Privacy Policy

Effective date: 8 July 2026

This Policy explains how personal data is processed when you use the admission services at apply.istu.edu.eu and the agent portal. The controller is International Science and Technology University Sp. z o.o., Janiszowska 8, 02-264 Warsaw, Poland ("the University", "we"). Financial services connected to admissions (the administration of payments, agent commissions and invoicing) are provided by ISTU INFORMATION TECHNOLOGIES L.L.C-FZ (Dubai, U.A.E), our financial-services company. Privacy contact: info@istu.edu.eu.

1. Data we collect

From applicants:

• Identity: name (in Latin letters), gender, date and place of birth, nationality (and second nationality where given), passport or national ID type and number.
• Contact: personal email address (verified with a one-time code), phone number with country code, and postal address.
• Photograph: the portrait you upload. It is checked automatically only to confirm it is a suitable single-person portrait for your student file; it is not used for automated identification, and no admission decision is based on it.
• Education and documents: the program you apply to, diplomas, transcripts, language certificates and, where required, their English translations.
• Scholarship proofs (special categories): if you apply for a scholarship based on disability, being a member of a martyr's family, or orphan status, the supporting documents you upload reveal health or family information. We process them only with your explicit consent, given by uploading them, and only to assess that scholarship; you may apply without them by not requesting those scholarships.
• Payment status: whether the required payment was received. Payments are processed by Stripe; we never receive or store card numbers.

From admitted students: a student ID number and a University Microsoft 365 account (username on the istu.edu.eu domain) created for you; the account is provisioned with Microsoft as provider.

From agents: company details and registration documents (Official Organizational Status Document, Certificate of Authorized Representative), the authorized person's name and title, contact details, and, for paying commissions, beneficiary bank details (bank name, IBAN, SWIFT/BIC, account number and holder), plus commission and invoice records.

Technical: server logs (IP address, time, requested page) kept for security and troubleshooting.

2. Purposes and legal bases

• Processing your application and communicating decisions: steps taken at your request prior to a contract of study, and our legitimate interest in running admissions.
• Verifying your email and the suitability of your photo: our legitimate interest in accurate, single-owner applications.
• Assessing disability / martyr-family / orphan scholarships: your explicit consent (withdrawable at any time before the decision by asking us to disregard the documents).
• Issuing and verifying acceptance letters: legitimate interest in preventing forged admission documents.
• Creating student accounts and records for enrolled students: performance of the study relationship.
• Managing agent accounts, commissions and invoices: performance of the agency relationship and legal (accounting) obligations.
• Security, backups and abuse prevention: legitimate interest.

3. Recipients and processors

We use a small number of service providers acting on our instructions: Hetzner Online GmbH (Germany): hosting of the application and its database; Brevo (EU): delivery of admission emails; Cloudflare: domain name services and the letter-verification service; Microsoft: the University's email domain and student accounts; Stripe: payment processing (Stripe acts as its own controller for payment data); and ISTU INFORMATION TECHNOLOGIES L.L.C-FZ (Dubai, U.A.E): our financial-services company, which receives the data needed to administer payments, agent commissions and invoices (payment status and, for agencies, the company, bank, commission and invoice details). When you type your address, the form offers suggestions by querying OpenStreetMap's Nominatim service directly from your browser; only the text you are typing is sent to it. Beyond these, data is disclosed only to University staff involved in admissions, to your agent if you applied through one, and where the law requires.

4. International transfers

The controller is established in the European Union (Poland) and the application and its data are hosted in the European Union (Germany). Limited data necessary for administering payments, agent commissions and invoices is shared with our financial-services company in the United Arab Emirates; these transfers are necessary for the performance of the payment arrangements that you, or the agency acting for you, request. All access is protected by the access controls and audit logging of the system.

5. Retention

• Applications that do not lead to enrolment: kept for 12 months after the end of the admission period, then deleted or anonymized, unless a legal claim requires longer.
• Enrolled students: application data becomes part of the student record and is kept for the duration of studies and the retention periods education and accounting law require.
• Issued acceptance letters and their verification records: kept long-term so the authenticity of University documents can always be checked.
• Agent, commission and invoice records: kept for the duration of the agency relationship and statutory accounting periods.
• Backups: encrypted-at-rest server copies on a rotating seven-day cycle.

6. Cookies

The Service uses only two strictly necessary cookies: a session cookie and a CSRF security cookie. There are no analytics, advertising or tracking cookies, which is why the Service shows no cookie banner.

7. Your rights

You may request access to your data, correction, deletion, restriction of processing, object to processing based on legitimate interest, withdraw consent (for scholarship documents) and, where applicable, receive your data in a portable format. Write to info@istu.edu.eu from the email address on your application; we answer within one month. You also have the right to lodge a complaint with a supervisory authority, the University's lead authority is the President of the Personal Data Protection Office (UODO) in Poland, and you may equally contact the authority of your own country of residence.

8. Security

Data travels only over HTTPS; passwords are stored as salted hashes; documents and letters are served through access-controlled downloads; staff actions on applications are attributed and logged; and the server is backed up nightly.

9. Children

The Service is not directed at persons under 17, and applications from them are not accepted.

10. Changes

We may update this Policy; the version on this page with its effective date applies. Material changes will be announced to applicants with pending applications by email.

← Back to the application