Last updated: October 26, 2026
Fortic AB (org. no. 556852-0042), operating as Student Competitions International ("we", "us", "our"), runs StudentCompetitions.com. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.
1. Who We Are
We are a Swedish registered company responsible for StudentCompetitions.com. We process your personal data in compliance with the General Data Protection Regulation (GDPR) and Swedish data protection laws.
Data Controller Contact: hello@studentcompetitions.com
2. What Information We Collect
2.1 Competition Submissions
When you submit a competition as an organizer, we collect:
- Competition title, organizer name, website URL
- Public contact email address
- Internal contact email address (for our use only)
- Competition description and uploaded image
- Your IP address and browser user agent
After you confirm your email address, we send the competition details to OpenAI for an automatic safety and quality check. This includes the organizer name and the public contact email address, but not the internal contact email address.
2.2 Email Subscriptions
When you sign up to receive information about competitions, we collect:
- Email address and name (optional)
- Regions and categories of interest
- Country code estimated from your signup IP address using a local country database
- Your IP address and browser user agent
After you confirm your email address, your subscription preferences and estimated country are stored in our internal Mail Platform to deliver relevant competition newsletters. The country estimate identifies the network location and may differ from where you live.
2.3 Payment Information
When you purchase a Boost, payment is processed by Stripe. We store only the Stripe session ID, payment amount, currency and status. We do not store your credit card numbers, expiration dates or CVV codes.
2.4 Cookies & Analytics
We use cookies for site functionality and, with your consent, Google Analytics 4 for understanding how visitors use our site. Analytics cookies are only set after you consent via our cookie banner. See our cookie policy for details.
2.5 Bot Protection
We use Cloudflare Turnstile to protect our forms from spam and abuse.
3. Legal Basis for Processing
Consent
- Marketing emails & newsletters
- Google Analytics cookies
Contract Performance
- Competition submissions
- Payment processing
- Transactional emails
Legitimate Interests
- Bot & spam protection
- Fraud detection
4. How We Use Your Information
- Processing and publishing competition submissions
- Sending verification emails and status notifications
- Delivering marketing emails about matching competitions
- Processing payments via Stripe
- Analyzing website performance (with consent)
- Preventing fraud and unauthorized access
- Complying with legal obligations
5. Third-Party Data Processors
| Service | Location | Purpose |
|---|---|---|
| Stripe | US (EU-US DPF) | Payment processing |
| AWS SES | EU (eu-central-1) | Transactional email |
| Sendy | EU (self-hosted) | Email marketing |
| Google Analytics | US (consent only) | Website analytics |
| Cloudflare Turnstile | Global CDN | Bot protection |
| OpenAI | US | Automatic safety check of competitions and of entries, organization profiles and posts (texts, images and the text of PDF files). Quality check of submitted competitions, and drafts of our competition newsletters and campaign emails. |
6. Data Retention
| Data | Retention |
|---|---|
| Competition data | While published; anonymized within 2 years after archival |
| Email subscriber data | Until you unsubscribe |
| Payment records | 7 years (Swedish accounting law) |
| Analytics data | 14 months (Google Analytics default) |
| IP addresses & user agents | Purged after 90 days |
7. Your Rights Under GDPR
You have the right to:
Access
Request a copy of your personal data
Rectification
Correct inaccurate data
Erasure
Request deletion ("right to be forgotten")
Data portability
Receive your data in machine-readable format
Restrict processing
Limit how we use your data
Object
Object to marketing or legitimate interest processing
Withdraw consent
At any time via email or cookie settings
Lodge a complaint
With IMY (Swedish Data Protection Authority)
To exercise your rights, email hello@studentcompetitions.com. We will respond within 30 days.
8. International Data Transfers
Some service providers (Stripe, Google Analytics, Cloudflare, OpenAI) process data in the United States. Transfers are protected by the EU-US Data Privacy Framework or Standard Contractual Clauses.
9. Security
We implement industry-standard measures including HTTPS encryption, secure password hashing, CSRF protection, rate limiting, virus scanning, and Content Security Policy headers.
10. Children's Privacy
StudentCompetitions.com is not intended for children under 13. We do not knowingly collect data from children under this age.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above.
12. Student Originals competitions
Student Originals are competitions that we run on StudentCompetitions.com together with an organiser, for example a company. This section explains what happens to your data when you enter one. The rest of this policy also applies. GDPR applies to our processing wherever you live, because we, the data controller, are based in Sweden.
The terms of each competition, which you read before you enter, name the organiser with its legal name and country and link to the organiser's privacy policy.
12.1 What we collect when you enter
- Your profile: name, country, university and education level
- Your email address
- Your entry: the text you write and the files you upload
- Your confirmation that you meet the minimum age of the competition
- The consents you give, and when you gave them
- Your IP address and browser user agent. We purge them after 90 days.
When you send your entry, we send its texts, images and the text of its PDF files to OpenAI for an automatic safety check. We do not send your name, email address or profile with it.
12.2 Legal basis
- Contract (Article 6(1)(b) GDPR): to run the competition you enter, and to share your details with the organiser as the rules describe.
- Consent (Article 6(1)(a) GDPR): for news and offers from the organiser, for contact from the organiser about jobs and internships, and for our newsletter. These boxes are optional.
You can withdraw a consent at any time. Unsubscribe from our newsletter with the link in each email. To withdraw a consent you gave the organiser, email us before the winners are chosen. After that, the organiser has your details, so contact the organiser directly.
12.3 Sharing with the organiser
While the organiser chooses the winners, it sees the approved entries without names. After the winners are chosen, we give the organiser a download with:
- The name, email address, country and university of everyone who sent an entry and did not withdraw it
- The place of each winner, and which optional boxes each person ticked
- The approved entries and their files
If you withdraw your entry, or if the competition is cancelled before the winners are chosen, your name and contact details are not shared with the organiser.
The organiser is an independent data controller for its own use of your data. The organiser's privacy policy applies to that use.
Many organisers are outside the EU and the EEA. If the organiser's country does not have an adequacy decision from the European Commission, the transfer is protected by the EU Standard Contractual Clauses (Module One), which the organiser signs when it approves the competition. You can ask us for a copy at hello@studentcompetitions.com.
12.4 What we publish
Winners are shown on StudentCompetitions.com with their first name, the first letter of their last name and their country, for example "Maria S., Philippines". If a competition has a gallery and the organiser picks your entry for it, the gallery shows your photos, your short texts (for example a caption) and your video link, named the same way. Long texts and PDF files are never published.
12.5 How long we keep it
- The download for the organiser: deleted 90 days after the winners are chosen. The organiser keeps what it downloaded under its own privacy policy.
- Files of withdrawn entries: deleted when the competition is archived, 90 days after the winners are chosen.
- Published winners and gallery entries: kept while the competition page is online.
- IP addresses and user agents: purged after 90 days.
- All other entries and files, including those of a cancelled competition, and your profile: kept until you ask us to delete them.
12.6 Your rights
You have the rights in section 7. To use them, email hello@studentcompetitions.com. For data the organiser has received, you can also contact the organiser.
13. Contact Us
Fortic AB, operating as Student Competitions International
Org. no. 556852-0042
Email: hello@studentcompetitions.com
Country: Sweden