Beyond Internships · Last updated: August 2026
We want to be upfront with you about your data. This policy is written in plain language – no jargon, no small print. It covers what we collect, why we collect it, and what you can do about it.
Beyond Internships is a small, independent business registered in Kenya (company number PVT-7815EDDR), with offices at The Promenade, General Mathenge Drive, 00400, Nairobi, Kenya. We specialise in helping university students find internship placements and furnished accommodation abroad.
We are the data controller for all personal data processed through our website at www.beyond-internships.com. That means we are responsible for deciding how and why your data is used and we take that seriously.
Got a question about your data? Contact us:
Email: 2p.plainprivacy@gmail.com
Post: Beyond Internships, The Promenade, General Mathenge Drive, 00400, Nairobi, Kenya
Our website is hosted by Netlify, Inc., based in the United States. You can reach them at privacy@netlify.com.
Because we offer services to students in the European Union, the GDPR applies to how we handle EU residents' data. As required by Article 27 GDPR, we have appointed Mr. L. Nébié, located in France, as our representative in the EU. They can be contacted at lamine.nebie@beyond-internships.com.
Two data protection laws apply to how we handle your data:
The Kenya Data Protection Act 2019 (“DPA 2019”) applies to all users.
The EU General Data Protection Regulation (“GDPR”) applies to users based in the European Union, because we specifically target EU students as part of our service.
Where both laws apply to you, we follow whichever provides the stronger protection. Legal basis references below cite both laws side by side.
We only collect data we actually need. Nothing more.
For each type of data we collect, we explain below: what we collect, why, the legal basis, whether providing it is mandatory or optional, and what happens if you choose not to.
To use our services, we collect your name, email address, phone number and your housing or internship search preferences.
Legal basis: Performance of a contract — Section 30(1)(b) DPA 2019 / Article 6(1)(b) GDPR.
Mandatory or optional? Mandatory. Without this data, we cannot create your account or provide our services.
If you apply for an internship through our services, you'll submit a CV and application materials. We use these to pass your application to the relevant host organisation.
Your CV is kept for up to 2 years from the date of application
If you are hired, your data passes to your employer and becomes subject to their internal privacy arrangements
You can ask us to delete your CV at any time — see Section 6
Legal basis: Performance of a contract — Section 30(1)(b) DPA 2019 / Article 6(1)(b) GDPR.
Mandatory or optional? Mandatory for internship applications. Without a CV and application materials, we cannot submit your application to host organisations. You can still use the housing search without providing this data.
Data received from third parties: Occasionally, host organisations or universities may share information about you with us as part of a placement process (for example, confirming your enrolment status). Where this happens, we will inform you at the time or as soon as practicable, as required by Article 14 GDPR and Section 26 of the DPA 2019. The source of such data will always be disclosed to you.
If you pay for any of our services, we collect your name and billing address. Full card numbers are never stored by us. Payments are handled securely by Stripe under their own PCI-DSS obligations.
Legal basis: Performance of a contract — Section 30(1)(b) DPA 2019 / Article 6(1)(b) GDPR.
Mandatory or optional? Mandatory for paid services. If you do not provide billing details, we cannot process your payment or activate the relevant service.
When you contact us, we keep a record of the conversation so we can help you properly and follow up if needed.
Legal basis: Legitimate interest — Section 30(1)(f) DPA 2019 / Article 6(1)(f) GDPR.
What that interest is: Our legitimate interest is in being able to resolve your query effectively, maintain continuity across follow-up contacts, and improve the quality of our support. We have assessed that this interest does not override your rights and freedoms.
Mandatory or optional? Optional. You are not required to contact us. However, if you do and choose not to provide certain details (such as your email or phone number), we may not be able to resolve your query.
If you choose to leave a review of our platform or services, we collect your name and the content of your review. We may display your review publicly on our website. If we do, only your first name will be shown – never your full name or any other identifying details, unless you choose to include them in the review text itself.
You can request removal of your review at any time by contacting us at 2p.plainprivacy@gmail.com.
Legal basis: Legitimate interest — Section 30(1)(f) DPA 2019 / Article 6(1)(f) GDPR.
What that interest is: Our legitimate interest is in showcasing genuine student feedback to help other students make informed decisions about using our platform, and to improve the quality of our services.
Mandatory or optional? Entirely optional. Leaving a review is never required to use any of our services. You can use the platform fully without submitting one.
If you sign up to hear from us, we'll send you updates and useful information about our services. We only do this with your explicit consent, and every email includes a one-click unsubscribe link. You can withdraw consent at any time – doing so won't affect anything sent before.
Legal basis: Consent — Section 30(1)(a) DPA 2019 / Article 6(1)(a) GDPR.
Mandatory or optional? Entirely optional. Signing up for the newsletter is not required to use any of our services. Not subscribing has no effect on your account.
Like most websites, ours automatically collects some technical information when you visit: your IP address, browser type, device information, and pages viewed. This helps us keep the site secure and understand how it's being used.
Legal basis: Legitimate interest — Section 30(1)(f) DPA 2019 / Article 6(1)(f) GDPR.
What that interest is: Our legitimate interest is in maintaining the security and stability of our website and understanding aggregate usage patterns to improve the service. This data is not used to identify you individually beyond what is necessary for security purposes.
Mandatory or optional? This data is collected automatically as a function of how websites operate. You can limit some collection through your browser settings.
We do not sell your data. Ever.
We only share your data where it is necessary:
Host organisations and landlords to process your internship application or housing enquiry. We share only what is needed for that specific purpose and require our partners to handle your data responsibly.
Our hosting provider (Netlify, Inc.) to keep the website running. They process data only on our instructions and cannot use it for their own purposes.
Stripe, our payment processor, to process payments securely. Stripe is PCI-DSS compliant and processes payment data under its own strict security obligations.
Public authorities only where legally required (for example, by a court order or regulatory obligation).
Our hosting provider is based in the United States. Where this involves transferring personal data outside Kenya, we ensure appropriate safeguards are in place as required by Section 48 of the DPA 2019. These may include standard contractual clauses or your explicit consent.
For EU residents: any transfer of your data outside the European Economic Area (EEA) is covered by appropriate GDPR transfer mechanisms, including Standard Contractual Clauses approved by the European Commission (Article 46 GDPR).
You can ask us for details of the specific safeguards in place by emailing 2p.plainprivacy@gmail.com.
You are in control of your data. These rights are yours by law, so you don't need to give a reason to use them.
Under the DPA 2019 (and GDPR for EU residents), you have the right to:
Access: ask us what data we hold about you and receive a copy
Correct: ask us to fix anything that is inaccurate or incomplete
Delete: ask us to erase your data (we will, unless we have a legal obligation to keep it)
Restrict: ask us to pause processing your data while an issue is resolved
Portability: receive your data in a portable digital format to move elsewhere
Object: ask us to stop processing where we rely on legitimate interest
Withdraw consent: for anything based on your consent (e.g. our newsletter) at any time
EU residents also have the right not to be subject to solely automated decisions that significantly affect you (Article 22 GDPR). We do not currently use automated decision-making of this kind.
To use any of these rights, email us at 2p.plainprivacy@gmail.com. We will respond within 30 days. We may need to verify your identity first.
If you're not satisfied with how we've handled your data, you can complain to:
The Office of the Data Protection Commissioner (ODPC) in Kenya: www.odpc.go.ke
Your national data protection authority if you are based in the EU (for example, the CNIL in France, or the ICO if you are in the UK)
We only keep your data for as long as we need it:
CV and application data: up to 2 years from your application date. If your application results in a placement and you become a client of ours, your data will be retained for up to 5 years from the end of the contract.
Accommodation data: for as long as you use our housing services, plus up to 5 years from the end of your last accommodation arrangement.
Billing and order records: 7 years, as required under Kenyan tax and companies’ legislation.
Support correspondence: up to 3 years from our last contact with you.
Newsletter data: until you unsubscribe.
When data is no longer needed, we delete or anonymise it securely. Anonymised data (where you can no longer be identified from it) may be kept for statistical purposes.
If you reside in France, you have the right to provide us with specific instructions regarding the processing of your personal data after your death.
To exercise these rights, you can write to us at 2p.plainprivacy@gmail.com.
We use appropriate technical and organisational measures to protect your data — including encrypted connections (HTTPS), secure credential storage, and restricted access controls. These measures are designed to ensure the integrity and confidentiality of your personal data, as required by Section 28(f) of the DPA 2019.
If a data breach occurs that is likely to put your rights at risk, we will notify the ODPC (and the relevant EU supervisory authority where GDPR applies) within 72 hours of becoming aware, as required by Section 43 of the DPA 2019 and Article 33 of the GDPR. Where the breach poses a high risk to you personally, we will also contact you directly.
No online service can guarantee absolute security, but we take all reasonable steps to protect your information.
Our services are not intended for anyone under 16. We do not knowingly collect personal data from children. If you think we may hold a child's data by mistake, please contact us at 2p.plainprivacy@gmail.com and we will delete it promptly.
If we update this policy, we'll post the revised version here with an updated date. For significant changes, we'll notify you directly — by email or a notice on the site — before the changes take effect.