This policy explains what personal data we collect on edumetric.eu and during the application process, why, who we share it with and what your rights are. We apply Regulation (EU) 2016/679 (GDPR).
Data controller
The controller of your personal data is [full company name and legal form], ul. Upalna 1A, 15-668 Białystok, Poland, tax ID (NIP) [NIP] (“Edumetric”, “we” or “us”).
For anything to do with your data, email kontakt@edumetric.eu [or a separate address, e.g. rodo@edumetric.eu], call +48 502 254 905 or write to our office. [We have not appointed a data protection officer / Data protection officer: name, email].
What data we collect
- Consultation form: name, phone, email, chosen programme and country, your message.
- Newsletter and event sign-ups: email address, the date you signed up and confirmed and, for events, which event.
- Email, phone and WhatsApp contact: contact details and the content of our correspondence.
- Recruitment Services: data universities and authorities need, such as date of birth, citizenship, address, passport details, certificates and diplomas, exam results, a photo and, where a university or authority requires it, medical certificates, which are health data.
- Student Area: the ID from your Student Card, first name, surname, nick, email, password (stored only as a cryptographic hash), account language, profile photo, university, programme, year of study, bio, chat posts, messages, friends and blocked lists, privacy settings.
- Technical data: IP address, browser and device type, server logs and information stored in cookies.
Purposes, legal bases and retention
- Legal basis
- Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in replying to correspondence)
- How long
- up to 12 months after our last contact, unless we sign an agreement
- Legal basis
- Article 6(1)(b) GDPR
- How long
- for the duration of the agreement, then until the limitation period for claims expires
- Legal basis
- Article 9(2)(a) GDPR (your explicit consent, which you can withdraw at any time)
- How long
- only for as long as the application requires
- Legal basis
- Article 6(1)(b) GDPR (agreement for electronic services)
- How long
- until the Account is deleted
- Legal basis
- Article 6(1)(f) GDPR and, for obligations under the Digital Services Act, Article 6(1)(c) GDPR
- How long
- until the Account is deleted; records of reports and moderation decisions for up to 12 months after they are handled
- Legal basis
- Article 6(1)(c) GDPR
- How long
- for the period required by tax and accounting law, usually 5 years from the end of the calendar year
- Legal basis
- Article 6(1)(f) GDPR
- How long
- until the limitation periods expire (Article 118 of the Polish Civil Code: usually 6 years, 3 years for business-related claims)
- Legal basis
- Article 6(1)(a) GDPR (your consent given in the cookie banner)
- How long
- until you withdraw consent or the cookie expires
- Legal basis
- Article 6(1)(b) GDPR (providing the service you ask for)
- How long
- up to 3 months after the event
- Legal basis
- Article 6(1)(f) GDPR, sent only after you consent to electronic communications under the Polish Electronic Communications Law
- How long
- until you withdraw consent or object
- Legal basis
- Article 6(1)(f) GDPR (making sure the number is never given to anyone else)
- How long
- indefinitely, but once the limitation period expires only the number and its “locked” status remain, with no personal data
Do you have to give us your data?
Giving us your data is voluntary, but without it we cannot reply to your enquiry, you cannot create an Account and we cannot handle your application. A profile photo, university, programme and bio are entirely optional.
Transfers outside the European Economic Area
Some of the universities we work with are based outside the European Economic Area, for example in Georgia and Ukraine. If you apply to one of them, we send them your data because this is necessary to perform an agreement concluded at your request (Article 49(1)(b) GDPR) [or: under standard contractual clauses adopted by the European Commission]. The European Commission has not found that these countries ensure an adequate level of data protection, so protection there may be weaker than in the EU.
US providers (Google, Meta) process data under the EU-US Data Privacy Framework or standard contractual clauses. Email us for a copy of the safeguards used.
Cookies and third-party tools
Cookies are small files your browser saves on your device. We use essential cookies without consent because the Website does not work properly without them. We use the others, analytics and third-party cookies, only with the consent you give in the cookie banner. You can change your consent at any time[ via the “Cookie settings” link in the footer]. You can also delete or block cookies in your browser settings.
- Who
- Edumetric
- How long
- until you sign out or close the browser, or up to 30 days with “Keep me signed in”
- Who
- Edumetric
- How long
- 12 months
- Who
- [e.g. Google Analytics 4, Google Ireland Ltd.]
- How long
- up to 2 years, only with consent
- Who
- Google, Trustpilot, Meta
- How long
- as set by the provider, only with consent
[We will confirm the list of tools once the website is live.]
Your rights
You have the right to:
- access your data and get a copy;
- have your data corrected (you can change your nick, photo, university and bio yourself in your profile);
- have your data erased (you can delete your Account yourself in Settings);
- restrict processing;
- data portability for data processed under an agreement or consent;
- object to processing based on our legitimate interest, and always to direct marketing;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise these rights, email kontakt@edumetric.eu. We will reply within one month. In justified cases we may extend this by two further months and will let you know. We may ask you to confirm your identity.
You can also lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority in the EU country where you live or work.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal effects or similarly significantly affect you. Admission decisions are made by the university.
Minors
Many of the people we help are still at secondary school. If you are under 16, creating a Student Area Account and giving consents (for example to analytics cookies) requires the consent of a parent or legal guardian. We sign Recruitment Services agreements with minors together with their legal representative.
Data security
We use an encrypted connection (HTTPS), store passwords only as a cryptographic hash, limit access to data to authorised people and make regular backups. Messages in the Student Area are not end-to-end encrypted. We never ask for your password by email, phone or chat.
Changes to this policy
We update this policy when the law, our services or the tools we use change. The date the current version took effect is shown at the top. We will email Account holders about significant changes.