Privacy Policy

Last updated: 2 October 2026

1. Summary

• Who we are: GoBali programs are marketed by Go Abroad Study Programs Pte. Ltd., Singapore. We are responsible for this website.
• Without your consent, we only process what is technically necessary to show you this website securely.
• Analytics and advertising (Google Analytics, Google Ads) only set cookies if you click “Accept” in the cookie banner. You can change your choice at any time via “Cookie settings” in the footer.
• Forms and applications: we use the data you send us to answer you and to process your application with the university.
• You have rights to access, correct and delete your data. Write to us at info@gobali.org.

2. Controller and contact

Go Abroad Study Programs Pte. Ltd.
Singapore Business Federation Center
160 Robinson Road
Singapore 068914

E-mail: info@gobali.org

For all privacy questions, including questions for our data protection contact, please write to info@gobali.org.

The study programs themselves are run by Udayana University and Ngurah Rai University in Bali, Indonesia. When you use their own systems (for example the myUNUD application portal or SiAkad), the respective university is responsible for that processing and its own privacy notice applies.

3. Which laws apply

We process personal data in line with the EU General Data Protection Regulation (GDPR) for visitors in the European Union and the European Economic Area, the UK GDPR for visitors in the United Kingdom, Singapore’s Personal Data Protection Act (PDPA) and, where applicable, Indonesia’s Personal Data Protection Law (Law No. 27 of 2022).

4. Hosting, delivery and security

This website is a static website delivered by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) through its global network. When you open a page, your browser automatically transmits technical data: IP address, date and time, the page requested, referrer, browser and operating system. Cloudflare uses this data to deliver the website, to protect it against attacks and misuse, and it is stored only briefly in log files.

• Purpose: secure and reliable delivery of the website.
• Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
• There is no database, login or user account on this website.

5. Contact forms

We offer these forms: General Inquiry, Support Request, Document Request and Research Inquiry. Depending on the form, we process:

• name, e-mail address, country, optional phone number and preferred contact method;
• student number, university and the topic of your request;
• your message;
• for the Document Request, the uploaded document concerned.

Your submission, including any uploaded files, is sent by e-mail to our team. The website does not store your submission or your files; it only passes them on. To send and receive these e-mails we use our e-mail provider MXroute, which acts on our behalf.

• Purpose: answering your request and providing the requested service (e.g. issuing a document).
• Legal basis: steps prior to or performance of a contract (Art. 6(1)(b) GDPR); for general questions, our legitimate interest in answering you (Art. 6(1)(f) GDPR).
• Fields marked as required are needed to handle your request. Without them we cannot process it.

6. Applications (Ngurah Rai University)

When you apply for a GoBali program at Ngurah Rai University through our online application form, we process:

• program, semester and selected courses;
• first and last name, address, gender (optional), date of birth, passport number, nationality, e-mail address and phone number;
• details of your guarantor (name, phone, e-mail, relationship to you);
• your home institution (name, faculty, address, optional contact person);
• uploaded documents: signature page, passport, letter of enrollment and profile picture;
• optional information on how you heard about us and your message;
• your acceptance of the Terms and Conditions and this Privacy Policy.

We use this data to check your application, to enroll you at Ngurah Rai University (Denpasar, Bali, Indonesia), to issue your documents and to support you with your visa and during your stay. For these purposes, we pass your application data to the university.

If you provide details of a guarantor or a contact person at your home institution, please inform them that you have shared their contact details with us for this purpose.

Applications for Udayana University are submitted directly in the university’s myUNUD portal (myunud.gobali.org). The privacy notice shown there applies.

• Legal basis: steps prior to entering into a contract and performance of the contract (Art. 6(1)(b) GDPR); the transfer to the university in Indonesia is necessary for the program you apply for (Art. 49(1)(b) GDPR).

7. Cookies and consent

This website only uses cookies or similar technologies that are not strictly necessary if you consent. The cookie banner asks for your choice when you first visit. Your choice itself is saved in your browser’s local storage, so that we do not ask again on every page. This storage is strictly necessary and does not require consent.

You can change or withdraw your consent at any time using the “Cookie settings” link in the footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

• Legal basis for consent-based tools: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG for visitors in Germany).

8. Web analytics with Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It helps us understand how visitors use our website so we can improve it. Google Analytics stores cookies on your device and records, for example, pages visited, time spent on pages, scrolling, clicks on links, downloads, video plays and form submissions, together with information about your device, browser and approximate location (country or city). IP addresses are not stored by Google Analytics 4.

We use Google’s Consent Mode: if you decline or have not yet decided, Google Analytics does not set cookies. In this case, only cookieless signals without an identifier (e.g. that a page was viewed) are sent, which Google uses in aggregated form to estimate visitor numbers.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the European Commission considers this certification to ensure an adequate level of data protection. We have also concluded a data processing agreement with Google. Data collected with cookies is deleted after 14 months.

• Purpose: statistical analysis and improvement of our website.
• Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).
• More information: Google Privacy Policy.

9. Advertising with Google Ads

We advertise our programs with Google Ads, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). With your consent, our website uses the Google Ads tag (ID AW-769491445). It lets us measure how well our ads work, for example whether a visitor who clicked one of our ads later submits an application in our application system myUNUD (myunud.gobali.org), and lets Google show our ads to people who have visited our website (remarketing). For this, Google sets cookies on your device (e.g. _gcl_au) and processes information such as the ad you clicked, the pages you visited, the time of your visit and information about your device and browser.

As for Google Analytics, we use Google’s Consent Mode: if you decline or have not yet decided, Google Ads does not set cookies and does not use your visit for remarketing. In this case, only cookieless signals without an identifier are sent, which Google uses in aggregated form.

Data may be transferred to Google LLC in the USA (see section 8 on the EU-U.S. Data Privacy Framework). Google Ads cookies are stored for up to 90 days.

• Purpose: measuring and improving our advertising.
• Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).
• More information: Google Privacy Policy and Google ad settings.

10. Spam protection with Cloudflare Turnstile

To protect our forms against spam and abuse, we use Cloudflare Turnstile (Cloudflare, Inc., USA). When you use a form, Turnstile checks in the background whether the request comes from a human, based on technical signals from your browser. Turnstile does not set tracking cookies and does not use the data for advertising.

• Legal basis: our legitimate interest in protecting our forms from spam and misuse (Art. 6(1)(f) GDPR).

11. YouTube videos

Some pages contain YouTube videos (YouTube is a service of Google Ireland Limited). The video is only loaded when you click it. Until then, no data is sent to YouTube. After your click, YouTube receives data such as your IP address and may set cookies. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com).

• Legal basis: your consent, given by clicking the video (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

12. WhatsApp

You can contact us via WhatsApp. The WhatsApp links on this website are plain links: data is only transferred when you click one and it opens WhatsApp. If you then write to us, WhatsApp (WhatsApp Ireland Limited, a Meta company) processes your phone number, profile name and messages in line with its own privacy policy. We use your messages to answer your request.

• Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

13. Social media, maps and external links

Links to our profiles on Facebook, X, YouTube, LinkedIn and Instagram, and to the university systems and Google Maps, are plain links. No data is sent to these services until you click a link. After that, the privacy policy of the respective provider applies.

This website does not use social media plugins, advertising cookies or tracking pixels. Fonts and icons are hosted on our own website, so no data is sent to font providers.

14. Recipients of your data

Within our organization, only the staff who need your data to handle your request or application have access to it. In addition, data may be received by:

• Ngurah Rai University and Udayana University, where needed for your application, enrollment and studies;
• our service providers acting on our behalf: Cloudflare (hosting, security, spam protection), Google (web analytics and advertising measurement, only with consent) and our e-mail provider MXroute;
• public authorities (e.g. immigration authorities) where this is required for your visa or by law.

We do not sell your data and we do not use it for advertising by third parties. We only use Google Ads for our own advertising (see section 9).

15. International data transfers

Our company is based in Singapore, the universities are in Indonesia and some of our service providers are in the USA. Where data from the EU/EEA is transferred to countries without an EU adequacy decision, we use the European Commission’s Standard Contractual Clauses or rely on another legal ground: in particular, transfers to the university that are necessary for your application (Art. 49(1)(b) GDPR). You can request a copy of the safeguards from us.

16. How long we keep your data

• Enquiries (general, support, research, document requests): up to 3 years after our last contact, so that we can deal with follow-up questions.
• Applications and student records of students who studied with GoBali: up to 10 years after the end of the program, so that we can confirm your studies, issue documents (e.g. for credit transfer or BAföG) and meet statutory record-keeping obligations.
• Applications that did not lead to studies: up to 2 years after the semester you applied for.
• Copies of passports and other ID documents: deleted once they are no longer needed for enrollment and your visa, at the latest 1 year after the end of the semester.
• Analytics data: 14 months (see section 8).
• Google Ads cookies: up to 90 days (see section 9).

We delete your data earlier if you ask us to, unless we are legally required to keep it.

17. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (data portability, Art. 20 GDPR);
• object to processing based on our legitimate interests (Art. 21 GDPR);
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to info@gobali.org. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Singapore, the Personal Data Protection Commission (PDPC) is responsible.

18. Security

This website is only delivered over encrypted connections (HTTPS). Form submissions and uploaded files are transmitted encrypted and are only accessible to the staff who handle your request.

19. Changes to this policy

We update this Privacy Policy when our website or the law changes. The current version is always available on this page.