How we handle your data.

Last updated: July 2026.

This Privacy Policy explains how The Areteia Foundation (“the foundation,” “we,” “us”) collects, uses, stores, and protects personal data. It applies to our website at areteia.foundation and to the application and scholarship programmes we operate. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Bulgarian law.

Who we are

The Areteia Foundation is a Non-Profit Public Benefit Organization registered under Bulgarian legislation. We are the data controller responsible for the personal data described in this policy. For any privacy question or request, contact us at hello@areteia.foundation.

The data we collect

Depending on how you interact with us, we may collect:

• Identity and contact details — name, date of birth, nationality, address, email, and phone number, and where the applicant is a minor, the name and contact details of a parent or legal guardian.
• Application content — educational history, achievements, essays, and the answers you provide in our application form.
• Financial information — household income, tax and benefit documentation, and asset checks used solely to assess financial need.
• Special category data — where relevant to an application, information about health, disability status, or family circumstances, and psychological assessments carried out during selection. We treat this data with heightened care and process it only with explicit consent.
• Technical data — basic, privacy-respecting analytics about how the website is used. We do not use advertising cookies.

Children’s data

Most of the people we support are under 18. We only process a child’s personal data with the consent of a parent or legal guardian, and we design our processes to protect children first. We never publish a minor scholar’s real name or face in public or fundraising materials without explicit, counselled consent, and we use composite case studies or pseudonyms instead.

Why we process your data, and our legal basis

• To assess and administer applications — on the basis of your consent, and to take steps at your request prior to entering a scholarship arrangement.
• To verify financial need — on the basis of explicit consent, using the documentation you supply.
• To safeguard scholars and administer the programme — in pursuit of our legitimate interest as a public-benefit organisation, balanced against your rights.
• To meet legal and reporting obligations — where we are required to retain or disclose information by law.

How we protect your data

We apply the same safeguards described in our governance commitments:

• Access is partitioned. Applicant dossiers are encrypted. The selection panel cannot view financial files, and financial auditors cannot view personal or psychological reflections.
• We minimise what we keep. Financial tracking documents are destroyed 12 months after a student exits the selection phase or the programme; only anonymised data is retained for statistical reporting.
• Review is anonymised. Names, genders, and locations are removed from applications before they are scored.

How long we keep it

We retain personal data only for as long as necessary for the purpose it was collected. Financial documents are destroyed within 12 months of a student leaving the selection process or the programme. Application records for candidates who are not selected are deleted after the selection cycle concludes, except where we are required to retain them for legal reasons. Anonymised, non-identifying data may be kept for statistical and reporting purposes.

Sharing your data

We do not sell personal data. We share it only where necessary: with the schools and universities to which tuition is paid directly; with vetted service providers who process data on our behalf under written agreements; and with authorities where we are legally required to do so. Any international transfer is made only with appropriate safeguards in place.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of earlier processing. To exercise any of these rights, write to hello@areteia.foundation. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни).

Cookies and analytics

The website uses only essential cookies and privacy-respecting analytics needed to keep the site working and understand general usage. We do not use advertising or third-party tracking cookies.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page. Material changes affecting how we handle applicant data will be communicated directly where appropriate.

Contact us

For any question about this policy or about how your data is handled, contact hello@areteia.foundation.