Data Processing & Sub-processors

1. Overview

When you use ScholarshipFit, we act as the data controller for your personal data under GDPR / UK GDPR (and equivalent laws in other jurisdictions). If you are a business customer using ScholarshipFit on behalf of end users (for example, a school licensing our platform for students), we may act as a data processor for that user data. This page describes both scenarios.

2. Sub-processors we use today

To operate the Service, we share limited data with the vetted service providers listed below. Each is bound by a written data-processing agreement and, where applicable, EU Standard Contractual Clauses (SCCs).

3. Notice of new sub-processors

We will update this page and, where reasonably possible, provide 30 days’ advance notice by email to designated privacy contacts before adding a new sub-processor that processes personal data. B2B customers who object to a new sub-processor on reasonable grounds may terminate their subscription for cause within that notice period.

4. Security safeguards

• TLS 1.2+ for all traffic between the client, our servers, and each sub-processor.
• Passwords hashed with bcrypt (cost factor ≥ 10).
• Signed session tokens (JOSE / JWT) with short expiration windows.
• Encryption at rest via managed database and storage providers.
• Least-privilege database access; no engineers have production credentials outside break-glass procedures.
• Automatic dependency scanning and prompt patching of critical vulnerabilities.
• Access logs retained for 90 days.

5. AI processing safeguards

Data sent to Anthropic through the Emergent LLM Gateway is used only to generate the specific response for your request. Anthropic’s enterprise terms with Emergent prohibit using customer inputs to train generally-available models. Prompts and outputs are retained by Anthropic for a limited period for abuse monitoring, per their commercial terms. We do not send your uploaded documents to any provider other than the one required to complete the requested analysis.

6. International transfers

Personal data may be transferred outside your country of residence, including to the United States, in connection with the sub-processors above. Where required, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and we perform Transfer Impact Assessments before onboarding a new sub-processor.

7. Data-subject requests

Requests for access, rectification, erasure, portability, restriction, or objection should be sent to legal@scholarshipfit.com. Please include the email address on your account and the specific right you are exercising. We respond within 30 days (or 45 days for CCPA requests).

8. Requesting a signed DPA

B2B customers (schools, consultants, organisations) who require a signed Data Processing Agreement can obtain our template by emailing legal@scholarshipfit.com. Our standard DPA incorporates the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) and the UK IDTA.

9. Data-breach notification

If we become aware of a personal-data breach that affects your data, we will notify affected users and, where required, the relevant supervisory authority within 72 hours in line with GDPR / UK GDPR obligations.

10. Contact

ScholarshipFit Ltd · Republic of Uzbekistan · legal@scholarshipfit.com