Privacy Policy
How we collect, use and protect personal data. Compliant with GDPR (EU) and Indonesian Personal Data Protection Law.
1. Data controller
StudyInBali – Muth/Müller GbR, Lohbreite 18, 58640 Iserlohn, Germany. Represented by Jennifer Wandt and Simone Junker. Contact: hello@studyinbali.com, +49 178 818 9255.
2. What we collect
· Application data: name, email, program choice, home institution, motivation note. Purpose: process your application. Legal basis: contract initiation (Art. 6(1)(b) GDPR).
· Visa data: passport scan, photo, medical form. Purpose: student visa coordination. Legal basis: contract performance.
· Newsletter: email address only. Purpose: send program updates. Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.
· Website analytics across the site: Plausible Analytics (cookie-free, no personal identifiers).
3. Processors we use
· Zoho One (CRM, email, bookings, and Zoho Flow for the automations behind our forms) · EU region servers.
· Vercel Inc. (hosting and the serverless functions behind our forms; EU region Frankfurt; photo uploads from the application form are stored temporarily in Vercel Blob, Frankfurt) · EU region.
· Plausible Analytics (cookie-free analytics across the site) · EU servers.
Meta is not a processor for us. Where we work with Meta, we do so as joint controllers; see the end of section 4.
4. Services contacted when you browse
Beyond the processors above, opening a page can contact the companies below. Each of these receives your IP address, because that is how any web request works. Nothing in the optional groups loads until you allow it, and you can change your mind any time through in the footer.
| Service | What for | When |
|---|---|---|
| Fonts (self-hosted) | Typefaces used across the site | Never. Served from our own server, see the note below. |
| geojs.io | Your approximate country, so prices show in your currency and credits in your system | Only with consent, group “Prices and credits” |
| open.er-api.com | Daily exchange rates for the conversion | Only with consent, group “Prices and credits” |
| open-meteo.com | Weather and sea temperature in Bali, shown on the home page | Only with consent, group “Prices and credits” |
| OpenStreetMap | Map tiles on Why Bali and Contact | Only with consent, group “Forms and the island map”, and only after you tap the map |
| YouTube (no-cookie mode) | Student videos | Only when you press play. Before that the video is a still image marked “Plays from YouTube” |
| Plausible Analytics | Aggregated page-use measurement across the site; no cookies or local-storage identifiers | When a page opens |
| Meta (Facebook) Pixel | Measures which of our ads lead to visits, info pack requests and applications, on every page of this site | Only with consent, group “Analytics and ad measurement” |
| Google Tag Manager | Loads our measurement container on every page of this site; the container currently loads Google Analytics 4 | Only with consent, group “Analytics and ad measurement” |
| Google Analytics 4 | Anonymous usage statistics: pages visited, device, country; IP address is truncated by Google. Recipient: Google Ireland Limited | Only with consent, group “Analytics and ad measurement”, loaded through Google Tag Manager |
Fonts, honestly: the typefaces are served from our own server. Loading them sends nothing to Google, so there is no transfer to consent to. Earlier versions of this page said otherwise, because the fonts did come from Google's servers until we moved them.
Google Tag Manager: if you allow “Analytics and ad measurement” on any page, your browser requests our tag container from googletagmanager.com. Google receives your IP address, browser information and the page address as part of that request. The container currently loads Google Analytics 4, which reports anonymous usage statistics back to Google and truncates your IP address before storing it. Nothing from this container loads before you agree.
Legal basis for the optional groups: your consent, Art. 6(1)(a) GDPR. Withdrawing is as easy as giving it and has no effect on anything you did before.
Meta, and what we answer for together: if you allow “Analytics and ad measurement”, two things happen. Neither happens otherwise. In your browser, on any page, Meta’s pixel is loaded from connect.facebook.net and reports that the page was opened; Meta receives your IP address, your browser details, the page address, and identifiers Meta may already have stored in your browser. From our server, when you request an info pack or join the VIP list, the same event is reported to Meta through the Conversions API; your email address only as an irreversible hash (SHA-256), never in plain text, together with your IP address and browser details. Both carry the same identifier, so Meta counts one event rather than two. Our application form does not send this server-side event.
Recipient: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR. What Meta does with the data afterwards is Meta’s own responsibility and outside our influence. You can exercise your rights against either of us. Contact us at hello@studyinbali.com. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, withdrawable at any time with effect for the future.
The application form
When you apply on /apply, the form data goes straight to our own server, a serverless function running on Vercel in Frankfurt. If you add a photo, it is stored temporarily in Vercel Blob, also in Frankfurt, until it is attached to your record. From there, your application is created as a record in Zoho CRM, where our student team works with it. No third-party form provider is involved. As the form itself states when you tick the consent box: we process your data for the purpose of registration and enrollment, including sharing it with partner universities in Bali, the ones running your program, so they receive the data they need for your enrolment. You can revoke this consent at any time by contacting hello@studyinbali.com.
5. What we store on your device
No advertising or tracking cookies without your say-so. The two exceptions you can switch on: if you allow “Analytics and ad measurement”, Meta’s pixel sets its cookies (_fbp, and _fbc after an ad click), and Google Analytics sets its _ga cookies, only after you allow that group; never before, and you can withdraw any time. The application form keeps your unsent draft in your browser’s session storage until you submit the form or close the tab; it never leaves your browser before then. Everything else is a handful of entries in your browser's local storage, readable only by this site, never sent to us.
| Name | What it remembers | How long |
|---|---|---|
| sib_consent_v2 | Your answer to the privacy choices above | Until you clear it or change it |
| sib_geo_cc | The country code we looked up, so we ask only once | Until you clear your browser data |
| sib_currency | A currency you picked by hand | Until you clear your browser data |
| sib-accent | The colour you chose in “What’s your Bali mood today?” | Until you clear your browser data |
| sib_sky_v1 | The last weather reading, so we do not ask again on every click | A few minutes |
| sib-splash-seen | That you have already seen the opening animation | Until you close the tab |
None of these identify you. They exist so the site does not forget what you already told it.
6. Data retention
· Application data: 24 months after application close, then deleted.
· Enrolled student records: 7 years after program completion (academic regulations).
· Newsletter: until you unsubscribe.
· Visa data: deleted within 6 months after program end.
7. Your rights (GDPR)
You have the right to access, correct, delete, restrict processing of, port and object to processing of your personal data. Email hello@studyinbali.com. You may also lodge a complaint with a supervisory authority.
8. International transfers
Some processing happens outside the EEA (Indonesia, where our team is based). We use Standard Contractual Clauses for such transfers where applicable.
9. Changes
We update this policy when our practices change. Material changes will be communicated to active applicants and students by email.
Last updated: 7 September 2026.