and deleted once no longer required for access or verification.

For the avoidance of any doubt, SRT does not routinely collect passports, ID cards, or similar documents from students or participants, unless this is required for compliance with venue-imposed requirements as outlined above.

Participation may be limited where an individual is unable or unwilling to satisfy venue-imposed requirements, or where compliance is mandated by applicable security rules or law.

Links to other web sites

Our Websites may link to other third-party websites that may also gather information about you. This Privacy Policy does not cover any processing of personal data by such third-party websites, which operate in accordance with their own separate privacy statements. If you have questions about how a third-party site uses your information, you’ll need to check that site’s privacy statement as appropriate.

Changes to Privacy Policy

From time to time we may make changes to this Privacy Policy. If we make any substantial changes to this privacy policy and the way in which we use your personal data, we will post the changes on this page and will do our best to notify you of any significant changes. Check our Privacy Policy on a regular basis.

DECLARATION OF ACCEPTANCE

I confirm that I have read and understood the SRT Privacy Policy and am informed about the processing of my personal data as described therein.

I am informed and I understand that:

• my personal data may be shared with third-party – service providers (such as online events hosting platforms), solely for the purpose of delivering the requested Services and always under appropriate contractual safeguards.
• my personal data may be transferred to third-countries – non-EU Members , but only where appropriate safeguards are in place to ensure GDPR‑compliant protection.
• I may withdraw any consent I have provided at any time, without affecting the lawfulness of processing carried out before withdrawal by contacting SRT at info@srtfairs.com.
• I may exercise my rights of access, rectification, erasure, restriction, objection, and data portability by contacting SRT at info@srtfairs.com.
• If there is a security issue, despite our strict internal security measures and procedures, SRT will notify me in accordance with GDPR requirements.
• If I am an individual at the age of 14 or less, my personal data will be provided only with the acceptance of my parent/legal guardian.

Amended 3 April 2026