Privacy Policy
How we collect, use and protect personal data. Compliant with GDPR (EU) and Indonesian Personal Data Protection Law.
1. Data controller
StudyInBali – Muth/Müller GbR, Lohbreite 18, 58640 Iserlohn, Germany. Represented by Jennifer Wandt and Simone Junker. Contact: hello@studyinbali.com, +49 178 818 9255.
2. What we collect
· Application data: name, email, program choice, home institution, motivation note. Purpose: process your application. Legal basis: contract initiation (Art. 6(1)(b) GDPR).
· Visa data: passport scan, photo, medical form. Purpose: student visa coordination. Legal basis: contract performance.
· Newsletter: email address only. Purpose: send program updates. Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.
· Website analytics across the site: Plausible Analytics (cookie-free, no personal identifiers).
3. Processors we use
· Zoho One (CRM, email, bookings) · EU region servers.
· Typeform (application form) · EU servers under DPA.
· Vercel (website hosting) · EU edge.
· Plausible Analytics (cookie-free analytics across the site) · EU servers.
Meta is not a processor for us. Where we work with Meta, we do so as joint controllers; see the end of section 4.
4. Services contacted when you browse
Beyond the processors above, opening a page can contact the companies below. Each of these receives your IP address, because that is how any web request works. Nothing in the optional groups loads until you allow it, and you can change your mind any time through in the footer.
| Service | What for | When |
|---|---|---|
| Fonts (self-hosted) | Typefaces used across the site | Never. Served from our own server, see the note below. |
| geojs.io | Your approximate country, so prices show in your currency and credits in your system | Only with consent, group “Prices and credits” |
| open.er-api.com | Daily exchange rates for the conversion | Only with consent, group “Prices and credits” |
| open-meteo.com | Weather and sea temperature in Bali, shown on the home page | Only with consent, group “Prices and credits” |
| Typeform | Our application form and the info-pack forms on our landing pages | Only with consent, group “Forms and the island map”. Typeform then puts an identifier on your device and loads Google reCAPTCHA |
| OpenStreetMap | Map tiles on Why Bali and Contact | Only with consent, group “Forms and the island map”, and only after you tap the map |
| YouTube (no-cookie mode) | Student videos | Only when you press play. Before that the video is a still image marked “Plays from YouTube” |
| Plausible Analytics | Aggregated page-use measurement across the site; no cookies or local-storage identifiers | When a page opens |
| Meta (Facebook) Pixel | Tells Meta when an info-pack request came from one of our ads, so we can see which ads work | Only with consent, group “Analytics and ad measurement” |
| Google Tag Manager | Loads the measurement container used on the Sustainable Tourism and Digital Business thank-you pages | Only with consent, group “Analytics and ad measurement” |
Fonts, honestly: the typefaces are served from our own server. Loading them sends nothing to Google, so there is no transfer to consent to. Earlier versions of this page said otherwise, because the fonts did come from Google's servers until we moved them.
Google Tag Manager: if you allow “Analytics and ad measurement” on one of the two thank-you pages, your browser requests our tag container from googletagmanager.com. Google receives your IP address, browser information and the page address as part of that request. The container can then load the measurement tags configured inside it. Nothing from this container loads before you agree.
Legal basis for the optional groups: your consent, Art. 6(1)(a) GDPR. Withdrawing is as easy as giving it and has no effect on anything you did before.
Meta, and what we answer for together: if you allow “Ad performance measurement”, two things happen. Neither happens otherwise. In your browser, Meta’s pixel is loaded from connect.facebook.net and reports that the page was opened; Meta receives your IP address, your browser details, the page address, and identifiers Meta may already have stored in your browser. From our server, when you request an info pack or join the VIP list, the same event is reported to Meta through the Conversions API; your email address only as an irreversible hash (SHA-256), never in plain text, together with your IP address and browser details. Both carry the same identifier, so Meta counts one event rather than two.
Recipient: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR. What Meta does with the data afterwards is Meta’s own responsibility and outside our influence. You can exercise your rights against either of us. Contact us at hello@studyinbali.com. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, withdrawable at any time with effect for the future.
5. What we store on your device
No advertising or tracking cookies without your say-so. The one exception you can switch on: if you allow “Ad performance measurement”, Meta’s pixel sets its cookies (_fbp, and _fbc after an ad click); never before you agree, and you can withdraw any time. Everything else is a handful of entries in your browser's local storage, readable only by this site, never sent to us.
| Name | What it remembers | How long |
|---|---|---|
| sib_consent_v2 | Your answer to the privacy choices above | Until you clear it or change it |
| sib_geo_cc | The country code we looked up, so we ask only once | Until you clear your browser data |
| sib_currency | A currency you picked by hand | Until you clear your browser data |
| sib-accent | The colour you chose in “What’s your Bali mood today?” | Until you clear your browser data |
| sib_sky_v1 | The last weather reading, so we do not ask again on every click | A few minutes |
| sib-splash-seen | That you have already seen the opening animation | Until you close the tab |
None of these identify you. They exist so the site does not forget what you already told it.
6. Data retention
· Application data: 24 months after application close, then deleted.
· Enrolled student records: 7 years after program completion (academic regulations).
· Newsletter: until you unsubscribe.
· Visa data: deleted within 6 months after program end.
7. Your rights (GDPR)
You have the right to access, correct, delete, restrict processing of, port and object to processing of your personal data. Email hello@studyinbali.com. You may also lodge a complaint with a supervisory authority.
8. International transfers
Some processing happens outside the EEA (Indonesia, where our team is based). We use Standard Contractual Clauses for such transfers where applicable.
9. Changes
We update this policy when our practices change. Material changes will be communicated to active applicants and students by email.
Last updated: 2 September 2026.