NCNY Enterprises Privacy Policy for Clients

What data do we collect, and where does it come from?

We collect only the personal data we need to run the service you ask for. The type of data depends on who you are and which service you use. Thus, this privacy policy groups that data by the people we work with. For example, student data differs from the data of a payroll client.

What do you give us when you ask us for help?

Most personal data comes straight from you, through our contact form or during our calls. Next, this policy sorts that data by the role you hold.

• Internship applicants: your name, contact data, CV, transcripts or work history, field of study and planned dates.
• Interns who travel: passport data, visa status, an emergency contact and proof of insurance.
• University staff: your name, role, work email, phone and the terms of our agreement.
• Nearshore candidates: your CV, work history, skills, references and salary range.
• Nearshore staff we pay: bank account numbers, tax IDs, pay records and contract terms.
• Employers: HR contact names, job titles, company data and hiring plans.
• Visa clients: copies of passports, degrees, job offers and letters for the file.

Please send us only what a form or a checklist asks for. Also, if you share data on another person, make sure that person knows and agrees.

What data do we get from the people you work with?

Also, some data reaches us from others. For instance, a university may send us a list of students who want a placement. Student data of this kind is used only to plan those placements. Likewise, a host company may send us feedback on an intern.

In addition, a J-1 sponsor may tell us whether an applicant meets its rules. Immigration lawyers or consultants may tell us what a visa file still needs. Similarly, payroll partners may confirm that a payment went through. This privacy policy covers that data in the same way as the data you give us.

What does our website log each time you visit it?

Our web host keeps short server logs, such as IP address, browser type and the time of each visit. This privacy policy covers these logs, which help us keep the site safe. However, the logs are not used to build a profile of you.

Cloudflare hosts this site and delivers each form to our team by email. In addition, Cloudflare helps us block spam and abuse of the form. Also, the documents of an application stay in private storage for 30 days, and then they are deleted.

How do we use the data that you give to us?

We use personal data only for clear and stated purposes. Under this privacy policy, each purpose appears in the list below. Besides these purposes, no hidden uses are added.

• To match applicants with host companies and to support each internship from start to end.
• To work with J-1 sponsors, which decide on each US internship and issue its papers.
• To find, screen and present nearshore candidates to US employers.
• To pay nearshore staff through licensed payroll or employer of record partners where local law requires one.
• To prepare visa files and pass them to the lawyer or consultant who advises and files.
• To answer your questions, send updates and keep records of our work.
• To meet our own legal, tax and accounting duties.
• To protect our systems, stop fraud and defend legal claims.

We do not sell your data, and we do not use it for ads. Also, we make no decisions about you by automated means alone. Instead, a person on our team reviews each match, each payment and each file.

In addition, each service page sets out its steps in plain words. For instance, our internship placement service across the Americas shows when a sponsor joins the process. Student data is never used for any purpose outside that process.

If we want to use student data or any other data for a new purpose, we will tell you first. Where the law requires it, we will also ask for your consent. As a result, this privacy policy will always match what we really do.

What legal basis lets us use your data under the GDPR?

The EU General Data Protection Regulation, or GDPR, applies when we handle data of people in the EU. Under its Article 6, we need a legal basis for each use. Therefore, this privacy policy names the bases we rely on in plain words.

• Contract: we need the data to deliver a service you asked for, or to take steps before a contract.
• Legal duty: the law requires us to keep or share certain records, such as tax records.
• Legitimate interests: we have a fair business reason, such as site safety, that does not override your rights.
• Consent: you agreed to a specific use, and you can take that consent back at any time.

Notably, passport and visa data need extra care. First, we ask for your explicit consent before we collect a copy of your passport. Next, you are shown who will see the copy and why. If you withdraw consent, we may no longer be able to move your file forward.

Health data is a special category under the GDPR, and criminal records have their own rules. In fact, we do not ask for them unless a visa route or host country requires them by law. Even then, your explicit consent is asked for first.

The full text of the law is published on EUR-Lex, the official EU law site. You can read the General Data Protection Regulation text (opens in a new tab).

Who do we share your data with, and why do we share it?

We share personal data only with those who need it for the service you chose. Notably, this privacy policy names no partners, because they change from case to case. Instead, you are informed who gets your file before it goes out.

• J-1 designated sponsors, which review applicants and decide whether to sponsor a US internship.
• Host companies that consider an intern or a nearshore candidate for a role.
• Employers who hire nearshore staff or who ask us to prepare a visa file.
• Immigration lawyers or consultants, who give legal advice and file forms.
• Licensed payroll or employer of record partners, which pay staff in line with local law.
• Service providers that host our email, files and website under a written contract.
• Public bodies, courts or police, but only when the law requires us to share.

Under this privacy policy, each partner gets only the part of the file it needs. For example, student data is sent to a host company only after the intern agrees. Similarly, payroll data is shared only with the partner that pays the staff member.

Moreover, our service providers may use your data only to serve us. Also, if we sell or merge our business, the buyer must honor this privacy policy. Otherwise, your personal data stays with us and the partners you chose.

Our work visa support for employers explains who advises on a case and who files it.

How long do we keep your data, and when do we delete it?

We keep personal data only as long as we need it for the purpose we collected it for. After that, the data is deleted or made anonymous. However, the time frames below are a plan, and a lawyer or consultant will confirm them before launch.

• Intern files: up to two years after the internship ends, unless you ask us to delete them sooner.
• Candidates we do not place: up to twelve months, so we can offer you other roles with your consent.
• Payroll and tax records: as long as tax and labor law in each country requires.
• Visa file copies: until the case closes, plus any time the law, or the lawyer or consultant, requires.
• Passport copies: we delete them once the sponsor, employer, lawyer or consultant no longer needs them.
• Server logs: these are kept for up to ninety days.

However, backups may hold data for a short time after we delete it. Old backups are overwritten on a set cycle. In short, this privacy policy sets the outer limit for how long we keep anything.

Student data from a past internship is kept only for the time in the list. Thus, an intern who wants an early delete can ask at any time.

What rights do you have over the data we hold on you?

Your rights depend on the privacy law that applies, especially where you live. In most cases, each valid request is handled without charge. First, we may ask you to prove who you are.

What rights do you have if you live in the EU?

• Right to access: get a copy of your data and learn how we use it.
• Right to correct: fix data that is wrong or out of date.
• Right to erasure: ask us to delete your data in some cases.
• Right to restrict: ask us to pause how we use your data.
• Right to object: say no to uses based on our legitimate interests.
• Data portability: get your data in a common format to take elsewhere.

Also, you may file a claim about your rights with the data protection authority in your EU country. Still, we would like to fix the problem first, so please write through our contact form.

Under this privacy policy, we answer within one month, as the GDPR requires. However, we may extend that time by two months for complex requests. In that case, you will be told why.

What rights do you have if you live in California?

The California Consumer Privacy Act, as amended by the CPRA, gives California residents certain rights. Your rights under that law apply when the law covers our business. In that case, you may use your rights as listed below.

• Right to know what we collect, use and disclose about you.
• Right to delete personal information, with some legal exceptions.
• Right to correct data on you that is not accurate.
• Right to limit the use of sensitive data, such as passport numbers.
• Right to refuse sale or sharing, though we do neither.
• Right to equal service, with no penalty for using your rights.

In fact, we do not sell personal information. Also, we do not share it for cross-context behavioral advertising, as the CPRA defines that term. The California Attorney General explains these rights in its CCPA guide for consumers (opens in a new tab).

To use any of your rights, send your request through the rights request form on our contact page. In addition, you may use an authorized agent, who must show written permission. Each privacy request gets a reply in writing. Overall, this privacy policy gives every client the same way to make a request.

Which cookies does this site set when you visit it?

As this privacy policy states, our site sets no tracking cookies and loads no third-party scripts. We use no ad networks, no analytics tools and no social media pixels. As a result, you see no cookie banner on this site.

A cookie is a small text file that a website stores in your browser. If we ever add an essential cookie, it will only keep the site working. For example, such a cookie might remember a step in a form.

Before that happens, each cookie will be listed in this privacy policy. Also, your browser lets you block or delete cookies at any time. Blocking cookies, however, will not stop you from reading this site.

How do we protect your data when it moves across borders?

We are based in the US, and our services link Europe with the Americas. So your data may travel from the EU to the US, Canada or Latin America. For example, a host company in Mexico may need student data from a university in France.

However, the GDPR allows such transfers only with proper safeguards. Therefore, this policy relies on the safeguards below, based on the country and the partner.

• Standard contractual clauses that are approved by the European Commission.
• An adequacy decision, where the EU has found that a country protects data well enough.
• The EU-US Data Privacy Framework, if the US recipient has joined it.
• Your explicit consent, in rare cases where no other safeguard fits.

Under this privacy policy, we also check that each partner protects data with care. Student data sent to a host abroad is covered by one of these safeguards. You may ask for a copy of the safeguards that apply to your data.

In short, this privacy policy follows your data and your rights wherever they go. Personal data is never sent abroad without a safeguard in place.

Do we collect any data from children or from minors?

Our services, and this privacy policy, are meant for adults. In fact, interns in our programs must be at least 18 years old. Hence, we do not knowingly collect personal data from anyone under 18.

If we learn that student data comes from a minor, it is deleted promptly. Also, a parent or guardian who has a concern can write to us at any time. Indeed, this privacy policy treats that kind of note as urgent.

How will we tell you when we change this privacy policy?

We may update this privacy policy when our services or privacy laws change. Next, the date at the top always shows the current version of this privacy policy. Also, if a change affects your rights in a major way, we will email you before it applies.

Older versions are kept on file, and we can send you one on request. Thus, you can always compare this policy with the text you first saw.

How can you reach us with a question about your data?

NCNY Enterprises is the controller of the personal data in this privacy policy. You can send any privacy policy request through the contact form on our contact page. We answer each privacy question in English, Spanish or French.

Once our registered business address is published, you may also send requests to it in writing. No data protection officer has been named yet, and a lawyer or consultant will advise whether we need one. Likewise, we will name an EU representative if the GDPR requires it.

For a question about our services, use our consultation request form. Finally, to see who we are, read about our talent mobility team.