Privacy Policy

1. Who We Are

ExamKlaar (examklaar.nl) is an online platform that helps people prepare for the Dutch inburgering (civic integration) exam through practice exams and AI-generated feedback. ExamKlaar is based in the Netherlands and is the controller of the personal data described in this policy.

Contact: github.com/RashadAnsari/examklaar/issues. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

2. What Personal Data We Collect

• ✓Account data: Your name, email address and password when you register. Passwords are stored only in a form we cannot read.
• ✓Exam answers and results: Your answers, scores, feedback and exam history, so you can track your progress.
• ✓Speaking recordings: The audio you record in speaking exercises and a written transcript of it, which we use to give you feedback.
• ✓Usage data: Only if you accept analytics cookies: which pages you visit, how you arrived, your approximate location (city or country), and your device and browser type.
• ✓Technical logs: Your IP address, browser type and the time of each request, recorded by our servers.

You need to give us your name and email address to create an account, and your answers to receive feedback. Without them we cannot provide the service. Accepting analytics cookies is optional.

3. Why We Use Your Data and Our Legal Basis

We use your personal data only for the purposes below, each with its legal basis under the GDPR:

• ✓Providing the service (contract, Art. 6(1)(b)): Running your account, letting you take exams, giving you feedback, and sending emails the service needs, such as email confirmation and password reset.
• ✓Security (legitimate interest, Art. 6(1)(f)): Keeping technical logs to protect the platform against fraud, abuse and attacks. We have weighed this interest against your privacy and limit it to what is needed.
• ✓Legal obligations (Art. 6(1)(c)): Responding to lawful requests from authorities.
• ✓Consent (Art. 6(1)(a)): Analytics cookies, and marketing emails if we ever send them. Marketing emails are sent only to people who opt in and always contain an unsubscribe link. You can withdraw consent at any time, which does not affect processing that took place before.

4. AI Feedback

Feedback on writing and speaking answers is generated automatically by an AI model. It is practice feedback only: it has no legal effect on you, does not affect your official inburgering exam, and is not automated decision-making within the meaning of Article 22 GDPR. If you think feedback is wrong, you can contact us.

5. Who We Share Your Data With

We do not sell your personal data. We share it only with the service providers below. Those acting on our behalf (processors) may use it only on our instructions and under a data processing agreement.

• ✓Hetzner Online GmbH (Germany), processor: Hosts the platform. Your account data and exam results are stored in its data centres in the EU.
• ✓Cloudflare, Inc. (USA), processor: Stores speaking recordings and our backups in EU data centres, and delivers exam images, audio and video.
• ✓Google LLC (USA), processor, AI feedback: Generates feedback on your writing and speaking answers. We send only the exam question and your written answer or the transcript of your recording. We never send your name, email address or audio. Google does not use this content to train its models, and keeps it for a limited period only to detect misuse of its service. Please do not include personal details in your answers beyond what the question asks for.
• ✓Google LLC (USA), processor, Google Analytics: Measures how visitors use the website, only if you accept analytics cookies. We have turned off advertising and data-sharing features.
• ✓Brevo SAS (France), processor: Sends the emails the service needs. Brevo receives only your email address.

We share data with other parties only where the law requires it, for example under a court order.

6. Transfers Outside the EU

Some of these providers are based outside the European Economic Area. We transfer data to them only with a safeguard recognised by the GDPR:

• ✓Google (USA): The EU-US Data Privacy Framework, backed by the European Commission's adequacy decision, with Standard Contractual Clauses as an additional safeguard.
• ✓Cloudflare (USA): Standard Contractual Clauses, for any access from outside the EU to data stored in the EU.

You can ask us for more information about these safeguards by opening an issue at github.com/RashadAnsari/examklaar/issues.

7. How Long We Keep Your Data

• ✓Account data and exam results: As long as you have an account. We delete them within 30 days after you ask us to delete your account. Our backups are kept for 30 days, so copies in them are gone 30 days after that.
• ✓Speaking recordings: Deleted automatically 30 days after you record them, or sooner if you delete your account.
• ✓Technical logs: Up to 90 days.
• ✓Analytics data: Up to 14 months, after which Google Analytics deletes it automatically.

8. Your Rights

You have the rights below. To use them, open an issue at github.com/RashadAnsari/examklaar/issues. Do not put your email address or other personal data in the issue. We then contact you to confirm the request, and reply within one month. For complex requests we may need up to two more months, and if so we tell you within the first month.

• ✓Access: Get a copy of the personal data we hold about you.
• ✓Rectification: Have incorrect or incomplete data corrected.
• ✓Erasure: Have your data deleted, except where the law requires us to keep it.
• ✓Restriction: Have us limit how we use your data in certain situations.
• ✓Portability: Receive the data you gave us in a structured, machine-readable format.
• ✓Objection: Object to processing based on our legitimate interest. We then stop unless we have compelling grounds to continue.
• ✓Withdraw consent: Withdraw consent you gave at any time.

You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or to the data protection authority in the EU country where you live.

9. Cookies

When you first visit, we ask whether you accept analytics cookies. If you do not accept, none are placed.

• ✓Necessary: A cookie that keeps you signed in, and a record of your cookie choice stored in your browser. These are needed for the website to work and do not require consent.
• ✓Analytics (with consent): Google Analytics cookies that measure how the website is used. They are not used for advertising.

You can change or withdraw your choice at any time with the 'Cookie Preferences' link in the footer, or delete cookies in your browser settings. We do not use advertising or tracking cookies.

10. Security

We take appropriate technical and organisational measures to protect your personal data, as Article 32 GDPR requires. These include encryption in transit, storing passwords only in a form we cannot read, and limiting access to personal data to those who need it. If a data breach puts your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay.

11. Age

ExamKlaar is intended for adults. You must be 18 or older to create an account. If you believe someone under 18 has given us personal data, open an issue at github.com/RashadAnsari/examklaar/issues, without personal details, and we will delete it.

12. Changes to This Policy

We may update this policy. We will tell you about significant changes by email or with a notice on the platform before they take effect. The date at the top of this page shows the latest version.

13. Contact

Questions about this policy or your data? Open an issue at github.com/RashadAnsari/examklaar/issues. Do not put your email address or other personal data in the issue. We reply there and arrange the rest with you.

ExamKlaar, the Netherlands. Contact: github.com/RashadAnsari/examklaar/issues.