Privacy

Who we are

Vaarlicht is a service of Kurverscode, registered with the Dutch Chamber of Commerce (KvK) under number 42205205. Questions about your data go to info@kurverscode.com.

What we keep

• Your progress. Which lessons you did, which step you are on, your answers to the questions and your test results. Without an account we keep this with an anonymous guest; neither your name nor your e-mail address is attached to that guest.
• Your e-mail address, if you create an account or buy something. We use it to sign you in and to send you the confirmation of a purchase. We send no newsletter or advertising.
• Your purchase. The e-mail address you entered, the language, the time of the order, the sentence you ticked about the cooling-off period, Mollie's payment number, the payment status and until when you have access.
• Your IP address. Our server sees it with every request. We only use it to block too many requests from one address, and keep it in the server's working memory for that. We do not store it in the database, nor which browser or device you use. Shortened, it is also in the server's access log and in error messages (see how long we keep data).
• Counts. We count how often the offer on the home page comes into view and how often someone uses the example drawing there. That is only a number per day, without a cookie and without anything that leads back to you.

You enter your payment details, such as your account or card, at Mollie. They never reach us.

Why we may do this

• We need your progress, your e-mail address and your purchase to give you the lessons you use or bought (performance of the contract).
• We keep a paid order for seven years because the law requires it (legal obligation).
• We use your IP address to protect the site against misuse (legitimate interest).

Cookies and storage in your browser

We set no cookies for advertising or to track you. What we do use:

• a cookie that remembers your session, so your progress stays with you, also without an account;
• a cookie that remembers your chosen language;
• storage in your browser for a test you have not handed in yet, for a notice you closed and for the logo animation.

Who else processes your data

• Hetzner Online GmbH rents us the server that runs the site and the database, in a data centre in Germany, and the storage for the backups, in Finland.
• Zoho sends our e-mails, such as a sign-in link or the confirmation of your purchase, from a data centre in the EU. For that, Zoho receives your e-mail address and the text of the e-mail.
• Mollie B.V. handles the payment. Mollie receives the amount and our order number, and the details you enter on its payment page yourself.
• Grafana Labs watches for us whether the site runs properly, from a data centre in the EU. Grafana receives measurements from the server, such as processor and memory use and the number of requests per kind of response, and the app's error messages. We remove e-mail addresses and tokens from those messages before they leave. The access log and visitors' IP addresses do not go there. Grafana Labs is an American company.
• Cloudflare only runs the address book of our domain: which server belongs to vaarlicht.nl. Your visit to the site does not pass through Cloudflare, so Cloudflare sees no pages and nothing you enter.

We have a data processing agreement with Hetzner, Zoho, Mollie and Grafana Labs about how they handle your data.

How long we keep data

• A guest who did nothing for 30 days is deleted with all their progress.
• An order that was not paid is marked expired after a day. Once no guest or account belongs to it any more, we erase its e-mail address.
• If you delete your account on the account page, your account, your progress and your answers are removed.
• A paid order is kept for seven years after the year of payment, because Dutch tax rules require it. If you delete your account earlier, the order stays without your e-mail address.
• Every night we make an encrypted backup of the database. We keep a backup for 30 days, then delete it. The storage also makes a fixed daily copy that is kept for 10 days, so a backup exists for at most 40 days. On top of that, Hetzner makes a daily copy of the whole server, which is kept for 7 days. Data you have deleted can therefore remain in a backup for that long. We only use backups to restore the site after an outage.
• Our server keeps an access log: which page was requested, when, and from which IP address, without its last part. We use it to trace outages and misuse, and keep it for at most 14 days. We remove the key you return with after paying, one-time codes from links and which browser you use. Error messages from the server contain the same shortened IP address. They are kept in log files of a fixed size, and the oldest messages are overwritten when those are full.
• Grafana keeps the measurements and the app's error messages for 14 days.

Your rights

You may ask which data we hold about you, and have it corrected or deleted. You may also ask us to restrict its use, object to the use of your IP address against misuse, and request your data in a file you can take with you. E-mail info@kurverscode.com. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority.