Privacy Policy
1. Controller
StudyInBali – Muth/Müller GbR, Lohbreite 18, 58640 Iserlohn, Germany. Represented by Jennifer Wandt and Simone Junker. Email: hello@studyinbali.com. Phone: +49 178 818 9255.
2. Data we process
| Purpose | Data | Legal basis |
|---|---|---|
| Application | Name, email, program, home institution, motivation note, photo (optional) | Art. 6(1)(b) GDPR (pre-contractual steps) and your consent to sharing with the partner university, Art. 6(1)(a) GDPR |
| Visa | Passport scan, photo, medical form | Art. 6(1)(b) GDPR (contract performance) |
| Info pack request | First name, last name, email | Consent, Art. 6(1)(a) GDPR |
| VIP list | Name, email | Consent, Art. 6(1)(a) GDPR |
| Contact form | Name, email, program (optional), message | Consent, Art. 6(1)(a) GDPR |
| Program updates by email | Email address | Consent, Art. 6(1)(a) GDPR. Every email contains an unsubscribe link. |
With the application, info pack, VIP and contact forms we also store the campaign parameters of the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content), the landing page and the referrer.
With your consent to the application form, we share your application data with the partner university in Bali that runs your program, for the purpose of enrolment.
3. Processors
| Processor | Purpose | Location |
|---|---|---|
| Zoho Corporation B.V. | CRM, email, booking, Zoho Flow automations | EU data centre |
| Vercel Inc. | Website hosting, server functions for the forms, temporary storage of application photos (Vercel Blob) | Frankfurt, Germany |
| Plausible Insights OÜ | Website statistics without cookies or personal identifiers | EU |
Form data is sent from your browser to our server functions on Vercel and from there into Zoho CRM. No external form provider is used.
4. Third-party services loaded on the website
The services below receive your IP address and browser information when they are loaded. Services marked “consent” load only after you have allowed the relevant group in the privacy banner. You can change or withdraw your choice at any time via in the footer.
| Service | Purpose | When it loads |
|---|---|---|
| Plausible Analytics | Aggregated page statistics, no cookies | On every page |
| Cloudinary | Video hosting | When you press play. On some pages a muted preview loads when the video scrolls into view. |
| YouTube (youtube-nocookie.com) | Embedded videos | When you press play |
| geojs.io | Approximate country, to show prices in your currency | Consent: “Prices and credits for your country” |
| open.er-api.com | Exchange rates | Consent: “Prices and credits for your country” |
| open-meteo.com | Weather and sea temperature in Bali | Consent: “Prices and credits for your country” |
| OpenStreetMap | Map tiles on Why Bali and Contact | Consent: “The island map”, and only after you open the map |
| Meta Pixel | Measuring which ads lead to visits, info pack requests and applications | Consent: “Analytics and ad measurement” |
| Google Tag Manager | Loads Google Analytics 4 | Consent: “Analytics and ad measurement” |
| Google Analytics 4 | Usage statistics (pages visited, device, country) | Consent: “Analytics and ad measurement” |
Fonts are hosted on our own server. No data is sent to Google Fonts.
Legal basis for services that require consent: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawal applies to the future. Legal basis for Plausible, Cloudinary and YouTube: our legitimate interest in measuring and operating the website, Art. 6(1)(f) GDPR; YouTube and Cloudinary videos only load on your action as described above.
Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When Google Tag Manager loads, Google receives your IP address, browser information and the page address. Google Analytics 4 collects pages visited, device type and approximate location; it does not store IP addresses. Google Analytics sets the cookies _ga and _ga_*.
Meta (joint controllership)
If you allow “Analytics and ad measurement”:
· The Meta Pixel loads from connect.facebook.net on every page and reports page views. Meta receives your IP address, browser information, the page address and any Meta identifiers already stored in your browser. The pixel sets the cookies _fbp and, after a click on a Meta ad, _fbc.
· When you request an info pack or join the VIP list, our server sends the same event to Meta via the Conversions API: your email address as a SHA-256 hash, your IP address and browser information. A shared event ID prevents double counting. The application form does not send this event.
Recipient: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc., USA. Meta is certified under the EU-US Data Privacy Framework. For collecting and transmitting this data, we and Meta are joint controllers under Art. 26 GDPR. Further processing by Meta is Meta’s sole responsibility. You can exercise your rights against us or against Meta.
5. Storage on your device
Without consent we do not set advertising or analytics cookies. With consent to “Analytics and ad measurement”, Meta and Google set the cookies listed in section 4.
The website also uses the following entries in your browser’s local or session storage. They are not sent to us. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary or requested by you).
| Name | Content | Duration |
|---|---|---|
| sib_consent_v2 | Your privacy settings | Until deleted or changed |
| sib_geo_cc | Country code (only with consent “Prices and credits for your country”) | Until you clear your browser data |
| sib_currency | Currency you selected | Until you clear your browser data |
| sib-accent | Colour selected in “What’s your Bali mood today?” | Until you clear your browser data |
| sib_sky_v1 | Last weather reading | A few minutes |
| sib-splash-seen | Opening animation already shown | Until the tab is closed |
| Application draft | Unsent entries in the application form (session storage) | Until the form is sent or the tab is closed |
6. Retention
· Application data: 24 months after the application period closes.
· Records of enrolled students: 7 years after the end of the program.
· Visa data: deleted within 6 months after the end of the program.
· Info pack, VIP list and email updates: until you unsubscribe or withdraw consent.
· Contact form messages: as long as needed to answer your request.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw consent at any time with effect for the future. Contact: hello@studyinbali.com. You can also lodge a complaint with a data protection supervisory authority.
8. Transfers outside the EU
Our team in Indonesia and our partner universities in Bali process data outside the EEA. Meta, Google, Vercel and Cloudinary are companies based in the United States. Transfers are based on the EU-US Data Privacy Framework or on Standard Contractual Clauses.
9. Changes
We update this policy when our data processing changes. Active applicants and students are informed of material changes by email.
Last updated: 7 October 2026.