Privacy Policy

This document is provided in English. Last updated: August 2026.

1. Controller

The controller responsible for the processing of personal data on this platform within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

Tekbyte UG (haftungsbeschränkt)
Barbarossastraße 42, 63128 Dietzenbach
Germany
Email: apply@tekbyte.de

2. What data we collect

Depending on how you use ApplyEuro, we process the following categories of personal data:

• Account data: name, email address, password (stored as a salted hash), preferred language, and account settings.
• Applicant profile data: nationality, date of birth, educational history, grades and transcripts, language test results, and — where you upload them — identity documents such as your passport and certified academic documents.
• Payment data: bank-transfer receipts and payment references you submit for Premium activation. We do not store bank card details.
• Communication data: messages exchanged with our advisors through in-app chat, and notes or logs from consultation calls you book with us.
• Technical data: data strictly required to operate the service, such as session tokens and your theme preference (see section 8 on cookies and local storage).

3. Purposes and legal bases

We process personal data only for the following purposes and on the following legal bases:

• Providing the service (eligibility evaluation, university matching, application guidance, Premium features) — Art. 6(1)(b) GDPR (performance of a contract).
• Processing documents you upload (passport, transcripts, certificates) for evaluation and application preparation — Art. 6(1)(b) GDPR, and Art. 6(1)(a) GDPR (consent) where you voluntarily provide documents beyond what is required.
• Verifying payments and keeping records of Premium purchases — Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention obligations under German commercial and tax law).
• Service security and abuse prevention (session management, fraud prevention) — Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable platform).
• Responding to your enquiries via email or chat — Art. 6(1)(b) or Art. 6(1)(f) GDPR.
• AI-assisted evaluation of your profile against matching programmes, where you have switched it on — Art. 6(1)(a) GDPR (consent). See section 5. This is optional; the service works without it.

Where processing is based on consent (Art. 6(1)(a) GDPR), you may withdraw your consent at any time with effect for the future.

4. Processors and recipients

Your data is stored on our self-hosted server infrastructure located in Germany. We use the following processors under data processing agreements pursuant to Art. 28 GDPR:

• Hosting: self-hosted server infrastructure operated by 1blu AG, Germany.
• Email delivery: 1blu AG, Germany (SMTP provider used for transactional emails such as verification and notification messages).
• AI-assisted evaluation: Google Ireland Limited (Google Gemini API). Used only where you have switched on AI-assisted evaluation, and only to produce your programme recommendations. See the section below for exactly what is sent.

We do not sell personal data and do not share it with third parties for advertising purposes.

5. AI-assisted evaluation

Premium members can switch on AI-assisted evaluation, which uses the Google Gemini API to estimate your admission chances for each matching programme and to explain the estimate in your language. This is off by default. Until you switch it on, your data is never transmitted to Google and your matches are ranked by our own calculation running on our servers in Germany.

When it is switched on, each evaluation sends exactly these six fields:

• Your highest qualification (for example: bachelor’s degree)
• Your field of study
• Your grade or percentage
• Your language test results (IELTS, TOEFL, German CEFR level)
• Your mathematics ECTS credits, where you have entered them
• Your stated goal (university study or Opportunity Card)

Alongside these, we send the public catalogue details of the programmes being compared, and your interface language so the explanation comes back in it.

Your name, email address, date of birth, nationality, passport number and every uploaded document are never sent to Google. Google receives no information that identifies you by name.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time from the recommendations section of your dashboard; withdrawal takes effect immediately for all future evaluations, and evaluations already produced remain in your account until you delete them or your access expires. Withdrawing does not affect the lawfulness of processing carried out beforehand.

Google processes this data as our processor under Art. 28 GDPR. Transfers outside the EU are covered by the European Commission’s Standard Contractual Clauses. Note that Google’s terms for the paid Gemini API and for its free tier differ in whether submitted content may be used to improve Google’s models — we use the paid tier precisely so that your data is not used for model training.

6. International transfers

Your account data, uploaded documents and communications are processed within the European Union on our servers in Germany and are not transferred outside the EU/EEA.

The one exception is the AI-assisted evaluation described in section 5, and only if you switch it on. Our contracting party there is Google Ireland Limited, based in the EU; where Google processes data outside the EU/EEA as part of that service, the transfer is covered by the European Commission’s Standard Contractual Clauses together with supplementary measures (Art. 44 et seq. GDPR). Switching the feature off stops any such transfer for future evaluations.

7. Retention

• Uploaded documents (passport, transcripts, certificates) are permanently deleted no later than 6 months after your Premium plan expires, unless you delete them earlier yourself.
• Payment records are retained for the statutory retention periods under German commercial and tax law (up to 10 years, § 257 HGB, § 147 AO).
• Account data is retained for as long as your account exists and deleted upon account deletion, subject to statutory retention obligations.
• Chat and call logs are retained for the duration of the advisory relationship and deleted together with your account.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy (Art. 15 GDPR); you can export your data directly from the in-app Settings page.
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure ("right to be forgotten", Art. 17 GDPR); you can delete your account and all associated data from the in-app Settings page at any time.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Object to processing based on legitimate interests (Art. 21 GDPR).
• Lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular the data protection authority of the German federal state in which we are established.

To exercise any of these rights, use the in-app Settings page or contact us at apply@tekbyte.de.

9. Cookies and local storage

We do not use tracking cookies, advertising cookies, or third-party analytics. The platform stores only strictly functional data in your browser: your theme preference (light/dark mode) and session tokens that keep you signed in. This storage is technically necessary to provide the service you request (§ 25(2) TDDDG, Art. 6(1)(b) GDPR) and therefore requires no consent banner.

10. Data security

We apply appropriate technical and organisational measures (Art. 32 GDPR), including encrypted transport (TLS), access controls, and encrypted storage of sensitive documents, to protect your data against loss, misuse, and unauthorised access.

11. Changes to this policy

We may update this privacy policy to reflect changes in the service or in the law. The current version is always available on this page; material changes will be announced in the app or by email.

12. Contact

For all privacy-related requests, contact apply@tekbyte.de.