PRIVACY POLICY

Last updated: Q4 2026

This Privacy Policy explains how InternshipSpain collects, uses, shares and protects personal data when individuals and companies use internshipspain.nl, internshipspain.es, the InternshipSpain application and associated services (together, the “Platform”).

We take the privacy of Students and Company representatives seriously and aim to process personal data transparently, fairly and in accordance with applicable data-protection law, including the General Data Protection Regulation (“GDPR”).

1. Who is responsible for your personal data?

The data controller responsible for the processing described in this Privacy Policy is:

Stijen B.V.
Trading through the Platform as InternshipSpain
Spijksedijk 20A
4207 GN Gorinchem
The Netherlands
Dutch Chamber of Commerce (KvK): 96238933

Email: info@internshipspain.nl

When this Privacy Policy refers to “InternshipSpain”, “we”, “us” or “our”, it refers to Stijen B.V.

2. Scope

This Privacy Policy applies to personal data relating to:

1. Students who create or use an InternshipSpain account;
2. individuals who purchase InternshipSpain services;
3. representatives, employees and contact persons of Companies using the Platform;
4. visitors to internshipspain.nl, internshipspain.es and other InternshipSpain websites;
5. people who communicate with us; and
6. other individuals whose personal data is processed through the Platform.

The Platform is intended for persons aged 18 and over.

3. Personal data we collect from Students

Depending on how you use the Platform, we may process the following categories of Student data.

3.1 Account and identification data

This may include:

• first name;
• last name;
• email address;
• telephone number;
• date of birth;
• city of residence;
• nationality;
• account identifiers;
• authentication information; and
• account status.

Passwords are handled through our authentication infrastructure and should not be stored by us in plain text.

3.2 Student Profile data

The information you add to your Student Profile may include:

• profile photograph;
• LinkedIn profile;
• education level;
• study programme;
• educational institution;
• field of study;
• study year;
• expected graduation year;
• work experience;
• languages;
• skills;
• interests; and
• other Profile information you voluntarily provide.

3.3 Internship preferences

We may process information including:

• preferred internship city or cities;
• desired internship period;
• internship requirements;
• description of the type of internship sought;
• preferred areas of work; and
• other preferences used to help Companies identify potentially relevant Students.

3.4 Documents

Students may upload documents including:

• curriculum vitae; and
• motivation letter.

Students should avoid including special-category personal data or other highly sensitive information in documents unless it is genuinely necessary.

3.5 Communication and matching data

We process information generated when you use Platform functionality, such as:

• Contact Requests received;
• Contact Requests accepted or rejected;
• Companies with which you interact;
• chat messages;
• message timestamps;
• Profile status;
• search or matching-related activity; and
• support communications.

3.6 Payment data

Where you purchase a Package, we may process information including:

• purchase amount;
• Package purchased;
• discount applied;
• transaction date;
• transaction status;
• Stripe customer or payment identifiers;
• invoice information; and
• refund or chargeback information.

Complete payment-card details are processed by Stripe and are not normally stored on InternshipSpain servers.

3.7 Technical and usage data

When you use the Platform or website, we may process technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• approximate location derived from technical information;
• pages visited;
• events and interactions;
• referral information;
• session data;
• login information;
• security logs;
• cookie identifiers; and
• analytics or advertising identifiers where you have provided the required consent.

4. Personal data we collect from Companies

For Company Accounts, we may process:

4.1 Company information

This may include:

• Company name;
• registered address;
• company registration information;
• website;
• industry or sector;
• corporate email domain;
• publicly available Company information; and
• other information required for verification.

Information relating solely to a legal entity is not always personal data, but information relating to identifiable Company representatives is.

4.2 Company representative information

This may include:

• first and last name;
• job title;
• business email address;
• telephone number;
• employer;
• account credentials; and
• authority or role within the Company.

4.3 Verification information

We may record:

• whether a Company passed verification;
• verification dates;
• sources checked;
• concerns or discrepancies identified;
• correspondence concerning verification; and
• decisions to approve, refuse, suspend or revoke access.

We may obtain verification information from the Company itself and from publicly available sources such as company registers, websites and other legitimate public sources.

4.4 Platform activity

We may process information including:

• Student Profiles viewed;
• filters and search criteria used;
• Contact Requests;
• accepted and rejected requests;
• chat activity;
• account usage;
• reports and complaints; and
• security logs.

5. What Companies can see about Students

Student Profiles are not intended to be publicly accessible on the open internet.

Published Student Profiles are accessible only to logged-in Company Accounts that InternshipSpain has admitted to the Platform following its verification process.

Depending on the Platform configuration and the information the Student has provided, a Company-facing Profile may contain information such as:

• name;
• profile photograph;
• education information;
• study information;
• graduation information;
• work experience;
• languages;
• skills;
• interests;
• internship preferences; and
• Profile documents or other information designated for Company visibility.

Not every item of personal data we store for account or administrative purposes is necessarily displayed on the Company-facing Profile.

In particular, a Student’s email address and telephone number are not disclosed to a Company merely because it can browse the Student Profile.

A Company must first submit a Contact Request. If the Student accepts that Contact Request, InternshipSpain may then provide the requesting Company with the Student’s designated contact details.

This gives the Student control over which Company receives their direct contact information through the Platform.

6. Why we use personal data and our legal bases

Under the GDPR, we must have a lawful basis for processing personal data.

6.1 Creating and maintaining Student accounts

Purpose: To create, authenticate, operate and maintain your account.

Legal basis: Performance of a contract or taking steps at your request before entering into a contract, Article 6(1)(b) GDPR.

6.2 Creating and publishing Student Profiles

Purpose: To provide the Profile Publication Service purchased by the Student and make the Student discoverable to verified Companies.

Legal basis: Performance of a contract, Article 6(1)(b) GDPR.

Publishing a Student Profile to verified Companies is a central element of the service the Student requests from InternshipSpain. We therefore process the personal data objectively necessary to provide that service on the basis of the agreement with the Student.

Where separate optional processing is not objectively necessary for the contracted service and another legal basis is required, we will use the appropriate legal basis, including consent where applicable.

6.3 Operating Company Accounts

Purpose: To create Company Accounts, provide Platform access and enable Companies to identify potential interns.

Legal basis: Performance of a contract, Article 6(1)(b) GDPR where the Company representative is personally party to the agreement, and/or our legitimate interests under Article 6(1)(f) GDPR in operating a business-to-business internship Platform.

6.4 Company verification and Platform safety

Purpose: To verify Companies, prevent fraudulent access, protect Students and maintain a safe Platform.

Legal basis: Our legitimate interests in protecting Students, Users and the integrity of the Platform, Article 6(1)(f) GDPR, and legal obligations where applicable.

6.5 Contact Requests

Purpose: To allow Companies to express genuine interest in a Student and allow the Student to decide whether to establish direct contact.

Legal basis: Performance of the Platform agreement, Article 6(1)(b) GDPR.

6.6 Disclosure of contact details after acceptance

Purpose: To provide a Student’s contact details to a Company after the Student accepts that Company’s Contact Request.

Legal basis: Performance of the contract and the action specifically initiated or approved by the Student, Article 6(1)(b) GDPR.

6.7 Chat and Platform communications

Purpose: To allow Students and Companies to communicate, provide the Platform service, investigate abuse and provide support.

Legal basis: Performance of a contract under Article 6(1)(b) GDPR for normal Platform communications and our legitimate interests under Article 6(1)(f) GDPR for safety, support and enforcement.

6.8 Search, matching and ranking

Purpose: To help Companies identify potentially relevant Students and organise search results.

Legal basis: Performance of our Platform service under Article 6(1)(b) GDPR and our legitimate interests under Article 6(1)(f) GDPR in providing relevant and usable search functionality.

6.9 Payments and invoicing

Purpose: To process purchases, confirm payments, issue invoices and maintain financial records.

Legal basis: Performance of a contract, Article 6(1)(b) GDPR, and compliance with legal obligations, Article 6(1)(c) GDPR.

6.10 Transactional emails

Purpose: To send account confirmations, Contact Request notifications, message notifications, security messages, purchase information and other communications necessary for the service.

Legal basis: Performance of a contract, Article 6(1)(b) GDPR, and where appropriate our legitimate interests in account security and administration.

These messages are not treated as optional marketing where they are necessary to provide or secure the Platform.

6.11 Marketing communications

Purpose: To send newsletters, offers, Platform updates, promotions and other marketing communications to Students or Company representatives.

Legal basis: Consent under Article 6(1)(a) GDPR where required by applicable electronic-marketing law.

Marketing consent is separate from acceptance of the Terms and is not required to use the core Platform service.

You may withdraw from marketing at any time using an unsubscribe link or by contacting info@internshipspain.nl.

6.12 Analytics

Purpose: To understand how our website and Platform are used and improve their performance.

Legal basis: Consent under Article 6(1)(a) GDPR where the relevant analytics technology requires consent.

Non-essential analytics technologies will not be intentionally activated before the required consent is obtained.

6.13 Advertising and measurement

Purpose: To measure advertising campaigns, understand conversions, create advertising audiences where permitted and improve marketing effectiveness.

Legal basis: Consent under Article 6(1)(a) GDPR and applicable cookie/ePrivacy rules.

This includes the Meta Pixel and comparable non-essential advertising technologies.

6.14 Security, fraud prevention and enforcement

Purpose: To detect fraud, scraping, unauthorised access, abuse, security incidents and breaches of our Terms.

Legal basis: Our legitimate interests under Article 6(1)(f) GDPR in protecting our Users, business and systems and, where applicable, legal obligations.

6.15 Legal compliance and claims

Purpose: To comply with tax, accounting, regulatory and legal requirements and to establish, exercise or defend legal claims.

Legal basis: Legal obligation under Article 6(1)(c) GDPR and/or legitimate interests under Article 6(1)(f) GDPR.

7. Search ranking and automated processing

InternshipSpain uses limited automated processing to organise Student search results.

When no specific filter or search criteria are applied, Student Profiles may be displayed in a randomised or otherwise neutral order.

When a Company applies filters, the Platform may automatically assign relevance or weighting to the Company’s selected criteria and order Students according to how closely their Profile appears to match that particular search.

Premium visibility purchased by a Student may also influence positioning where the relevant Package provides for this.

This processing may constitute limited profiling under data-protection law because personal information is used to assess relevance to search criteria.

However:

• the system does not itself accept or reject Students for internships;
• a ranking does not determine whether a Company may employ or engage a Student;
• Companies remain responsible for deciding which Students to view or contact; and
• InternshipSpain does not currently make decisions producing legal or similarly significant effects on a Student solely by automated means.

If this changes, we will assess the relevant legal requirements and update this Privacy Policy.

8. Artificial intelligence

InternshipSpain does not currently use artificial intelligence to create Student Profiles or make internship decisions.

We may introduce AI-assisted functionality in the future, for example for:

• profile-writing assistance;
• recommendations;
• matching;
• search;
• customer support;
• moderation;
• fraud prevention; or
• other Platform improvements.

Before introducing AI that materially changes the processing of personal data, we will update our privacy information and determine the appropriate GDPR legal basis.

Where required, we will also carry out a Data Protection Impact Assessment, obtain consent or introduce human review and other safeguards.

We will not treat this section as blanket permission to process personal data through any future AI provider for any purpose.

9. Who receives personal data?

We disclose personal data only where reasonably necessary for the purposes described in this Privacy Policy.

9.1 Verified Companies

Verified Companies can view published Student Profiles.

A Company receives direct contact details only after the Student accepts that Company’s Contact Request.

Companies are contractually prohibited from using Student data for unrelated marketing, data resale, scraping or other unauthorised purposes.

Where a Company subsequently determines how and why it stores or uses Student data for its own internship evaluation or recruitment activities, it may act as an independent data controller and is responsible for its own compliance with applicable data-protection law.

10. Cookies and similar technologies

InternshipSpain uses cookies and similar technologies on internshipspain.nl, internshipspain.es and other parts of the Platform.

10.1 Strictly necessary technologies

Certain technologies are required for core functions such as:

• authentication;
• account security;
• session management;
• fraud prevention;
• remembering essential preferences; and
• operating the Platform.

Where these technologies are strictly necessary to provide a service requested by the User, they may be used without optional cookie consent where applicable law allows this.

10.2 Analytics

We currently use Google Analytics 4 to understand website and Platform usage.

Where consent is legally required, Google Analytics is activated only after that consent has been given via our cookie banner.

10.3 Advertising technologies

We currently use the Meta Pixel, the TikTok Pixel and Google Ads conversion tags for advertising measurement, remarketing where permitted, and related marketing purposes.

These technologies are not necessary to provide the Platform and are loaded in the browser only after marketing-cookie consent via the cookie banner.

When a Student pays for a Package, we may also send a conversion event (including a hashed email address and advertising click identifiers such as gclid, fbclid or ttclid) to Google, Meta and TikTok from our servers. This server-side measurement is used to confirm that a payment occurred and may take place even if browser cookies were declined. Hashed identifiers are not used to send marketing emails.

10.4 Google Tag Manager

InternshipSpain does not currently use Google Tag Manager. Analytics and advertising tags are loaded directly by the Platform after the required consent.

10.5 Managing consent

Users must be able to make an active choice about non-essential technologies.

Where required, our consent mechanism will allow Users to:

• accept optional categories;
• reject optional categories;
• make more detailed choices; and
• change or withdraw their choices later.

Additional details may be provided in a separate Cookie Policy or Cookie Settings interface.

11. Marketing emails

We may ask Students and Company representatives whether they would like to receive marketing communications from InternshipSpain.

Marketing consent will not be bundled with mandatory acceptance of the Terms.

Where we rely on consent:

• the choice will be optional;
• consent can be withdrawn at any time;
• every marketing email will provide an appropriate unsubscribe mechanism; and
• withdrawal does not affect the lawfulness of marketing sent before withdrawal.

We may retain a minimal suppression record after unsubscribe where necessary to ensure that we continue to honour the opt-out.

12. How long we keep personal data

We do not intend to keep identifiable personal data longer than necessary for the purpose for which it was collected.

Our general retention approach is as follows.

Active Student account and Profile

We retain the information necessary to operate a Student account and published Profile while the Student is actively using the Platform and remains relevant as an internship seeker.

Students are expected to remove or update their Profile when they no longer seek an internship abroad.

We may also contact inactive Students to verify whether their Profile remains relevant.

Profile visibility after deletion or deactivation

When a Student deletes or deactivates their Profile, we will stop making it available to Companies through the Platform as soon as reasonably practicable.

Account and Profile data scheduled for deletion will generally be removed from active systems within 30 days unless a legal basis requires limited information to be retained.

Backups

Deleted information may temporarily remain in secured backups for a limited period under our technical backup cycle.

Backup information is not used for normal Platform purposes and will be overwritten or deleted in accordance with the relevant backup process unless restoration is required for disaster recovery.

Payment and accounting records

Financial, invoice and transaction records are retained for the period required under applicable tax and accounting law.

For Dutch accounting records this will generally be at least seven years. A longer period may apply where specific tax rules, including applicable EU VAT/One Stop Shop requirements, require it.

Contract and legal records

Records reasonably necessary to demonstrate acceptance of Terms, purchases, consumer-law acknowledgements or other contractual events may be retained for as long as reasonably necessary to establish, exercise or defend legal claims, normally no longer than the applicable legal limitation period unless a longer period is legally required.

Chat and support communications

Chat, support and complaint information may be retained while necessary to operate the account, maintain Platform safety, resolve complaints or establish or defend claims.

Where there is no continuing need, it will be deleted or anonymised in accordance with our retention procedures.

Company verification records

Company verification records may be retained while the Company has access to the Platform and for a reasonable period afterwards where necessary for security, fraud prevention, complaint handling or legal claims.

Marketing information

Marketing information is retained until consent is withdrawn or the information is otherwise no longer necessary.

A minimal suppression entry may be retained afterwards to ensure that an opt-out is respected.

Analytics

Analytics data is retained according to our configured retention settings and the operation of the relevant analytics provider, subject to our data-minimisation obligations.

When information is irreversibly anonymised so that it no longer relates to an identifiable individual, it may be retained for statistical or analytical purposes.

13. Profile deletion and refunds are separate issues

Privacy rights and contractual payment rights are separate.

A Student may request deletion of personal data where the GDPR provides that right.

Exercising a privacy right, hiding a Profile or requesting account deletion does not by itself reverse a Profile Publication Service that has already been supplied.

Accordingly, deletion does not automatically create a right to a refund.

This does not affect statutory consumer rights, including any withdrawal or contractual remedy that remains applicable under mandatory law.

14. Security

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include, as appropriate:

• encrypted transmission using HTTPS/TLS;
• authentication and account-access controls;
• role-based and least-privilege access;
• restricted access to production data;
• separation of Company and Student permissions;
• Company verification before access to Student Profiles;
• secure password-handling through our authentication infrastructure;
• monitoring and logging for security purposes;
• controlled processor access;
• backups and recovery procedures;
• contractual data-protection arrangements with processors; and
• incident-response procedures.

No online service can guarantee absolute security.

Users must also protect their account credentials and notify us promptly if they suspect unauthorised access.

15. Personal data breaches

Where a personal data breach occurs, we will assess the incident and take the steps required by applicable data-protection law.

Where the GDPR requires notification to a supervisory authority, we will make the required notification without undue delay and, where feasible, within the applicable statutory period.

Where a breach is likely to result in a high risk to affected individuals, we will also communicate the breach to those individuals where legally required.

16. Your privacy rights

Subject to the conditions and exceptions in the GDPR, you may have the following rights.

Right of access

You may ask whether we process personal data about you and request a copy of that data and related information.

Right to rectification

You may ask us to correct inaccurate personal data and complete incomplete information.

Students can also update many Profile details directly through their account.

Right to erasure

You may request deletion of personal data where the requirements of Article 17 GDPR are met.

This right is not absolute. We may retain information where processing remains necessary, for example because of a legal obligation or the establishment, exercise or defence of legal claims.

Right to restriction

In certain circumstances you may ask us to temporarily restrict processing.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, transmit it to another controller.

Right to object

You may object to processing based on legitimate interests on grounds relating to your particular situation.

Where personal data is processed for direct marketing, you have the right to object to that marketing at any time.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing lawfully carried out before withdrawal.

Rights relating to automated decision-making

You have rights under Article 22 GDPR where a decision based solely on automated processing produces legal effects or similarly significantly affects you.

InternshipSpain does not currently use the search-ranking functionality to make such decisions.

17. How to exercise your rights

You can exercise your privacy rights by contacting:

info@internshipspain.nl

Please explain which right you wish to exercise and provide sufficient information for us to identify the relevant account or data.

We may request reasonable verification of your identity before disclosing, correcting or deleting personal data.

We will respond within the time period required by applicable law. Under the GDPR this is generally within one month, subject to permitted extensions for complex or numerous requests.

There is normally no charge for exercising GDPR rights. A reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive and applicable law permits this.

18. Data already received by Companies

Removing a Student Profile prevents future access to that Profile through InternshipSpain.

A Company may, however, already have legitimately received or recorded information before deletion, particularly where the Student accepted a Contact Request.

Companies are contractually required to process Student data only for legitimate internship-related purposes and to comply with applicable data-protection law.

Where a Company independently controls a copy of Student data, requests relating to that Company’s independent processing may also need to be addressed directly to the Company.

InternshipSpain will reasonably assist where appropriate.

19. Children

InternshipSpain is intended only for persons aged 18 or older.

We do not knowingly permit persons under 18 to create Student accounts.

If we become aware that a person under 18 has created an account, we may suspend the account and delete the associated personal data, subject to applicable legal requirements.

If you believe a minor has provided personal data through the Platform, please contact info@internshipspain.nl.

20. Sale of personal data

InternshipSpain does not sell Student personal data to data brokers.

The fact that a Student purchases Profile publication does not mean that Student personal data is sold to Companies.

Companies receive limited access to Student information solely through the Platform and subject to contractual restrictions designed around legitimate internship purposes.

21. Business transfers

If Stijen B.V. or the InternshipSpain business is involved in a merger, acquisition, restructuring, financing or sale of all or part of its business or assets, relevant personal data may be disclosed to professional advisers and prospective or actual transaction parties where legally permitted.

We will continue to apply applicable data-protection requirements to such processing.

22. Legal disclosures

We may disclose personal data where reasonably necessary to:

• comply with a legal obligation;
• respond to a valid order of a court or competent authority;
• enforce or defend our legal rights;
• investigate fraud or unlawful conduct;
• protect the safety of Users; or
• respond to a genuine emergency where law permits disclosure.

23. Changes to this Privacy Policy

We may update this Privacy Policy when our Platform, providers, processing activities or legal obligations change.

The date at the beginning of this Policy shows when it was last updated.

Where a change materially affects how we process personal data, we will provide an appropriate notice before the change takes effect where required.

If a new processing purpose requires consent, an update to this Privacy Policy alone will not be treated as consent.

24. Complaints

If you have a concern about our processing of personal data, we encourage you to contact us first at:

info@internshipspain.nl

You also have the right to lodge a complaint with the competent supervisory authority.

For Stijen B.V. in the Netherlands, the supervisory authority is:

Autoriteit Persoonsgegevens
The Netherlands

You may also have the right to complain to another competent data-protection authority, for example in the EU Member State where you habitually reside, work or believe an infringement occurred.

25. Contact

For privacy questions or requests:

Stijen B.V. / InternshipSpain
Spijksedijk 20A
4207 GN Gorinchem
The Netherlands
KvK: 96238933

Email: info@internshipspain.nl