Privacy & data protection
Last updated: 2026-10-07
We store the information you provide in order to manage mentorships and internships. This notice explains what we process, why, who can see it, how long we keep it, and your rights (GDPR Arts. 13–15).
Who is responsible
The controller for the personal data processed here is Mehmet Erşahin, the operator of this InternshipCRM instance. The postal address and any further contact details are published in the imprint.
What we use your data for
To operate the platform: matching mentees with mentors and companies, tracking the internship/hiring pipeline, logging interactions, scheduling and communication. Where an organisation has switched it on, an e-mail its staff send with the CRM’s address in blind copy (BCC), or a reply they forward to it, is recorded with its date, subject and the e-mail addresses involved only; the content and attachments are not stored.
Legal basis
Processing relies on your consent (Art. 6(1)(a)) and on the legitimate interest of running the mentorship programme (Art. 6(1)(f)). Optional processing, such as AI-assisted CV reading, always requires separate consent.
Who can see your data
Depending on your role: a mentee’s profile, CV and interaction history are visible to their assigned mentor and to administrators, and — once placed — to the linked company and the referral source. Mentors and companies see only their own mentees/candidates. We never sell your data. Extracted CV text is sent to an AI provider only if you separately enable AI-assisted CV reading. On the public home page, and only after you accept marketing cookies, the live chat is loaded from tawk.to — it receives your IP address and whatever you type into the chat. Decline, or leave the chat alone, and nothing is sent to them.
AI-assisted features
Four features can send text to an AI provider, and only where they apply to you: AI-assisted reading of your CV, written feedback on your CV, a summary of your mentor’s interaction log about you, and interview preparation. A fifth, mentor matching, sends skills and interests with no name or identifier on either side. Reading your CV and CV feedback need your separate consent; the interaction summary needs the mentee’s separate consent. Both can be withdrawn at any time under Account → Privacy, and the feature then stops. We send extracted text, never the file itself, and the text sent is never stored. Some generated text is kept so that it is still there after a reload — the AI page lists which — and it is deleted after the retention period, or together with the account it is about. Administrators can also have the themes in evaluation comments, weekly-report blockers and written survey answers summarised; e-mail addresses, phone numbers and — in evaluation comments and weekly reports — the names of the people involved are masked before that text is sent. What each feature sends, what it deliberately withholds and who the provider is are set out in full on the AI page.
Company enquiries and demo requests
If you send the company enquiry or the demo request form, we store what you typed (company, name, work e-mail, phone, the roles or marketplaces you named, your message), the language of the page, when you accepted this notice and which version of it you accepted. To see which campaign brought you, we also keep the utm_* parameters in the page address and the page you came from — its address without the query string, and nothing if you came from one of our own pages — plus the host name the form was sent on. We do not store your IP address. The request goes to the administrators of the organisation that runs that site, to answer it (Art. 6(1)(b), steps prior to a contract). The optional product-news box is only a request: nothing is sent on the strength of it until you have confirmed your address. If you tick it, we send you one e-mail with a confirmation link — at most one per address per day; to enforce that limit we keep a one-way hash of the address, never the address itself, for a day. Only when you press the button behind that link do we record your consent (Art. 6(1)(a)): the time you ticked the box, the time you confirmed, and the version and language of the wording you ticked — no IP address. The same e-mail, and every product-news e-mail, carries a link to withdraw; a withdrawal is recorded as well, so that we can show we respect it. We keep the request as long as it takes to answer it and for any business relationship that follows; write to us to have it deleted sooner.
How long we keep it
We keep your data while your account is active and no longer than necessary for the purposes above. You can delete your account at any time from settings.
Your rights
You have the right to access, rectify, erase, restrict and object to processing, and to data portability. You can download all your data and delete your account from your account settings at any time.
Contact
For any data protection request, write to kontakt@ersah.in. The operator’s full details, including the postal address, are in the imprint.
Where processing is based on consent, you may withdraw it at any time (e.g. in Account → Privacy), without affecting processing carried out beforehand.
You have the right to lodge a complaint with a data protection supervisory authority — in Germany, the authority of your federal state (Land) or the Federal Commissioner for Data Protection (BfDI).