Privacy notice

Last updated: 10 October 2026

Who is responsible (controller)

The controller of the personal data described in this notice is the operator of apply.edu.pl and aplikuj.edu.pl. For any privacy matter, including the rights listed below, write to hello@apply.edu.pl. No data protection officer has been appointed.

What we process, why and on what legal basis

apply.edu.pl is a static catalogue. We do not require accounts and we do not collect personal data through forms on this site today. The sections below cover every situation in which personal data is processed when you use the site.

Some things are stored only on your device and are never sent to us: your cookie-consent choice (localStorage key cookie-consent), your shortlist and comparison list, and your preferences. They are listed in our cookie policy.

Every visit: delivering the site and keeping it secure

• Purpose. Delivering pages to your browser, security, preventing abuse (including limiting the rate of requests) and troubleshooting.
• Data. Whatever you choose on the cookie banner, our web server keeps standard access logs of requests to the site: your IP address, the time of the request, the address (URL) requested, the response status, the referring page and your browser's user agent. Our CDN and security provider, Cloudflare, stands in front of the site and processes the same request data, including IP addresses. Cloudflare may set a strictly necessary security cookie (see the cookie policy). These logs are separate from the analytics log described below.
• Legal basis. Our legitimate interests in delivering the site and keeping it secure (Article 6(1)(f) GDPR).
• Recipients. Our hosting provider and Cloudflare, Inc. (see Who receives your data).
• Retention. The web server's access logs are rotated daily and 14 rotations are kept, so entries are deleted after about two weeks. Cloudflare states that it processes this kind of data on behalf of its customers for a limited period of time.

Our own usage measurement: only after you accept

• Purpose. Seeing which pages and links are useful, so that we can improve the catalogue.
• Data. Measurement starts only after you choose “Accept” on the cookie banner (or accepted earlier on this device). Until you choose, and if you choose “Decline”, nothing is measured and nothing is stored for it. Measurement uses no cookies. Once you accept, a random visit id is kept in your browser's sessionStorage under the key ae_sid until you close the tab. Each measurement event sends that visit id and: the page path; the host name of the referring site (never its full address); for clicks, the link type, an identifier of the item clicked (for example the university or programme) and the destination host; how long the page was viewed and how far it was scrolled; and your country as supplied by our CDN's request header. No IP address is written to our analytics log. Measurement honours your browser's Do-Not-Track setting: with it on, nothing is measured even after Accept.
• Legal basis. Your consent (Article 6(1)(a) GDPR).
• Recipients. Our hosting provider; the requests pass through Cloudflare.
• Retention. The visit id stays in your browser until you close the tab. The raw event log is rotated weekly and four rotations are kept, so entries are deleted after about five weeks. The statistics derived from it are aggregate counts.

Cloudflare Web Analytics: only after you accept

• Purpose. Page-load performance and visit statistics provided by our CDN provider.
• Data. After you accept, the same script also loads Cloudflare Web Analytics: a third-party script from cloudflareinsights.com that sets no cookies. It is not loaded before you accept or if you decline. Cloudflare states that Web Analytics collects the minimum amount of information (timing metrics) and that it does not track individual end users across its customers' websites. As the other end of the connection, Cloudflare receives your IP address.
• Legal basis. Your consent (Article 6(1)(a) GDPR).
• Recipients. Cloudflare, Inc.
• Retention. Cloudflare makes these statistics available to us for the previous six months.

“Ask an advisor” chat: only after you accept

• Purpose. Answering your questions about studying in Poland through an AI chat assistant.
• Data. The chat is a third-party service, DM Champ (OneGlimpse B.V., the Netherlands). Its widget loads only after you choose “Accept”; your browser then connects to the servers the widget is delivered from (api.dmchamp.com and api.youraiconnector.com), which receive technical data such as your IP address, and the widget may set its own cookies or storage. If you use the chat, the provider processes the messages you type and the replies. Your first message is sent together with the context of the page you are on: its title and address and, where shown, the programme, university, city and tuition fee. Please do not type sensitive information into the chat.
• Legal basis. Your consent (Article 6(1)(a) GDPR).
• Recipients. DM Champ, which according to its privacy policy acts as a processor for conversation data, and the service providers on its sub-processor list.
• Retention. According to the provider's privacy policy, conversation data is kept for as long as the contact record of the conversation exists in our account with it, and for up to 90 days after deletion in backups. The provider states that it keeps server logs and security events typically for up to 12 months. You can ask us to have a conversation deleted.

Maps

• Purpose. Showing where universities and cities are.
• Data. University pages, city pages and the map page show maps from OpenStreetMap, a third party. Your browser requests an embedded map from www.openstreetmap.org, or map tiles from tile.openstreetmap.org, so OpenStreetMap receives your IP address and the usual technical details of the request, including the address of the page or site that shows the map. This happens as soon as the page loads (for an embedded map, when it is about to scroll into view), without any click and whatever you chose on the cookie banner. The “Activate map” button starts nothing: it only lets you scroll and zoom a map that has already loaded.
• Legal basis. Our legitimate interests in delivering the site, here its maps (Article 6(1)(f) GDPR).
• Recipients. OpenStreetMap (the OpenStreetMap Foundation).
• Retention. OpenStreetMap's own privacy policy applies to what it does with that request.

Messages you send us (e-mail)

• Purpose. Answering you.
• Data. Your e-mail address and the content of your message.
• Legal basis. Our legitimate interests in answering messages sent to us (Article 6(1)(f) GDPR).
• Recipients. Our e-mail hosting provider.
• Retention. For as long as needed to deal with your enquiry.

Outbound links to universities

When you click through to a university's website or application system, we append referral parameters (for example utm_source=apply.edu.pl) to the destination link. This information is read by the university's own analytics, not by us.

Who receives your data

• Hosting provider. The site runs on a virtual server in a data centre in Finland (EU), rented from a provider in Poland.
• Cloudflare, Inc. Our CDN and security provider, in front of the site, and the provider of Cloudflare Web Analytics. Under Cloudflare's data processing addendum it acts as a processor.
• E-mail hosting provider. A provider in Poland.
• DM Champ. The chat, only after you accept.
• OpenStreetMap. Receives map requests directly from your browser.
• Universities you click through to. They receive your visit like any website does, together with the referral parameters above.

Transfers outside the European Economic Area

• Our hosting is in Finland and our e-mail provider is in Poland, both in the EEA.
• Cloudflare may process data outside the European Economic Area. Cloudflare states that for transfers to the United States it relies on its certification under the EU-U.S. Data Privacy Framework, and that it uses the European Commission's standard contractual clauses for other international transfers and if that certification lapses. Details are in its data processing addendum and on its GDPR page.
• DM Champ states that personal data is primarily processed in the European Union (the Netherlands and Germany) and that, where data is transferred outside the EEA, it relies on the European Commission's standard contractual clauses, the EU-U.S. Data Privacy Framework where applicable, and adequacy decisions.
• OpenStreetMap states that it stores data in the United Kingdom and the Netherlands and that map tiles are provided by a global network of cache servers, so a map request may be handled outside the EEA.

Your rights

You have the right to access your data, to have it rectified or erased, to have its processing restricted, to data portability, and to object to processing that is based on legitimate interests. To use any of these rights, write to hello@apply.edu.pl.

Where processing is based on your consent, you can withdraw it at any time with “Cookie settings” in the footer: it forgets your choice, measurement stops and the banner returns. Withdrawal does not affect the lawfulness of processing before it.

You have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

Do you have to provide data?

Providing data is voluntary. Your browser sends the technical data of a request automatically, and a page cannot be delivered without it. Measurement, Cloudflare Web Analytics and the chat are optional: if you decline, the rest of the site works the same.

Automated decisions

We do not use automated decision-making or profiling.

Children

apply.edu.pl is not directed at children.

Third-party sites

We link to university websites, official sources and maps. Once you leave apply.edu.pl, those sites' own privacy policies apply.

Contact

Questions about privacy? Email hello@apply.edu.pl.