Privacy policy

Controller

Scindu is the controller of your personal data in Scindu Clubs. Contact for all data questions and requests: iwo@scindu.com.

What we process

• Account data: name, e-mail address, password hash, university, language, the date you accepted the terms, and login records.
• Profile data you enter: faculty, programme, degree and year of study, average grade, languages, skills, interests, achievements, links, a short bio, residence and the situations you choose for scholarship matching.
• Documents you upload, such as a CV or a transcript, and the information we extract from them.
• Club data: the club profile, members and roles, projects, needs and invite links.
• Usage data: pages and actions you use in the service, device and browser data, and technical logs.
• Company requests: contact details and the message a company sends through the form.
• Messages you send us.

Sensitive data

Some scholarship situations, such as disability, are health data. We process them only with your explicit consent. You give it when you select that situation in your profile. It is optional. You withdraw it when you remove the selection. We use this data only to match you with scholarships, and we never show it to clubs or companies.

Why we process it and the legal basis

• To provide the service you signed up for: your account, club pages, member directories, scholarship and opportunity matching, and reading the documents you upload to fill your profile. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• To show your details to companies and to send you opportunity alerts, when you turn these settings on. Basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your profile.
• To analyse and improve the service, develop new Scindu products and features, keep the service secure, and prevent abuse. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To build statistics and anonymised datasets about student clubs, skills and research interests, and to use them in Scindu's offer to companies, universities and funders. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To establish, exercise or defend legal claims, and to meet legal duties such as accounting. Basis: Art. 6(1)(f) and Art. 6(1)(c) GDPR.

Anonymised and aggregated data

When data can no longer identify you, it is not personal data. Scindu may keep and use anonymised and aggregated data for any purpose, also after you delete your account. Examples: the number of students with a skill at a university, or the share of clubs that work on a field.

Automated tools and AI

We use automated tools to match you with scholarships and opportunities, and AI models to read documents you upload and to suggest profile entries. These tools give suggestions only. They do not make decisions with legal or similarly significant effects on you. Check the suggestions before you save them.

Who receives your data

• Other users, as the service shows it: public club pages show the club profile, projects, open needs, board names and titles, and the number of members per skill. Members of a club see each other's profiles. Your documents, grades and situations are visible only to you.
• Companies, only if you turned on the sharing setting in your profile.
• Our service providers, who process data for us under a data processing agreement: Supabase (database, login and file storage, servers in the EU), Vercel (hosting and privacy-friendly analytics), Resend (sending account e-mails such as password resets, from servers in the EU) and OpenAI (AI reading of uploaded CVs to suggest profile entries; the file is sent when you upload a CV or ask us to read it again; OpenAI does not train on it and keeps it for at most 30 days for abuse monitoring).
• Public authorities, when the law requires it.
• A buyer or successor of Scindu or its business, if the business is sold or reorganised. The successor must respect this policy.
• We do not sell personal data.

Transfers outside the EEA

Some providers, such as Vercel, Resend and OpenAI, may process data in the United States. We use transfers based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.

How long we keep it

• Account, profile and club data: while your account exists. We delete it within 30 days after you delete the account, except for anonymised data.
• Documents: until you delete them or your account.
• Usage data and logs: up to 24 months. After that we delete or anonymise them.
• Company requests and messages: up to 3 years after the last contact, for possible claims.
• Backups are overwritten in a regular cycle of up to 30 days.

Your rights

• You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interest.
• Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect earlier processing.
• To use a right, write to iwo@scindu.com. We reply within one month.
• You can complain to the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

Required and optional data

Your name, e-mail address and university are necessary to create an account. All other profile data, documents and settings are optional. Without them, matching is less precise.

Cookies

We use only the cookies needed to keep you logged in and to remember your language. Our analytics does not use cookies and removes query strings from page addresses.

Age and changes

• The service is for people aged 16 or older.
• We may update this policy. The date at the top shows the current version. We tell users about important changes by e-mail or in the service.

Sample data

Opportunities marked Sample, and the example club, are illustrative. They do not describe real calls, funders or people.