Legal · GDPR / AVG
Privacy Policy
Last updated: 25 February 2026 · Applicable law: GDPR (EU 2016/679) & Dutch AVG
RijExam respects your privacy and is committed to protecting your personal data. This policy explains what data we collect, how we use it, and what rights you have — in accordance with the General Data Protection Regulation (GDPR) and its Dutch implementation, the Algemene Verordening Gegevensbescherming (AVG).
1. Data Controller
The data controller responsible for your personal data is RijExam, registered in the Netherlands. For privacy-related questions, contact us at privacy@rijexam.nl.
2. Personal Data We Collect
| Data | Source | Purpose |
|---|---|---|
| Full name | Registration | Display in app, personalisation |
| Email address | Registration | Authentication, notifications |
| Password (hashed) | Registration | Account security — never stored in plain text |
| Selected licence & language | Profile setup | Personalise exam content |
| Exam attempts, scores, answers | App usage | Show your results, statistics |
| Subscription records | Purchase | Verify access rights |
| IP address, device & browser info | Automatic | Security, fraud prevention |
| Terms acceptance timestamp | Sign-up | Legal compliance record |
We do not collect sensitive personal data (special categories under GDPR Article 9) such as health data, biometric data, or political opinions.
3. Legal Basis for Processing (GDPR Article 6)
- Contract (Art. 6(1)(b)) — Creating your account, delivering the service, managing your subscription.
- Legitimate interest (Art. 6(1)(f)) — Platform security, fraud prevention, improving the service. We have assessed that our interests do not override your rights.
- Legal obligation (Art. 6(1)(c)) — Retaining financial records for Dutch fiscal law (Belastingdienst — 7-year requirement).
- Consent (Art. 6(1)(a)) — Marketing emails (if and when introduced). You may withdraw consent at any time.
4. Data Retention
- Account & profile data — retained until you delete your account or after 2 years of inactivity, whichever comes first.
- Exam attempts & results — deleted together with your account.
- Financial/payment records — retained for 7 years as required by Dutch fiscal law, even after account deletion.
- Server logs — up to 90 days for security purposes.
5. Third Parties & Data Processors
We use the following trusted third-party data processors:
- Supabase (database & authentication) — EU-region servers. A Data Processing Agreement (DPA) is in place.
- Payment processor (e.g. Stripe or Mollie) — processes payment data under their own GDPR-compliant terms. We do not store full payment card details.
- Email service provider — for transactional emails (password reset, receipts).
We never sell your personal data to third parties. We do not use your data for targeted advertising.
6. International Data Transfers
Your data is stored on Supabase servers located within the European Union. If any service provider processes data outside the EU/EEA, we ensure an adequate level of protection through Standard Contractual Clauses (SCCs) as approved by the European Commission.
7. Cookies
We use only functional/essential cookies — primarily authentication session cookies set by Supabase to keep you logged in. These are strictly necessary and do not require your consent under the Dutch Telecommunicatiewet.
We do not currently use analytics, advertising, or tracking cookies. If this changes, we will update this policy and implement a consent banner.
8. Your Rights (GDPR Articles 15–22)
As a data subject you have the following rights:
Right of Access (Art. 15)
Request a copy of all personal data we hold about you.
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data — via your Profile page.
Right to Erasure (Art. 17)
Delete your account and all data — via Profile → Security → Delete My Account.
Right to Restriction (Art. 18)
Ask us to limit processing of your data in certain circumstances.
Right to Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests.
To exercise any right (other than deletion, which you can do yourself), contact us at privacy@rijexam.nl. We will respond within 30 days as required by GDPR Article 12.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encrypted data storage, hashed passwords, HTTPS-only access, and role-based access controls. In the event of a data breach that affects your rights, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform affected users without undue delay.
10. Supervisory Authority
If you believe we are not handling your data in accordance with GDPR/AVG, you have the right to lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens (AP)
P.O. Box 93374, 2509 AJ The Hague, Netherlands
autoriteitpersoonsgegevens.nlWe encourage you to contact us first so we can resolve your concern directly.
11. Changes to This Policy
We may update this Privacy Policy. If changes are material, we will notify you by email at least 30 days in advance. The “Last updated” date at the top of this page always reflects the most recent version.
12. Contact
Privacy questions or requests: privacy@rijexam.nl