Privacy Policy

Last updated 5 November 2026.

1. Who we are

Learnium Consulting ("Learnium", "we", "us") helps students apply to English-taught programmes at Italian universities. Learnium Consulting is a company registered in Pakistan; part of our team lives in Turin, Italy. Data controller: Learnium Consulting. We have not appointed a data protection officer. We have not appointed a representative in the European Union or the United Kingdom. For any privacy question or request, write to us at contact@learniumconsulting.com, through our contact page or on WhatsApp at +39 351 648 0444 and mention "privacy".

2. What we collect and why

• Enquiries (contact form, the short questionnaire before a WhatsApp chat, booking a call): your name, email, phone if you give it, whether you are a student or a parent, the level, field and start date you are interested in, citizenship (and a second one if you have it), the country where you live (and, in the UAE or Saudi Arabia, the emirate or region, because it decides the Italian visa office), your latest qualification or where you are with school, for Medicine your school qualification, the subject of any university degree and whether you have sat the IMAT before, whether you will be under 18 when the course starts, and your message. We use them to answer you and advise you before you decide to work with us (legal basis: steps before a contract, GDPR Art. 6(1)(b)). Your name and email are needed so we can answer you. We send an automatic reply to confirm your message arrived, and a copy goes to our team inbox.
• How you found us: with a form we also receive the page you arrived on, the name of the website that sent you (never the full address of that page) and, if present, the campaign labels of the link you clicked. Your browser holds these only for the visit and they go to us only if you send a form, so we know which of our channels help students (legitimate interest, Art. 6(1)(f)).
• Your agreement to this policy: every form that collects your data has a box to tick (the contact form, the questionnaire before a chat or a call, the newsletter box, the portal sign-up and the family sign-in). When you tick it we keep the time and the date of the version of this policy you accepted, with the enquiry, the subscription or the account it belongs to, as proof of what you agreed to. We keep it as long as that record (section 6).
• Newsletter: your email address, to send guides and updates (your consent, Art. 6(1)(a)). Every newsletter has an unsubscribe link. If you are under 14, a parent or guardian needs to subscribe for you.
• WhatsApp and phone: your number and messages, to help you. We use them to answer you or to do the work you hired us for (Art. 6(1)(b)). WhatsApp's own terms and privacy policy also apply.
• Portal invites: the student portal is by invitation. When you are ready to start, your mentor enters your name and email address (and, if known, your study level and start year) and we email you a link to create your account. We keep the invite to let only that address sign up and to set up your file with your mentor (steps before a contract, Art. 6(1)(b)). An invite works for 30 days; one that is never used is deleted at our next yearly review (section 6).
• If you become a client (student portal): the details universities and visa offices ask for: your name as on your passport, date and place of birth, gender, nationality, contact details and address, the country where you live and your residence status there, passport and national ID numbers (or that you do not have them yet), your education history, grades and test scores, your budget and who will pay for your studies, the source and amount of your funds, any earlier visa refusal, gaps in your studies, work experience, where you will live in Italy, and the documents you upload (passport, transcripts, certificates, photos, statements of purpose and portfolios, and for the visa file a police clearance certificate, bank statements, tax returns, payslips, sponsor and property papers, birth and family certificates and health insurance). We ask for a police clearance certificate only where a visa office requires it, and use it only for your visa file. Our document reader keeps the values it reads from a document, such as grades, so that a person can check them. We use them to prepare and submit your applications and visa file (contract, Art. 6(1)(b)). Universities and visa offices require most of this: without it we cannot complete that application. Please do not send us medical details unless a university needs them; if one does, we will ask for your explicit consent first.
• Your case (clients): to run your application on time we keep, in the portal, your case plan (the route, the visa office and the dates it is planned from, whether you apply for DSU support and, from the questionnaire, the province or region of the permanent address on your Pakistani ID card, which decides whether Karachi or Islamabad handles a visa from Pakistan), dated tasks and deadlines, your applications and shortlist, test registrations and results, your visa appointment and its outcome, the decisions we record with their reasons, notes our team writes about your case, any risk points we check (for example a passport that expires too early), and the admission report our founder approved for you. For a Master's applicant we also keep the list of courses on your transcript (title, credits, year of study) and the Italian subject area each course belongs to, which a mentor confirms by hand, because some programmes ask for a minimum number of credits in certain subject areas. We show your team a Profile check for your file: for each requirement, such as your English proof, your documents and your test dates, whether it is met, still missing or not yet answered. The Profile check is worked out from the details above and decides nothing about you. Our team uses them to do the work you hired us for (contract, Art. 6(1)(b)); you see the parts meant for you on your dashboard and in your data download.
• Application logins: to apply for you we may keep the logins of accounts used for your application (university portals, test and visa sites, an email address made for them), with the username and short notes. Passwords are encrypted in a separate vault. You and the staff allowed to work on your file can reveal them, and every reveal is logged. Parents never see them (contract, Art. 6(1)(b)).
• Who pays your invoices: we ask you for the name and email address of the parent, guardian or sponsor who pays (or you tell us you pay yourself). We send every invoice to you and copy that person, and use the address only for invoices and payment reminders, so they receive the invoice without needing an account. You give it for this one purpose; it does not give them access to the family page, which stays with your approval. You can change or remove it on your dashboard at any time, and the person who pays can ask us to see or delete it. Our team sends these emails themselves from our accounts address; nothing is sent automatically. Legal basis: the contract with you (Art. 6(1)(b)). For the person who pays: our legitimate interest in sending an invoice to the person who settles it (Art. 6(1)(f)); they can object at any time.
• Family access (parents and guardians): if your mentor invites a parent or guardian to the family page, we keep their name, email address, relationship to the student, and when they were invited, signed in, approved or removed. They see only a family view of the case: the stage, milestones and dates, what the family is asked to do (and any file they upload for it), the invoices and payments, the team's names, IMAT progress figures and class details if the student takes them, the updates we publish and a report our founder approved. They never see our team's notes, decisions, risk checks, application logins or other students, and they open the student's uploaded files only if the student allows it. A student can also add a parent or guardian in their own portal: before the link is made we show them what that person will see and will not see, and adding them is the student's consent, so no second approval is needed. An adult student approves a link a mentor creates, and can remove any parent at any time in the portal, which ends their access at once. Once the student has an admitted university, the family page also shows our arrival guide for that city, which is public information. When a step is finished we write a short update for the student and the family; nothing is emailed automatically, and our team sends any message themselves. Legal basis: the contract for the parent or guardian who signs it for a student under 18, otherwise the adult student's consent (Art. 6(1)(b) and (a)).
• Contracts, invoices and payments: to bill you and because tax and accounting law requires us to keep these records (contract and legal obligation, Art. 6(1)(b) and (c)).
• If you use IMAT Practice: your account email and name, and the answers you give (which question, your choice, whether it was right, the time you took, and your mock paper results). We use them to show your progress, your mistakes and the topics to work on (contract, Art. 6(1)(b)). You, the Learnium admin and a mentor coaching you for the IMAT can see them, with any tutor notes, assignments and study plans, and they are included when you download your data. A linked parent or guardian sees progress figures and class details only, never your individual answers.
• If you take IMAT classes: your class schedule, teacher, topic, the meeting link, preparation, homework, a summary and any note for your family (contract, Art. 6(1)(b)). Classes run on Google Meet. If a class is recorded, we ask first and note who agreed; for a student under 18, a parent or guardian decides (consent, Art. 6(1)(a)), and you can withdraw at any time. The recording and its transcript are used to write the class summary, by a tool on our own computer or by a cloud AI service. Only our staff can open them, and they are deleted 3 years after the class.
• Security logs: our hosting providers record IP addresses and sign-in events to keep the website and portal safe. The portal also keeps a log of what staff do in it, kept for 3 years, and our forms keep a scrambled form of your IP address for one day to stop abuse. Our legitimate interest is keeping accounts and files safe (Art. 6(1)(f)).

Where your data comes from: mostly from you. Some comes from others: a student may give us a parent's, guardian's or sponsor's details, in which case we point that person to this policy the first time we email them or they sign in, and universities, test bodies and visa offices send us results and decisions. Cal.com sends us the details you enter when you book a call.

This website sets no cookies unless you click "Accept" in our banner, for optional analytics, and analytics never runs on student portal pages. See the Cookie Policy.

3. How we use technology, including AI

We use technology, including AI tools, to help with your application: to compare your education history with each programme's published admission rules, to read the documents you upload, and, when a class is recorded, to write its summary. Each tool receives only the information its task needs; when we compare programmes or read your documents, your name, contact details and ID numbers are removed first. Passports, bank statements and identity documents uploaded to the portal are never sent to an AI provider. A mentor checks the results, and a person checks and submits every application. AI does not decide anything about you, and universities make their own admission decisions. We also use AI to read and draft replies to emails sent to our business inbox, because answering quickly helps students (legitimate interest, Art. 6(1)(f)). It sees those emails in full, so please send documents through the portal, not by email.

4. Who sees your data

• Our team in Italy and Pakistan. Each mentor sees only the students assigned to them or whose file they work on, and only the parts the account administrator allows.
• A parent or guardian linked to your file sees the family view described in section 2, and nothing more. If you are 18 or over, this happens only after you approve it or add them yourself, and you can remove them at any time.
• Universities, Universitaly and visa authorities (Italian embassies, consulates and visa centres), and translators or apostille services you choose: only what each application needs, when you ask us to apply.
• Service providers who store or send data for us under contract: Supabase (portal database and files, stored in Switzerland, Zurich), Cloudflare (website hosting, bot protection and forwarding emails sent to our addresses), Resend (sending our emails, from its servers in Ireland), Google (our email inbox, where messages you send us arrive, Google Meet for classes, and Google Calendar if you add a class to it), Cal.com (booking calls), Documenso (signing contracts), Meta (WhatsApp), and an AI provider for the uses in section 3 (a person checks and sends every reply). Google Analytics and Microsoft Clarity only if you accept analytics. Our database and uploaded files are backed up every night in encrypted form, which only we can open, on our own computer and in our Google Drive. If your data is erased it can remain in older backups for up to about a year, until they expire, and we never restore it.

We never sell your data and never use it for anyone else's marketing.

5. Where your data is stored and sent

Learnium is based in Pakistan, and the European Commission has not recognised Pakistan as protecting personal data to the EU standard. When you give us your data directly, this policy and the security in section 8 protect it. The student portal stores your data in Switzerland (Zurich), a country the European Commission does recognise. Some of our service providers are based in, or process data in, the United States. Where you live in the EU or the UK, they are bound by the European Commission's Standard Contractual Clauses or, where certified, the EU-US Data Privacy Framework. For WhatsApp (Meta) and Documenso we rely on the data protection terms those providers publish. Our AI provider works under its standard terms for now, with training on your data switched off, and keeps what it receives for up to 30 days, longer only if its safety systems flag it; we will move to a business contract with data protection terms as our use grows. You can ask us for a copy of these safeguards.

6. How long we keep it

• Enquiries: 3 years after our last contact, because many students come back for a later intake.
• Newsletter: until you unsubscribe. We keep the proof of your agreement for 3 years after that.
• Client files, including application logins: 6 years after our work for you ends, for example if you apply again, ask us about past applications, or need proof of what we did for you.
• Class recordings and transcripts: 3 years after the class.
• The log of staff actions: 3 years.
• Contracts, invoices and payment records: 10 years after the end of the tax year they belong to, or longer if a tax or legal dispute is open.

We go through what is due every January and delete it by hand, so an item can stay a few weeks past its date.

7. Your rights

You can ask for a copy of your data and to correct it. Students with a portal account can download their data at any time from their dashboard ("Your data"). Depending on where you live, the law may also give you the right to have your data deleted, to restrict or object to its use, or to receive it in a portable file (section 11). Contact us to use any of these rights; we answer within one month and it is free. You can withdraw consent (for example to the newsletter or analytics) at any time. If you are not satisfied, you can complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live.

Your right to object: where the law gives you this right (section 11), you can object at any time to any use based on our legitimate interest, and we stop unless we have a stronger reason that the law accepts.

You can also complain to us first at contact@learniumconsulting.com; we acknowledge it and answer within 30 days.

Section 11 explains which extra rights apply where you live.

8. Keeping your data safe

The portal database and files are stored in Switzerland, encrypted in storage and in transit, and protected so that each person sees only what they are allowed to see. Staff sign in with a one-time code sent to their email and a second code from an authenticator app on their phone. If something ever goes wrong that puts your data at risk, we will tell you and the authorities as the law requires.

9. Young people

Our service is for students applying to university. If you are under 18, a parent or guardian must agree before you create a portal account and must sign any agreement with us. The onboarding form then asks for your parent or guardian's name, relationship to you, email and WhatsApp number. We use them only to contact your family about your application and for the agreement they sign, keep them with your client file for as long as that file, and a parent or guardian can ask us to see, correct or delete them like any other data. Your mentor can invite that parent or guardian, and only them, to the family page while you are under 18; when you turn 18, their access pauses until you approve it in the portal. Under 14, a parent or guardian must agree to the newsletter for you. We do not knowingly collect data from children under 13.

10. Changes to this policy

If we change how we handle data, we update this page first and, where the law requires it, ask for your consent before the change applies. The date at the top shows the current version.

11. Depending on where you live

Everything above applies to everyone. These additions depend on the country where you live (not your nationality):

• European Union, Iceland, Liechtenstein and Norway: the General Data Protection Regulation (GDPR) applies. In addition to a copy and correction, you can ask us to delete your data, to restrict or object to its use, and to receive it in a portable file. The legal bases named in section 2 are those of the GDPR. You can complain to the data protection authority of the country where you live or work, or to Italy's Garante (garanteprivacy.it).
• Switzerland: the Federal Act on Data Protection applies. You can ask us to delete your data, and complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• United Kingdom: the UK GDPR and the Data Protection Act 2018 apply, with the same rights as in the EU, including deletion. You can complain to the Information Commissioner's Office (ico.org.uk).
• Canada: you can ask what we hold about you and how it was used, withdraw your consent and ask us to delete data we no longer need, and complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). We send marketing messages only with your consent.
• United States: we do not sell your personal information and do not share it for targeted advertising. For now we do not send our newsletter to people we know are in the United States or Canada.
• Saudi Arabia: the Personal Data Protection Law applies. You can ask us to correct, complete or destroy your data, and complain to the Saudi Data and AI Authority (SDAIA). Transfers outside the Kingdom are protected as described in section 5.
• United Arab Emirates and Qatar: where your national data protection law gives you rights such as correction and deletion, you can use them as described in section 7.
• Pakistan and other countries: you can get a copy of your data and correct it at any time. The keeping periods are in section 6, and your data is protected as described in this policy and never used for anything else.