Privacy notice

1. Scope and controller

AMERA Global Career Development, Sofia, Bulgaria, is the controller for the processing described in this notice. Questions and requests can be sent to hello@amera.io.

This notice covers the public AMERA website, program enquiries, and applications. A host company that later receives candidate information may act as an independent controller for its own recruitment or placement decisions and must provide its own information where required.

2. Personal data we process

We do not ask for special-category data, national identification numbers, financial information, or medical information in the initial application. Please do not place such information in your CV or notes.

• Application information: name, email address, telephone number if provided, field of study, CV or résumé, and optional notes.
• Enquiry and correspondence information: your contact details, messages, and our responses.
• Technical and security information: IP address, browser and device information, requested pages, timestamps, and security events that may be recorded by the hosting infrastructure.
• Preference information: selected language and your privacy choices.

3. Where the data comes from

Most data comes directly from you. Basic technical and security data may be generated automatically by your browser, our hosting infrastructure, or strictly necessary site functions. If a university, referrer, or partner provides information about you, we will give you the information required by law unless an exception applies.

4. What is required

Fields marked as required are needed to assess and respond to an application. Telephone information and free-text notes are optional at the initial stage. If required information is not provided, we may not be able to assess the application. Optional cookies are never required to browse or apply.

5. Who may receive personal data

We do not sell personal data. Processor names must be added to the internal processor register and this notice updated where transparency requires identification of a provider.

• Authorised AMERA team members who need the information for application administration, communication, security, or legal compliance.
• Contracted hosting, email, document-storage, application-management, and professional-service providers acting under appropriate confidentiality and data-processing terms.
• Prospective host companies and program partners, but only at an appropriate stage, only with relevant information, and after you have been informed where required.
• Public authorities, courts, advisers, or insurers where disclosure is required by law or necessary to establish, exercise, or defend legal claims.

6. International transfers

The program involves potential host organisations in Japan. If candidate data is transferred to an eligible recipient in Japan, AMERA will rely on the applicable European Commission adequacy framework where its conditions are met. Otherwise, an approved transfer mechanism and any necessary supplementary safeguards will be used before transfer.

Service providers outside the European Economic Area may be used only after their transfer mechanism, sub-processors, data location, and contractual safeguards have been reviewed.

7. Retention

Data is deleted or anonymised when it is no longer needed. Final production periods must be matched to the actual systems and documented in AMERA’s retention schedule.

• Unsuccessful or withdrawn initial applications: normally up to 6 months after the relevant cohort decision, unless a shorter period is requested or a longer period is required for a legal claim.
• Selected participants: for the program relationship and afterwards for applicable contractual, accounting, tax, insurance, safeguarding, and limitation periods.
• General enquiries: normally up to 12 months after the enquiry is resolved, unless needed for an ongoing relationship or legal claim.
• Security logs: normally up to 30 days, with longer preservation only where needed to investigate an incident or meet a legal obligation.
• Privacy-choice records: up to 180 days, then renewed or removed.

8. Your rights

To exercise a right, email hello@amera.io. We may ask for proportionate information to verify your identity. We normally respond within one month, subject to the extensions allowed by law.

• To be informed and to obtain access to your personal data.
• To correct inaccurate or incomplete data.
• To request erasure or restriction where the legal conditions are met.
• To object to processing based on legitimate interests and to object to direct marketing at any time.
• To receive data you provided in a structured, commonly used, machine-readable format where portability applies.
• To withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
• To lodge a complaint with the Bulgarian Commission for Personal Data Protection or the supervisory authority in your country of residence or work.

9. Automated decisions

AMERA does not currently make application decisions solely by automated means and does not profile applicants for automated eligibility decisions. If this changes, the required information and safeguards will be provided before that processing begins.

10. Security and incidents

AMERA applies technical and organisational measures appropriate to the risk, including access limitation, secure transport, minimisation, supplier controls, and incident procedures. No internet service can guarantee absolute security.

Personal-data breaches are documented and assessed. Where required, AMERA will notify the competent authority within 72 hours of becoming aware and will inform affected people without undue delay when there is a likely high risk.

11. Changes to this notice

This notice will be updated when processing, providers, destinations, or legal requirements change. Material changes will be highlighted and, where necessary, communicated directly. The effective date at the top identifies the current version.