Legal

Privacy and cookies

We keep data collection to the minimum needed to run the website and answer your requests.

Last updated: 30 October 2026

In short

We collect as little personal data as possible. The most important points:

  • Visitor statistics are kept on our own server, use no cookie and do not store your IP address.
  • The only cookies we set are technical ones that the website needs to work and to stay secure.
  • We use no advertising, no social media tracking and no third-party analytics.
  • We never sell personal data.
  • You can ask us at any time to see, correct or delete your data.

Who is responsible

The European Association for Higher Education Advancement (EAHEA), Estonia, is the controller of the personal data processed on this website (International Higher Education Day, www.higheredday.com). For any question about your data, write to us through the contact page.

Visitor statistics

To understand how the website is used we record visits and page views on our own server. For each visit we store the pages opened, the date and time, the host name of the website that referred you (not its full address), the campaign parameters of the link you followed (for example utm_source), the type of device, the browser, the operating system and the language of the page. We set no cookie and we do not store your IP address: a visitor code is calculated from your IP address, your browser details and the date with a secret key, changes every day and cannot be traced back to you or followed from one day to the next. Records older than 365 days are deleted automatically. The legal basis is our legitimate interest in running and improving the website (Article 6(1)(f) GDPR). Because the statistics are cookie free and cannot be traced back to you, they do not need your consent.

Contact form

When you write to us through the contact page we store your name, email address, organisation (optional), subject and message, and a keyed one-way hash of your IP address (never the address itself) that helps us to detect repeated abuse. A copy of the message is sent by email to the EAHEA office. We use this information only to answer you. The legal basis is our legitimate interest in answering the people who contact us (Article 6(1)(f) GDPR).

Registering an institution or an event

When you register an institution or an event we store what you enter: the name, type, country, city, website, logo and description of the institution, the name and email address of the contact person, and the title, description, date, place, links and cover image of the event, together with the hash of your IP address and the language of the page you used. The name and email address of the contact person are never published; we use them only to review your submission and to confirm it and tell you the decision by email. Once approved, the institution and event details, the logo and the cover image are published on this website and can be found by search engines, so please do not put personal data of other people into descriptions without their permission. The legal basis is your request to take part (Article 6(1)(b) GDPR) and our legitimate interest in organising the celebration (Article 6(1)(f) GDPR).

Team accounts

A few members of the IHED organising team have an account to review submissions and edit the content of the website. We store their name, email address, a hashed password and the settings of the two-factor sign-in. These accounts exist only for the work of the team and are not available to visitors.

Cookies and similar technologies

Cookies are small files that a website stores in your browser. This website sets only cookies and browser storage that are strictly necessary to provide what you ask for, so they do not need your consent; the notice at the bottom of the page only informs you. We use no analytics, advertising, social media or other tracking cookies. If this ever changes we will update this page and ask for your consent first.

Name Purpose Duration Type
SUNMVC Session cookie. Keeps the security token that protects forms against forged requests, the image check code and the one-time message shown after you send a form. It contains a random identifier only. Up to 30 days Necessary, first party
sun_remember Only for team members who tick “Remember me” when they sign in to the admin area; keeps them signed in on that browser. Visitors never receive it. 30 days Necessary, first party
ihed_cookie_notice Browser storage, not a cookie. Remembers that you have read the cookie notice, so it is not shown again. Until you clear the data of this website in your browser Necessary, first party
__cf*, cf_* Cookies whose names start with __cf or cf_ and browser storage of Cloudflare Turnstile. They protect the website and its forms against bots and abuse. Turnstile is loaded only on pages that have a form. Set by Cloudflare, short lived Necessary, third party (Cloudflare)

You can see and delete cookies in the settings of your browser, and most browsers can block them. If you block the technical cookie, the forms of this website cannot work, because their security token cannot be checked.

Service providers and recipients

We do not sell or rent personal data. We share data only with the providers that help us to run the website and with the people who need it for their work:

  • Cloudflare, Inc.: delivers and protects the website (content delivery and firewall) and provides the Turnstile check on forms. It processes technical request data such as IP addresses.
  • Google Workspace (Google): the email service that sends our messages and receives yours.
  • DigitalOcean: the cloud hosting provider of the server on which the website and its database run.
  • Members of the IHED organising team and the EAHEA office, who read the submissions to do their work.

All fonts, scripts, icons and images of the website are loaded from our own server, not from external networks.

Transfers outside the European Economic Area

Some of our providers may process data outside the European Economic Area, for example in the United States. Such transfers are covered by an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or by standard contractual clauses.

How long we keep data

  • Visitor statistics: 365 days, then they are deleted automatically.
  • Contact messages: as long as needed to answer you and to document the request, then they are deleted.
  • Registered institutions and events: as long as they are published or needed for the history of the celebration. You can ask us to correct or remove them at any time.
  • Team accounts: until the person leaves the team.

Security

The website is served over HTTPS. Forms are protected against forged requests, spam and abuse (security token, hidden trap field, Cloudflare Turnstile, image check and a limit on repeated submissions). Uploaded images are re-encoded, texts are cleaned before they are saved and passwords are stored only as hashes. Team accounts can use two-factor sign-in.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict the processing of your data;
  • object to processing that is based on our legitimate interest;
  • receive your data in a portable format.

To use these rights write to us through the contact page and describe the entry concerned (for example the name of the institution or event). We may ask you to confirm your identity and we answer within one month. If you think that we handle your data unlawfully you can complain to a supervisory authority: in Estonia the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority of your own country.

Children

The website is meant for institutions, educators and students. It is not aimed at children under 16 and we do not knowingly collect their personal data.

Published events and institutions link to external websites. We are not responsible for their content or their privacy practices.

Changes to this page

We update this page when the website or the law changes. The date of the last update is shown at the top of the page.

Contact