Privacy policy
What happens to your personal data when you use this site. In short: we collect what you type into the consultation form, we use it to reply to you, and we do not share it with anyone else.
Last updated September 2026
Who is responsible for your data
Evidence Based Education Solutions (“EBES”, “we”, “us”) is the data controller for the personal data described on this page.
- Legal name: Evidence Based Education Solutions OÜ
- Trading name: Evidence Based Education Solutions
- Registry code: 17046360
- Registered in Estonia: 12 August 2024 (status: registered)
- Email: info@ebesonline.org
EBES is a small Estonian consultancy and has not appointed a data protection officer, because the scale of our processing does not require one under Article 37 of the GDPR. Every question about your data is answered by us directly, at the email address above, and enquiries are read only by the consultancy’s two co-founders.
What we collect
What you send us through the consultation form. This is the only form on the site. It asks for your name, your email address, a free-text message, where you are in your process (one of four options), and which parts of Europe interest you (any of five options).
The form also contains a hidden field that human visitors never see or fill in. Automated spam bots fill it in, which is how we identify and discard them. If you are a person using a normal browser, this field stays empty and collects nothing about you.
Server logs kept by our host. The site is hosted on Netlify. Like any web host, Netlify records standard access logs for the requests that reach its servers: IP address, time of request, page requested, browser user-agent. We do not use these logs to build a profile of you, and we do not combine them with anything you send us through the form.
That is the complete list. We set no cookies, we run no analytics, we use no tracking pixels, we do no advertising or remarketing, we have no mailing list or newsletter, and we have no user accounts. There is nothing to opt out of, because there is nothing running.
Why we collect it, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Consultation form submissions | To read your enquiry, reply to you, and discuss whether we can help | Art. 6(1)(b): steps taken at your request before entering into a contract |
| Keeping the exchange on file | So we have a record of the advice given, and can pick up where we left off | Art. 6(1)(f): our legitimate interest in accurate records of our own work |
| The hidden anti-spam field | To keep automated submissions out of the inbox | Art. 6(1)(f): our legitimate interest in a working contact form |
| Netlify server logs | To keep the site up, secure and functioning | Art. 6(1)(f): operating a secure service |
| Google Fonts request | To display the site’s typefaces | Art. 6(1)(f): presenting the site as designed |
We do not use your data for any purpose other than the ones listed here. We will not send you marketing. We will not add you to anything.
Please do not send us sensitive data
The message box is free text, so we cannot control what goes into it. Please keep it to your study plans. You do not need to tell us about your health, your religion, your political views, your ethnic background or your sexual orientation in order to get useful advice from us, and we would rather you did not. If you do send something of that kind, we will use it only to answer your question and we will delete it on request.
How long we keep it
- Form submissions and the email conversation that follows: 24 months from our last exchange with you, after which they are deleted from both the Netlify form dashboard and the Gmail mailbox behind info@ebesonline.org. University application cycles run over two to three years, and people often come back mid-way, which is why the period is not shorter.
- If you ask us to delete your data sooner: we do it, and we confirm when it is done.
- Netlify server logs: kept by Netlify under its own retention schedule, which we do not control.
Who else sees it
Netlify. Netlify hosts the site and processes form submissions on our behalf. Your submission is stored in Netlify’s form dashboard and forwarded by email to info@ebesonline.org. Netlify acts as our processor and may only handle the data on our instructions. Netlify operates infrastructure outside the European Economic Area, and those transfers are covered by the European Commission’s Standard Contractual Clauses.
Google (Gmail). The info@ebesonline.org mailbox is hosted on Gmail, so the forwarded copy of your submission (and any email conversation that follows) sits on Google’s servers. Google processes that mail on our behalf as our processor, under its own data processing terms, and does not use the content of a business mailbox to target advertising. Google operates infrastructure outside the European Economic Area, and those transfers are covered by the European Commission’s Standard Contractual Clauses. When the retention period set out above runs out, we delete the thread from the mailbox and from its Trash.
Nobody else. In particular: we do not pass your details to universities, to recruitment agencies, to other consultancies, or to anyone who might contact you. We take no commission from any university and we accept no sponsored placements, so we have no financial reason to hand your name to anyone, and we do not. We have never sold personal data and we will not.
The only exception would be a legal one: if we were required by Estonian or EU law to disclose something to a public authority. That has not happened, and if it did we would tell you unless the law forbade it.
Google Fonts: the one third party on the page
The site loads its typefaces from Google Fonts, at fonts.googleapis.com and fonts.gstatic.com. When you open a page, your browser makes a request directly to Google’s servers. Google will see your IP address, the time of the request, and basic browser information, in the same way any server sees that from anyone who connects to it. This happens between your browser and Google; the data does not pass through us and we receive nothing back from it.
We mention it because it is the one point on this site where a third party sees anything about you, and a privacy policy that did not say so would be incomplete. If you would rather it did not happen, the cookie settings page explains how to block it. The site stays fully readable in your device’s default fonts.
Your rights
Under the GDPR you have the right to:
- Access: ask us for a copy of the personal data we hold about you.
- Rectification: ask us to correct anything wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to stop using your data while a question about it is resolved.
- Portability: ask for the data you gave us in a machine-readable file.
- Object: object to processing we carry out on the basis of legitimate interests.
To exercise any of these, email info@ebesonline.org and say what you want. You do not need a particular form of words, and you do not need to give a reason for an erasure or objection request. We will reply within 30 days, usually much sooner, and we will not charge you.
Because we hold very little, most of these requests are quick. An access request generally amounts to us sending you back your own form submission and the emails between us.
Complaints
If you think we have handled your data badly, please tell us first. Email info@ebesonline.org and we will look into it properly.
You also have the right to complain directly to the Estonian supervisory authority, whether or not you have contacted us: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. If you live in another EU or EEA country, you may complain to your own national authority instead.
If you are under 18
Some of the people who write to us are still at school. If you are under 18, please talk to a parent or guardian before sending us your details, and feel free to have them write to us with you. We will answer either of you.
Changes to this policy
If we change how the site handles data (for example, if we ever self-host the fonts, or add anything that sets a cookie), we will update this page and change the date at the top before the change goes live. There is no mailing list, so the only way to see the current version is to check this page.