Privacy Policy

Who we are and how to reach us

1. This policy explains what we do with your personal data when you use pass the year, and what you can ask us to do about it.
2. erudeon v.o.f. decides why and how your personal data is used, and is the controller for it. Our details are below, and that address is also where you write to us about anything in this policy.
3. We have not appointed a data protection officer. We are not required to, and a request sent to the address below reaches the people who can act on it.

What personal data we collect

1. What you give us. Your name and email address, a password or your Google sign-in, the billing details and phone number you enter when you buy, a VAT number if you provide one, and whatever you write when you contact us.
2. What you create using the Platform. Your answers to exercises, your progress and mastery, notes and annotations you write, and the days you studied.
3. What we record as you use it. Sign-in and access records, your IP address, your browser and device, and which pages you viewed.
4. What we receive from others. Confirmation from our payment provider that a payment succeeded or failed. We never receive your card number, which is entered directly with that provider.
5. We do not ask you for special categories of data, such as health or beliefs, and you should not send them to us.
6. You do not have to give us anything. But without a name and an email address we cannot give you an account, and without billing details we cannot issue a valid invoice for a purchase.

Why we use it, and our legal basis

1. To give you an account and provide the Services. Creating and securing your account, unlocking what you have bought, running exercises and tracking your progress, and answering you when you write. Our basis is that we need this to perform our contract with you.
2. To take payment. Processing what you pay and confirming it. Our basis is performance of our contract with you.
3. To keep the financial record. Issuing an invoice and keeping it. Our basis is a legal obligation under Dutch tax law.
4. To send you service messages. Sign-in links, order confirmations, session times and changes, and notices about these documents. We may also use the phone number you gave at checkout to reach you about that purchase or a session you booked, by message or by phone. Our basis is performance of our contract with you.
5. To keep the Platform secure. Detecting and investigating misuse of accounts and of paid material. Our basis is our legitimate interest in protecting the Platform and the people using it.
6. To mark the files we deliver to you. A file you download may carry your email address, so that a copy shared outside your account can be traced back. Our basis is our legitimate interest in protecting the material we sell.
7. To understand and improve the Services. Seeing which material is used and where people get stuck. Our basis is our legitimate interest in making the Platform work better.
8. To measure how people reach us and how the site is used. Counting how many people open a page, which link or site they came from, what they click, and how many go on to buy, so we know which of our own pages and campaigns are worth keeping. We do some of this counting ourselves and some with our analytics provider. It is done without storing anything on your device and without being linked to your account unless you sign in or buy. The identifier we keep for it is deleted after 90 days; what our analytics provider holds follows the retention set out below. Our basis is our legitimate interest in understanding whether our own pages work.
9. Where we ask for your consent. Following your visit from page to page and session replay, anything stored on your device beyond what is strictly necessary, and any optional mail. You can withdraw consent at any time, and withdrawing it does not affect what we did before you did.

Who we share it with

1. We share your personal data only with providers who process it on our instructions and for no purpose of their own, and only what they need.
2. Those categories are: payment processing; invoicing and the accounting record; email delivery; product analytics; hosting the live sessions you have a seat for; and serving and protecting the site. Where we produce a transcript or a written summary of a recorded session, a provider does that for us as well.
3. Ask us and we will name the company behind any of those categories, and tell you what it holds about you.
4. Signing in with Google is different, and we describe it separately for that reason. If you choose it, Google authenticates you on its own terms as its own controller rather than on our instructions, so it is not one of the providers above. You never have to use it: an email address and a password reach all the same things.
5. We also share personal data where the law requires it, and with our professional advisers where we need advice. We do not sell your personal data, and we do not share it for anyone's marketing.

Where your data goes

1. We keep your personal data in the European Union. Our database, our file storage and our video sit on servers we control in the EU, and our email provider sends from the EU.
2. Some of our providers are established outside the EU. Where personal data reaches one of them, the transfer relies on that provider's standard data processing agreement and on the Standard Contractual Clauses approved by the European Commission.
3. Ask us about a particular provider and we will tell you where it processes data and which safeguard the transfer relies on.

How long we keep it

1. We keep personal data for as long as we need it for the purpose we collected it for, and then delete or pseudonymize it.
2. Two things outlive your account on purpose: the financial record, which Dutch tax law requires us to keep for seven years, and the record of what you agreed to and when, because proof of consent and proof of erasure are the two things an erasure may not erase.

Your rights

1. You may ask us for a copy of your personal data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable form, and to object to processing we base on our legitimate interests.
2. Where we rely on your consent, you may withdraw it at any time.
3. You can do the main two yourself, at any time, without asking us. The routes are below.
4. Deleting your account starts a 30 day period during which you can change your mind. After it we erase your data: your profile is stripped, your study data is deleted, and records we have to keep are detached from you.
5. There is one thing erasure cannot reach. A file already delivered to you may carry your email address in its watermark, and we cannot recall a copy that has left our servers.
6. We answer within one month. Where a request is complex we may need longer, and we will tell you so within that first month.

Study data

1. Your answers, your progress and your mastery are used to show you where you stand and to decide what to put in front of you next.
2. They are never used to decide what you may access or what you pay. Access follows what you have bought, and nothing else.
3. We do not make decisions about you by automated means that produce a legal effect or similarly significantly affect you. Ordering exercises by what you have found difficult is not such a decision.
4. Where we report on how material performs, we do so in aggregate, and no report identifies you.

Live sessions and recordings

1. To give you a seat in a live session we pass your name and email address to the provider that hosts it, so that it can admit you.
2. Sessions are recorded. If you speak or turn your camera on, you appear in the recording. Attending with your camera and microphone off ordinarily keeps you out of it, though your display name, anything you send to the chat and anything you share on screen may still be captured.
3. A recording, and any transcript or summary made from it, is available only to staff who need it, and every access to it is logged.
4. Where a transcript or a summary is produced, a provider acting on our instructions produces it, and may not use it for any purpose of its own. Ask us and we will name that provider.
5. If you appear in a recording and would rather not, tell us and we will remove that part or the recording. Where a recording names other students as well as you, we edit it rather than hand it over.

Cookies and similar technologies

1. Our Cookie Policy sets out what we store on your device, why, and the choices open to you.
2. Before you answer, and after a refusal, our analytics provider counts page views and clicks without storing anything on your device or reading anything from it, and without identifying you (the basis in point 8). Following your visit from page to page, and session replay, run only if you agree.

Changes to this policy

1. We update this policy when what we do with personal data changes.
2. The date at the top of this page is the date of the current version, and a change takes effect when it is published here. Where the law requires us to tell you about a change directly, we will.

Complaints

1. Tell us first. Write to the address above and we will look into it.
2. You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
3. If you live in another EU country, you may complain to the supervisory authority there instead.