This policy explains which personal data Opportunity Universe processes, on what legal basis, for how long, who receives it and which rights you have under the General Data Protection Regulation (GDPR). We deliberately collect as little personal data as possible: the entire database can be searched without an account, and no advertising or cross-site tracking takes place on this website.
Last updated: 6 September 2026
The controller responsible for data processing on this website within the meaning of Article 4 (7) GDPR is:
Edu.Harbour GbR
Postfach 762135
22069 Hamburg
Germany
contact@eduharbour.com
The address above is a mailbox. Our official business address is listed at eduharbour.com/imprint
This policy applies to the website opportunity-universe.com and to the emails we send, in particular the newsletter. It does not apply to the websites of the organisations whose programmes we list. When you follow a link to an organiser, that organiser's own privacy policy applies.
When you open a page, your browser automatically transmits technical data that our web server records in log files: the IP address, the date and time of the request, the page requested, the referring page, the browser and operating system version and the amount of data transferred. This processing is necessary to deliver the website, to guarantee its stability and to detect and investigate attacks. The legal basis is our legitimate interest in a secure and functioning website under Article 6 (1) (f) GDPR. Log entries are deleted after a short retention period and are not merged with other data sources or used to build profiles of individual visitors. For any question about this processing you can write to info@opportunity-universe.com.
This website uses only cookies that are technically necessary to provide the functions you request, so no consent banner is required and no consent is stored. We set a session cookie (ou_sess) that keeps you signed in and protects forms against cross-site request forgery; it expires when you close the browser. We set a language cookie (ou_lang) that remembers the interface language you selected, and, only if you choose a country manually, a country cookie (ou_country) that remembers that choice. Both are stored for up to twelve months. In addition your browser may store which search filter groups you expanded, using sessionStorage on your own device; that information is never transmitted to us. No advertising, analytics or cross-site tracking cookies are used.
So that we can show opportunities relevant to where you are, we determine an approximate country. We use the country code that our content delivery network supplies with the request where available, otherwise we look the country up from your IP address. Only the resulting two-letter country code is kept, for the duration of your session; we do not store your IP address for this purpose and cannot derive your precise location from it. You can override the detected country at any time in the country selector, and that choice takes precedence. The legal basis is our legitimate interest in providing relevant content under Article 6 (1) (f) GDPR.
You can search the entire database without an account. If you create one, we process your email address and, only if you choose to provide them, your name, date of birth, country of residence, citizenship, city, school or employer, study level, subject interests, preferred opportunity categories and regions, funding and destination preferences, the languages you can apply in and your interface language, together with the opportunities you save and the timestamps of your registration and last activity. We use this data to operate the account, to keep your saved list and to rank opportunities by relevance for you. The legal basis is the performance of a contract under Article 6 (1) (b) GDPR. You can sign in either with a password of your choosing, which we store only as a salted one-way hash and never in readable form, or by means of a one-time link sent to your email address. Account data is stored until you delete your account, after which it is erased.
The newsletter is sent only after you confirm your address by clicking the link in a confirmation email (double opt-in). We store your email address, the profile and interest details described in the previous section, which are used solely to choose which opportunities you are shown and how often, the confirmation timestamp and the record of which opportunities have already been sent to you, so that an issue never repeats an entry. Providing the profile details is optional; without them you receive a general edition. The legal basis is your consent under Article 6 (1) (a) GDPR. You can withdraw consent at any time, with effect for the future, by using the unsubscribe link contained in every issue or by writing to us; withdrawal does not affect the lawfulness of processing carried out before it.
If you submit an opportunity, share a success story, report an error or send a partnership enquiry, we process the content you provide together with your name and email address, and, for some forms, your IP address in order to prevent abuse. Uploaded images are stored with the submission. This data is used solely to review, respond to and, where relevant, publish the submission; success stories are published only with the explicit consent you give in the form, and only with the name you enter yourself. The legal basis is our legitimate interest in reviewing submissions and preventing abuse under Article 6 (1) (f) GDPR, and, for publication, your consent under Article 6 (1) (a) GDPR.
We record the search terms and filters used on this website together with the number of results and the interface language, so that we can identify gaps in coverage and improve the search. These records contain no IP address, no cookie identifier and no account reference, and therefore cannot be attributed to an individual person. We additionally keep purely aggregated daily counters, for example how many searches were run on a given day. The legal basis is our legitimate interest in improving the service under Article 6 (1) (f) GDPR.
We rank the opportunities you see by relevance, using the country, study level and subject interests you provide, together with attributes of each opportunity such as funding, eligibility and deadline. This affects only the order in which publicly available entries are shown to you and never restricts what you can find, since every entry remains searchable. No automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22 GDPR takes place.
Hosting and email delivery are carried out on infrastructure operated in Germany on our behalf, on the basis of a data processing agreement under Article 28 GDPR. When a page loads, your browser also requests resources from the following providers, which necessarily receive your IP address: Google Fonts and Google favicons (Google Ireland Limited), the jsDelivr and unpkg content delivery networks for icon and map libraries, and map tiles from OpenStreetMap and CARTO on the map pages. Organisation logos are requested from Clearbit. Cover images for opportunities are retrieved by our server from Pexels and stored on our own infrastructure, so your browser does not contact Pexels. Our crawling and extraction pipeline uses language models from OpenAI to structure publicly available opportunity pages; no personal data of website visitors is transmitted in that process. We do not sell personal data and do not pass it to advertisers.
Some of the providers named above are established outside the European Economic Area or are affiliated with companies that are. Where personal data is transferred to such a country, the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses adopted by the Commission under Article 46 (2) (c) GDPR, supplemented where necessary by additional safeguards.
We keep personal data only for as long as the purpose for which it was collected requires. Account and newsletter data is kept until you delete your account or unsubscribe. Submissions, stories, feedback and enquiries are kept for as long as needed to review and answer them and, where published, for as long as the entry remains online. Server log files are deleted after a short retention period. Where statutory retention obligations apply, in particular under commercial and tax law, the data is restricted from further processing until those periods expire.
This website is delivered exclusively over an encrypted TLS connection, which you can recognise by the lock symbol in your browser. Access to personal data inside our organisation is limited to the persons who need it in order to operate the service. Passwordless sign-in links are single use and expire after a short period.
Under the GDPR you have the right to obtain confirmation as to whether we process your personal data and to receive a copy of it (Article 15), to have inaccurate data corrected (Article 16), to have your data erased (Article 17), to obtain restriction of processing (Article 18), to receive your data in a structured, commonly used and machine-readable format and to have it transmitted to another controller (Article 20), and to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21). Where processing is based on consent you may withdraw that consent at any time with effect for the future. Profile data can be changed or deleted directly in your account; for anything else write to info@opportunity-universe.com and we will respond within the statutory period. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
We update this policy when the service or the legal situation changes; the version published here is always the current one and carries the date shown at the top. For any question about data protection, or to exercise any of the rights described above, please write to info@opportunity-universe.com.
