Privacy Policy

Last updated: June 18, 2026

1. Introduction

The International Space University ("ISU", "we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our AS26 Advanced Studies website and related services (collectively, the "Site"). This policy is compliant with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

By accessing or using the Site, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Site.

2. Data Controller

The data controller responsible for your personal data is:

International Space University (ISU)
Parc d'Innovation, 1 rue Jean-Dominique Cassini
67400 Illkirch-Graffenstaden, France
Email: privacy@isunet.edu

3. What Data We Collect

We may collect and process the following categories of personal data:

Identity Data: Name, email address, and university affiliation when you register or log in.
Usage Data: Information about how you interact with the Site, including pages visited, time spent, and click patterns.
Technical Data: IP address, browser type and version, time zone setting, operating system, and device information.
Authentication Data: Login credentials managed through Firebase Authentication (Google OAuth).

4. How We Use Your Data

We use your personal data for the following purposes:

To provide and maintain the Site and its educational services.
To authenticate users and manage access to course materials.
To analyze usage patterns and improve the user experience.
To communicate course updates, announcements, and schedule changes.
To comply with legal obligations under applicable law.

5. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following legal bases:

Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., analytics cookies).
Contractual Necessity: Where processing is necessary for the performance of our educational services.
Legitimate Interest: Where processing is necessary for our legitimate interests (e.g., improving our Site), provided these are not overridden by your data protection rights.

6. Third-Party Services

We use the following third-party services that may collect data:

Google Analytics: For website traffic analysis. Google Analytics uses cookies to collect anonymized usage data. See Google's Privacy Policy.
Firebase (Google Cloud): For authentication and database services. See Firebase Privacy Policy.
GitHub Pages: For hosting. See GitHub's Privacy Statement.

7. Cookies

The Site uses cookies and similar tracking technologies to enhance your experience. You can control cookie preferences through your browser settings. Essential cookies required for authentication cannot be disabled while using the Site.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, typically for the duration of the academic program plus 12 months. After this period, data will be anonymized or securely deleted.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data ("right to be forgotten").
Right to Restrict Processing: Request that we limit the processing of your data.
Right to Data Portability: Request a machine-readable copy of your data.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at privacy@isunet.edu.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (for Google/Firebase services). Such transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS/TLS), Firebase security rules, and access controls.

12. Children's Privacy

The Site is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware of such collection, we will promptly delete the data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

14. Contact & Complaints

If you have any questions about this Privacy Policy or wish to lodge a complaint, please contact us at privacy@isunet.edu. You also have the right to lodge a complaint with your local data protection authority (in France: CNIL).