Privacy Policy
How we collect, use, and protect your personal information when you use Island Internship.
01
Who we are
Island Internship is an internship placement service for university students, operated from Amsterdam, the Netherlands. We connect European students with verified host companies in Bali (Indonesia) and Sri Lanka, and provide the surrounding support — documentation, visa guidance, housing, and on-the-ground assistance.
For the purposes of the General Data Protection Regulation (GDPR), Island Internship is the data controller for personal data collected through this website and our services.
Data controller details
02
What we collect
We collect information in three ways: directly from you, automatically when you use the site, and occasionally from third parties.
Information you give us
- Application data — field of study, preferred timing, university requirements, academic background, career interests
- Contact details — name, email address, phone number, WhatsApp contact
- University information — university name, study programme, internship credit requirements, coordinator contact details
- Travel documents — nationality, passport details needed for visa guidance and host company paperwork
- Payment information — processed via our third-party payment provider; we do not store card numbers on our servers
- Housing and arrival preferences — intake dates, accommodation requirements, arrival flight details
- Communications — messages sent via our contact form, WhatsApp, email, or phone
Information collected automatically
- Usage data — pages visited, time on page, referring URLs, click patterns
- Device data — browser type, operating system, screen size, device type
- Approximate location — country or city level, inferred from IP address
- Cookies and similar technologies — see Section 9 for details
Information from third parties
- Host companies — confirmation of placement details and supervisor information
- Universities — verification of internship requirements where requested
- Payment processors — transaction status and payment confirmation
03
How we use your information
Delivering the programme
- Reviewing your application and assessing fit for the programme
- Matching you with a verified host company in your chosen destination
- Preparing university documentation — internship agreements, learning objectives, evaluation sheets
- Providing nationality-specific visa and entry guidance
- Arranging housing around your intake date
- Coordinating airport pickup and arrival logistics
- Providing on-the-ground support via WhatsApp during your placement
- Processing your programme fee payment
Communication
- Responding to enquiries and free consultation calls
- Sending application status updates and matching confirmations
- Sharing arrival briefings, orientation week details, and programme changes
- Adding you to the cohort WhatsApp community (with your consent)
Improvement and compliance
- Analysing website usage to improve content and user experience
- Detecting and preventing fraud or misuse
- Keeping financial and contractual records as required by Dutch law
- Protecting the rights, property, and safety of students, staff, and partners
04
Legal bases for processing (GDPR)
We process your personal data under the following lawful bases, as required by the GDPR:
| Processing activity | Lawful basis |
|---|---|
| Processing your application and delivering the placement programme | Performance of a contract (Art. 6(1)(b)) |
| Preparing university documentation | Performance of a contract (Art. 6(1)(b)) |
| Processing payment | Performance of a contract (Art. 6(1)(b)) |
| Keeping financial records | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries | Legitimate interests (Art. 6(1)(f)) |
| Improving our website and services | Legitimate interests (Art. 6(1)(f)) |
| WhatsApp community membership and programme updates | Consent (Art. 6(1)(a)) |
| Passport / nationality data for visa processing | Explicit consent + necessary for the contract (Art. 6(1)(a) + (b)) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may object to this processing at any time — see Your rights.
05
Who we share your information with
We do not sell your personal data. We share it only where necessary to deliver the programme or comply with the law.
Host companies
Your name, contact details, field of study, university documentation, and internship requirements are shared with your matched host company in Bali or Sri Lanka. This is necessary to set up your placement.
Universities
Where required, we share internship agreements, learning objectives, placement confirmation, and evaluation sheets with your university coordinator.
Service providers (data processors)
We work with carefully selected providers who process data only on our instructions:
- Payment processor — for secure programme fee transactions
- Housing provider — to arrange your accommodation
- Visa consultants — for destination-specific visa guidance
- Transport provider — for airport pickup coordination
- Email and communication tools — for correspondence
- Analytics provider — for aggregate, anonymised website analytics
- Website hosting — Vercel (server infrastructure)
Legal and safety disclosures
We may disclose data when required by law, regulation, or court order; to protect against fraud or illegal activity; or to protect the safety of our students, staff, or partners.
Business transfers
If Island Internship is acquired, merged, or sells its assets, personal data may be transferred as part of that transaction. You will be notified of any such change and your rights will be protected.
06
International data transfers
Because our programme operates in Bali (Indonesia) and Sri Lanka, your data will be transferred to and processed in those countries. Both are outside the European Economic Area (EEA).
We ensure appropriate safeguards are in place for these transfers, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission where applicable
- Assessment of the local legal environment in each destination
- Limiting the data transferred to what is strictly necessary for your placement
Our team is physically present in Bali and Sri Lanka during placement season. Data shared with our local team members remains subject to this Privacy Policy and our internal data handling standards.
07
How long we keep your data
We retain your data for as long as necessary for the purpose it was collected, and no longer.
| Data category | Retention period | Reason |
|---|---|---|
| Application data (pre-enrolment) | 12 months from enquiry if no placement agreed | Legitimate interest in follow-up |
| Programme and placement records | 5 years after programme completion | University credit disputes, references |
| University documentation | 5 years after programme completion | Academic record requirements |
| Payment records | 7 years | Dutch tax and accounting obligations |
| Communication records | 2 years after last contact | Support continuity |
| Website analytics (anonymised) | 26 months | Product improvement |
After these periods, data is securely deleted or anonymised. You may request earlier deletion — see Your rights.
08
Your rights
Under the GDPR, you have the following rights in relation to your personal data. We will respond to all valid requests within 30 days.
Access
Request a copy of the personal data we hold about you.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Request deletion of your data (subject to legal retention obligations).
Restriction
Ask us to limit how we use your data in certain circumstances.
Portability
Receive your data in a structured, machine-readable format.
Objection
Object to processing based on legitimate interests.
Withdraw consent
Withdraw consent at any time where processing is based on it.
Complaints
Lodge a complaint with the Dutch data protection authority (AP).
How to exercise your rights
Contact us via WhatsApp at +31 6 83 66 03 60 or through our website. We may ask you to verify your identity before acting on your request.
Supervisory authority
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority.
Students from other EU countries may also contact their national supervisory authority.
09
Cookies
We use cookies and similar technologies to operate the website, understand how visitors use it, and improve our service. We ask for your consent before setting non-essential cookies.
| Type | Purpose | Consent required? |
|---|---|---|
| Essential | Website security, session management, load balancing | No — necessary for the site to function |
| Analytics | Aggregate, anonymised usage data to improve the site (e.g., page views, session length) | Yes |
| Preference | Remembering your language or cookie consent choice | Yes |
You can manage or withdraw your cookie consent at any time through your browser settings or our cookie banner. Blocking essential cookies may affect website functionality.
We do not use advertising or social media tracking cookies.
10
Data security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. These include:
- Encrypted data transmission (TLS/SSL) for all information sent to and from our website
- Access controls ensuring only authorised team members can view personal data
- Payment data processed exclusively through PCI-DSS-compliant third-party providers — card details never touch our servers
- Regular review of security practices and provider agreements
No method of transmission over the internet is 100% secure. If you believe your data has been compromised, contact us immediately via WhatsApp at +31 6 83 66 03 60 and we will act promptly.
11
Children
Our programme is designed for university students, who are typically 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected such data, we will delete it without delay.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us.
12
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes — those that significantly affect how we use your data — we will notify you directly where we have your contact details.
We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes your acceptance of the revised policy.
13
Contact us
For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern, reach us through any of the channels below. We aim to respond within 2 business days.