Privacy Policy
Last updated: 2026-08-22
1. Who is responsible
Masar UG (haftungsbeschränkt), Hünxer Str. 121, 46537 Dinslaken, Germany. Contact: info@masar-center.de, +49 177 1873142. Full registration details are in our Impressum.
2. What this policy covers
This policy describes how Masar Portal (portal.masar-center.de) processes your personal data when you create an account, complete the application wizard, and upload documents for our consulting services. It is specific to the portal — separate from, and processed independently of, any data collected through the main masar-center.de website.
3. What we collect
- Account data: name, email address, phone number, password (stored as a salted hash, never in plain text), your preferred language.
- Application data: the visa category you apply under, your full name as printed in your passport, passport number and expiry date, and answers to the wizard's category-specific questions (e.g. the language your programme is taught in, or your medical profession).
- Documents you upload: depending on your category, this can include your passport, biometric photos, educational certificates and transcripts, language certificates, a criminal record extract, birth and civil registry documents, professional licences, and — for Medical (D16) applications — a medical report. Your in-app checklist shows the exact list for your category.
- Review data: when our staff review a document, we record a status (approved / needs revision / rejected) and, where relevant, a short note explaining what needs to change.
- Technical data: standard connection information collected by our hosting infrastructure (e.g. IP address, timestamp) as part of normal server operation and security logging.
4. Sensitive documents
A criminal record extract and a medical report — required only for Medical (D16) applications — are documents of a more sensitive nature under Art. 9/10 GDPR. We collect them only because they are documents the relevant authorities require for your specific application, only from applicants who choose that category, and only for as long as needed to support your application. Before these documents become part of your checklist, the application wizard asks you to explicitly opt in via a checkbox, separate from the rest of your application; you can withdraw that consent at any time by contacting us (Section 9), though we may then be unable to continue processing your application.
5. Why we process your data (legal basis)
- Art. 6(1)(b) GDPR — to perform the consulting services contract between you and Masar UG (processing your application, tracking checklist progress, reviewing documents).
- Art. 6(1)(a) / Art. 9(2)(a) GDPR — your explicit consent, for the sensitive documents described in Section 4.
- Art. 6(1)(f) GDPR — our legitimate interest in keeping the portal secure (e.g. malware scanning of uploads, access logging).
- Art. 6(1)(c) GDPR — compliance with legal obligations that apply to us.
6. Who we share it with
We do not sell your data. It is shared only with service providers who process it on our behalf (Art. 28 GDPR processors), each bound by a data processing agreement, and only to the extent needed to run the portal:
- Neon (database hosting) — Frankfurt, Germany (EU).
- Cloudflare R2 (document storage) — configured to store data within the EU jurisdiction.
- Cloudmersive (automated malware scanning of every uploaded file, before it is stored).
- Resend (sending account and notification emails).
- Vercel (application hosting) — Frankfurt, Germany (EU) region.
Where a provider may process data outside the EU/EEA, we rely on appropriate safeguards under Art. 46 GDPR, such as the European Commission's Standard Contractual Clauses. Masar UG staff who review applications can see your documents and application data as needed to do that review; they are bound to confidentiality.
7. How long we keep it
We keep your account, application, and document data for as long as you have an active application with us, and for a reasonable period afterwards in case you need to reopen your case or for our own record-keeping.
You can delete your account yourself at any time, from the "Account" page once signed in. We email you a link to confirm, and once you open it your account, all of your applications, and every document you uploaded are permanently erased — from our database and from our document storage alike. This cannot be undone.
We do not yet delete data automatically after a fixed period; that is still a planned addition. You can also always ask us directly (Section 9) to delete your data, and we will do so unless we are legally required to keep it.
8. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you (Art. 15),
- have inaccurate data corrected (Art. 16),
- have your data deleted (Art. 17),
- restrict how we process it (Art. 18),
- receive a copy of it in a portable format (Art. 20),
- object to processing based on our legitimate interest (Art. 21),
- withdraw consent at any time, without affecting processing that happened before the withdrawal,
- lodge a complaint with a supervisory authority — in our case, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
9. How to reach us
For any of the above, or any question about your data, email info@masar-center.de.
11. Security
We take reasonable technical and organisational measures to protect your data: encrypted connections (HTTPS) throughout, automatic malware scanning of every uploaded file before it is stored, storage within the EU, and documents that are never publicly accessible — staff view them only through short-lived, individually generated links.
12. Changes to this policy
We may update this policy as the portal changes. The date at the top of this page shows when it was last updated.