The European Association for Higher Education Advancement MTÜ (“EAHEA”, “we”, “us”) respects your privacy. This Privacy Policy explains which personal data we collect when you visit our website, contact us, apply for or use our accreditation, certification, validation and membership services, or pay for them, why we use it, who receives it, how long we keep it and which rights you have. Personal data means any information that relates to an identified or identifiable person. We process personal data in line with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act.
This policy covers our website www.eahea.org and our online application and payment services (apply.eahea.org and payment.eahea.org), and the communication we have with you by email, phone, chat or post. If you are an applicant or a member, our Terms and Agreement apply as well. Our Cookie Policy explains the cookies of the website.
Data Controller
Data Controller: European Association for Higher Education Advancement MTÜ (registry code 80637958)
Address: Lõõtsa 6, Tallinn 15551, Estonia
Contact for privacy matters: [email protected]
Phone: (+372) 634 6234
Personal Data We Collect
- Inquiries. When you use the contact form, the help form, email, phone or the chat buttons: your name, email address, phone number, organization, country, the content of your message and any file you send.
- Applications. When you apply for a service: the details of the institution, organization or individual (name, legal status, address, country, phone, email, website), the names, positions and email addresses of the authorized person and of the primary and financial contacts, the billing name, address, registration number and VAT number, your answers to the questions of the service, and the supporting documents you upload (for example registration documents, curricula, diplomas, transcripts and certificates).
- Payments and invoices. Invoices and payment records: amounts, currency, payment method, status and transaction reference, and the bank details you give when you pay by bank transfer. Card payments are made on the payment page of Stripe. We do not receive or store your card number; we receive the confirmation of the payment.
- Certificates and membership. The records of the certificates, validation documents and memberships we issue: certificate number, dates of issue and validity, status, renewals and the history of the application.
- Security and technical data. The IP address and technical data of your browser when you submit a form, apply, pay or sign in, and your acceptance of our Terms and Agreement and of the cookie notice (date and IP address). We use them to protect the website, to prevent abuse and fraud, and as proof of your acceptance.
- Website statistics. The statistics of our website are counted on our own server. They use no cookies, do not store your IP address and use a visitor code that changes every day and cannot be traced back to you.
- Analytics and advertising data (only with your consent). If you choose Accept All in the cookie notice, Google Analytics, Google Ads and the Meta pixel collect data about your use of the website: online identifiers stored in cookies, your IP address, the device and browser you use, the pages you view, the source that brought you to the website and, when a payment is completed, its amount, currency and transaction reference (never your name or contact details). If you choose Necessary Only, none of these services is loaded.
- Communication. The emails and messages you exchange with us. They are kept in our mailboxes (Google Workspace).
We do not ask for special categories of personal data (for example data about health, religion or political views). Please do not send such data to us.
Why We Use Your Data and on Which Legal Basis
- To answer your questions and give you information. Legitimate interest and steps taken at your request before a contract.
- To process applications, review documents, issue certificates and memberships, send invoices and receive payments. Performance of the contract with you or with the organization you represent.
- To keep accounting records, to meet tax and VAT obligations and to handle legal claims. Legal obligation (for example the Estonian Accounting Act) and our legitimate interest in establishing, exercising or defending legal claims.
- To publish the status of accredited and certified institutions and members in the Verification Directory. Our legitimate interest, and the interest of students and the public, in being able to check the status of an institution or a person (see below).
- To monitor the quality of accredited institutions, to handle complaints and to protect the EAHEA name, logo and accreditation status against misuse. Legitimate interest.
- To keep the website, the forms and the payments secure and to prevent abuse and fraud. Legitimate interest.
- To tell you about our services, news and events. Legitimate interest when you are an applicant, a member or have asked us for information about similar services; in other cases only with your consent. You can object at any time (see Marketing).
- To measure the use of the website, to measure the results of our advertising and to show our advertisements (Google Analytics, Google Ads and the Meta pixel). Your consent, which you give by choosing Accept All in the cookie notice. You can withdraw it at any time.
- Optional services of other companies (a YouTube video, Google Translate, the contact buttons) and cookies that are not strictly necessary. Your consent, which you give by choosing to use them. You can withdraw it at any time.
Where we ask for your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing done before it. Where the data is necessary for a contract or for a legal obligation, we cannot provide the service without it.
Verification Directory
The purpose of our Verification Directory is to let students, employers and the public check the status of an institution, a member or a certified person. For institutions it shows the name, the services and certificates with their numbers and dates, the status (for example active, suspended, revoked or expired), and the public contact details of the institution (address, website and email), and the logo. The details of individuals are shown only while their certification is active, are not offered to search engines, and can be found only by searching the name or the certificate number. A suspended or revoked status and a short factual reason may be shown as the Terms and Agreement describe. A certificate may carry a QR code that leads to its record in the directory. If you believe a record is wrong, write to us and we will check it.
Who Receives Your Data
We do not sell your personal data and we do not share it for advertising. We share it only with:
- Our service providers (processors), who act on our instructions: our hosting provider (servers in the European Union), Cloudflare (delivery and security of the website, the Turnstile security check), Google Workspace (email and documents), and Tawcu (the contact buttons, a company based in Estonia).
- Stripe, which processes card payments on its own payment page, and the banks involved in a bank transfer.
- Google, when you choose a language other than English (Google Translate) and YouTube when you press play on a video.
- Google Ireland Limited (Google Analytics and Google Ads) and Meta Platforms Ireland Limited (the Meta pixel), only if you accept the analytics and advertising cookies. They process the data for us and, for their own purposes, as their policies describe.
- The VIES service of the European Commission, to which we send a VAT number to check that it is valid.
- Accountants, auditors and professional advisers, who are bound by confidentiality, and authorities, courts and law enforcement when the law requires it or to establish or defend legal claims.
- Awarding institutions or other bodies that we ask to confirm a document when we verify a diploma, a certificate or a validation request.
- A successor, if EAHEA is merged with or transferred to another organization, under the same protection.
The public part of the Verification Directory can be seen by anyone.
International Transfers
Our own servers are in the European Union. If you are located outside the EU and give us information, it is transferred to and processed in the EU. Some of the companies named above (for example Google, Meta, Stripe, Cloudflare and YouTube) may process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, or on standard contractual clauses and other safeguards required by the GDPR. You can ask us for more information about these safeguards.
How Long We Keep Your Data
We keep personal data only as long as it is needed for the purposes above:
- Inquiries and emails: until your question is answered and for a reasonable time afterwards, unless they belong to an application or a contract.
- Applications, documents, certificates and memberships: while the service is active and afterwards as long as needed to verify the certificate, to handle complaints and claims, and to meet legal duties. The status of an issued certificate stays in the Verification Directory for verification.
- Invoices and accounting records: seven years, as the Estonian Accounting Act requires.
- Website statistics: 12 months.
- Analytics and advertising data: kept by Google and Meta for the periods set in their services and their policies. You can withdraw your consent at any time.
- Security and activity records of our systems (including IP addresses): about six months for the records of staff actions, and 90 days for the records of payment events received from Stripe. Records that prove a payment or an acceptance of our terms are kept with the application.
When the time ends, we delete the data or make it anonymous, unless the law requires us to keep it longer.
Cookies
Our website uses the cookies it needs to work and the cookies of the services you choose to use. Cookies for analytics and advertising (Google Analytics, Google Ads and the Meta pixel) are set only if you choose Accept All in the cookie notice. Please read our Cookie Policy for the list of cookies and your choices.
Marketing
We may send you information about our services, news and events if you are an applicant or a member, have asked for information, or have agreed to receive it. We may also advertise our services on Google and Meta; with your consent, the analytics and advertising tools described above are used for this purpose. You can stop our messages at any time by writing to [email protected] or by using the link in a message. We will still send you messages that are necessary for a service you use (for example invoices, receipts and renewal notices).
Security
We protect personal data with appropriate technical and organizational measures: encrypted connections (HTTPS), access only for authorized staff with their own accounts and a protected sign-in, private storage of uploaded documents outside the public part of the website, protection against automated abuse, and payment on the secure page of Stripe. No system is completely secure, so please do not send data by email that is not necessary.
Children
Our services are for institutions, organizations and adults. We do not knowingly collect personal data of children under 18. If you think a child has given us data, write to us and we will delete it.
Automated Decisions
We do not make decisions about you that are based only on automated processing and that have legal effects on you.
Data Quality
The personal data we hold about you must be accurate and current. Please keep us informed if your data changes during your relationship with us.
Links to Other Sites
This website contains links to other sites that are not owned or controlled by EAHEA. We are not responsible for the privacy practices of those sites. Please read the privacy statements of every website that collects personal data. This policy applies only to the data we collect.
Your Rights
Under the GDPR you have the following rights:
- Access. Ask for a copy of the personal data we hold about you and check that we process it lawfully.
- Correction. Ask us to correct incomplete or inaccurate data. We may need to verify the new data.
- Erasure. Ask us to delete personal data where there is no good reason for us to continue to process it, where you have successfully objected, where we processed it unlawfully, or where the law requires erasure. We may not always be able to comply, for example when the law requires us to keep invoices or records, and we will tell you why.
- Objection. Object to processing that is based on our legitimate interest, because of your particular situation, and always to direct marketing.
- Restriction. Ask us to suspend the processing: while we check the accuracy of data, when the processing is unlawful but you do not want erasure, when you need the data for legal claims, or while we check an objection.
- Portability. Ask for the data you gave us in a structured, commonly used, machine-readable format, or to send it to another controller, where the processing is based on consent or on a contract and is done by automated means.
- Withdraw consent at any time where we rely on consent.
- Complain. You have the right to lodge a complaint with a supervisory authority. In Estonia it is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, email [email protected], www.aki.ee. You may also complain to the authority of the country where you live or work. We would be glad if you contacted us first, so we can try to solve the problem.
To use your rights, free of charge, email us at [email protected], write to Lõõtsa 6, Tallinn 15551, Estonia, or call (+372) 634 6234. We may ask you to prove your identity and we answer within one month.
Changes to This Policy
If we make material changes in the way we use your personal data, we will tell you by a notice on our website or by email. We will use your personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible purpose; if you wish to know how the new purpose is compatible with the original one, please contact us. The date of the current version is shown below.
Version: 3.1 / Date: October 28, 2026