Last updated: October 20, 2026
Fortic AB, org.nr 556852-0042, ("we", "us", "our") operates StudentCompetitions.com. This privacy policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.
1. Who We Are
Fortic AB is a Swedish registered company responsible for StudentCompetitions.com. We process your personal data in compliance with the General Data Protection Regulation (GDPR) and Swedish data protection laws.
Data Controller Contact: hello@studentcompetitions.com
2. What Information We Collect
2.1 Competition Submissions
When you submit a competition as an organizer, we collect:
- Competition title, organizer name, website URL
- Public contact email address
- Internal contact email address (for our use only)
- Competition description and uploaded image
- Your IP address and browser user agent
2.2 Email Subscriptions
When you sign up to receive information about competitions, we collect:
- Email address and name (optional)
- Regions and categories of interest
- Country code estimated from your signup IP address using a local country database
- Your IP address and browser user agent
After you confirm your email address, your subscription preferences and estimated country are stored in our internal Mail Platform to deliver relevant competition newsletters. The country estimate identifies the network location and may differ from where you live.
2.3 Payment Information
When you purchase a Boost, payment is processed by Stripe. We store only the Stripe session ID, payment amount, currency and status. We do not store your credit card numbers, expiration dates or CVV codes.
2.4 Cookies & Analytics
We use cookies for site functionality and, with your consent, Google Analytics 4 for understanding how visitors use our site. Analytics cookies are only set after you consent via our cookie banner. See our cookie policy for details.
2.5 Bot Protection
We use Cloudflare Turnstile to protect our forms from spam and abuse.
3. Legal Basis for Processing
Consent
- Marketing emails & newsletters
- Google Analytics cookies
Contract Performance
- Competition submissions
- Payment processing
- Transactional emails
Legitimate Interests
- Bot & spam protection
- Fraud detection
4. How We Use Your Information
- Processing and publishing competition submissions
- Sending verification emails and status notifications
- Delivering marketing emails about matching competitions
- Processing payments via Stripe
- Analyzing website performance (with consent)
- Preventing fraud and unauthorized access
- Complying with legal obligations
5. Third-Party Data Processors
| Service | Location | Purpose |
|---|---|---|
| Stripe | US (EU-US DPF) | Payment processing |
| AWS SES | EU (eu-central-1) | Transactional email |
| Sendy | EU (self-hosted) | Email marketing |
| Google Analytics | US (consent only) | Website analytics |
| Cloudflare Turnstile | Global CDN | Bot protection |
6. Data Retention
| Data | Retention |
|---|---|
| Competition data | While published; anonymized within 2 years after archival |
| Email subscriber data | Until you unsubscribe |
| Payment records | 7 years (Swedish accounting law) |
| Analytics data | 14 months (Google Analytics default) |
| IP addresses & user agents | Purged after 90 days |
7. Your Rights Under GDPR
You have the right to:
Access
Request a copy of your personal data
Rectification
Correct inaccurate data
Erasure
Request deletion ("right to be forgotten")
Data portability
Receive your data in machine-readable format
Restrict processing
Limit how we use your data
Object
Object to marketing or legitimate interest processing
Withdraw consent
At any time via email or cookie settings
Lodge a complaint
With IMY (Swedish Data Protection Authority)
To exercise your rights, email hello@studentcompetitions.com. We will respond within 30 days.
8. International Data Transfers
Some service providers (Stripe, Google Analytics, Cloudflare) process data in the United States. Transfers are protected by the EU-US Data Privacy Framework or Standard Contractual Clauses.
9. Security
We implement industry-standard measures including HTTPS encryption, secure password hashing, CSRF protection, rate limiting, virus scanning, and Content Security Policy headers.
10. Children's Privacy
StudentCompetitions.com is not intended for children under 13. We do not knowingly collect data from children under this age.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above.
12. Student Originals competitions
Student Originals are competitions that we run on StudentCompetitions.com together with an organiser, for example a company. This section explains what happens to your data when you enter one. The rest of this policy also applies. GDPR applies to our processing wherever you live, because Fortic AB in Sweden is the data controller.
The terms of each competition, which you read before you enter, name the organiser with its legal name and country and link to the organiser's privacy policy.
12.1 What we collect when you enter
- Your profile: name, country, university and education level
- Your email address
- Your entry: the text you write and the files you upload
- Your confirmation that you meet the minimum age of the competition
- The consents you give, and when you gave them
- Your IP address and browser user agent. We purge them after 90 days.
12.2 Legal basis
- Contract (Article 6(1)(b) GDPR): to run the competition you enter, and to share your details with the organiser as the rules describe.
- Consent (Article 6(1)(a) GDPR): for news and offers from the organiser, for contact from the organiser about jobs and internships, and for our newsletter. These boxes are optional.
You can withdraw a consent at any time. Unsubscribe from our newsletter with the link in each email. To withdraw a consent you gave the organiser, email us before the winners are chosen. After that, the organiser has your details, so contact the organiser directly.
12.3 Sharing with the organiser
While the organiser chooses the winners, it sees the approved entries without names. After the winners are chosen, we give the organiser a download with:
- The name, email address, country and university of everyone who sent an entry and did not withdraw it
- The place of each winner, and which optional boxes each person ticked
- The approved entries and their files
If you withdraw your entry, or if the competition is cancelled before the winners are chosen, your name and contact details are not shared with the organiser.
The organiser is an independent data controller for its own use of your data. The organiser's privacy policy applies to that use.
Many organisers are outside the EU and the EEA. A transfer to such an organiser is based on Article 49(1)(b) GDPR, because it is necessary to perform the contract about your participation.
12.4 What we publish
Winners are shown on StudentCompetitions.com with their first name, the first letter of their last name and their country, for example "Maria S., Philippines". If a competition has a gallery and the organiser picks your entry for it, the gallery shows your photos, your short texts (for example a caption) and your video link, named the same way. Long texts and PDF files are never published.
12.5 How long we keep it
- The download for the organiser: deleted 90 days after the winners are chosen. The organiser keeps what it downloaded under its own privacy policy.
- Files of withdrawn entries: deleted when the competition is archived, 90 days after the winners are chosen.
- Published winners and gallery entries: kept while the competition page is online.
- IP addresses and user agents: purged after 90 days.
- All other entries and files, including those of a cancelled competition, and your profile: kept until you ask us to delete them.
12.6 Your rights
You have the rights in section 7. To use them, email hello@studentcompetitions.com. For data the organiser has received, you can also contact the organiser.