1. Data Controller (Verantwortliche Stelle)
In the sense of Art. 4(7) GDPR and Turkey's KVKK Art. 3, the data controller is:
TechNS UG (haftungsbeschränkt) Ludwig-Erhard-Str. 16A, 61440 Oberursel (Taunus), Germany Email: admin@applytogerman.com — Phone: +49 6171 277 51 37
We have not appointed a Data Protection Officer (Datenschutzbeauftragter); inquiries may be directed to the address above.
2. Personal Data Collected
| Category | Data | When |
|---|---|---|
| Access data | IP (hashed), browser, referrer, path | Every page view |
| Account data | Name, email, password (bcrypt) | On registration |
| Newsletter | Email, name (optional) | On subscription |
| Reviews | Name, email, university review | On submission |
| Cookies | Session, language, consent state | Browser cookies |
| Analytics data | Page views, click and scroll behaviour, session recordings and heatmap data (Microsoft Clarity), device and browser information | Only if you consented to analytics |
3. Purposes & Legal Basis
- Service provision (university discovery, comparison) — Art. 6(1)(b) GDPR, contract performance
- Security & abuse prevention — Art. 6(1)(f) GDPR, legitimate interest
- Newsletter — Art. 6(1)(a) GDPR, explicit consent (double opt-in)
- Analytics — Art. 6(1)(a) GDPR, explicit consent, and § 25(1) TDDDG (Google Analytics 4, Microsoft Clarity and our own page-view counter; they do not run without consent)
- Legal obligations — Art. 6(1)(c) GDPR (e.g. tax record retention)
4. Retention Periods
- Access logs — Anonymized after 90 days
- Account data — Until deletion request
- Newsletter — Until unsubscribe
- Reviews — Until removed by author or moderator
- Legal obligations (tax) — 10 years (HGB § 257, AO § 147)
5. Third-Party Data Transfer
We share data only with:
- Hosting: All-Inkl (KASSERVER.COM), EU/Germany
- Email delivery: Brevo (formerly Sendinblue), EU, GDPR-compliant
- CDN/fonts: None (self-hosted Inter font, no Cloudflare)
- Analytics: Google Analytics 4 (Google Ireland Ltd., measurement ID
G-D0VB1M1RKF) and Microsoft Clarity (Microsoft Ireland Operations Ltd.; heatmaps, click and scroll analytics, session recordings) — only with your explicit consent
Analytics tools are loaded only once you consent. Our contracting parties are the EU entities (Google Ireland Ltd., Microsoft Ireland Operations Ltd.); in operating the services, data may reach the US parent companies (Google LLC, Microsoft Corporation). Where data is transferred to the United States, reliance may be placed on the relevant adequacy decision if the recipient holds a valid certification under the EU-U.S. Data Privacy Framework; for transfers not covered by the DPF, appropriate safeguards such as the EU Standard Contractual Clauses may be used to the extent applicable. If you do not consent, these tools do not run and no such transfer takes place.
6. Cookies
See our Cookie Policy. Summary:
- Essential: Session (CSRF, login), language preference
- Analytics: Google Analytics 4 and Microsoft Clarity cookies (
_ga,_ga_*,_clck,_clsk) and our own counter (almanyauni_uid) — only if you consented. You can withdraw consent at any time in the cookie settings. - Advertising: None
7. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)
- Access — Know what data we store about you
- Rectification — Correct inaccurate data
- Erasure ("right to be forgotten") — Delete your account and all data
- Restriction — Stop specific processing
- Portability — Receive your data in a machine-readable format
- Objection — Object to processing based on legitimate interest
- Complaint — File with the Hessian DPA (HBDI) or KVKK Authority
Contact: admin@applytogerman.com
8. SSL/TLS Encryption
All connections are encrypted with HTTPS (TLS 1.2+). The 🔒 icon in your URL bar confirms encrypted communication.
9. Automated Decision-Making
No automated decision-making or profiling per Art. 22 GDPR is performed.
10. Changes to this Policy
We may update this policy due to legal changes or service updates. Material changes will be notified via email or a site banner. The effective date is shown above.