This Privacy Policy explains how Stepstone Overseas Education Pvt. Ltd. ("Stepstone", "we", "our", or "us") collects, uses, shares, and protects your personal information when you interact with us through our WhatsApp Business chatbot, website, or any other service we provide.
1. Who We Are
Stepstone Overseas Education Pvt. Ltd. is a registered education consultancy based in Pakistan, providing study abroad guidance, test preparation, visit visa services, ticketing, and Umrah packages. We operate a WhatsApp Business account powered by the Meta (WhatsApp) Business Platform to communicate with prospective and current clients.
Contact: info@stepstoneoverseas.com
2. Information We Collect
We collect information you provide directly when using our WhatsApp chatbot or contacting us:
- Identity data: Full name, date of birth, CNIC number (when required for visa applications).
- Contact data: WhatsApp phone number, email address.
- Education data: Academic qualifications, GPA, passing years, English test scores (IELTS/PTE/TOEFL).
- Financial data: Monthly income range, bank balance range — collected solely for visa eligibility assessment. We do not collect bank account numbers or payment card details.
- Travel data: Passport details (bio-data page scans for ticketing), travel history, previous visa refusals.
- Conversation data: Messages you send to our WhatsApp chatbot, including form responses and document uploads.
- Technical data: WhatsApp sender ID, message timestamps, message type metadata provided by the Meta Business Platform.
3. How We Use Your Information
We use your data for the following purposes, each resting on a lawful basis:
- Service delivery (contract): To assess your eligibility, prepare visa applications, enrol you in test prep batches, book flights, or process Umrah packages.
- Communication (contract / legitimate interest): To send updates, document requests, and application outcomes via WhatsApp or email.
- Lead management (legitimate interest): To assign your case to a senior counsellor, track progress, and ensure timely follow-up.
- Legal compliance (legal obligation): To comply with Pakistani law, embassy requirements, and Meta's WhatsApp Business policies.
- Service improvement (legitimate interest): To analyse conversation flows using aggregated, anonymised data only.
We do not use your data for unsolicited marketing, sell it to third parties, or use it for automated decision-making that produces legal effects without human review.
4. WhatsApp & Meta Platform
Our chatbot operates through the Meta WhatsApp Business Platform. When you message us on WhatsApp:
5. Data Storage & Security
Your data is stored in a managed PostgreSQL database (Supabase) hosted on Amazon Web Services (AWS). We implement the following safeguards:
- All data transmitted between our systems is encrypted in transit using TLS 1.2 or higher.
- Database access requires authentication and is restricted to authorised personnel only.
- Sensitive fields (passport scans, financial estimates) are handled with additional access controls.
- We conduct periodic reviews of our security practices.
No method of electronic storage is 100% secure. We take all reasonable steps to protect your data but cannot guarantee absolute security.
6. Data Sharing
We share your data only as necessary to deliver services:
- Universities and colleges: Your academic profile, when you authorise us to submit an application on your behalf.
- Visa embassies and consulates: Application documents required under their submission requirements.
- Airlines and travel partners: Passenger details required for ticket issuance.
- Umrah tour operators: Pilgrim registration data required under Saudi Ministry regulations.
- Technology sub-processors: Vercel (serverless hosting, USA), Supabase / AWS (database, USA/EU), Meta (WhatsApp Business Platform).
We do not sell, rent, or trade your personal data.
7. Data Retention
- Active leads: Retained for the duration of the application or service process plus 2 years.
- Completed cases: Retained for 5 years to comply with financial and regulatory record-keeping requirements.
- WhatsApp conversation logs: Retained for 12 months, then anonymised or deleted.
- Inactive records (no contact for 3 years): Deleted or anonymised.
You may request earlier deletion at any time — see Section 8 below.
8. Your Rights
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate or incomplete data.
- Deletion: Request that we delete your data (subject to legal retention obligations). See our Data Deletion page for the full process.
- Restriction: Ask us to restrict processing while a dispute is resolved.
- Portability: Request your data in a machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where processing is consent-based, withdraw it at any time without affecting prior processing.
To exercise any right, email privacy@stepstoneoverseas.com or send a WhatsApp message. We will respond within 30 days.
9. Cookies & Website Tracking
Our website is a static informational site. We do not use third-party analytics, advertising trackers, or cookies beyond those required for basic functionality. No cross-site tracking is employed.
10. Children's Privacy
Our services are intended for individuals 16 years of age or older. We do not knowingly collect personal data from children under 16. If you believe a minor has submitted data to us without parental consent, please contact us immediately and we will delete it.
11. International Transfers
Our infrastructure providers (Vercel and Supabase/AWS) may process data in the United States or the European Union. These transfers are made under standard contractual clauses and equivalent safeguards recognised by applicable data protection frameworks.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you via WhatsApp or email. Continued use of our services after changes are posted constitutes acceptance of the updated policy.
13. Contact Us