Privacy Policy

FEJA is operated by FEJA Family Ltd, a private limited company registered in England and Wales under company number 17383395, with its registered office at 82a James Carter Road, Mildenhall, Bury St Edmunds, England, IP28 7DE.

Under data protection law we are the controller of the information described here: we decide what is collected and why, and we are accountable for it. For anything to do with your information, write to support@ofeja.com.

This policy covers the FEJA apps and ofeja.com. It does not cover the websites of universities, schools and other providers you reach through FEJA — once you leave the app, their policy applies. Section 6 explains this.

What you enter

• Name — so we know what to call you.
• Email address — to sign you in and recover your account.
• Age — to confirm you meet our minimum age and to filter programmes with age limits. We store an age, not a date of birth.
• Country — chosen from a list, used to show programmes open to you.
• Whether you are at school, at university, or neither — used to rank what you see.
• The programmes you save — kept on our servers so your list is there on any device.

That is the whole profile. We do not ask for the name of your institution, your address, or your phone number.

How you sign in

Accounts currently use an email address and a password. If we add Sign in with Apple or Google later, those providers would confirm your identity and pass us a unique identifier, your name and your email address — never your password. We will update this policy before enabling either.

Collected automatically

• Which listings you open, tap through, or swipe — so we can see which programmes are useful and find more like them.
• Device and app information — model, operating system and app version, for diagnosing faults.
• IP address — an unavoidable part of connecting to our servers. It gives a rough idea of your country and helps us detect abuse. We do not use it to locate you.

This is recorded in our own database. We do not use a third-party analytics service.

If you email us, we keep the message and your contact details so we can reply.

• No device location. FEJA does not request or use GPS. Your country is only what you select.
• No cross-app or cross-site tracking. We use no advertising identifiers and no advertising SDKs, and we do not link your activity in FEJA to anything you do elsewhere. This is why the app never shows Apple's tracking prompt.
• No selling your data. We do not sell, rent or trade personal information.
• No payment details. FEJA is free, so there is nothing to charge.
• No access to your contacts, photos, camera, microphone or health data.
• No special category data. We do not ask about your health, ethnicity, religion, politics or sexual orientation. Please do not send it to us.

If any of this ever needed to change, we would update this policy and tell you in the app before it took effect.

Under UK and EU law we need a specific legal basis for each use of your information.

Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override them, because the data is limited and none of it is used for advertising or profiling. You can object at any time — see section 9.

We make no automated decisions about you with legal or similarly significant effects. Filtering listings by the age and country you entered is a search, not a decision about you.

We send service emails where they are part of running your account — confirming sign-up, resetting a password, or telling you about an important change. While you have an account these cannot be switched off.

We do not currently send marketing email or push notifications. If we introduce either, it will be opt-in: your device asks before any notification can be sent, and every optional email will carry a working unsubscribe link.

We pass no personal information to programme providers. Tapping Apply opens a link to the provider's website. That is the entire transaction — we attach no name, email, profile or identifier to it, and providers receive nothing about you from us.

This holds whether or not we work with the provider directly. Two things follow:

• On their site, their rules apply. Anything you type into an application form goes to them under their privacy policy. We have no visibility of it and no control over it.
• We do not hear back. Providers do not tell us whether you applied or what happened.

For our own statistics we record that a listing was opened, linked to your account. It shows us which programmes are popular. It is not shared with the provider.

We do not sell your information and we do not share it for anyone else's marketing. We use a small number of providers to run FEJA. They act on our instructions only, under contracts that hold them to it.

We may also disclose information if the law requires it — for example a valid court order, which we check is properly made before responding — or if FEJA is sold or merged, in which case your information stays subject to this policy and we would tell you beforehand.

Your account, profile and saved list are stored on servers in the European Union.

Where information reaches a provider outside the UK or EEA, we rely on the safeguards the law requires: the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, or an adequacy finding for the country concerned. Ask us and we will send you the safeguards for a particular transfer.

If an account sits unused for three years we will email first, and delete it if we do not hear back.

If you are in the UK or the EEA you have the rights below. In practice we extend them to everyone, wherever you are.

• Access — a copy of what we hold about you.
• Correction — fix anything inaccurate. Most of it you can edit in the app.
• Erasure — have it deleted. Deleting your account does this directly.
• Portability — receive what you gave us in a machine-readable file.
• Restriction — ask us to pause using it while a dispute is resolved.
• Objection — object to anything we base on legitimate interests.

Email support@ofeja.com. We reply within one month, free of charge, and may ask you to confirm your identity so nobody else can request your data.

If you are not satisfied, please tell us first — we would rather fix it. You may also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or in the EEA the supervisory authority where you live or work.

You can delete your account and everything in it at any time from your profile settings in the app. We ask you to confirm, and then it is done.

Deleting removes your profile, saved list and account record from our live systems straight away, and frees your email address for re-use. Encrypted backups cycle out within 30 days. Aggregate figures that can no longer be linked to you may remain.

If you would rather we did it, email support@ofeja.com.

If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you have rights to know what we collect, to access, correct, delete and receive a copy of it. Section 9 describes how we handle all of these and the same process applies.

For the avoidance of doubt: we have not sold personal information, and have not shared it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act. We will not discriminate against you for exercising these rights. You may use an authorised agent; we will ask for proof you authorised them.

FEJA is intended for people aged 16 or over, and is rated accordingly on the App Store and Google Play. We do not knowingly collect information from anyone under 16.

If we learn an account belongs to someone under 16, we delete it. If you are a parent or guardian and believe your child has created an account, email support@ofeja.com and we will remove it.

Information is encrypted in transit with TLS and encrypted at rest by our hosting provider. Access to production data is limited to the people who need it and protected by multi-factor authentication. Passwords are stored only as salted hashes.

No system is perfectly secure and we will not claim otherwise. If a breach occurs that is likely to affect your rights, we will notify the relevant authority within 72 hours and tell you directly where the law requires it.

If you think you have found a security problem, email support@ofeja.com. We are grateful for reports made in good faith and will not pursue anyone who reports responsibly.

The FEJA apps use no cookies.

On ofeja.com we use only strictly necessary storage — keeping you signed in where relevant and protecting against abuse. These need no consent because the site cannot work without them. We run no advertising, retargeting or analytics cookies on our website.

We update this policy when the app changes or the law does. The date at the top shows the current version.

For minor wording we simply update this page. For anything that materially affects your privacy — a new category of data, a new purpose, a new provider handling your information — we will tell you in the app or by email before it takes effect.

support@ofeja.com

FEJA Family Ltd
82a James Carter Road
Mildenhall, Bury St Edmunds
England, IP28 7DE
United Kingdom

Registered in England and Wales, company number 17383395.