Our Privacy Policy

IDK-Yet - Privacy Policy

Introduction

How IDK-Yet processes and protects your data

This policy explains how IDK-Yet processes your personal data and what choices you have.

A few key facts about our services and our safeguards:

• We share your data with a university only when you ask us to, for a recipient you have chosen (section 8). If we are ever acquired or reorganised, your data may pass to the new controller (section 20.2).

• Your data is not used to train or fine-tune artificial intelligence models - ours or anyone else’s.

• We do not show you advertising based on your profile, and we do not build advertising audiences from your data. Partner universities appear only in a separate Match section, which you use only if you consent (section 8.1).

• Our AI models run on infrastructure we control inside the European Union. Your answers are not sent to any external AI provider.

• Our website uses no cookies and no cross-site tracking.

• The Advisors who deliver Sessions are independent professionals, not our staff: each is a separate controller of the data they handle and answers for it (section 6.1).

How this policy is organised

This policy covers several groups of people and is divided into five Parts, so that you can go to the one that concerns you.

Language

The English version of this Privacy Policy is the official and legally binding one. Versions in other languages may have been produced with automated translation tools and may not be fully accurate. In case of any discrepancy or doubt, the English version prevails.

Availability of features

This policy describes every processing activity connected with the IDK-Yet ecosystem, including features that are not available in every market, on every platform or in every version of the App. A section applies to you only if you use the feature it describes. Where a feature requires your consent, it is not activated unless you give that consent.

PART I - GENERAL INFORMATION

1. Who we are

I Don’t Know Yet S.à r.l.-S (“IDK-Yet”, “we”, “us”, “our”) is the data controller of the personal data described in this policy, except where this policy states otherwise - in particular section 12, where a school may be the controller and we act as its processor.

We provide this policy under Regulation (EU) 2016/679 (the “GDPR”), the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework, Directive 2002/58/EC (the “ePrivacy Directive”) as transposed in the relevant Member States, and any other applicable data protection legislation, as amended or replaced from time to time (together, the “Applicable Privacy Laws”).

2. What this policy covers

This policy applies when you:

• use the IDK-Yet mobile application for iOS or Android (the “App”);

• visit or use the IDK-Yet website at idk-yet.com and its subdomains (the “Website”);

• book or attend a Session with one of our Advisors;

• contact us by email, through the App or through the Website;

• attend an event, presentation or workshop we run at a school or with a partner institution;

• apply to work with us, or work with us, as an Advisor or contributor (Part III), or deal with us as a school, university or partner contact (Part IV).

Throughout this policy, “Platform” means the App and the Website together, including our advisor dashboard, the administrative portal, our back-end systems and related technology. Some of those components are still under development; where that changes what happens to your data, this policy says so.

This policy does not apply to the independent processing carried out by third parties whose sites or services you reach from the Platform. Section 18 explains this.

3. Who this policy is about

Not every section applies to every group.

Sections 13 to 22 apply to every group, unless a section says otherwise.

PART II - STUDENTS, GUARDIANS AND WEBSITE VISITORS

4. Age requirements and the data of minors

4.1 Minimum age: 14, and how it works between 14 and 18

Nobody under 14 may use the Platform. We do not knowingly collect personal data from a child under 14. If we learn that an account belongs to a child under 14, we close it and delete its data; if you believe we hold such data, write to privacy@idk-yet.com and we will act on it.

Above 14, three things change with age. This is the whole rule:

“Guardian” means a parent or a person holding legal parental authority over the Student.

4.2 Why the line falls at 16

Article 8(1) GDPR lets each Member State set, between 13 and 16, the age at which a child can consent for themselves to an information society service. Luxembourg - where we are established - has kept it at 16, the highest figure the GDPR permits.

That is why a Student can open an account and consent for themselves from 16. Below 16, consent must come from the Guardian, who therefore opens the account. Where the law of the Student’s country of residence imposes a requirement our rule does not already satisfy, we apply it in addition. Setting the floor at 14 also means we sit at or above every national threshold in the European Union.

4.3 Why the Guardian pays, even for a 16- or 17-year-old

Reaching the age of digital consent is not the same as being able to conclude a contract. A 16-year-old in Luxembourg can validly consent to the processing of their personal data, but a contract concluded by a minor alone can be set aside. So for anything paid, the Guardian is our customer: they accept our Terms and Conditions, they make the Booking, they pay, and they are our point of contact.

For the free features - the account, the Questionnaire, the Matching Service - we rely on the performance of the contract for the account, which is accepted by the Guardian where the Student is 14 or 15 and by the Student from 16 (Article 6(1)(b) GDPR). Where the law of the Student’s country of residence does not recognise a minor’s capacity to conclude that contract, we rely instead on our legitimate interest in providing the service the Student has asked us for (Article 6(1)(f) GDPR), for which we have documented a balancing assessment. Either way the data is processed for the same purposes, in the same way, with the same safeguards.

4.4 Additional safeguards for every Student under 18

Whatever the age band, a Student under 18 is a minor: section 9 applies in full, and a Session with them takes place only on the conditions set out in section 6.3. No consent record, no Session.

4.5 Personal data of Guardians

Where a Guardian opens an account for a Student aged 14 or 15, or books a Session for a Student under 18, we process the Guardian’s own personal data: name, email address, telephone number, the confirmation of their parental authority and relationship to the Student, billing information, the record of their consent, and their correspondence with us.

Legal basis. Performance of the contract we have with the Guardian (Article 6(1)(b) GDPR) and, for the safeguarding consent record, compliance with a legal obligation and our legitimate interest in protecting young people (Articles 6(1)(c) and 6(1)(f) GDPR).

Retention. Three (3) years from the last Session booked, except for accounting records, kept for ten (10) years as Luxembourg commercial and tax law requires, and the safeguarding consent record, which follows section 9.4.

4.6 Plain-language information

Notices shown in the App where data is collected are written in plain language suited to an audience that starts at 14. They summarise this policy and do not replace it.

5. How the App works and what we process by default

The activities in this section always happen when you use the App. If you choose not to provide this data, you will not be able to use the App.

5.1 Account creation and authentication

We use your data to create your account, verify that it is really you and let you log in.

Data. Name and surname; email address; password (stored only as a salted hash, never in readable form); a one-time verification code sent to your email address or telephone number; telephone number where you provide one; your profile picture, if you add one; your age or year of birth, to run the age check described in section 4; where the Student is 14 or 15, the Guardian’s identity and the confirmation of their parental authority; user and device identifiers, including IP address, device identifiers and custom identifiers we generate.

Legal basis. Performance of the contract we have with you (Article 6(1)(b) GDPR), subject to what section 4.3 says about Students aged 16 and 17. For the age check, our legitimate interest in keeping the Platform free of users below the minimum age we have set (Article 6(1)(f) GDPR).

Retention. For as long as your account is open, and for three (3) years from your last interaction with the App after that. One-time verification codes are deleted within twenty-four (24) hours.

5.2 The Questionnaire and the Matching Service

The core of the App is the Questionnaire and the matching that follows it, carried out by our algorithm, N.i.k.i. You answer multiple-choice and free-text questions about your interests, the field you want to study, where you want to study, the languages you speak, your budget, whether you need a scholarship, and your extracurricular interests. We turn those answers into a profile, and the profile into a ranked list of institutions and programmes, each with an explanation.

Data. Your answers to the Questionnaire, including free-text answers; information about your current and previous education, results and qualifications; your language skills; your interests, preferences and objectives; your budget indications; your gender, only if you choose to provide it; your age; your country or region; the profile we derive from your answers, including the scores we compute for you against a fixed weighting scheme; the matching results we generate; your interactions with those results, such as which institutions you save or open.

How the matching works. Your answers are processed in two stages. First, deterministic rules - if/then matrices built by our methodology experts - turn your answers into a weighted profile covering factors such as subject affinity, tolerance for city size and maximum tuition. Second, that profile is passed to a search module which queries our own dataset, open datasets such as the Erasmus+ catalogue, and information published by institutions, and produces the ranking.

Where the AI runs. Our AI models are open-weight models we host ourselves, on infrastructure we control in the European Union. We do not send your answers to a third-party AI provider: nothing you write goes to OpenAI, Google, Anthropic or any comparable service. Sections 7 and 16 explain what this means for automated decision-making and for international transfers.

About your gender. Providing your gender is optional and the field can be left blank. Leaving it blank does not change your ranking and removes nothing from your results; the only difference is that we cannot surface initiatives that are addressed to a specific group. Where you do provide it, we use it to surface study programmes, equal-opportunity initiatives and inclusion projects aimed at groups that are under-represented in a given field - for example STEM programmes with dedicated scholarships for women. We do not use it for any other purpose, and we do not use it to filter out options.

Accessibility requirements. If you tell us that you need accessible facilities, so that we can filter for institutions that provide them, section 13.1 applies: we process that information on your explicit consent and use it for nothing else.

Legal basis. Performance of the contract we have with you (Article 6(1)(b) GDPR). Where you provide optional information such as your gender, your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by clearing the field.

Retention. Questionnaire answers, the derived profile and the matching results are kept for a maximum of eighteen (18) months from the date you provide them, after which they are deleted from our live systems and from those of our processors, and removed from our backups on the next backup rotation. You can delete them earlier at any time by clearing your Questionnaire in the App or by writing to us.

Where an answer has been incorporated into a Session record (section 6.3), into a safeguarding record (section 9), or into a record we must keep in order to comply with a legal obligation or to establish, exercise or defend a legal claim, that copy follows the retention period of the record it forms part of. It is not used for matching after the eighteen months have elapsed.

Where an Advisor holds a copy of an answer because you gave it to them in a Session, that copy is theirs as a separate controller and follows sections 6.1 and 6.3, not the period above.

5.3 Content moderation and misuse detection

We check free-text answers and any content you upload for content that is abusive, unlawful, off-topic or obviously random, so that the Platform stays usable and safe.

Data. The content you submit; the automated moderation score or flag produced for it; the identifiers of the account that submitted it; the outcome of any human review.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR) as regards the quality of the matching output, and our legitimate interest in preventing abuse and protecting other users, particularly minors (Article 6(1)(f) GDPR). Where the content is unlawful, compliance with a legal obligation (Article 6(1)(c) GDPR).

Human review. Automated moderation never on its own results in the closure or suspension of an account. Where a decision would have that effect, a member of our team reviews it. See section 7.

Retention. Moderation flags are kept for twelve (12) months. Records connected to a safeguarding concern follow section 9.

5.4 Customer support

We use your personal data to answer your questions and support requests and to send you administrative and technical notices about your account and the service.

Data. Name and email address; telephone number where you provide one; the content of your communication and any attachment; your account and device identifiers, so we can reproduce the problem.

Legal basis. Performance of the contract we have with you (Article 6(1)(b) GDPR).

Retention. Three (3) years from your most recent interaction with us.

5.5 Troubleshooting, security and abuse prevention

We use your personal data to keep the Platform working, to analyse, prevent and correct failures and bugs, and to prevent misuse.

Data. User and device identifiers, including IP address, device identifiers and custom identifiers we generate; telephone number; device information such as model, type, operating system version, language, device name and region; internet and network activity, including information about network usage, connectivity, latency, failures, crashes and error logs; inferences we generate about your use of the App; anything you upload when reporting an issue; authentication and access logs.

Legal basis. Our legitimate interest in ensuring the quality, security and proper functioning of our service (Article 6(1)(f) GDPR). We have carried out a balancing assessment for this processing and will provide a summary on request.

Retention. Material you upload to report an issue: seven (7) days. Security and access logs: twelve (12) months. Other technical data: a maximum of one (1) year from your most recent interaction with the App.

5.6 Service improvement and product analytics

We analyse how the App is used so that we can improve it.

Data. Device and custom identifiers; information about your interaction with the App, such as which screens you open and which features you use; inferences about your use of and experience with the App; your answers to in-App surveys; aggregated Questionnaire data.

What we do with it. Fix what is not working; measure whether a change made the App better; run user-experience research such as A/B testing; run in-App surveys; decide what to build next.

What we do not do with it. We do not use this data for advertising in any form: see section 14.

Legal basis. Our legitimate interest in improving and developing our service (Article 6(1)(f) GDPR). You can object to this processing at any time under section 17; where you do, we will stop unless we can demonstrate compelling legitimate grounds that override your interests.

Retention. A maximum of one (1) year from your most recent interaction with the App, after which the data is deleted or irreversibly anonymised.

5.7 Push notifications and in-App messages

If you allow it, we send you push notifications about your account, your matches, your Sessions and service updates.

Data. A push token generated by the operating system of your device; your device and account identifiers; your notification preferences; delivery and open events.

Legal basis. Your consent (Article 6(1)(a) GDPR), which you give in the App when you choose your notification preferences. The permission prompt shown by your operating system is a separate, technical permission: it is not by itself the consent we rely on, because it is not specific to a purpose. The storage of the push token on your device additionally requires your consent under Article 5(3) of the ePrivacy Directive. You can withdraw your consent at any time, in the App or in your device settings.

Retention. For as long as the notification permission is active, and thirty (30) days after it is withdrawn or your account is closed.

6. Advisors, mentors and Sessions

This section applies if you book or attend a Session with one of our Advisors.

6.1 Our role

We introduce you to Advisors and, when you book, we sell you the Session ourselves. The contract for the Session is between you and IDK-Yet; you enter into no contract with the Advisor. We engage Advisors under a separate written agreement to deliver Sessions on our behalf.

For data protection purposes, we and the Advisor are each a separate and independent controller. We are the controller of the personal data processed through the Platform and the tools we provide. The Advisor is the controller of the personal data they process in order to advise you and to meet their own legal and professional obligations. Neither of us processes your data on behalf of the other, and we are not joint controllers. The Advisor exercises their own professional judgement and keeps their own records, which is what makes them a controller rather than someone acting on our instructions.

What that means for you, in practice.

• Booking a Session means your data is passed to the Advisor. We do that on the basis of the contract you have with us (Article 6(1)(b) GDPR): the Session cannot be delivered otherwise. We pass on only what the Advisor needs - section 6.3 lists it.

• Each of us answers to you for its own processing. We comply with the GDPR for what we do; the Advisor complies with it for what they do, on their own account and under their own responsibility. How they organise that is their decision, not ours, and this policy does not describe it.

• You can exercise your rights against each of us for what each of us holds. Write to us at privacy@idk-yet.com for what is in our systems, and to the Advisor for what they hold. If you are not sure who holds what, or how to reach your Advisor, ask us and we will help you identify the right contact.

• Being a separate controller does not make the Advisor free to do as they like with your data. Under our agreement with them they must not extract your data from our tools beyond what is strictly necessary to deliver the Session or to comply with their own legal obligations; must keep it confidential and use it for nothing else; must not use it for marketing or to train any AI model; must not enter it into any AI tool we have not made available or approved in writing; must erase it once it is no longer needed to deliver the Session or to meet their own legal obligations; and must tell us within twenty-four (24) hours of any breach affecting it, as we must tell them.

• Where the Advisor is established outside the European Economic Area, section 16 applies.

6.2 Booking and payment

Data. The identity of the person making the Booking - the Student if aged 18 or over, the Guardian if the Student is under 18; the Student’s name and account; the date, time, duration and subject of the Session; the price and the payment status; billing details; the invoice.

We do not store your full card details. Payment is collected through a payment service provider acting as an independent controller for the card data itself.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR); compliance with our accounting and tax obligations (Article 6(1)(c) GDPR).

Retention. Booking records: three (3) years from the Session. Invoices and accounting records: ten (10) years, as required by Luxembourg law.

6.3 Delivery of the Session

Data. The Student profile, Questionnaire answers and application materials that the Advisor needs to prepare; the connection logs and the start and end times of the Session; the notes the Advisor records about the Session; any document you or the Advisor upload.

Where the Advisor’s records are kept. The Advisor records each Session in our administrative portal. That portal is under development and is not yet available; until it is, Advisors keep those records in the form we notify to them, and transfer them into the portal once it is in service. That form may be a template or a shared document we provide, in which case we are the controller of what it contains; where it is not, the Advisor’s own record of a Session sits in their systems and under their control as a separate controller. Ask us and we will tell you which applies to your Advisor.

Video. Sessions are delivered online through a professional video-conferencing service - either one we provide, or one the Advisor uses in its place and has declared to us. Where the Student is under 18, a Session takes place only through a service we have approved in writing for that Advisor, only against a confirmed Booking, and with the Advisor’s camera on, as our safeguarding rules require. Advisors may not move a Session onto any other tool or channel, and may not use a personal social-media or private-messaging account.

Written contact. We do not operate (yet) a messaging service between Students and Advisors. Where an Advisor writes to you outside a Session, they do so from the professional email address they have declared to us, and that correspondence does not pass through our systems.

Where the service is one we provide, its supplier acts as our processor under Article 28 GDPR, and section 15 identifies it. Where the Advisor uses their own professional service - which is the case wherever we have not yet made a service of our own available - its supplier is the Advisor’s supplier, not ours: the Advisor chooses it, contracts with it and is the controller of what passes through it. We tell you which service will be used when we confirm your Booking, and you may ask us at any time.

Recording. We do not record Sessions, in any circumstances. Advisors are contractually prohibited from photographing, screenshotting or recording a Student or a Session, and are required to disable recording in whichever tool they use. We cannot technically prevent a participant from recording with their own device; any such recording breaches our Terms and, for an Advisor, their contract with us - please report it to admin@idk-yet.com.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR). For the checks we make on the Booking records and on the connection logs of any service we operate ourselves, in order to verify that a Session took place as booked, our legitimate interest in the quality and safety of the service (Article 6(1)(f) GDPR).

Retention. Session notes: three (3) years from the Session. Connection logs and metadata: twelve (12) months. Records connected to a safeguarding concern follow section 9. A copy held by the Advisor as a separate controller must be erased once it is no longer needed to deliver the Session or to meet their own legal obligations; beyond that, the period is theirs to set.

6.4 Reviews

The Platform does not publish reviews today; this section applies from the date on which we make the feature available. From that date, if you leave a review of a Session, we publish it with your first name and, where you have one, your profile picture. We may also use it in our communications.

Legal basis. Your consent (Article 6(1)(a) GDPR), which you can withdraw at any time, after which we stop using the review in our communications and remove it from public display, including from the Advisor’s profile.

Retention. Until you withdraw your consent or delete the review.

7. Automated decision-making, profiling and AI

7.1 What is automated and what is not

The Matching Service is automated. It builds a profile from your answers and produces a ranked list of institutions and programmes.

This is advice, not a decision. The output of the Matching Service is a list of suggestions addressed to you. It does not decide whether you are admitted anywhere, it does not grade you, and no institution receives an assessment of you from us, except a partner university you match with, which receives your profile. Nothing follows from it automatically: you remain free to apply wherever you wish, including to institutions we did not suggest, and nothing is closed off to you as a result of a ranking. We have concluded on that basis that the Matching Service produces no legal effect concerning you and does not similarly significantly affect you, and so does not fall within Article 22(1) GDPR. We keep that conclusion under review, and the rights described below apply regardless of it.

We use automated tools to moderate content and detect misuse. No account is ever closed or suspended on the basis of automated processing alone.

7.2 The logic involved

The main factors that determine your ranking are: the affinity between the fields you express an interest in and the content of each programme; the language of instruction against the languages you say you master; the geographical constraints you set; tuition against the budget you indicate and the scholarships available; entry requirements against the qualifications you declare; and the practical characteristics you tell us matter to you, such as city size, campus type or accommodation.

Each factor carries a weight. The weighting scheme is fixed: it is designed by our methodology experts and is the same for everyone. It is not learned from your data and it does not change because of how you or anyone else uses the App. What is computed for you individually is your score against that fixed scheme. The search module produces the ranking and does not set the weights.

In the Match section (section 8.1), N.i.k.i. also compares your profile with the candidate profile each partner university gives us (the academic background, qualifications, interests, geography and study goals it is looking for) and shows you a compatibility score. Here the criteria are set by the university and change when it updates its candidate profile. Partner universities have no influence on your general results.

7.3 AI transparency

Where you interact with an AI-supported feature, we tell you so at the point of interaction. Where any text you read in the App has been produced by an AI system rather than written or approved by a person, we label it as such, so that you always know which is which.

We provide this information under Article 50 of Regulation (EU) 2024/1689 (the “AI Act”), whose transparency obligations have applied since 2 August 2026.

We have also assessed the Matching Service against point 3 of Annex III to the AI Act. Point 3(a) covers AI systems intended to determine access or admission, or to assign natural persons, to educational and vocational training institutions at all levels; point 3(c) covers systems used to assess the appropriate level of education a person will receive or be able to access, in the context of or within such institutions. The Matching Service does none of these things. It produces a personal recommendation addressed to you and plays no part in any admission, assignment or level-setting decision. A partner university receives your profile only if you choose to match with it. On that basis we have concluded that it is not a high-risk AI system. We keep this assessment documented and under review, and we will redo it if the product changes.

7.4 AI training

We do not use your personal data to train or fine-tune AI or machine learning models - neither ours nor anyone else’s. The models we run are used as they are supplied by their publishers.

We do measure how well the Matching Service and our moderation tools perform - for example by comparing two versions of a ranking, or by reviewing the outcome of human moderation decisions against what the automated tool flagged. We do this on aggregated or pseudonymised data, we use it to decide what to change in our own rules and configuration, and the results are never fed back into a model as training data.

Our Advisors are contractually prohibited from entering your data into any AI tool we have not made available or approved in writing. That prohibition covers general assistants, note-takers, meeting summarisers and translation tools alike.

8. Optional features that depend on your consent

The features in this section are never activated unless you switch them on. If you don’t consent, the matching, the rankings and the explanations remain fully available.

8.1 Partner universities

Partner universities are institutions that have a commercial agreement with us. The Match section of the App shows only them and lets you choose to be put in touch with them.

How it works. When you first open the Match section, we ask for your consent to compare your profile with the candidate profiles of our partner universities and to share it with them so that they can contact you about their programmes. If you give it, N.i.k.i. shows you the partner universities that fit your profile best. By tapping the heart on a university’s card, you tell us that you want to hear from it: we then share your profile with that university and ask it to contact you. The card names the university, says where it is and links to its privacy policy. Nothing is shared before you tap the heart, or with a university you pass on.

What is shared. Your name, email address and, if you have given it, telephone number; your age and country of residence; the level, field and start year of the studies you are looking for; your education, results, qualifications and languages, as you entered them; the programme you matched with. We do not share your free-text answers, your gender, any accessibility information, your budget indications, your compatibility scores, your matching results for other universities or anything about your Sessions.

Who the university is, in data protection terms. Once the university receives your profile, it processes it as an independent controller, under its own privacy policy and for its own purposes, and we do not control what it does with it. We share your profile only under a written agreement that allows the university to use it to contact you about its programmes and to handle any application you choose to make. Where the university is outside the European Economic Area, section 16 applies.

Applying through us. If you apply to a partner university through a link or referral code we give you, the university tells us whether you were admitted and enrolled, the programme and intake, the tuition fees paid and any scholarship or fee reduction applied. We may confirm to the university that you came through us. Unlike the rest of this section, this does not depend on your consent.

Legal basis. For the Match section, your consent (Article 6(1)(a) GDPR), which you give when you first open it for sharing your profile with the universities. If you are 14 or 15, your Guardian gives it for you (section 4.1). You can withdraw it at any time in the App settings: we then stop the comparison, remove your profile from our partner portal, share it with no further university and tell those that already received it. Withdrawal has no effect on the lawfulness of what happened before, and does not oblige the university to erase what it already received: you can exercise your rights against it directly, and we will help you identify the right contact. For the information about an application made through us, our legitimate interest in calculating and receiving our commission (Article 6(1)(f) GDPR) and, for the invoices that refer to you, compliance with our accounting obligations (Article 6(1)(c) GDPR).

Retention. We keep the record of your consent and of each sharing for three (3) years from the withdrawal of the consent or, if earlier, from the closure of your account, as evidence that the sharing was lawful. Your profile stays visible to a university in our partner portal until you withdraw your consent or close your account, and no longer than your matching results (section 5.2). Information about an application made through us: three (3) years from the last commission paid on it, and ten (10) years for invoices and accounting records.

8.2 Marketing communications

If you opt in, we send you news about IDK-Yet, our content and our ecosystem services.

Data. Your email address; your name; your preferences; delivery, open and click events, which we use only to measure whether our newsletters work, in aggregate.

Legal basis. Your consent (Article 6(1)(a) GDPR). Every message contains a one-click unsubscribe link. Unsubscribing does not affect the service messages described in section 5.4, which we must be able to send you.

Retention. Until you unsubscribe, and for one (1) year afterwards so that we can prove we honoured your choice.

8.3 Ecosystem services: housing, summer programmes, courses and certifications

We present services offered by partners - student accommodation, language and summer programmes, online courses, certifications.

Where we only refer you, we share nothing about you unless you ask us to. Following the link takes you to the partner, who becomes an independent controller from that point.

Where you book through us, we process the data needed to arrange the service: your identity and contact details, the details of the booking, any information the provider requires such as dietary requirements or accommodation preferences, and - where the participant is a minor - the Guardian’s details and consent.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR), including the transmission to the provider of the data it needs to deliver the service you booked. Where we would pass on data the provider does not need for that purpose, or where the provider wants to use your data for its own separate purposes such as its own marketing, we ask for your consent (Article 6(1)(a) GDPR) and you can refuse without losing the service you booked.

Retention. Three (3) years from the end of the service; ten (10) years for accounting records.

8.4 Internships and job opportunities

Where the App presents internship or job opportunities and you choose to apply, we pass to the employer or intermediary the information you select for that application.

The recipient acts as an independent controller. Before you apply, we tell you who they are and link to their privacy policy.

Legal basis. Your consent for the transmission (Article 6(1)(a) GDPR); performance of the contract for the operation of the feature itself (Article 6(1)(b) GDPR).

Retention. Three (3) years from the application.

8.5 Editorial content and community features

Where you submit content - a testimonial, a question, a contribution to our editorial section - we process what you submit, the identifiers of your account, and the outcome of our review. Nothing you submit is published automatically. We read everything, we decide whether to publish it, and what we publish is an edited version written under our own editorial responsibility.

We tell you before publication whether your contribution will appear under your name, under a pseudonym or anonymously, and we abide by that choice.

Legal basis. Your consent (Article 6(1)(a) GDPR), withdrawable at any time, after which we unpublish.

Retention. Until withdrawal, plus twelve (12) months for the moderation record.

9. Safeguarding

Because we work with people under 18, we operate a safeguarding regime, set out in our Safeguarding Policy, which involves processing personal data.

9.1 What we process

Records of Guardian consent, checked before every Session with a minor - no consent record, no Session; reports of safeguarding concerns, including anonymous reports; the account of a disclosure recorded in the young person’s own words, with date, time and context; the assessment we make and the action we take; correspondence with Guardians, schools, social services and the police; the outcome and the lessons learned.

A safeguarding record may contain personal data about an Advisor or about any other person named in a concern, as well as about the young person. Section 11.10 explains what that means for an Advisor.

9.2 Legal basis

Our primary basis is our legitimate interest in protecting young people from harm (Article 6(1)(f) GDPR), for which we have documented a balancing assessment. Where a specific reporting duty under Luxembourg child-protection law applies to us, we rely on compliance with a legal obligation (Article 6(1)(c) GDPR). Where a young person’s life or physical integrity is at stake, we rely on the protection of vital interests (Article 6(1)(d) GDPR).

Where a safeguarding record contains special category data - for example about health - we rely on Article 9(2)(g) GDPR, on the ground of the substantial public interest in the protection of children, as given effect by Luxembourg child-protection legislation, subject to the safeguards described in section 9.4. We rely on Article 9(2)(c) GDPR only where the person concerned is in fact physically or legally incapable of giving consent, and on Article 9(2)(f) GDPR only where a legal claim or proceeding is in prospect.

9.3 What this means in practice

Where there is a serious concern about the safety of a young person, we may make a referral to the competent authorities without the consent of the Student or the Guardian, and we may be unable to inform them in advance. We do this only where it is necessary to protect the young person.

Where we receive content that appears to be child sexual abuse material, we preserve it without viewing it further, disable access to it and report it to the police immediately. It is never forwarded internally.

9.4 Retention

Safeguarding records are kept for as long as our legal obligations and any applicable limitation period require, and in any event until the Student reaches the age of majority and for ten (10) years thereafter.

Safeguarding records are held separately from ordinary business records, and access is restricted to our Designated Safeguarding Lead, the Deputy Designated Safeguarding Lead and management. Our Safeguarding Policy names both of them and is published on the Platform.

10. The Website

10.1 What happens when you browse

Our Website is a public information site. You can read all of it without an account, without accepting anything, without any cookie and without any cross-site tracking.

Server logs. Our hosting provider records, for each request, the IP address, the date and time, the page requested, the HTTP status code, the volume of data transferred, the referring page and the browser user-agent string. This is a technical necessity of how the web works and a security requirement.

Legal basis. Our legitimate interest in the security, availability and integrity of the Website (Article 6(1)(f) GDPR). You can object to this processing at any time under section 17.

Retention. Server logs: thirty (30) days, except where a log is retained longer as part of a security incident investigation.

10.2 Cookies

Our Website uses no cookies. We place no identifier on your device and we read none for our own purposes. There is therefore no cookie banner, and there is nothing for you to consent to or refuse.

Article 5(3) of the ePrivacy Directive requires consent for storing information on, or accessing information already stored on, a user’s terminal equipment, unless this is strictly necessary to provide the service you have requested. Because we store nothing, and use the information your browser sends strictly for the purposes in sections 10.1 and 10.3, there is no cookie consent to collect. This is a deliberate design choice, and if it ever changes we will tell you before it does.

10.3 Audience measurement

We measure how many people visit the Website and which pages they read, using a cookieless, privacy-preserving analytics tool hosted in the European Union. It does not set cookies, does not use any persistent identifier, and does not follow you across other websites. Unique visitors are estimated from a temporary hash that combines your IP address - which is never stored - your user-agent and a salt that rotates daily, which makes it impossible to link your visits from one day to the next.

What we can see. Page views; estimated unique visitors; where visitors came from; which pages are most read; country; device type; browser.

What we cannot see. Who you are; what you did on any other site; what you did here last week.

Legal basis. Our legitimate interest in understanding whether our Website is useful (Article 6(1)(f) GDPR). The tool reads no identifier stored on your device: it derives a short-lived hash from the IP address and user-agent string that your browser necessarily sends to load the page. For that operation we rely on the exemption in Article 5(3) of the ePrivacy Directive for what is strictly necessary to provide the service you have requested, applied to strictly necessary, first-party audience measurement. We have documented a balancing assessment for this processing and will provide a summary on request. You can object to this processing at any time under section 17.

Retention. The daily hash exists only for the day on which it is generated, and once the salt rotates it can no longer be linked to you or to your visits on any other day. No individual-level record is retained beyond that day; only aggregate statistics are kept.

10.4 Fonts and external resources

The Website loads its typefaces and scripts from our own servers. It does not call Google Fonts or any other third-party content delivery network, so browsing our Website does not disclose your IP address to any third party.

10.5 Forms on the Website

Where the Website offers a form - a contact form, a beta-testing registration, a newsletter signup, a partnership enquiry - we tell you at that point what we collect and why. As a general rule:

10.6 Social media links

The Website links to our profiles on third-party platforms. These are ordinary links: no content from those platforms is embedded, and no data is sent to them unless you click. Once you do, the platform’s own privacy policy applies.

PART III - ADVISORS AND OTHER PROFESSIONALS WHO WORK WITH US

11. Advisors, applicants, contributors and other professionals

This Part is about your own personal data if you have applied to become an Advisor, if you are one, or if you contribute content or methodology to the Platform. It is not about the data of the Students you advise.

This Part is the privacy information we are required to give you under Article 13 GDPR. It is the “privacy information provided to the Advisor” referred to in clause 14.5 of our General Conditions for Advisors. Sections 13 to 22 apply to you as they apply to everyone else, and this Part tells you where they work differently for you.

What you must do with a Student’s data is a different question, governed by clause 14 of the General Conditions, by the Advisor Code of Conduct and by your own obligations as a controller. Section 6.1 explains the distinction.

11.1 Who is the controller of what

Your own personal data. For everything described in this Part, IDK-Yet is the controller. Section 1 gives our identity and our contact details; section 22 tells you where to write.

11.2 Applying to work with us

This section applies from the moment you first contact us about becoming an Advisor.

Data. Your name and contact details; your curriculum vitae; the fields you propose to advise in and the languages you speak; the country from which you would provide the Services, your country of nationality and your country of residence - which we need in order to know which law governs the verification in section 11.4; your education, qualifications and professional experience; a video interview, which we do not record; the notes we make and the outcome of our assessment.

Legal basis. Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in choosing carefully who advises young people (Article 6(1)(f) GDPR).

Retention. Where we engage you, your application becomes part of your engagement record and follows section 11.11. Where we do not, we keep it for twelve (12) months from our decision, so that we can explain that decision if you ask and so that you need not start from scratch if you apply again, and then delete it. You may ask us to delete it sooner.

11.3 Verifying who you are and what you are qualified to do

Before you may deliver Sessions we verify who you are and what you are qualified to do.

Data. Your identity, verified against government-issued photo identification and matched to the person appearing on video - we record the document type, the last four characters of the document number, the verification date and who verified it, and take no copy; your qualifications and professional experience; your registration with a professional body, where applicable, with the registration number and expiry date; your professional references; your professional indemnity insurance details; your business registration and tax status; a check against applicable sanctions lists, limited to establishing that we may lawfully contract with you; your confirmation that you are subject to no prohibition, disqualification or restriction on working with children or young persons; and the record of the safeguarding briefing you completed and the version of the policies you accepted.

We may ask to see original documents, and we may ask you again during the engagement where something we hold may no longer be accurate.

Conflicts of interest. Clause 13.1 of the General Conditions requires you to declare, within five business days of the matter arising, any interest that could reasonably be seen to influence the advice you give: a commission, referral fee or other consideration receivable from an education-related business; an employment, directorship, consultancy or shareholding in one; and any family or personal relationship with a Student. We record what you declare, our assessment of it, and any condition we attach. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in the independence of the advice given to young people (Article 6(1)(f) GDPR).

Legal basis. Performance of our contract with you (Article 6(1)(b) GDPR); compliance with a legal obligation, for the sanctions check and for our tax and invoicing records (Article 6(1)(c) GDPR); and our legitimate interest in protecting young people and in the integrity of the Platform (Article 6(1)(f) GDPR), for which we have documented a balancing assessment. You can object to the processing that rests on our legitimate interest at any time, under section 11.13.

Retention. Section 11.11.

11.4 Criminal record checks - and the checks we do not carry out

When. Only where you will deliver Sessions to Students under 18. If you advise adults only, we ask for nothing under this heading.

What we ask for. The criminal record certificate, or equivalent check, that the law applicable to you provides for the recruitment of a person for activities involving regular contact with minors. Under our screening procedure we tell you, for you specifically, which document that is, the authority that issues it, whether you or we obtain it, and how recent it must be. As a rule you obtain the document yourself and produce it to us; we request it from the authority only where the law requires us to be the applicant.

What we record. We inspect the document and record only the type of document, its date, its reference, the date of verification, the identity of the verifier, and whether a disqualifying entry was identified. We take no copy of the document and we retain none.

What we do not do. We require no criminal record information beyond that document, and you should provide none. We carry out no general background check: we seek no information about pending proceedings, accusations or investigations, we search no press or social media for that purpose, and we use no commercial database of criminal records. Where no such document is lawfully available to you, or where we cannot lawfully receive it, you are assigned only to Students aged 18 or over, and no wider document is sought instead.

Repetition. There is no automatic renewal and we do not repeat the check as a matter of routine. We repeat it only where the law applicable to you requires it, where your role changes - in particular on a first assignment to Students under 18 - or where we have a specific safeguarding reason.

What you must tell us. One thing only, and only so far as the law permits you to disclose it: that you have become subject to a prohibition, disqualification or restriction on working with children or young persons, or that you no longer meet a legal requirement for the Services (clause 12.5 of the General Conditions). You are not asked to report accusations, complaints or proceedings.

Criminal-conviction data - our legal basis. Article 10 GDPR is not itself a legal basis: it permits the processing of data relating to criminal convictions and offences only where authorised by Union or Member State law providing appropriate safeguards, in addition to a basis under Article 6. Our Article 6 basis is performance of our contract with you (Article 6(1)(b) GDPR) together with our legitimate interest in protecting young people (Article 6(1)(f) GDPR), for which we have documented a balancing assessment.

For the authorisation, in Luxembourg we rely on the legislation on the organisation of the criminal record, under which you obtain the extract yourself and produce it to us. Where you are established in another Member State, we rely on the equivalent authorising provision of the law applicable to you, and that provision also determines what may be asked for and by whom. Where no such provision of Union or Member State law authorises the check, we do not carry it out, and the fallback described above applies: you are assigned only to Students aged 18 or over.

The safeguards we apply are the ones described above: sight and record only; no copy taken or retained; the access restrictions described in section 9.4; and deletion at the end of the engagement.

Retention. The record - never the certificate - is deleted at the end of your engagement, unless it relates to a live concern.

11.5 Your public Advisor Profile

We write your Advisor Profile ourselves, from the information and materials you give us during onboarding and afterwards. It is published, and it is meant to be seen. This section tells you how far it travels.

Data. Your display name; your photograph; your headline and biography; your university and education; your professional background and experience; your qualifications and areas of expertise; the languages in which you advise; your published availability; your ratings, the reviews Students leave and the number of Sessions you have delivered; and any other professional information you have given us.

Where it appears. On the Platform and on our Website, and - under clause 20 of the General Conditions - in our own channels: our social-media accounts, newsletters, presentations, press materials, app-store listings, partner communications and paid advertising. Anything published on a public page can be viewed, copied, indexed by search engines and cached by third parties beyond our control.

Legal basis. Two different ones, because the two uses are not the same:

• On the Platform and on our Website, performance of our contract with you (Article 6(1)(b) GDPR): publishing the Profile is how Students find you and book you, and there is no way to deliver Sessions without it.

• In our own channels listed above, and for the twelve months after the engagement ends, our legitimate interest in promoting the service and the Advisors on it (Article 6(1)(f) GDPR), on the strength of the authorisation you give in clause 20.1 of the General Conditions. You can object to this use at any time under section 11.13, and independently of that you may ask under clause 20.4 for a specific item to be withdrawn.

Any new recording made with you (a bespoke video or filmed interview, a photo shoot, a podcast or a recorded testimonial) is not covered by either and requires your separate written approval under clause 20.3.

What happens when the engagement ends. We remove your Advisor Profile from the Platform and produce no new material featuring you. Material already produced or in circulation may remain in use for twelve (12) months. You may ask us to withdraw a specific item, and we will do so within a reasonable period on the channels we control. We cannot recall printed material already distributed, alter archived copies or copies held by third parties, or clear search-engine caches.

11.6 Delivering Sessions: bookings, records and the tools you use

Data. Your availability and calendar; the Booking requests you receive, accept or decline; the Sessions you deliver and their duration; the entry you record for each activity - date, Student, start and end time, type of Session, applicable Session Fee and any agreed follow-up; the notes you record about a Session; and the connection logs, and session start and end times that the Platform generates.

Where those records live. In the Administrative Portal, once it exists. The Administrative Portal is under development and is not yet available. Until it is, clauses 6.7 and 8.1 of the General Conditions apply: you keep those records in the form we notify to you, and you transfer them into the Portal when we tell you it is in service. Where that form is a template or a shared document we provide, we are the controller of what it contains; where it is not, those records are in your systems and under your control, as a separate controller.

The tools. Sessions are delivered through a professional video-conferencing service - either one we provide, or one you use in its place and have declared to us under clause 5.4 of your Engagement Letter. A Session with a Student under 18 takes place only through a service we have approved in writing for you. Where you use your own service under clause 6.6, its provider is your supplier, not our processor: you choose it, you contract with it, and you are the controller of what passes through it. Section 15 lists the providers that are ours.

Account access and security. Your access to the Platform and to any other tool we provide is personal to you, and we process what that requires: your credentials - your password is stored only as a salted hash, never in readable form; the factors you enrol for multi-factor authentication where we require it; your authentication and access logs; the identifiers of the devices from which you connect; and any report or detection of unauthorised access or use of a credential. Clauses 15.1 to 15.6 and 17.3 of the General Conditions set out your side of this. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in the security of the Platform and in protecting Student data (Article 6(1)(f) GDPR). Retention: authentication and access logs, twelve (12) months, as for everyone.

Legal basis. Performance of our contract with you (Article 6(1)(b) GDPR) and, for the accuracy of activity records, compliance with our accounting and tax obligations (Article 6(1)(c) GDPR).

Retention. Section 11.11.

11.7 Fees, invoicing and tax

Data. Your bank details; your business registration number, tax identifiers and VAT status, including any exemption regime you rely on; your invoices, and the invoices we issue in your name where we have agreed self-billing; the Sessions each invoice covers; the Platform Fee retained and the Advisor Fee paid; the statements we make available to you; and any set-off, reclaim or dispute, together with the representations you make about it.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR) and compliance with our accounting, invoicing and tax obligations (Article 6(1)(c) GDPR).

Retention. Ten (10) years for accounting, invoicing and tax records, as Luxembourg law requires.

Tax reporting (DAC7). The Luxembourg law of 16 May 2023, which transposes Council Directive (EU) 2021/514, might require us to collect and verify the information listed in clause 9.14 of the General Conditions and to report it each year, with the amounts paid to you, the number of Sessions and the fees we retained in each quarter, to the Luxembourg tax authority (Administration des contributions directes), which passes it on to the tax authority of each Member State in which you are resident. If you are resident in no Member State, you are not reported, but the checks still apply. We give you the information reported about you by 31 January of the following year. Providing it is a legal requirement: if you do not provide it after our request and two reminders, we must, once sixty (60) days have passed since our request, either withhold your Advisor Fees until you do, or close your account and prevent you from registering again (clause 9.14). Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR). Retention: ten (10) years from the end of the reporting period.

11.8 Ratings, reviews, quality and monitoring

Ratings and reviews. The Platform publishes no rating and no review today. From the date on which we make the feature available and tell you so, Students may rate and review you after a Session, and those ratings and reviews are published on your Advisor Profile. We do not edit a review. We remove one only where it is unlawful, abusive or discriminatory, contains a third party’s personal data, is manifestly unrelated to the Session, or is fraudulent - or where the Student who wrote it withdraws their consent to its publication, which they may do at any time (section 6.4). You may ask us to examine a rating or review you consider unfair or fraudulent, and a person, not a tool, decides.

Monitoring and quality checks. We may review the Booking records, and the connection logs and metadata generated by the tools we operate, in order to check the quality of the Services, to verify that Sessions took place as recorded, to enforce our safeguarding rules, and to enforce clause 21 of the General Conditions on taking a Student off the Platform. Automated tools may flag content for review; a person decides what happens next.

What we cannot see. Where a Session is delivered on a service we do not operate, and where you correspond with a Student on a professional email address of your own under clause 6.6, we cannot observe the Session and no connection log of yours reaches us. What reaches us is the Booking, what you record, what passes through our systems, and what a participant tells us. Verification therefore means comparing what you have recorded against the Bookings, not reconstructing the Session.

Recording. We do not record Sessions in any circumstances. You must not record, photograph or screenshot a Session or a Student, and you must disable recording in whichever tool you use.

Legal basis. For ratings and reviews, performance of the contract (Article 6(1)(b) GDPR). For monitoring and quality checks, our legitimate interest in the integrity, quality and safety of the service and our duty of care towards young people (Article 6(1)(f) GDPR).

What we do not do. We do not process by automated means any data about your emotional or psychological state, we do not process the content of your private conversations, and we do not use biometric data to infer emotion or personality.

11.9 Verifications and audits

Data. The documents we ask for in order to verify compliance, the accuracy of an invoice or a warranty in clause 4 of the General Conditions - proof of registration, qualification, insurance and tax status; the records you keep under clause 22.4; the outcome of the verification; and your responses.

Verifications take place during normal business hours and with reasonable notice, except where fraud, a safeguarding concern or a security incident is suspected. A verification never requires you to disclose the confidential information of your other clients, and we do not ask for it.

Legal basis. Performance of the contract (Article 6(1)(b) GDPR); compliance with our own legal obligations (Article 6(1)(c) GDPR); and our legitimate interest in verifying that the Services are delivered and invoiced as agreed (Article 6(1)(f) GDPR).

Retention. Section 11.11.

11.10 Concerns, complaints, suspension and termination

Data. Any concern, complaint, allegation or report about you, whatever its source - a Student, a Guardian, a school, another advisor, a member of the public or an authority - including an anonymous report; what we did about it; your written representations; our decision and its reasons; and any report we make to a competent authority.

No decision about you is taken by a machine. A suspension or a termination is decided by a person. Where we suspend you, we tell you the principal reasons as soon as reasonably practicable, unless the law prevents it or telling you would prejudice an investigation or a report to an authority. You may put your case to us in writing and we consider it before deciding. You may ask for an explanation and a review of a suspension or a termination at admin@idk-yet.com: a person carries out the review, and we normally reply within twenty (20) business days.

Where a concern is a safeguarding concern, section 9 applies to it in full - including its access restrictions and its retention period, which is tied to the age of the Student concerned and not to the length of your engagement. It also means that where there is a serious concern about the safety of a young person we may refer the matter to the competent authorities, and may be unable to tell you in advance.

Legal basis. Our legitimate interest in the safety of Students, in the integrity of the Platform and in establishing, exercising and defending our rights (Article 6(1)(f) GDPR), for which we have documented a balancing assessment; compliance with a legal obligation where one applies (Article 6(1)(c) GDPR); and, where a young person’s life or physical integrity is at stake, the protection of vital interests (Article 6(1)(d) GDPR). Where a record contains special category data, section 9.2 applies.

Retention. Section 11.11.

11.11 How long we keep your data

Where a legal obligation or a documented legal hold requires longer, that longer period applies to the data concerned and only to that data. Section 19 sets out the same rule for everyone.

11.12 Where we obtain your data from someone other than you

Most of what we hold about you comes from you. We also receive:

• references from the referees you name, which contain personal data about you and about them;

• information published by a professional body or a public register, where we verify a registration you have declared;

• the criminal record extract, in the rare case where the law requires us rather than you to be the applicant, in which case it comes from the issuing authority (section 11.4);

• the result of the sanctions screening described in section 11.3, which comes from the published sanctions lists;

• the result of the checks on your tax identification and VAT numbers in the public databases provided for that purpose, and any information from a tax authority that what we reported about you may be inaccurate (section 11.7);

• ratings, reviews, feedback and complaints from Students and Guardians;

• safeguarding reports and other concerns about you, from any of the sources listed in section 11.10, including anonymous ones;

• information from a public authority, where one contacts us about you.

Section 15.1 explains when and how we tell you what we have obtained and where it came from.

11.13 Your rights, and where to write

Section 17 applies to you in full, including its response times, identity checks and the right to complain to a supervisory authority.

Two points are specific to you:

• Objection. Several of the activities in this Part rest on our legitimate interest - the eligibility and conflict checks in section 11.3, the marketing use of your Profile in section 11.5, the account security measures in section 11.6, the monitoring in section 11.8, the verifications in section 11.9 and the handling of concerns in section 11.10. You may object to any of them at any time, and we will stop unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is needed to establish, exercise or defend a legal claim. We will give you a summary of the balancing assessment on request.

• Where to write. For your own personal data and your rights, and for a security incident or a personal data breach - which you must report without delay and in any event within twenty-four (24) hours (clause 14.4) - write to privacy@idk-yet.com; for a safeguarding concern (within twenty-four (24) hours) or a complaint about a suspension, a termination or a review, to admin@idk-yet.com. Section 22 lists all our contact points.

11.14 Contributors and other professionals

Where you write, create or review content for us, or contribute to the methodology behind the Questionnaire, we process your name, your contact details, your professional background, the record of what you produced and of what we paid you, and any attribution you agreed to. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR) and compliance with our accounting and tax obligations (Article 6(1)(c) GDPR). Retention: three (3) years after the end of the collaboration, and ten (10) years for accounting and tax records.

PART IV - SCHOOL, UNIVERSITY AND PARTNER CONTACTS

12. School, university and partner contacts

Where you are a member of staff at a school, university or partner organisation and we deal with you in that capacity, we process your name, role, institution, work contact details, our correspondence, the records of meetings, events and agreements and, if you use our partner portal, your account and access logs.

Legal basis. Our legitimate interest in managing and developing our institutional relationships (Article 6(1)(f) GDPR), and, once an agreement is in place, performance of that contract (Article 6(1)(b) GDPR).

Retention. Three (3) years from the last contact; for the duration of any agreement and ten (10) years afterwards where an agreement was concluded. Partner portal access logs: twelve (12) months.

Where we run an event, presentation or test at a school, we agree in writing beforehand with the school which of us is the controller for what. Where the school selects the participants and holds the consents, the school is the controller for that part and we act on its instructions.

PART V - RULES THAT APPLY TO EVERYONE

13. Special categories of data and criminal-conviction data

13.1 We do not ask for special category data

We do not ask you for data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data about your sex life or sexual orientation. Please do not include such information in free-text answers or messages.

Our free-text fields are designed for study preferences. If you nevertheless include special category data, we do not use it in the matching, and we delete it when we become aware of it, unless it forms part of a safeguarding record under section 9 or is necessary for the establishment, exercise or defence of legal claims. The only exception is the accessibility information described below, which you give us deliberately, for a stated purpose and on explicit consent.

The same applies to Advisors: we ask for no special category data in onboarding, in verification or in the course of the engagement, and Advisors should send us none.

Gender. We treat the optional gender field as ordinary personal data under Article 6 GDPR, processed on the basis of your consent. It is not a special category of data under Article 9 GDPR. Section 5.2 explains what it is used for and what happens if you leave it blank.

Accessibility. Where you tell us that you need accessible facilities so that we can filter for institutions that provide them, you may be disclosing information about your health. We treat any such information as special category data processed on the basis of your explicit consent under Article 9(2)(a) GDPR, we use it only for that filter and for nothing else, you can withdraw it at any time by clearing the field, and it is deleted with the rest of your Questionnaire answers under section 5.2.

13.2 Criminal-conviction data

We process criminal-conviction data only in the vetting of Advisors described in section 11.4, only to the extent of recording that a check was carried out and its outcome, and never by retaining a copy of the certificate. We carry out no general background check on anyone, and we hold no criminal record data about Students, Guardians or institutional contacts.

14. What we will not do with your data

We commit to using your personal data only for the purposes described in this policy. In particular:

• We will not use your personal data for advertising or direct marketing based on profiling, except that a partner university you match with in the Match section may contact you about its programmes (section 8.1). We show no behavioural advertising in the App or on the Website, we build no advertising audiences, and we run no remarketing.

• We will not use your personal data to train or fine-tune artificial intelligence or machine learning models. Section 7.4 explains the limited performance measurement we do carry out, and why it is not the same thing.

• We will not make your data available to any institution, employer, partner or other third party for its own commercial purposes unless you have asked us to, for the specific recipient, under section 8, or have applied to it through us (section 8.1).

Aggregated and anonymised information

We produce statistical reports about study preferences and trends - for example, how interest in a field varies by region - and we may publish or license these reports to institutions and partners.

These reports are produced only from data that has been irreversibly anonymised, so that no individual can be identified from them, directly or indirectly, by us or by anyone else, taking account of all means reasonably likely to be used. Once anonymised, the information is no longer personal data and this policy no longer applies to it. We do not license or sell pseudonymised data, and these reports never contain individual-level records.

15. Who receives your data

We may disclose personal data to the following categories of recipient, and only where there is a lawful basis.

We enter into a data processing agreement under Article 28 GDPR with every processor. Advisors are not our processors but independent controllers (section 6.1). We maintain an up-to-date list of our processors and sub-processors, and we will provide it on request to privacy@idk-yet.com.

We may also disclose your personal data where necessary to comply with a legal obligation, or where we have reason to believe that your actions breach our terms or the law, or where disclosure is necessary to protect the rights, property or safety of IDK-Yet, our users, or the public.

15.1 Where we obtain your data from someone other than you

Most of the data described in this policy comes from you. In a few cases we receive it from someone else:

• a Guardian gives us the Student’s name and contact details when making a Booking, and a Student gives us their Guardian’s details;

• a school or partner institution gives us the contact details of its staff, or we take them from the institution’s own published pages;

• a partner university tells us whether a Student who applied through our link or referral code was admitted and enrolled, and which fees were paid (section 8.1);

• a referee named by an Advisor gives us the reference, which contains personal data about both of them;

• a safeguarding concern may be reported to us by a Student, a Guardian, an Advisor, a school, a public authority or a member of the public, including anonymously;

• information about institutions and study programmes - which is not personal data about you - comes from public and third-party sources.

Where we obtain your personal data from someone other than you, we inform you within one month of obtaining it, or at the latest when we first communicate with you, unless doing so proves impossible or would involve a disproportionate effort, or would seriously impair the achievement of the objectives of the processing - which is the case where telling you would defeat the purpose of a safeguarding assessment (Article 14(5)(b) GDPR).

16. Transfers outside the European Economic Area

We are established in Luxembourg. Our core systems - the App, the database and our AI models - are hosted on servers located in the European Economic Area, and your Questionnaire answers are not sent to any external AI provider (section 5.2).

A limited number of ancillary tools are supplied by providers established in the United States: currently our push-notification and one-time-code provider, our Session booking tool and, if and when we provide a video-conferencing service of our own, that service. Personal data processed through those tools may be transferred outside the EEA. Section 15 identifies them. Where a transfer takes place, we rely on one of the following:

• an adequacy decision of the European Commission - currently, for certified United States recipients, the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023); or

• the Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional technical and organisational measures identified through a transfer impact assessment.

We keep the validity of these mechanisms under review. The adequacy of the EU-US Data Privacy Framework was upheld by the General Court of the European Union in September 2025 and is under appeal before the Court of Justice; should it be annulled, we will move the affected transfers onto Standard Contractual Clauses or onto European alternatives.

Advisors established outside the EEA, or accessing data from outside it, are engaged only where the transfer mechanism required by Chapter V GDPR is in place before the first Session. Because the Advisor is an independent controller and not our processor (section 6.1), the transfer is a controller-to-controller transfer, and the mechanism is chosen accordingly. Where the Advisor uses their own tools, any onward transfer through those tools is theirs to justify as a separate controller.

Partner universities outside the EEA receive your profile only where an adequacy decision applies to them or they have signed with us the Standard Contractual Clauses for transfers between controllers. Failing both, we ask for your explicit consent to that specific transfer, after telling you that it is covered by neither an adequacy decision nor appropriate safeguards and what risks this may involve for you (Article 49(1)(a) GDPR).

To obtain details of the safeguards in place, or a copy of the relevant clauses, write to privacy@idk-yet.com.

17. Your rights

This section applies to everyone this policy is about; section 11.13 adds what is specific to Advisors. Subject to the conditions and exceptions set out in the Applicable Privacy Laws, you have the following rights, exercisable at any time. We do not charge for exercising them; only where a request is manifestly unfounded or excessive, in particular because it is repetitive, may we charge a reasonable fee or decline to act - and if we do, we will explain why and tell you how to challenge that decision (Article 12(5) GDPR).

How to exercise them

Write to privacy@idk-yet.com. You do not need to use a particular form or give a reason.

Our response time. We respond without undue delay and in any event within one (1) month of receiving your request, in accordance with Article 12(3) GDPR. Where a request is complex, or where you have made a number of requests, we may extend this by up to two (2) further months; if we do, we will tell you within the first month and explain why.

Identity verification. We may take reasonable steps to verify your identity before we act, such as asking for information and checking it against what we hold. If you make a request as an authorised agent, we may ask for proof of your authority or contact the person concerned to confirm.

Guardians. A Guardian may exercise these rights on behalf of a Student under 18. Where the Student is 16 or 17, we will normally inform the Student and take their views into account, unless doing so would create a safeguarding risk.

No detriment. You will not be treated less favourably for exercising your rights.

Complaints

If you believe we have infringed the Applicable Privacy Laws, you may lodge a complaint with our lead supervisory authority:

Commission nationale pour la protection des données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg cnpd.public.lu

You may also complain to the supervisory authority of the Member State where you live or work, or where the alleged infringement took place. We would appreciate the chance to address your concern first, but you are not obliged to come to us before going to a regulator.

18. Third-party websites and services

The App and the Website may contain links to sites and services operated by third parties. This policy does not apply to what they do with your data, and we are not responsible for their practices. Read their privacy policy before you give them your personal data.

Where you download the App, the operator of the app store - Apple or Google - processes your data as an independent controller, under its own privacy policy. We do not receive your payment details or your app store account credentials from them.

19. Retention

Each section of this policy states how long we keep the data it describes, and section 11.11 collects the periods that apply to Advisors. Where a legal obligation or a documented legal hold requires a longer period, that longer period applies to the data concerned, and only to that data. At the end of the applicable period, data is deleted or irreversibly anonymised. Where the same information appears in two records with different periods - for example a Questionnaire answer that has also been recorded in a Session note - each copy follows the period of the record it belongs to.

Those periods cover the copies we hold. A copy held by an Advisor as a separate controller (section 6.1), or by an institution or partner to whom you asked us to send your data (section 8), follows their own retention policy, not this one.

20. Extraordinary circumstances

20.1 Compliance with legal obligations

We may use your data to comply with our legal obligations, including requests from public authorities, and to demonstrate that we have complied with them.

Data. The specific information that a law, or a public authority acting under a law, requires us to process or produce.

Legal basis. Compliance with a legal obligation (Article 6(1)(c) GDPR). Where the law leaves us discretion as to how to comply, our legitimate interest in demonstrating our compliance (Article 6(1)(f) GDPR).

Retention. For the period prescribed by the obligation concerned; where no period is prescribed, for the applicable limitation period. This section does not extend the retention periods set out in sections 5 to 12. It applies only to the specific data that a legal obligation or a documented legal hold requires us to keep, and only for as long as that obligation or hold lasts.

20.2 Defence of rights and corporate transactions

We may use your data to establish, exercise or defend our rights and those of our staff, and for corporate transactions such as a merger, an acquisition, a reorganisation or a sale of assets, and the related due diligence.

Data. The specific information necessary for the claim or the transaction concerned.

Legal basis. Our legitimate interest in establishing, exercising or defending our rights and in carrying out corporate transactions (Article 6(1)(f) GDPR). We have documented a balancing assessment for this processing.

Retention. For the duration of the claim or the transaction and afterwards, for ten (10) years or for the applicable limitation period if that is longer. It applies only to the specific data necessary for the claim or transaction concerned.

Where a corporate transaction results in your data being transferred to a new controller, we will inform you before the transfer takes effect and tell you what it means for you.

21. Changes to this policy

We may update this policy, in whole or in part, and will notify you of any change in accordance with the Applicable Privacy Laws.

Where we make a change, we update the date at the end of this policy. Where the change is material - a new purpose, a new legal basis, a new category of recipient, or a significant extension of retention - we will notify you directly, by email, by an in-App message or by a push notification, before the change takes effect, and where the change requires your consent we will ask for it.

We keep the previous versions of this policy and will provide any of them on request.

22. Contact

Last updated: 19 October 2026 - Version 3.2