Privacy Policy

We process the following categories of personal data:

• Account data: Name, email address, role (student, parent, mentor, dean, organization).
• School data: School name, class, academic year.
• Internship data: Placement, hours, reflections, assessments, contracts.
• Organization data: Company name, contact person, address, phone number, email, website.
• Usage data: Login timestamp, browser type, IP address (for security).
• Digital signatures: User ID, date, time, and IP address when signing contracts.

We process personal data based on the following legal grounds (GDPR Art. 6):

• Performance of a contract: To deliver the Platform's services to schools, students, and organizations.
• Legal obligation: To comply with legal requirements regarding education and community service.
• Legitimate interest: For security, fraud prevention, and Platform improvement.
• Consent: For sending email notifications (you may disable these at any time).

We only share personal data with:

• Your school: Deans and mentors have access to student internship and hours data.
• Internship organization: Receives intern data for internship supervision.
• Parents/guardians: Have access to their child's progress.
• Processors: We use services from Clerk (authentication), SendGrid (email), Vercel (hosting), and Neon (database). Data processing agreements are in place with all parties.

We do not sell personal data to third parties.

• Account data: Until the account is deleted or 2 years after last activity.
• Internship data: Up to 5 years after internship completion (educational legal retention period).
• Log data: Maximum 12 months.
• Digital signatures: Up to 7 years after signing (burden of proof).

The Platform uses the following cookies:

• Strictly necessary cookies: For authentication (Clerk session cookies) and language settings. These are required for the Platform to function and are exempt from the consent requirement.
• Functional cookies: To remember your language preference (Dutch/English).

We do not use tracking, advertising, or analytics cookies.

Under the GDPR, you have the following rights:

• Right of access: You can request which data we process about you.
• Right to rectification: You can request correction of inaccurate data.
• Right to erasure: You can request deletion of your data (“right to be forgotten”).
• Right to restriction: You can request restriction of processing.
• Right to data portability: You can request your data in a common format.
• Right to object: You can object to processing based on legitimate interest.

To exercise your rights, contact us at privacy@strategihub.com. We will respond to your request within 30 days.

If you believe we are processing your personal data unlawfully, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We take appropriate technical and organizational measures to protect your personal data, including: encrypted connections (TLS/SSL), role-based access control, Content Security Policy headers, rate limiting on public endpoints, input validation and sanitization, and regular security audits.