Start Me Up Careers – Privacy Policy
About this policy
This policy explains how Start Me Up Careers Limited (“Start Me Up”, “we”, “us”) collects, uses and protects personal information when you visit our website, apply for or take part in one of our internship programs, or otherwise deal with us.
Start Me Up Careers Limited is the controller of your personal information. We are a company registered in England and Wales (company number 10084962) and are registered with the Information Commissioner’s Office (ICO) under registration number 00014867279.
We process personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We do not sell personal information.
If you have any questions about this policy or how we use your information, please email privacy@startmeup.careers. Our Director, Clare Harrison, is responsible for data protection at Start Me Up.
This policy was last updated in October 2026.
The information we collect
We collect most information directly from you, mainly through our online application form and during your program. Our programs are open only to participants aged 18 and over.
When you apply or ask for information, we may collect:
• your name, university and year of graduation
• contact details, including email address and phone number
• your location, preferences and interests, to help us suggest suitable placements
• your résumé and any other information you choose to share with us
• information about how you use our website (see Cookies below)
Once you confirm your place by paying a deposit, we collect further information needed to run your program, which may include:
• passport details, for visa processing and travel arrangements
• emergency contact details, which may be a parent, guardian or other person you choose
• medical conditions, allergies or other health information that may affect your placement
During your program, we may record information about your placement, and about any incident you are involved in.
Health information is “special category” data under UK GDPR. We collect it only to help you manage any conditions safely during your program, and we handle it with extra care (see How we protect your information).
We may also receive information about you from your university, if you are applying through one of our university partners.
How we use your information and why
UK GDPR requires us to have a lawful basis for each way we use your information. The table below sets out what we use it for and the basis we rely on.
What we use it for
Lawful basis
Assessing your application and arranging your internship, accommodation, transportation and visa support
Performance of our contract with you, or steps you ask us to take before entering into one
Managing your health and safety during the program, including using health information
Your explicit consent; or, in an emergency, protecting your vital interests
Contacting your emergency contact if you are ill or involved in an incident
Protecting your vital interests; our legitimate interest in your welfare
Answering your questions and keeping internal records
Our legitimate interest in running our business
Sharing information with your university, where you take part through a university partnership
Performance of our contract with your university, and our legitimate interests
Improving our programs and website, and market research by email
Our legitimate interest in improving our services
Sending you marketing emails about our programs
Your consent, or as a previous inquirer or customer where the law allows. You can opt out at any time
Meeting legal, tax and accounting obligations
Legal obligation
We do not make decisions about you using fully automated processes. All decisions about applications and placements are made by our staff.
Who we share your information with
We share personal information only where we need to deliver your program, where you have agreed, or where the law requires it. We never sell, rent or lease your information.
Who
Host organizations
To find and arrange your internship placement
Accommodation and transportation providers
To arrange housing and travel during your program
Your university, if you take part through one of our university partners
To meet our contract with the university, for example confirming your participation
Your emergency contact, such as a parent or guardian
If you are ill or involved in an incident
Medical services or authorities
Where necessary to protect your health or safety in an emergency, or where the law requires it
Our service providers, including our customer database (Zoho CRM), email, invoicing and payment providers
To store your information securely and run our business
We share only the information each recipient needs. Our service providers act on our instructions under contracts that require them to protect your information.
Health information is shared only with people who need it to support you during the program.
Sending information outside the UK
Because our programs take place in Indonesia, we need to share some of your information with host organizations, accommodation providers and others there.
Indonesia does not have a UK “adequacy” decision, so we transfer only the information needed to deliver your program. These transfers are necessary to perform our contract with you.
Our customer database, Zoho CRM, stores your information in data centers located in the United States. Where information is stored outside the UK, we rely on UK adequacy regulations or on appropriate safeguards, such as the UK International Data Transfer Addendum.
You can contact us for more information about these safeguards.
How long we keep your information
We keep personal information only for as long as we need it.
Information
How long we keep it
Health and medical information – Deleted when your program ends
Passport details – Deleted when your placement ends
Other participant records – 5 years after your program ends
Inquiries from people who do not take part- 12 months after your last contact with us
Financial records – 6 years, as required by UK tax law
If you unsubscribe from marketing emails, we keep a record of your email address so that we do not contact you again.
How we protect your information
We store participant information in Zoho CRM, a cloud service certified to the ISO/IEC 27001 information security standard. Information is encrypted while it is sent and while it is stored.
Our staff must follow our Information Security Policy. It requires multi-factor authentication to access our customer database, limits access to staff who need it, and sets security requirements for the devices staff use. Health information is restricted to the staff who need it to support you.
If a data breach is likely to put your rights at risk, we will tell you without undue delay. Where the law requires it, we will also report it to the ICO within 72 hours.
Payments. We do not store your card or bank details. Card payments are handled by our payment provider, Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS).
Cookies and marketing
Cookies are small files stored on your device when you visit a website. We use them as follows:
• Essential cookies make our website work, for example keeping you signed in. These are always on.
• Analytics cookies help us understand how visitors use our website, using Google Analytics. Google may process this data in the United States. We use these only if you agree.
• Preference and testing cookies remember your choices and let us test different versions of our pages. We use these only if you agree.
You can accept or reject non-essential cookies using the banner when you first visit our website, and change your choice at any time via [LINK]. You can also block cookies in your browser settings, though some parts of the website may not work properly.
Marketing emails. We send marketing emails only where you have agreed, or where you have previously inquired about or bought our services. Every email includes an unsubscribe link, or you can email privacy@startmeup.careers at any time.
Your rights
Under UK GDPR you have the right to:
• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use your information
• object to us using your information, including for marketing
• ask us to transfer your information to another organization
• withdraw your consent at any time, where we rely on consent
To use any of these rights, email privacy@startmeup.careers. We will respond within one month. Some rights apply only in certain circumstances, and we will explain if we cannot meet a request.
If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Other websites. Our website links to other sites. We are not responsible for how they handle your information, so please read their privacy policies.
Changes to this policy. We review this policy at least once a year and will post any changes on this page.