Privacy statement

• Your answers in a practice exam. To calculate and keep your result. They are linked to a random code in your browser, not to your name. Legal basis: performance of the service you use.
• Your e-mail address and your account, if you log in. An account is optional; you only pay if you buy full access. You log in with a link we send to your e-mail address (no password). We keep your e-mail address, when your account was created and when you last visited, and we link your practice exams to your account, including those you took in the same browser before logging in. That way the account page shows what you have done, your purchases and, with full access, your results and your score per topic. Of a login link we only keep a hashed code, and the link works once and for 30 minutes. To prevent abuse of the login form, we keep a hashed code of your IP address for one hour with each request, not the address itself. Legal basis: performance of the service you use; for the abuse protection, legitimate interest.
• Signing in with Google, if you choose to. You can also sign in with “Continue with Google”. Google then confirms who you are. We only ask Google for your e-mail address and only receive that address and whether Google has verified it; no name, photo, contacts or other data. With that address you sign in to the same account as with a login link. What Google itself processes when you sign in is described in Google’s privacy policy. Legal basis: performance of the service you use.
• Your e-mail address, if you pay. To give you access (through a login link), send you the payment confirmation and answer your questions. Legal basis: performance of the contract.
• One review request after your purchase. About a week after your payment we send you one e-mail asking whether you would write a review on Trustpilot. Every buyer gets the same e-mail, there is no reward, and we pass nothing about you to Trustpilot: the e-mail only contains a link to our public page there. If you write a review, you do so yourself on Trustpilot and their privacy policy applies. We keep when we sent the e-mail and, if you opt out, that you want no more review requests. You opt out with the link in the e-mail. Legal basis: legitimate interest (you are already a customer).
• Your e-mail address, if you sign up for the waitlist. As long as full access is not on sale yet, you can sign up for an e-mail as soon as it is. We then keep your e-mail address, the exam, the practice exam you just took (so we can send you back to your result), on which page and when you signed up, and which consent text you ticked. You first get an e-mail to confirm your sign-up. After that we send you one e-mail as soon as full access is on sale and at most one reminder, nothing else. Legal basis: your consent. You can always withdraw it with the unsubscribe link in every e-mail; we then delete your sign-up at once. To prevent misuse of the form, we keep a hashed code of your e-mail address and IP address for one hour with each sign-up, not the addresses themselves. Legal basis: legitimate interest.
• Your e-mail address, if you ask for a study plan by e-mail. After a practice exam you can ask us to e-mail you a study plan for that exam. We then keep your e-mail address, the exam, the practice exam you just took, the language, when you asked, which consent text you ticked and how many e-mails we have sent. You get at most 3 e-mails over 7 days, only about practising for that exam; the last one says what full access costs and gives. If you buy full access to that exam, the e-mails stop by themselves. Legal basis: your consent. You can always withdraw it with the unsubscribe link in every e-mail; we then delete your request at once. Against misuse of the form we keep, as with the waitlist, a hashed code of your e-mail address and IP address for one hour. Legal basis: legitimate interest.
• Your e-mail address, if you save your result. After you hand in a practice exam, you save your result to an account: with Google or with a link we e-mail you. We then keep your e-mail address and link the practice exam to your account, so you can find your result on any device. If you choose e-mail, we only send you that link. Legal basis: performance of the contract (your account).
• 20% off when you save your result. If you save your result (with Google or a link in your e-mail) or are already signed in, you get 20% off that result for 24 hours. For this we keep, with your practice exam attempt, your e-mail address, when the discount started and whether you used it. Legal basis: performing what you buy from us (article 6(1)(b) GDPR).
• Tips and offers, only if you tick the box. When you save your result, you can tick a separate box to let us e-mail you tips and offers now and then; that box is never ticked in advance. We then keep the exact wording you agreed to and when, and when we e-mailed you. If you have not bought anything for that exam about an hour later, we send you at most one e-mail with 50% off; after that no new discount e-mail for 30 days, also not for another exam. Legal basis: your consent (article 6(1)(a) GDPR and article 11.7 of the Dutch Telecommunications Act). You can withdraw it at any time with the unsubscribe link in every e-mail; after that we send you no more offers.
• Payment data. Your payment goes through Stripe. We do not see your bank or card details; we only receive the amount, the date and whether the payment succeeded. If you choose PayPal, you pay through PayPal: it receives the details of your payment for that and processes them under its own responsibility, under its privacy policy (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). Legal basis: performance of the contract and the statutory retention obligation.
• Usage statistics. To see how the site is used and where visitors drop off, we keep short events in our own database: a page visit (which public page, and from which page on this site you came), starting and handing in a practice exam (which practice exam, and through which explanation page if you came from there), the step to save your result (whether you continued with Google or e-mail and whether you ticked tips), viewing the payment page, a tap on a locked part of your result (only whether it was a question, a topic or your score), starting a payment, an error in the order form (only which field, never what you typed), a purchase (which product), a waitlist sign-up (from which page) and your answer to the statistics cookie question (shown, accepted or declined). They contain no name, e-mail address or IP address. A page visit and that cookie answer are not linked to anything. The other events carry the code of your practice exam attempt; if you buy full access, that attempt is linked to your e-mail address. With your first page visit we also note which link brought you here: the campaign codes in that link (utm), whether it carried a Google Ads click code (only yes or no) and the name of the website that referred you. That source goes with the start of your practice exam and any purchase, so we can see which channels work. We use no cookies for this and store nothing in your browser for it. Legal basis: legitimate interest.
• Visit statistics from Ahrefs. We also count visits with Ahrefs Web Analytics. It works without cookies and without storing anything in your browser, and Ahrefs keeps no IP addresses with the statistics. Ahrefs sees which page you view, which site or search engine you came from, your country and city (derived from your IP address), your browser, operating system, device type, screen size and language. We only see totals, no data per visitor. Legal basis: legitimate interest.
• Microsoft Clarity, only with your consent. If you click “Accept” for Microsoft Clarity in the notice at the bottom, we load Clarity. It shows us how visitors use the site, so we can improve it: which pages you view, where you click and how far you scroll, as a recording of your visit and in heatmaps, as well as your device type, browser, operating system, screen size and country (derived from your IP address). We don’t see what you type in a field: Clarity always hides input fields, including your e-mail address, and we hide your account page completely. Clarity links your page views with a random code in a cookie, not with your name; Microsoft may also set its own cookies on its domain (such as MUID). Microsoft Ireland Operations Ltd. is itself also responsible for this (see Microsoft’s privacy statement). Microsoft stores the data in its Azure cloud and may transfer it to Microsoft Corporation in the US under EU standard contractual clauses; Microsoft also takes part in the EU-U.S. Data Privacy Framework. Legal basis: your consent. If you choose “Decline”, we don’t load Clarity; you can change your choice with “Cookie settings” at the bottom of the site. If you withdraw your consent, Clarity erases its cookies.
• An error report about a question, if you send one. With “Report a mistake” under a question in your result you send us a message. We then keep which question (and which version) it is, your message, the code of your practice exam attempt and, only if you fill it in, your e-mail address to reply to you. We also send the report to our own e-mail address. To prevent abuse, we keep a hashed code of your IP address for one hour with each report, not the address itself. Legal basis: legitimate interest (correct questions); for your e-mail address your consent, which you withdraw by e-mailing us.
• Technical logs of the server (such as error messages), to investigate outages and misuse. Legal basis: legitimate interest.

We only set the Microsoft Clarity cookies (_clck, 1 year, and _clsk, 1 day) if you agree to them in the notice at the bottom (see above); your browser then remembers your choice. Our visit statistics (Ahrefs Web Analytics) work without cookies. Your browser keeps your answers during a practice exam (local storage) and a session code, so you can carry on after a broken connection and stay logged in (180 days, or until you log out). When you are logged in, a cookie also says only that you are logged in, so the header shows the account link. That is needed for the service to work; no consent is needed for it.

• Attempts without an account and without a purchase: at most 90 days.
• Your account (your e-mail address, your practice exams and your results): up to 24 months after your last visit, or until you delete it. This also applies after a purchase.
• Login links: one day after they expire. The hashed IP code with a login request: one hour.
• Payment and invoice data: 7 years, because tax law requires it.
• That we sent you the review request, and your opt-out if you gave one: as long as we keep your purchase or your account.
• Usage statistics: 12 months.
• Visit statistics at Ahrefs: according to the retention periods of Ahrefs. They contain no IP addresses.
• Recordings at Microsoft Clarity: 30 days; recordings we keep as a favourite, and a random sample that Microsoft keeps, up to 9 months.
• Your e-mail address with an error report about a question, if you leave it: 12 months after we have dealt with the report, or 12 months after the report if it has not been dealt with.
• Waitlist: a sign-up you do not confirm, within 7 days. We delete a confirmed sign-up after the e-mail that full access is on sale and any reminder, and in any case within 12 months after you signed up. If you unsubscribe, we delete your sign-up at once.
• Study plan by e-mail: 30 days after the last e-mail, or after the e-mails stopped because you bought or your address could not be reached. If you unsubscribe, we delete your request at once.
• Consent for tips and offers: as long as it applies. If you unsubscribe, we delete the consent within 30 days and only keep that you unsubscribed, so you get no more offers.
• The 20% discount and the discount e-mail (your address, your consent and what we sent): 12 months after you saved your result. If you unsubscribe, we delete them within 30 days.

We never sell your data. We use these service providers, with a data processing agreement:

• Vercel: hosting the website (EU region; Vercel is based in the US (EU standard contractual clauses)).
• Supabase: database with attempts, purchases, e-mail addresses and the usage statistics (Frankfurt (EU)).
• Stripe: handling payments (EU entity in Ireland).
• Resend: sending login links, payment confirmations, the waitlist e-mails and the study plan (EU region).
• Ahrefs: cookieless visit statistics (Ahrefs Web Analytics) (Ahrefs Pte. Ltd. in Singapore, storage also in the US (EU standard contractual clauses)).

You may access your data, have it corrected or deleted, object to processing based on legitimate interest, and request your data in a common format. E-mail info@examenzaal.nl for this; we respond within one month. Invoice data that we must keep by law can only be deleted after that period ends.

You delete your account yourself on your account page, under Instellingen (Settings). We then immediately delete your e-mail address, your practice exams and results, your login links, your waitlist signup and your e-mail address with error reports. If you bought something, we keep that purchase without your e-mail address until the 7-year legal retention period has passed; your access ends.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).