Privacy Policy

Last updated 1 June 2025 · Effective 1 June 2025

1. Who we are and how to reach us

This website is operated by [Registered company name] ("ScholarPath", "we", "us", "our"), a company registered in Romania under registration number [CUI / J-number], with its registered office at [registered address, Romania].

We are the data controller for the personal data described in this policy, meaning we determine why and how your data is processed. If you have any questions or concerns about how we handle your personal data, please contact us at hello@scholarpath.ro or by writing to the address above. We aim to respond to all privacy enquiries within 5 business days.

2. The personal data we collect

We apply the principle of data minimisation and collect only what is necessary for the specific purpose at hand. Depending on how you interact with us, we may collect and process the following categories of data:

Identity data — full name, date of birth, gender, nationality, and country of residence, provided when you contact us, register on our portal, or engage our services.
Contact data — email address, phone number, WhatsApp number, and postal address.
Academic and qualification data — your level of education, institution attended, graduation year, academic grades, language proficiency, and any academic certificates, transcripts, or diplomas you share with us to support your application.
Identity and travel documents — passport number, passport expiry date, birth certificate, police clearance certificate, medical certificate, and other official documents required by Romanian universities, the Ministry of Education, embassies, or immigration authorities for visa and residence-permit purposes.
Application preferences — your chosen field of study, preferred university city, intended intake year, and programme interest.
Consultation and communication data — notes from consultations, messages exchanged through our portal, and records of your application progress.
Payment data — records of transactions and invoices. Card payments and online transactions are handled by our payment service provider; we do not store your full card number or CVV.
Technical and usage data — IP address, browser type and version, device type, pages visited, and time spent on the site, collected through cookies and server logs. See our Cookie Policy for details.

Certain documents required for visa applications — such as medical certificates — may contain special-category personal data (e.g. health data) as defined under Article 9 of the GDPR. We process such data only where strictly necessary for your application and on the legal basis of your explicit consent, or where processing is necessary for reasons of public interest in the area of public health under applicable EU and Romanian law.

3. How we use your personal data

We use your personal data for the following purposes:

To respond to enquiries submitted through our contact form or by email, and to provide you with information about our services.
To assess your academic profile, identify eligible programmes and universities, and provide admissions consultancy during paid consultations.
To prepare, coordinate, and submit your application to the Romanian Ministry of Education for qualification recognition and to your chosen university.
To prepare documentation and provide guidance for your long-stay student visa application to the relevant Romanian consulate or embassy.
To assist with post-arrival formalities in Romania, including residence permit registration and university enrolment.
To communicate with you about the progress of your application and to send you service-related notifications through our portal.
To process payments, issue invoices, and maintain accounting records as required by Romanian law.
To manage your portal account and ensure the security of our platform.
To improve our website, services, and internal processes, using aggregated or anonymised analytics data where possible.
To send you marketing communications about our services where you have given your explicit consent. You may opt out at any time by contacting us or using the unsubscribe link in any marketing email.

4. Legal basis for processing

We rely on one or more of the following legal bases under Article 6 of the GDPR (and Article 9 for special-category data) for each processing activity:

Performance of a contract (Art. 6(1)(b)) — processing necessary to carry out the consultancy services you have engaged us for, or to take steps at your request before entering into a service agreement.
Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for optional marketing communications, analytics cookies, and the processing of any special-category personal data contained in your application documents. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Legal obligation (Art. 6(1)(c)) — to comply with applicable accounting, tax, and reporting requirements under Romanian law.
Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve our website and services, and to prevent fraud, where our interests are not overridden by your rights and freedoms.

We do not sell, rent, or trade your personal data to third parties. We share your data only where necessary for the purposes described above or where required by law, and only with:

Universities and higher education institutions in Romania, as part of your application for admission.
The Romanian Ministry of Education (Ministerul Educatiei), for the recognition of your foreign qualifications.
Romanian embassies, consulates, and immigration authorities, for visa and residence-permit purposes.
Translation and apostille service providers, where we coordinate the legalisation or translation of your documents on your behalf.
IT and hosting service providers, including our portal infrastructure provider, email delivery service, and payment processor, who act as data processors under appropriate data processing agreements.
Professional advisors (accountants, lawyers) bound by confidentiality obligations, where necessary for our business operations.
Competent authorities, where we are legally required or permitted to disclose data (for example, to comply with a court order or regulatory request).

Where we share data with third-party processors, we ensure appropriate contractual and technical safeguards are in place in accordance with Chapter IV of the GDPR.

6. International transfers

Because we serve students from countries around the world and submit applications to various embassies and authorities globally, some of your personal data may be transferred to, or accessed from, countries outside the European Economic Area (EEA). Where such transfers take place, we ensure adequate protection is in place, using one or more of the following safeguards:

Transfers to countries covered by an adequacy decision by the European Commission.
Standard Contractual Clauses (SCCs) approved by the European Commission.
Transmission to official government bodies (e.g. embassies) where the transfer is necessary for important reasons of public interest.

You may request a copy of the relevant safeguards by contacting us at hello@scholarpath.ro.

7. How long we retain your data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Active client data — retained for the duration of your engagement with us and for up to 3 years thereafter, to handle any queries, disputes, or follow-up applications.
Accounting and financial records — retained for 10 years as required by Romanian fiscal legislation.
Portal account data — retained while your account is active. If you delete your account, personal data is removed within 90 days unless retention is required for legal or contractual reasons.
Enquiry and contact form data (where no service is engaged) — retained for up to 12 months.
Technical and usage logs — retained for up to 12 months.

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be associated with you.

8. Your rights under the GDPR

As a data subject, you have the following rights in relation to your personal data:

Right of access — to obtain confirmation of whether we process your data and to receive a copy of it.
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure ("right to be forgotten") — to request deletion of your data where it is no longer necessary for the purposes it was collected, where you withdraw consent, or where processing is unlawful, subject to our legal retention obligations.
Right to restriction of processing — to request that we limit how we use your data in certain circumstances.
Right to data portability — to receive your personal data in a structured, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
Right to object — to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Rights in relation to automated decision-making — we do not make solely automated decisions that produce significant legal effects about you.

To exercise any of these rights, please contact us at hello@scholarpath.ro. We will respond within one calendar month of receiving your request. In complex or numerous cases, we may extend this period by a further two months, and will inform you accordingly.

You also have the right to lodge a complaint with the Romanian data protection supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro, or with the supervisory authority of the EU member state in which you reside or work.

9. How we protect your data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include encrypted data transmission (HTTPS), access controls limiting data access to authorised personnel, secure cloud infrastructure, and regular review of our security practices. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ANSPDCP within 72 hours and, where required, inform you without undue delay.

10. Processing of minors' data

Many of our clients are students who are 17 or 18 years old at the time of application. Where a client is under 18, we require a parent or legal guardian to provide consent and accept our Terms of Service on their behalf. We do not knowingly collect data from children under 16 years of age without verified parental consent. If you believe we have collected data from a minor without appropriate consent, please contact us immediately at hello@scholarpath.ro.

11. Cookies

We use strictly necessary cookies to operate the site and, with your consent, analytics cookies to understand how visitors use it. We do not use advertising cookies or sell data to advertising networks. Full details — including the specific cookies we set, their purpose, and their duration — are in our Cookie Policy. You can manage your cookie preferences at any time through the banner displayed on your first visit.

12. Changes to this policy and contact

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or business operations. The "last updated" date at the top of this page reflects the current version. Where changes are material, we will notify portal users by email or through an in-portal notification. Continued use of our website or portal after an updated policy takes effect constitutes acceptance of the revised policy.

For any questions, requests, or complaints about how we handle your personal data, please contact us at hello@scholarpath.ro.