Effective date: 5 June 2026 · Governed by GDPR (EU) 2016/679 and Dutch law
YassApply B.V. is headquartered in Amsterdam, Netherlands and processes your personal data under GDPR. We collect only what is necessary to provide our study abroad guidance services. We do not sell your data. You have full rights to access, correct, delete, and export your data. Our AI recommendations are advisory and subject to human oversight.
YassApply B.V. ("YassApply", "we", "us", or "our") is the data controller responsible for processing your personal data. Registered office: Orteliusstraat 363 1, Amsterdam, 1056PD, Netherlands. Email: privacy@yassapply.com. Phone: +1 5589 55488 55. Data Protection Officer (DPO): dpo@yassapply.com. YassApply is registered with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and fully complies with Regulation (EU) 2016/679 ("GDPR"), the Dutch Telecommunications Act (Telecommunicatiewet), and the ePrivacy Directive.
We collect and process the following categories of personal data: (a) Identity & Contact Data — full name, email address, phone number, country of residence. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). (b) Academic Profile Data — grades, field of study, language scores (IELTS/TOEFL), academic background, and career goals provided voluntarily. Legal basis: consent (Art. 6(1)(a) GDPR). (c) Application & Document Data — passport copies, academic transcripts, CVs, personal statements, and letters of recommendation uploaded by you. Legal basis: performance of a contract and your explicit consent. (d) Usage Data — IP address, browser type, pages visited, session duration, collected via cookies. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). (e) AI Interaction Data — messages exchanged with our AI advisor, processed to provide personalized recommendations. Legal basis: consent and performance of a contract. We do not process special categories of personal data (Art. 9 GDPR) unless you voluntarily provide such information in free-text fields.
We process your personal data for the following purposes: (i) Provision of Services — delivering AI-powered university matching, scholarship recommendations, visa guidance, and application support; (ii) Account Management — creating and maintaining your YassApply account; (iii) Communication — responding to inquiries, sending service-related notifications, and — with your consent — marketing communications; (iv) Improvement of AI Models — anonymised and aggregated data may be used to improve recommendation accuracy; (v) Legal Compliance — fulfilling obligations under Dutch and EU law; (vi) Fraud Prevention and Security — detecting and preventing unauthorized access. We will never use your personal data for purposes incompatible with those stated above without your prior explicit consent.
We share your data only with processors who provide appropriate guarantees under Art. 28 GDPR via Data Processing Agreements (DPAs): (a) OpenAI, LLC (USA) — AI processing; transfer safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission; (b) Cloud Infrastructure Providers — hosting on EU-based servers where possible; (c) Payment Processors — PCI-DSS compliant providers for subscription billing. We do not sell, rent, or trade your personal data to any third party for commercial purposes. We will disclose data to competent authorities only when legally required (e.g., court order, GDPR supervisory authority request).
Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through: (a) European Commission adequacy decisions (Art. 45 GDPR); (b) Standard Contractual Clauses (Art. 46(2)(c) GDPR); or (c) Binding Corporate Rules. Specifically, data processed by OpenAI in the United States is covered by SCCs. You may request a copy of applicable transfer safeguards by contacting privacy@yassapply.com.
We retain personal data only for as long as necessary for the purposes described: Account data — retained for the duration of your account plus 3 years after closure for legal claims; Document uploads — deleted upon your request or 2 years after account closure; AI conversation logs — anonymised after 12 months; Financial records — retained for 7 years as required by Dutch tax law (Belastingdienst). Upon expiry of retention periods, data is securely deleted or irreversibly anonymised.
As a data subject under GDPR, you have the following enforceable rights: (a) Right of Access (Art. 15) — obtain a copy of your personal data and information about its processing; (b) Right to Rectification (Art. 16) — correct inaccurate or incomplete data; (c) Right to Erasure / "Right to be Forgotten" (Art. 17) — request deletion of your data where no overriding legal basis exists; (d) Right to Restriction of Processing (Art. 18) — limit how we use your data in specific circumstances; (e) Right to Data Portability (Art. 20) — receive your data in a structured, machine-readable format; (f) Right to Object (Art. 21) — object to processing based on legitimate interests or for direct marketing; (g) Right to Withdraw Consent (Art. 7(3)) — withdraw consent at any time without affecting prior processing; (h) Right Not to Be Subject to Automated Decision-Making (Art. 22) — our AI recommendations are advisory only and involve human oversight. To exercise any right, email: privacy@yassapply.com. We will respond within 30 days as required by Art. 12 GDPR. You also have the right to lodge a complaint with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or your local EU supervisory authority.
We use cookies and similar technologies in accordance with the ePrivacy Directive and Dutch Telecommunications Act. Strictly Necessary Cookies (no consent required): session cookies, CSRF protection tokens, authentication cookies. Analytical Cookies (consent required): anonymised usage statistics to improve our platform. Marketing Cookies (consent required): only activated with your explicit consent. You may manage cookie preferences through our Cookie Consent Manager on your first visit or at any time via your account settings. Refusing non-essential cookies will not affect your ability to use our core services.
We implement appropriate technical and organisational measures as required by Art. 32 GDPR, including: TLS/SSL encryption for all data in transit; AES-256 encryption for sensitive data at rest; access controls and role-based permissions; regular security assessments and penetration testing; pseudonymisation of AI training data; incident response procedures with 72-hour breach notification to supervisory authorities (Art. 33 GDPR) and affected individuals (Art. 34 GDPR) where required.
Our services are not directed at persons under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a minor has provided personal data without parental consent, contact us immediately at privacy@yassapply.com and we will delete such data without undue delay.
We may update this Privacy Policy to reflect changes in law or our practices. We will notify you of material changes via email or a prominent notice on our platform at least 30 days before changes take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.
Data Controller: YassApply B.V., Orteliusstraat 363 1, Amsterdam, 1056PD, Netherlands. Privacy enquiries: privacy@yassapply.com. DPO: dpo@yassapply.com. Phone: +1 5589 55488 55. Supervisory Authority: Autoriteit Persoonsgegevens, Bezuidenhoutseweg 30, 2594 AV The Hague, Netherlands (autoriteitpersoonsgegevens.nl). Last updated: 5 June 2026.
Questions? Email us at privacy@yassapply.com or contact our team.
