Privacy statement

Who processes your data

The controller is the provider of Wegkompas. Name, Chamber of Commerce (KvK) number, e-mail address and the other details are at the bottom of this page, in the Who we are block. You can reach us by e-mail; a contact form does not replace that address.

What data, why and on what legal basis

Each processing activity lists its legal basis under Article 6(1) GDPR (AVG).

  • Account: e-mail address, so you can sign in and keep your progress. Basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Signing in with Google or Apple (if that button is on the sign-in page and you choose it): Google or Apple sends us your e-mail address and, if the service includes them, your name and profile picture. We only use the e-mail address, for your account; our sign-in system (Supabase) stores the name and picture with your account automatically, but we do not use them. Basis: performance of the contract (b). Google and Apple are themselves responsible for their own processing; their own privacy statements apply to it.
  • Nickname: the name you chose yourself. Only you see it. We do not ask for your real name (if you sign in with Google or Apple, see above). Basis: performance of the contract (b).
  • Settings: language, theme, exam language and category, your target date and experience level — so the learning route fits you. Basis: performance of the contract (b).
  • Progress: which questions you answered and how, to schedule repetition. Basis: performance of the contract (b).
  • Problem report with screenshot: if you click «Report a problem» and confirm with «Send», we receive an image of that page as you saw it, the page address, your language, screen size and browser type, plus anything you add yourself. Password fields stay out of the picture. We use this only to find and fix the problem and delete it after ninety days. Legal basis: legitimate interest in a working service (art. 6(1)(f) GDPR).
  • Birth year and month: solely to determine which rules for minors apply to you. These fields never leave the server and never end up in the app bundle. Basis: legal obligation (Art. 6(1)(c) GDPR, read with Art. 8 GDPR and Art. 5 of the Dutch GDPR Implementation Act, UAVG).
  • Orders and payments: which package you bought, the price, the date, the payment status and Mollie’s reference. Basis: performance of the contract (b). We also keep the payment register because tax law requires it: legal obligation (c, read with Art. 52 of the Dutch General Tax Act, AWR). With the payment status Mollie also sends details such as your name, your account number or the last digits of your card. We do not store them: of the payment we keep only the reference, the status, the amount, the payment method, the times and our own order details.
  • Consents when ordering: for each box (terms, immediate start) the exact text shown, the time, the version of the terms, the IP address and the browser signature. Basis: legitimate interest (f): we must be able to show what you saw and agreed to, because the law puts the burden of proof on us (art. 6:230n(4) Dutch Civil Code, BW).
  • Withdrawals: your name, your e-mail address, which contract you dissolve and the time of submission — also if you withdraw without an account. Basis: legal obligation (c): we must confirm receipt and refund (art. 6:230oa(4) BW and art. 6:230r(1) BW).
  • E-mails about your purchase and your withdrawal: the confirmation of the contract and of your withdrawal. For each sending we keep a log line: type of e-mail, time and whether sending succeeded — without the e-mail address and without the content. Basis: legal obligation (c; art. 6:230v(7) BW and art. 6:230oa(4) BW).
  • Problem reports: when you press “Report a problem”, we send a screenshot of the page as you saw it (it may show your nickname or your progress; password fields are left out), the page address (URL), the language, the window size and the browser signature, your comment if you add one, and your account if you are signed in. The screenshot is kept in protected storage at Supabase; only we can access it. Basis: legitimate interest (f): finding and fixing errors on the site.
  • Free-trial abuse prevention: a sha256 fingerprint of the e-mail address, not a readable address. Basis: legitimate interest (f): preventing someone from restarting the free trial again and again.
  • Technical data: IP address and browser data in our hosting’s server logs. Basis: legitimate interest (f): keeping the site secure and working and detecting abuse.
  • Active session: your account, the identifier of the session you are currently signed in with and a rough description of the device: only the browser family and operating system (for example «Safari · iOS»), not the full browser identifier. This lets us keep one active session per account and prevent an account from being passed on. We overwrite these data at every new sign-in. Basis: legitimate interest (f): keeping a personal account personal.

What is required. An account needs only an e-mail address: you enter it yourself, or it comes from Google or Apple if you sign in with them. When you sign up with an e-mail address we also ask for your birth year; if you sign in with Google or Apple, we ask for it afterwards in your account. Without a birth year you cannot pay, and we apply the strictest rules for minors: all optional processing is then off. Everything else is your choice.

No automated decisions. We take no decisions based solely on automated processing that have legal effects for you or affect you in a similarly significant way, and we do not profile you. The site does apply fixed rules to the birth year you entered yourself: under sixteen all optional processing is off, and paying is possible from eighteen.

Minors under sixteen

For users under sixteen we process no data on the basis of consent. Concretely: no analytics, no tracking cookies, no profiling and no marketing e-mail. This follows from Article 5 UAVG, which sets the GDPR age threshold in the Netherlands at sixteen.

Withdrawing consent

On the basis of consent we process only the visit statistics of Google Analytics 4 (see “Processors and other recipients” below). We ask for that consent in advance in the cookie banner; if you refuse, the script is not loaded. You can change or withdraw your choice at any moment via “Cookie settings” at the bottom of every page, as easily as you gave it. What happened before the withdrawal remains lawful.

Retention periods

  • Account, settings and progress: as long as the account exists.
  • Payment register and invoices: seven years, because Article 52 AWR requires it.
  • Consents: five years; we erase the IP address in them after twelve months.
  • Withdrawals: seven years, as proof that we received, confirmed and handled them in time.
  • E-mail log lines: twelve months.
  • Problem reports and their screenshots: ninety days.
  • Free-trial fingerprint: twenty-four months.
  • Active session: as long as the account exists; overwritten at every new sign-in and erased when you sign out.

Deleting your account. If you want your account deleted, send an e-mail to the address in Who we are. We then delete your account, your settings, your progress, your active session and your problem reports. What we must keep by law or as proof — the payment register, the consents, your withdrawals and the free-trial fingerprint — remains for the stated period, but under a pseudonym: without your name, without your e-mail address and, for the consents, without the IP address. A withdrawal you submitted without an account is kept with the name and e-mail address you entered in it.

Your rights

Access, rectification, erasure, restriction, portability and objection. Send a request to the e-mail address in Who we are. We answer within one month. If you disagree with how we handled it, or prefer not to raise it with us first, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Processors and other recipients

These parties process data on our behalf, each only for its own task:

  • Supabase — database, sign-in and storage of screenshots from problem reports, in an EU region.
  • Vercel — website hosting; the server functions run in Frankfurt, the network that delivers pages quickly is worldwide.
  • Our e-mail service — for the confirmation e-mails: depending on the configuration, an SMTP mail provider or Resend.
  • Google Ireland Limited (Google Analytics 4) — visit statistics, only after your consent in the cookie banner: which pages are visited, from what kind of device and via which source, and whether someone reaches the checkout page. Google Analytics 4 stores no IP addresses; advertising features and Google Signals are off; Google keeps the measurement data for us for at most fourteen months.

Mollie processes your payment on its own payment page. For that payment Mollie is itself responsible (an independent controller); its own privacy statement then applies.

Google and Apple receive something only if you sign in with them; see “Signing in with Google or Apple” above.

Statistics (Google Analytics 4) is on only after your explicit consent in the cookie banner; without consent the script is not loaded and Google places no cookies. Which party places which cookie is listed per cookie in the cookie statement.

Transfers outside the EU

Vercel, Google (only if you allow statistics) and, depending on the configuration, our e-mail service are companies from the United States or use servers outside the European Economic Area. Where that applies, the transfer takes place under the provider’s data processing agreement: with the European Commission’s standard contractual clauses (SCC) or under the EU-US Data Privacy Framework (DPF), if the provider participates in it.

Sources

Who we are

tknb Service

Wegkompas is a trade name of tknb Service.

KvK 97608378

BTW NL005279156B15

Address: on request by e-mail

E-mail: tknb.service@gmail.com

Last updated: