1. Who is responsible
EUpassway is an independent language-exam preparation service. The operator named below is the controller for your personal data under the General Data Protection Regulation (GDPR/AVG). EUpassway is not affiliated with DUO, the Goethe-Institut, telc or any other exam provider.
- Operator
- JRK Digital Media B.V.
- Address
- Johan de Wittlaan 7, 2517 JR Den Haag, Nederland
- Chamber of Commerce (KvK)
- 98096591
- Privacy contact
- info@jrkdm.com
2. What we process and why
We only process what is needed to run the learning service. For each category we state the purpose and the legal basis (GDPR Art. 6).
- Account — name, email address, a salted one-way password hash and your preferences (selected exams, exam dates, interface language, weekly study time, time zone). Purpose: providing your account. Basis: performance of the agreement with you.
- Learning activity — practice attempts and answers, mistake review, flashcard reviews, tasks and study plans, focus sessions, bookmarks and notes. Purpose: saving your progress and showing it back to you. Basis: performance of the agreement. Scores are for your own study only; no automated decisions with legal or similarly significant effects are made.
- Private files — PDF and image files you upload (max. 50 MB per account). They are visible only to you and are not scanned for malware, so please do not upload identity documents or other sensitive files. Basis: performance of the agreement.
- Shared notes — when you choose to share a note, a separate copy is reviewed by an editor and may be published without your email address. You can withdraw it at any time; deleting your account also removes it. Basis: your consent.
- Trying without an account — a random guest identifier (cookie) and your trial practice answers, kept for 90 days after your last practice or until you sign in and keep them. Basis: our legitimate interest in letting you try the service before registering.
- Exam reminders and page feedback — for exam reminders: your email address, the exam you chose, your language and the dates of your consent and of the reminders we sent. Purpose: emailing you before registration deadlines. Basis: your consent (double opt-in). Unconfirmed sign-ups are deleted after 7 days; unsubscribing (link in every email) deletes your data at once. Sent through Resend. For “Was this page useful?”: an anonymous count per page; if you write a comment, its text and the optional email address you give, kept as an enquiry like contact messages.
- First-week study emails — if you ask for them when you create an account (an unticked box) or in Settings: a welcome email with a 3-day plan and reminders on day 2, 4 and 7 (at most four), using your name, email address, chosen exam and exam date and your practice results. Purpose: helping you start studying. Basis: your consent; you can withdraw it at any time with the link in every email or in Settings, after which none are sent. We keep the date of your consent, a link token and which emails were sent, deleted with your account. Sent through Resend.
- Contact, reports and account recovery — your name, email address and message when you contact us, report a content problem or ask for account recovery. Purpose: answering you and verifying account ownership. Basis: your consent (contact form) and our legitimate interest (content quality, account security).
- Aggregated usage statistics — cookie-free counters per day, such as how often a card is opened, a book link or audio player is used, a practice is started or a search finds nothing (only such search terms are kept, after removing anything that looks like an email address, link or number). No cookie, IP address, device data or user identifier is stored with them, and they cannot be traced back to you. Basis: our legitimate interest in improving the content.
- Account active dates — to measure how many learners come back, we record the dates on which your account was used for learning and the study language (not what you did). Kept up to 400 days, deleted with your account. Basis: our legitimate interest in improving the service.
- Security data — your IP address is used briefly to limit abusive requests; only a one-way pseudonymised key is stored, and deleted within two days. Sign-in session tokens are stored only as hashes. Basis: our legitimate interest in protecting the service and your account.
4. Who receives your data
We do not sell your data and do not share it for advertising. The service and its encrypted backups are hosted by Google Cloud EMEA Limited (datacenter Eemshaven, Nederland) on servers in the European Economic Area, under a data processing agreement. We do not transfer your data outside the EEA.
Pronunciation uses the speech engine built into your own browser or operating system; its provider’s terms apply there. Links to videos, podcasts and official exam websites open those third-party sites, where their privacy policies apply.
Statistics (only with your consent): Google Ireland Ltd. processes visit data for Google Analytics 4 as our processor. IP addresses are not stored by GA4, Google signals and advertising features are off, and data is kept for up to 14 months. Google may process data in the United States under the EU–US Data Privacy Framework.
5. How long we keep data
- Account and learning data — until you delete your account. Deletion removes it from the live database immediately.
- Guest trial data and sessions — 90 days after the last practice, then deleted automatically.
- Contact messages, reports and recovery requests — 12 months, or earlier when you delete your account.
- Usage statistics — aggregated daily counters are kept as statistics; search terms without results 180 days; account active dates 400 days.
- Backups — encrypted backups are kept for 30 days. Data you deleted can remain in a backup until it expires; it is not restored into the live service except for disaster recovery.
6. Your rights
You have the right to access, correct, delete or restrict the processing of your data, to object to processing based on legitimate interest, to data portability, and to withdraw consent at any time. You can download all your account data as a file or delete your account yourself in Settings. For anything else, email the privacy contact above; we reply within one month.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
7. Security
Connections use HTTPS. Passwords are stored as salted scrypt hashes and session tokens only as hashes. Uploaded files are private and downloadable only by you. Backups are encrypted before leaving the server. Only authorised administrators can access the admin area.
8. Minimum age
EUpassway is intended for people aged 16 and over. If you are younger, a parent or guardian must agree to your use.
9. Changes
We will update this page when our processing changes and show the date at the top. Significant changes will be announced on the site before they take effect.