Skip to main content

At Közép-európai Egyetem (seat: 1051 Budapest, Nádor u. 9.) (Central European University, hereinafter as “CEU”) we place great emphasis on the protection of your personal information and compliance with the applicable data privacy requirements, including specifically the EU General Data Protection Regulation (GDPR)1. This Privacy Notice relates to the collection, use, transfer, and retention of personal data related to admissions at CEU Summer University (hereinafter as “CEU SUN”).

Please read it carefully before submitting your personal data.

Who are we and what do we do?

The Summer University Office of Közép-európai Egyetem receives and processes applications to CEU non-degree courses offered by the SUN program. The Office processes incoming applications and forwards them to the respective course director/s for academic review. It is the main point of contact for all applicants for any questions or issues regarding technical and/or content-related questions about the application form and application requirements. Moreover, admissions decisions are communicated by the SUN Office.

Identity and contact details of the Data Controller

Közép-európai Egyetem
1051 Budapest
Nador u. 9.
Phone: + 36 1 3273000, Email:

What is the purpose and legal basis of processing your data?

Category of personal data Purpose of data processing Special category of personal data Legal basis
Közép-európai Egyetem

Personal Details
(Name; Date of Birth; Citizenship; E-mail address)

Create online registration profile to access the application form No Consent of data subject GDPR Article 6 (1) a)

Personal Details
(Title; First/Given Name; Middle Name; Other Middle Names; Last/Family Name; First/Given Name at Birth; Gender, Date of Birth; Country of Birth; City of Birth; Citizenship, Dual Citizenship; Country of Permanent Residence)

Contact Details
(Address Line 1; City; County /State/Province; Postcode; Country; Phone; E-mail Address; Online Service)

(Country; Institution/School/College/Other; Qualification; Subject; Completion; Start Date; (Expected) End Date; (Expected) Graduation Date; English Language Qualifications; Documents)


Employment details
(Current role; Previous Role)

Writing Requirements
(Statement of Purpose)

  • managing the application and selection process
  • the exercise of rights and fulfilment of obligations by applicants
  • the maintenance of the records
  • the determination, assessment and certification of eligibility for the benefits granted pursuant to the higher education institution’s rules
No Consent of data subject GDPR Article 6 (1) a)

(Title; First/Given Name; Last/Family Name; Position; Institution/Company; E-mail Address; Country of referees)

  • asking their professional evaluation about the eligibility of applicants
No Consent of data subject GDPR Article 6 (1) a)
  • providing of equal treatment
  • providing assistance granted pursuant to law and the higher education institution’s rules for organisation and operation of selection process
Yes Consent of data subject GDPR Article 6 (1) a)
(Financial Aid needs)
  • the determination, assessment and certification of eligibility for the benefits granted pursuant to the higher education institution’s rules for organisation and operation
No Consent of data subject GDPR Article 6 (1) a)
Name and e-mail address
  • sending email communication about the program(s) of CEU’s academic departments and any future CEU SUN programs, as well as scholarship opportunities
No Consent of data subject GDPR Article 6 (1) a)

For statistical purposes, your data will be anonymized by CEU. We have put in place suitable data protection procedures to safeguard your information in line with the applicable data protection laws.

Who receives your information?

The CEU SUN works closely together with all parties involved in the selection process to provide a coordinated approach. Any transmission of data between the Data Controller and their internal units is managed through agreed processes which comply with relevant data protection legislation.

We will not distribute any of the personal data you provided us with to any third party, except those parties who are directly involved in the selection of CEU SUN applicants, provided you have consented to such transmission.

Unless we have a legal obligation to do so, we will not disclose your data to individuals, organizations, or other entities outside CEU other than those who are acting as agents and data processors working on our behalf.

For the purposes set out above, it may be our legitimate interest to pass your information to our third-party service providers, agents, and subcontractors, for the purposes of completing tasks and providing services to you on our behalf. However, with all external entities with whom data is shared, we share only those data needed to perform the specific service and require a contract and/or confidentiality and non-disclosure agreement to be signed before any data transfer—requiring them to keep your information secure and not to use it for their own purposes. We will not sell or rent your information to third parties.

Specific third parties acting as data processors we work with include:

  • Microsoft 365: Based in the US, with CEU’s data stored within EU in datacenters located in Amsterdam and Dublin. Software as a service which provides CEU’s email and document management.
  • TRIBAL: Located in Bristol, UK, Tribal Group plc. is a global provider of software and services to the education sector. To provide software and services, Tribal collects, stores, and processes personal data about its customers, potential customers, suppliers, contractors, partners, and staff as well as contracted to process information on behalf of their customers.We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

How long will your information be held?

We keep the personal data of unsuccessful applicants as well as of those who started but did not submit their application until October 31 of the same year. Your data will be anonymized for further especially statistical use. The principles of data protection should not apply to anonymous information.

If your application is successful and you are admitted to CEU SUN, your personal data will be handled in line with CEU’s data privacy rules applicable to students’ personal data.

If you choose to cancel your application at any point of time during the admissions process, your data will be anonymized for further use within 25 days after your cancellation. The principles of data protection should  not apply to anonymous information.

The referees’ personal data will be removed from our records by October 31 of the same year, unless they gave permission to be contacted with our news and announcements.

Personal data collected for the purpose of sending e-mail communication about our programs will be stored until you withdraw your consent in writing.

What are your rights?

You have the right:

  • to access your personal information,
  • to object to the processing of your personal information,
  • to rectify,
  • to erase and
  • to restrict processing your personal information
  • to withdraw your consent at any time.

If you wish to exercise any of these rights, please email or write to us at our Data Protection Officer (Nádor utca 9, 1051 Budapest, Hungary). CEU will make every effort to fulfill your request to the extent allowed by law and will respond in writing within 25 days of receiving your request.

Should you wish to request help from the relevant national authority, their details are as follows:
National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11., e-mail:, levelezési cím: 1363, Budapest, Pf. 9.).

Security of your information

We are committed to holding your data securely and treating it with sensitivity. All data are held securely and in accordance with the relevant data privacy laws and our internal policies. We do not sell to or trade your data with any other organizations. For further details please see CEU’s Data Protection Policy at

Although most of the information we store and process stays within Hungary, some information may be transferred to countries outside the European Economic Area (EEA). This may occur if, for example, one of our trusted partners’ servers are located in a country outside the EEA (see above: data processors). Where these countries do not have similar data protection laws to the European Union, we will take steps to make sure they provide an adequate level of protection in accordance with EU data protection law.

Future changes

If our information policies or practices change at some time in the future, we will post the changes on our website:

Download this Privacy Statement in PDF HERE.

1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.