Privacy Policy

1. Who We Are

GradGermany (“we”, “us”, “our”) is an education consultancy that helps international students apply to universities in Germany. This Privacy Policy explains what data we collect when you use our website and services, how we use it, and what rights you have.

This policy applies to our website at gradgermany.com, the student portal, and any services we provide (collectively, the “Platform”). It should be read alongside our Terms & Conditions.

2. Data Controller

The data controller is GradGermany, contactable at [email protected].

3. What Data We Collect

We only collect data that is necessary to provide our services:

• Account data: Name, email address, password (stored encrypted), phone number, date of birth, nationality, current education level, and target intake semester
• Contact form data: Name, email, phone, subject, and message — collected when you submit a contact or enquiry form, even without creating an account
• Application data: Documents you upload (transcripts, certificates, CVs, letters of recommendation, etc.), application status, and consultant notes related to your case
• Communication data: Messages exchanged with your consultant through the Platform
• Technical data: IP address, browser type, and session cookies — collected automatically when you visit the website

We do not collect financial or payment card data directly. If we introduce payments in future, they will be processed by a secure third-party payment provider.

4. How We Use Your Data

• To provide our services: Evaluate your profile, manage your application, coordinate with universities, and communicate with you about your case
• To respond to enquiries: Reply to contact form submissions and schedule appointments
• To send notifications: Application status updates, document feedback, appointment reminders, and new messages from your consultant
• To improve the Platform: Understand how the website is used so we can fix issues and improve the experience
• To comply with the law: Fulfil legal obligations and respond to lawful requests from authorities

We show third-party ads (Google AdSense) and measure ad effectiveness (Meta Pixel) only after you accept marketing cookies. We do not sell your personal data to third parties or share it with data brokers.

5. Who We Share Your Data With

We only share your data when necessary to deliver our services or, with your consent, to measure how the site is used:

• Universities: When submitting your application on your behalf
• Hosting provider: Our server is hosted by Hetzner (Germany). Your data is stored on servers located in Germany
• Email provider: To send you notifications and service emails
• Google (Analytics): Anonymised site-usage analytics — only if you accept analytics cookies
• Microsoft (Clarity): Session recordings and heatmaps to improve usability — only if you accept analytics cookies. Text content on the page is masked before it leaves your browser
• Meta (Facebook Pixel): Advertising-effectiveness measurement — only if you accept marketing cookies
• Google (AdSense): Serves third-party display ads on the site — only if you accept marketing cookies
• AI providers (OpenAI, Google Gemini — USA): When you request a profile evaluation and give explicit consent, your profile details and any documents you upload are analysed by these services to generate a draft assessment, which a consultant reviews before it is shared with you
• Legal authorities: Only if required by law

We do not sell your data or share it with data brokers.

5a. AI-Assisted Evaluation & International Transfers

If you submit a profile evaluation and tick the dedicated AI-consent box, the details you provide and any documents you upload (for example transcripts, certificates or your passport) are sent to OpenAI and Google Gemini in the United States to produce a draft evaluation. This is automated assistance only — a human consultant reviews and may adjust the result before it is published to you, and you may ask us to re-do the assessment without AI. This processing happens only with your explicit consent; if you do not consent, we cannot generate the evaluation. Because these providers are in the USA, your data is transferred outside the EU/EEA; we rely on the providers' data-processing terms and standard contractual safeguards for that transfer. You can withdraw this consent at any time by contacting our Grievance Officer (section 11), after which we stop any further AI processing of your data.

6. Cookies

Essential cookies (always active — required for the Platform to function):

• Session cookie: Keeps you logged in while you use the Platform
• CSRF token: Protects forms against cross-site request forgery
• Consent cookie: Remembers whether you accepted or declined optional cookies

Analytics cookies (only loaded after you click "Accept" on our cookie banner):

• Google Analytics 4: Anonymised page-view and visitor counts
• Microsoft Clarity: Session recordings with text content masked, to spot usability issues

Marketing cookies (only loaded after you click "Accept" on our cookie banner):

• Meta Pixel: Measures the effectiveness of our ads on Facebook and Instagram
• Google AdSense: Serves third-party display ads and sets advertising cookies/identifiers

If you decline, none of the analytics or marketing cookies above are loaded. You can change your mind at any time by clearing your browser's site data for this domain — the cookie banner will then reappear.

7. Data Retention

• Account data: Kept while your account is in use. You may request deletion at any time
• Inactive accounts: If you do not log in or use your account for 4 months, we email you a warning; if there is still no activity after a further 14 days, your account and its data are automatically deleted. Simply logging in (or emailing us to ask us to keep your data) resets this
• Contact form submissions: Kept for up to 2 years, then deleted
• Application records: Kept for 6 years after completion of services (as required by German commercial law)

8. Data Security

Your data is protected by:

• HTTPS encryption on all connections (via Cloudflare)
• Encrypted password storage (bcrypt)
• Role-based access controls (students, consultants, and admins see only what they need)
• Server hosted in Germany (Hetzner), subject to EU data protection standards

9. Your Rights (DPDP Act 2023 — India)

GradGermany primarily serves Indian students. Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of your personal data and processing activities
• Correct or erase data that is inaccurate or no longer needed
• Grievance redressal through our Grievance Officer (see below)
• Nominate another person to exercise your rights in case of death or incapacity

11. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000:

Shikha Gupta
E-Mail: [email protected]
Phone: +91 879 9797 088

We will acknowledge your request within 48 hours and resolve it within 30 days.

12. How to Request Data Deletion

• Registered users: Email [email protected] from your registered email address with the subject “Data Deletion Request”
• Non-registered visitors: Email the same address with the email or details you used when contacting us

We will process your request within 30 days and confirm deletion by email. Some data may be retained where required by law (e.g. tax or accounting records).

13. Children

Our services are not directed at anyone under the age of 16. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this policy from time to time. Changes will be posted here with an updated date. We will notify registered users by email of any material changes.

15. Contact Us

GradGermany — Data Protection
Grievance Officer: Shikha Gupta
Email: [email protected]
Phone: +91 879 9797 088
Website: gradgermany.com