What happens to your data

1 · Who is responsible

StudyInBali – Muth/Müller GbR
Lohbreite 18, 58640 Iserlohn, Germany
Represented by Jennifer Wandt and Simone Junker
hello@studyinbali.com

2 · Opening a page

These pages are delivered by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. To send you a page, Vercel processes your IP address, the address of the page requested, the time, and your browser and operating system. This is unavoidable for any website: without your IP address the page cannot reach you.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is delivering the site and defending it against attacks. Vercel processes this data on our behalf under Article 28 GDPR. Data may be processed in the United States; Vercel is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

Vercel keeps these access logs for a short, technically necessary period to operate and secure the pages. We do not use them to build a profile of you, and we do not have access to them beyond ordinary troubleshooting.

3 · What we store on your device

Two entries, both stored locally in your browser. Neither is a tracking cookie and neither is sent to us or anyone else.

• sib_consent_v2 keeps your privacy choices so we do not ask again on every visit. Storing it is strictly necessary to honour your decision, so it needs no separate consent (Section 25(2) no. 2 TDDDG). It stays until you clear your browser storage.
• sib-theme remembers a colour variant within the current browser session and is gone when you close the tab.

Everything else described below is loaded only after you allow it, and you can change that at any time under Privacy choices.

4 · Fonts

The typefaces (Barlow Condensed, DM Sans, JetBrains Mono) are hosted on our own server, not loaded from Google Fonts. Your browser does not connect to fonts.googleapis.com or fonts.gstatic.com, and no data — including your IP address — is transmitted to Google for this purpose. This applies regardless of your privacy choices, because nothing ever leaves this site to load a typeface.

5 · Measuring our advertising, only if you allow it

If you allow Measuring our ads, two things happen. Neither happens otherwise.

In your browser. The Meta pixel is loaded from connect.facebook.net and reports that this page was opened. Meta receives your IP address, your browser details, the page address, and identifiers Meta may already have stored in your browser.

From our server. When you join the VIP list, our server reports that same event to Meta through the Conversions API. Your email address is transmitted only as an irreversible hash (SHA-256), never in plain text, together with your IP address and browser details. Browser and server event carry the same identifier so Meta counts one event rather than two.

Recipient: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework.

Joint responsibility. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Article 26 GDPR. What Meta does with the data afterwards is Meta's own responsibility and outside our influence. You can exercise your rights against either of us.

Legal basis: your consent, Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw it at any time with effect for the future, at Privacy choices. Withdrawal does not affect what was lawful before.

6 · Prices in your currency, only if you allow it

If you allow Prices and credits for your country, your browser asks two services which country you are in and what the exchange rate is, so that fees can be shown alongside the euro amount:

• ipapi.co, operated by Kloudend, Inc., USA. Receives your IP address.
• open.er-api.com (Open Exchange Rates API). Receives your IP address.

Legal basis: your consent, Article 6(1)(a) GDPR and Section 25(1) TDDDG, withdrawable at any time. Without this the page simply shows euros.

7 · Forms hosted elsewhere

A few of our pages still use a form hosted by Typeform (TYPEFORM SL, Carrer Bac de Roda 163, 08018 Barcelona, Spain). It loads only when you open the form, and only if you allowed Embedded form. The page you are reading this on does not use it; our own form runs on our own server.

Legal basis: your consent, Article 6(1)(a) GDPR and Section 25(1) TDDDG.

8 · Joining the VIP list

When you submit the form we process your first name, last name, email address, and the campaign parameters in the link you arrived through (utm_source and similar), so that we can tell which channel reached you.

The data is stored in our customer system, Zoho CRM, operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, in a data centre inside the European Union. Zoho processes it on our behalf under Article 28 GDPR. Our announcement emails are sent through Zoho Campaigns, which can record whether an email was opened and whether you clicked a link in it, so we can see which updates were actually useful. You can object to this at any time; the unsubscribe link in every email removes you from measurement along with the mailing itself.

We keep this data until you withdraw your consent, for at most 24 months after our last contact with you.

Legal basis: your consent, Article 6(1)(a) GDPR, given by ticking the box. Every email carries a one-click unsubscribe, and one click is enough to withdraw.

Spam protection. The form carries a field invisible to you and measures how long the form was open. Your IP address is held in the server's memory for ten minutes to limit how often the form can be submitted. It is not stored beyond that. Legal basis: Article 6(1)(f) GDPR, our interest in not receiving automated submissions.

9 · Who receives your data

• Vercel Inc., USA — hosting
• Zoho Corporation B.V., Netherlands — customer system and email
• Meta Platforms Ireland Ltd., Ireland — only with your consent
• Google Ireland Ltd., Ireland — fonts
• Kloudend, Inc. and Open Exchange Rates — only with your consent
• TYPEFORM SL, Spain — only on pages that use it, only with your consent

We do not sell your data and we do not pass it on for anyone else's advertising.

10 · Your rights

You may at any time ask us to:

• tell you what we hold about you (Article 15)
• correct it (Article 16)
• delete it (Article 17)
• restrict how we use it (Article 18)
• hand it to you or another provider in a machine-readable form (Article 20)
• stop using it where we rely on legitimate interest (Article 21)

Where we rely on your consent, you may withdraw it at any time with effect for the future (Article 7(3)). An email to hello@studyinbali.com is enough, and for the choices on this site one click at Privacy choices is enough.

You may also complain to a supervisory authority. The one responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf.

11 · Changes

We update this notice when what we do changes. The date at the top tells you which version you are reading.