Privacy Policy

1. DEFINITIONS

1. 1.1.

   StudentSpace – SGE OPERATING COMPANY sp. z o.o. with its registered office in Warsaw (ul. Litewska 1, 00-581 Warsaw), entered into the Register of Entrepreneurs of the National Court Register, for which registration files are kept by the District Court for the Capital City of Warsaw in Warsaw, XII Business Division, under KRS number 0001031019, REGON: 525057433, NIP: 7011139662, share capital: PLN 322,750.00.

2. 1.2.

   Personal data – information about a natural person identified or identifiable by one or more factors specific to physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, online identifier and information collected through cookies and other similar technology.

3. 1.3.

   Policy – this Privacy Policy.

4. 1.4.

   GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

5. 1.5.

   Website – website operated by the Owner of the Website, available at: www.studentspace.pl.

6. 1.6.

   User – any natural person visiting the Website or using one or more of the services or functionalities described in the Policy.

2. PROCESSING OF DATA IN CONNECTION WITH THE USE OF THE WEBSITE

1. 2.1.

   In connection with the User's use of the Website, StudentSpace collects data to the extent necessary to provide the individual services offered, as well as information about the User's activity on the Website. The detailed principles and purposes of the processing of Personal Data collected during the User's use of the Website are described below.

3. THE PURPOSES AND LEGAL BASIS OF THE PROCESSING OF DATA BY THE WEBSITE

1. 3.1.

   Personal data of all persons using the Website (including IP address or other identifiers and information collected via cookies or other similar technologies), is processed by StudentSpace:

   1. 3.1.1.

      in order to provide services electronically in terms of making the content collected on the Website available to Users - in which case the legal basis for the processing is the necessity of the processing for the performance of the contract (Article 6(1)(b) GDPR);

   2. 3.1.2.

      for the purpose of contacting and responding to queries sent by Users regarding StudentSpace services, with which they have approached the Administrator using the form available on the Website, the chat (AI assistant) available on the Website, or by sending a message to the Administrator's e-mail address, including by saving the content of such an enquiry or conversation in the CRM system used by StudentSpace — then the legal basis for processing is the legitimate interest of the Administrator (Article 6 (1) (f) of the GDPR), consisting in the need to respond to Users and manage contact with them;

   3. 3.1.3.

      for analytical and statistical purposes - in which case the legal basis for the processing is the Administrator's legitimate interest (Article 6(1)(f) GDPR), consisting of conducting analyses of the Users' activities, as well as their preferences in order to improve the functionalities used and services provided;

   4. 3.1.4.

      for the purpose of possibly establishing and investigating claims or defending against claims - the legal basis for the processing is the legitimate interest of StudentSpace (Article 6(1)(f) GDPR) to protect its rights;

   5. 3.1.5.

      for StudentSpace marketing purposes - the rules for processing Personal Data for marketing purposes are described in the MARKETING section.

2. 3.2.

   The User's activity on the Website, including their Personal Data, is recorded in system logs (a special computer programme used to store a chronological record containing information about events and activities that concern the IT system used to provide services by StudentSpace). The information collected in the logs is processed primarily for purposes related to the provision of services. StudentSpace also processes this information for technical, administrative purposes, for the purposes of ensuring security of the IT system and the management of this system, as well as for analytical and statistical purposes - in this respect, the legal basis for processing is the legitimate interest of StudentSpace (Article 6(1)(f) GDPR).

4. MARKETING

1. 4.1.

   StudentSpace processes Users' Personal Data in order to carry out marketing activities, which may consist of:

   1. 4.1.1.

      sending e-mail notifications regarding interesting offers or content, which in some cases contain commercial information on StudentSpace products or products of third parties with whom we cooperate;

   2. 4.1.2.

      sending text messages regarding interesting offers or content, which in some cases contain commercial information about StudentSpace products or the products of third parties with whom we cooperate;

   3. 4.1.3.

      carrying out other types of analytical and statistical activities as well as those related to direct marketing of our goods and services and those of other entities cooperating with us (sending commercial information by e-mail);

   4. 4.1.4.

      using the personal data (name, e-mail address, telephone number) provided by the User in the chat (AI assistant) available on the Website for the marketing purposes referred to in items 4.1.1–4.1.3 above, only where the User has given separate consent selected in the chat window.

2. 4.2.

   Personal data is processed:

   1. 4.2.1.

      in case of sending the User marketing materials - the legal basis for processing is the legitimate interest of StudentSpace (Article 6(1)(f) GDPR) in relation to the consent given by the User to receive marketing communications.

   2. 4.2.2.

      in case of advertising cookies - the legal basis for processing is the User's consent (Article 6(1)(a) GDPR) given on the cookie banner. The data is used for the purpose of promoting the brand and informing about the offer of StudentSpace.

3. 4.3.

   If the User posts any Personal Data of other persons (including their name, address, telephone number or e-mail address) on the Website, the User may only do so on the condition that they do not infringe the law or violate the personal rights of such persons.

4. 4.4.

   Advertising and measurement in Google and Meta services (first-party data). StudentSpace uses the advertising and measurement tools of the providers Google (Google Ireland Limited) and Meta Platforms Ireland Limited and, to that extent, shares selected contact data of Users with them.

   1. 4.4.1.

      The data shared with Google and Meta consists of the e-mail address, the telephone number and information about the stage of the sales process (from an enquiry or lead to the conclusion and payment of the agreement). Contact data is cryptographically secured (hashed) before transfer.

   2. 4.4.2.

      The data is used to: (a) measure the effectiveness of and optimise advertising campaigns, including so-called enhanced and offline conversions; (b) exclude Users from being shown selected advertisements; (c) create audiences, including similar (lookalike) audiences, in order to reach new persons with comparable characteristics.

   3. 4.4.3.

      The legal basis for this processing is the User’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time with effect for the future by writing to rodo@studentspace.pl. If consent is not given or is withdrawn, the User’s data is not used for the above purposes, and StudentSpace takes steps to remove it from the audiences held by the providers. The consent settings on the cookie banner (Consent Mode) also cover this transfer.

   4. 4.4.4.

      For the purposes referred to above, StudentSpace uses only the data of persons who have confirmed that they are at least 18 years old; the data of persons who have not so confirmed is not shared with Google or Meta for these purposes. The modelling of similar audiences (profiling) is carried out by the Google/Meta platforms on the basis of the data provided, in accordance with their terms; this processing does not constitute automated decision-making producing legal effects or similarly significantly affecting the User within the meaning of Article 22 GDPR.

5. 4.5.

   Joint controllership with Meta. In respect of certain operations related to Meta tools (in particular the collection and transfer of event data and the creation of audiences), StudentSpace and Meta Platforms Ireland Limited may act as joint controllers within the meaning of Article 26 GDPR — at the stage of collecting and transferring the data; as regards further use, Meta acts as a separate controller and, for certain functions (matching, measurement), as a processor. These rules are set out in Meta’s terms (including the Meta Business Tools Terms together with the Controller Addendum). Regardless of these arrangements, the User may exercise their rights against each of the joint controllers, and in matters concerning StudentSpace — at rodo@studentspace.pl.

6. 4.6.

   Collection of data through Meta advertising forms (Lead Ads). StudentSpace obtains part of the contact data through advertising forms in Meta services (Facebook/Instagram) that the User completes directly in those services; in that form StudentSpace obtains the e-mail address, telephone number and consents. The source of the data is then the Meta service. Such data is processed for the purpose of contact and presenting an offer (Article 6(1)(f) GDPR) and — provided the User gives consent — for the advertising purposes described in point 4.4 (Article 6(1)(a) GDPR).

7. 4.7.

   Conversion measurement in OpenAI advertising (ChatGPT Ads). StudentSpace uses the measurement tools of OpenAI Ireland Limited - the Measurement Pixel embedded in the Website and the Conversions API transmitting events on the server side. The following data is shared with OpenAI: the conversion event identifier, the ad click identifier stored in a Website cookie, the page URL, the timestamp, the IP address and the browser identifier (user agent), as well as - if the User provides them in a form - the e-mail address and the telephone number, cryptographically secured (hashed) in the User's browser before transfer. StudentSpace does not share contact data in plain form. Contact data is shared only in respect of persons who have confirmed that they are at least 18 years old. The data is used for the purpose referred to in item 4.4.2(a). The legal basis for the processing is the User's consent (Article 6(1)(a) GDPR) given on the cookie banner. The consent may be withdrawn at any time with effect for the future by writing to rodo@studentspace.pl or by using the floating "MANAGE COOKIES" button. If consent is not given or is withdrawn, the Measurement Pixel and the Conversions API do not send events to OpenAI.

5. COOKIES AND SIMILAR TECHNOLOGY

1. 5.1.

   Cookies are small text files that are stored on the User’s device when using websites. They remember, among other things the User’s visit and settings. They perform various functions, but StudentSpace uses them primarily to enable the User to access the Website and to facilitate use of the services available on the Website.

2. 5.2.

   StudentSpace also uses cookies for analytical and marketing purposes, but only if the User has consented to this on the cookie banner displayed on the Website. This consent can be withdrawn at any time using the floating "MANAGE COOKIES" button.

3. 5.3.

   Cookies are divided into permanent and session cookies - depending on how long they are stored, and into necessary and optional cookies - depending on the purposes they serve.

4. 5.4.

   Advertising cookies are optional. They customize advertising to the interests of Users on and off the Website. Based on these cookies and the User's activity, an interest profile is created. StudentSpace and its partners may install advertising cookies using the Website.

5. 5.5.

   Data processing by means of advertising cookies requires the User's consent, which can be obtained and withdrawn in accordance with item 5.1.

PERMANENT AND SESSION COOKIES

NECESSARY AND OPTIONAL COOKIES

1. 5.6.

   Detailed purposes of the use of cookies are described on the cookie banner that is displayed when the User first visits the Website and is later accessible via the floating "MANAGE COOKIES" button.

2. 5.7.

   The Website uses cookies from StudentSpace and its trusted partners. You can find information about StudentSpace's trusted partners on the cookie banner. Detailed information on how they process the User’s data can be found in their respective privacy policies.

ADMINISTRATOR’S TRUSTED PARTNERS

MANAGING SETTINGS OF COOKIES

1. 5.8.

   The user can manage cookie settings via the cookie banner. StudentSpace makes the Website available to the User in accordance with these settings. The cookie banner allows the User to

   1. 5.8.1.

      obtain detailed information about the cookies used on the Website and about trusted partners;

   2. 5.8.2.

      give or withdraw consent to the use of optional cookies.

2. 5.9.

   The cookies banner is displayed when the User visits the Website for the first time, and remembers their consent. The User can make changes to their settings at any time using the floating "MANAGE COOKIES" button.

3. 5.10.

   The user can also manage cookies by changing browser settings. Detailed information on this can be found under the following links.

1. 5.11.

   Some cookies are essential to the functioning of the Website, therefore changing browser settings may render some services inoperable or even make it impossible for the User to use the Website.

6. HOW LONG PERSONAL DATA CAN BE PROCESSED

1. 6.1.

   How long data is processed by StudentSpace depends on the type of service provided and the purpose of the processing. As a general rule, the data is processed for the duration of the service provided or processing of the order, until the withdrawal of the consent given or an effective objection to the data processing in cases where the legal basis for the data processing is the legitimate interest of StudentSpace.

2. 6.2.

   The processing period may be extended if the processing is necessary for the establishment and assertion of possible claims or defence against claims, and thereafter only if and to the extent required by law. After the expiry of the processing period, the data shall be irreversibly deleted or anonymised.

7. USER RIGHTS

1. 7.1.

   The User has the right to access the data and to request rectification, erasure, restriction of processing, the right to data portability and the right to object to processing of the data, as well as the right to lodge a complaint with the supervisory authority in charge of the protection of Personal Data.

2. 7.2.

   To the extent that User Data is processed on the basis of consent, this consent may be withdrawn at any time by contacting any StudentSpace electronically at: rodo@studentspace.pl or by a letter sent to: SGE Operating Company sp. z o.o. ul. Litewska 1, 00-581 Warsaw.

3. 7.3.

   The User has the right to object to processing of data for marketing purposes if the processing is carried out in connection with StudentSpace's legitimate interests, and - for reasons related to the User's particular situation - in other cases where the legal basis for data processing is StudentSpace's legitimate interests (e.g. in connection with the implementation of analytical and statistical purposes).

8. DATA RECIPIENTS

1. 8.1.

   In connection with the provision of services, Personal Data may be disclosed to third parties, including in particular:

   1. 8.1.1.

      suppliers responsible for the operation of IT systems, including e-mail,

   2. 8.1.2.

      providers of logistic, legal, auditing and accounting services.

   3. 8.1.3.

      marketing agencies (for marketing services);

   4. 8.1.4.

      providers of the chat/AI assistant tool used on the Website and providers of the CRM system used to manage contact with Users.

   5. 8.1.5.

      providers of advertising platforms — Google (Google Ireland Limited), Meta Platforms Ireland Limited and OpenAI Ireland Limited — to the extent and for the purposes described in the MARKETING section; depending on the specific function, these entities act as separate controllers, joint controllers or processors.

2. 8.2.

   StudentSpace reserves the right to disclose selected information concerning the User to competent authorities or third parties who request such information, based on the relevant legal basis and in accordance with the provisions of the applicable law.

9. TRANSMISSION OF DATA OUTSIDE THE EEA

1. 9.1.

   The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, StudentSpace transfers Personal Data outside the EEA only when necessary and with an adequate level of protection, primarily by:

   1. 9.1.1.

      cooperating with processors of Personal Data in countries for which a relevant decision of the European Commission has been issued as to whether an adequate level of protection for Personal Data is ensured; in some cases, the European Commission additionally requires such processor to participate in programmes approved by it of entities outside the EEA, the participants of which are obliged to provide Personal Data with the same protection as it enjoys in the European Union (for details, see here)

   2. 9.1.2.

      using standard contractual clauses issued by the European Commission; together with the required additional security measures, these provide Personal Data with the same protection as they enjoy in the European Union; sample agreements can be found here;

   3. 9.1.3.

      using binding corporate rules approved by the competent supervisory authority.

2. 9.2.

   In connection with the use of Google, Meta and OpenAI advertising and analytics tools, Personal Data (including contact data in secured form) may be transferred to the United States. The transfer takes place on the basis of a European Commission decision confirming an adequate level of protection under the EU–US Data Privacy Framework - in respect of recipients holding a valid certification - or on the basis of standard contractual clauses (SCC) together with supplementary security measures.

3. 9.3.

   A copy of the details of the safeguards used by StudentSpace when transferring data outside the EEA can be obtained by contacting StudentSpace as indicated in section 11 of this Policy.

10. PERSONAL DATA SAFETY

1. 10.1.

   StudentSpace conducts a risk analysis on an ongoing basis to ensure that Personal Data is processed in a secure manner - ensuring, in particular, that only authorised persons have access to the data and only to the extent that this is necessary for their tasks. StudentSpace ensures that all operations on Personal Data is recorded and carried out only by authorised employees and associates.

2. 10.2.

   StudentSpace takes all the necessary measures to ensure that also their subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process Personal Data on behalf of StudentSpace.

11. CONTACT DETAILS

1. 11.1.

   Contact with StudentSpace is possible via e-mail at rodo@studentspace.pl or by post at the following address: SGE Operating Company sp. z o.o. ul. Litewska 1, 00-581 Warsaw.

12. CHANGES TO THE PRIVACY POLICY

1. 12.1.

   The policy is regularly reviewed and updated as necessary.

2. 12.2.

   The current version of the Policy has been adopted and has been effective since 14.09.2026.