Privacy Policy

Last updated: 14 September 2026

SSA Education Abroad (“we,” “our,” or “us”) is committed to protecting your privacy. This privacy policy outlines how we collect, use, protect, and share your personal data when you visit our website or use our services, including sensitive student data handled through our portal and associated third-party vendors.

What Personal Information Do We Collect?

When you apply to one of our programs, participate in activities, or inquire about our services, we may collect personally identifiable information (PII), including:

Name, email address, mailing address, and phone number
Passport number and nationality (when necessary for logistical purposes)
Health and academic information required for program participation
Flight and travel details, and other logistical data
Payment information (for processing transactions)

We may also collect personal data through forms, orders, subscription services, surveys, or specific actions that you take on our platform, such as interacting with content specific to your interests.

When Do We Collect Information?

We collect information when you:

Register on our website or portal and create an account
Complete forms or submit applications for programs
Subscribe to our newsletter or enroll in email updates
Provide additional information to support program participation or logistical coordination (travel, housing, etc.)

How Do We Use Your Information?

The information you provide is used to:

Process your application and enrollment in study abroad programs
Facilitate your program experience, including travel arrangements, housing, and logistics
Secure necessary reservations or tickets with third-party vendors (e.g., hotels, monuments)
Communicate with you regarding program updates, logistics, and operational matters
Send periodic email updates related to program services (you can opt-out of marketing messages at any time)
Monitor website traffic and improve your browsing experience through cookies and analytics
Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes. All the categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Please note: Opting out of marketing emails will not stop communication regarding your account or the essential logistics of your study abroad program.

Data Sharing with Third-Party Providers

To facilitate your study abroad experience, we may need to share limited personal data with third-party partners, including:

Hotels and student residences for booking accommodations
Monuments or event organizers to secure tickets or access to specific sites
Travel logistics partners for flight or transportation arrangements
Google Workspace services (Drive and Gmail) for document storage and communication
Other reputable service providers in case-to-case situations necessary for program execution

We ensure that all third-party vendors uphold privacy safeguards and only use your data for operational purposes relative to your program participation.

We also use a small number of analytics and advertising providers, which are listed in full in the “Analytics, Advertising and Other Service Providers” section below, together with what each one receives.

Cookies and Similar Technologies

We use cookies and similar technologies on ssabroad.org, go.ssabroad.org and account.ssabroad.org for four purposes:

Strictly necessary. Keeping you signed in to your account, remembering your cookie choices, and protecting our forms from automated abuse. These always run.
Functional. Remembering preferences such as the programme options you have looked at.
Analytics. Understanding how the site is used so we can improve it.
Advertising and measurement. Measuring whether our advertising leads to enquiries, and showing our ads to people who have already visited the site.

The providers we use for each purpose are listed in the next section.

Your choices. Our cookie notice lets you accept all, decline, or choose by purpose, and declining keeps the site fully usable. You can change your choice at any time using the Cookie Settings button on any page. If you are in the United States, the Your Privacy Choices button (our “Do Not Sell or Share My Personal Information” option), in the cookie notice and at the bottom of every page, turns off advertising and visitor-identification cookies, and stops us sharing your information with those providers for advertising. Your choice is stored in your browser, so if you clear your cookies or use another browser or device you will need to make it again.

The choices below apply on ssabroad.org and go.ssabroad.org. They depend on where you are when you visit, because the law does.

If you are in the United States. Analytics and advertising cookies run by default, and you can turn them off at any time with Reject on the cookie notice or the Cookie Settings button on any page. We also honour the Global Privacy Control browser signal: when your browser sends it, we treat it as an opt-out of the sale or sharing of your information and of advertising cookies, and the cookie notice shows you that we have done so. Some browsers, including Safari, delete a website’s stored data after about seven days without a visit, which also clears a choice you made, so you may need to make it again.

If you are in the European Economic Area, the United Kingdom or Switzerland. No analytics or advertising cookie is set until you choose. You can withdraw your consent at any time from Cookie Settings on any page. Withdrawing consent does not affect anything that happened before you withdrew it. If you decline, Google’s measurement tags may still send basic signals that set no cookies, such as the page you visited, so that we can count visits in aggregate.

Everywhere else. We ask for your choice before setting any analytics or advertising cookie.

We remember your choice for 12 months in a cookie named ssa_consent, kept for ssabroad.org so you are not asked again on every page. If we add a new purpose or a new provider, we will ask you again. We keep a record of each choice – an anonymous identifier, the date and time, the country your connection comes from, the version of our cookie notice, and what was accepted or declined – for up to seven years, as evidence of your choice.

The student portal, account.ssabroad.org, has its own cookie notice.

Analytics, Advertising and Other Service Providers

We do not use Google AdSense, and we do not use the DART cookie. Earlier versions of this policy said we did. That was out of date.

These providers receive data from your visit, in line with the choices described above.

Provider	What it does for us	What it receives	Where to learn more
Google Analytics 4 (Google LLC)	Site usage statistics	Pages viewed, device, approximate location, and a random visitor identifier	Google’s privacy policy
Metricool (Metricool Analytics S.L., Spain)	Website and marketing analytics	Pages viewed, and an identifier used to recognise a returning visitor	Metricool’s privacy policy
Hotjar (Hotjar Ltd, Malta)	Heatmaps and recordings of how our pages are used	Mouse movement, scrolling and clicks. Text you type is masked	Hotjar’s privacy policy
Google Ads (Google LLC)	Measures whether our advertising leads to enquiries and to calls booked with an adviser, and shows our ads to people who have visited the site	Whether you arrived from one of our ads, and which enquiry form you completed. When you send an enquiry or book a call with an adviser, we also send Google a scrambled (hashed) copy of the email address you gave us. Google uses it only to match it to a Google account and tell us whether one of our ads led to your enquiry or call; it cannot turn the scrambled copy back into your address. We do not do this for high-school programme enquiries, and if you are in the EEA, UK or Switzerland we only do it after you accept advertising cookies.	Google’s ad settings, where you can turn off personalised ads. To ask us not to send your scrambled email address, write to [email protected]
Meta (Meta Platforms Ireland Ltd)	Measures whether our Facebook and Instagram advertising leads to enquiries, and shows our ads to people who have visited the site	Pages you viewed on our site, and whether you completed an enquiry form	Meta’s privacy policy, and your Facebook ad preferences
Vector (Vector Technologies)	Identifies the organisation a visitor belongs to, for our university and school partnerships	Your IP address and the pages you view, matched against business data	Vector’s privacy policy
Clientify (Clientify S.L., Spain)	Our customer relationship system. Stores the enquiries you send us and the calls you book with an adviser, and records visits by people who have already enquired	Your enquiry or booking, and the pages you view once you have enquired	Clientify’s privacy policy
Google reCAPTCHA (Google LLC)	Protects our forms from automated abuse. Strictly necessary	Interaction data used to tell people apart from bots	Google’s privacy policy

We do not sell personal information for money. Sharing with our advertising and visitor-identification providers may count as “sharing” for cross-context behavioural advertising under some US state privacy laws, which is why the “Do Not Sell or Share My Personal Information” option described above exists.

Data Retention Policy

We retain personal data for as long as necessary to fulfill the operational purposes for which it was collected. While we are in the process of integrating automatic data expiration into our systems, users can request the deletion of their personal data at any time by emailing [email protected]. For compliance purposes, backup systems may retain copies of your data temporarily, but this data will be purged according to our backup cycle.

Data Security

We employ various measures to ensure your data is secure:

SSL encryption for protecting data as it is transmitted over the internet.
Restricted access to sensitive data, with internal access limited to authorized staff only.
Secure storage as part of AWS Lightsail and Google Workspace, ensuring operational confidentiality based on industry standards.

Although personal data is encrypted in transit, some data may not be encrypted during storage, but efforts toward system improvements are continuously under review.

Data Usage for Marketing

We use data for marketing purposes but ensure that marketing emails are consent-based. We differentiate between marketing emails and operational emails related to your account or program logistics. Unsubscribing from marketing communications will not impact operational, user-triggered notifications (e.g., flight change updates, application status updates).

Data Portability and User Rights

You have the right to request that your data be deleted or corrected. Requests can be directed to [email protected]. We will assess and fulfill requests per applicable GDPR, FERPA, and other legal requirements. Please note that data removal requests are processed manually, and backups or legacy data in archive systems may remain until purged during normal backup cycles.

Privacy Policy Updates

We place the latest version of this privacy policy on our website. Regular policy updates will be published, but no notifications will be directly sent to users unless explicitly required by law. We encourage users to periodically review this page for updates.

California Online Privacy Protection Act (CalOPPA)

According to CalOPPA, users visiting our website can do so anonymously. When we collect personal information, we conspicuously disclose how it will be used. We agree to:

Allow users to visit the site without revealing personal information.
Utilize a dedicated privacy link on our homepage.
Notify users of any privacy policy changes via our Privacy Policy page.

Children’s Online Privacy Protection (COPPA)

We do not knowingly collect personal data from children under the age of 13. Our college programmes are for university students. Our high-school programmes are applied for by a parent or guardian, who provides the student’s information. We do not knowingly use the personal information of anyone we know to be under 18 for targeted advertising, and we do not sell it. Parents and guardians are responsible for guiding children’s internet activity in line with COPPA. If you believe we hold information about a child that we should not, contact us at the address at the end of this policy.

Do Not Track and Global Privacy Control

We honour the Global Privacy Control signal as described in “Cookies and Similar Technologies” above.

Browsers’ older “Do Not Track” setting has no agreed meaning across the industry, and we do not treat it as an opt-out. To control what we collect, use the Cookie Settings button on any page, or, if you are in the United States, the Your Privacy Choices button in the cookie notice and at the bottom of every page.