Privacy statement

1. Who

Stephen Adei, trading as Stephen's Privélessen (sole proprietorship), KvK 88195910, VAT NL004558497B41, Hendrik Hosstraat 20, 1106 ZN Amsterdam, is the controller for the processing of personal data via the website, the contact and sign-up forms, WhatsApp, the portal and the app. Questions: [email protected].

2. Which data

• Name of the student and any parent(s): for identification and correspondence.
• Data from the contact and sign-up forms and WhatsApp: age, subject and level, learning goals, preferred days and the contact details of the student and parent/guardian. Do not put medical data in free text.
• Phone number and email (optional): for lesson notifications and cancellation confirmations.
• PIN code: stored encrypted (bcrypt); the original is never kept.
• Lesson history (date, status, any cancellation): for package administration and the cancellation terms.
• Package hours and balance: administratively necessary.
• Cancellation history: only to apply the agreed cancellation terms.
• Push tokens (only if you have enabled notifications in the app): to send notifications.
• Device info (only the userAgent string): for debugging.

3. Why

Processing is based on the performance of the tutoring agreement (GDPR art. 6(1)(b)) between Stephen's Privélessen and the student (or their parent/guardian). Specific notification preferences are based on consent, which you can withdraw at any time by emailing us.

4. Who we share with

Only with the processors and recipients listed below, as far as necessary:

• The tutor who teaches your lessons (Stephen Adei or a student tutor engaged by Stephen's Privélessen): only first name, level, learning goals and lesson notes. A student tutor does not see parents' contact details or payment details.
• Hosting provider (own VPS in an EU data centre): to run the portal.
• Google Workspace (email, EU/US): our mailbox and the emails sent when signing the agreement digitally.
• Google Calendar and Meet: appointments and online lessons.
• Cloudflare (DNS and proxy for our websites, and email sending; EU/US): email address and message.
• Meta (WhatsApp Business Platform): messages you send us on WhatsApp, and our replies, go through Meta.
• Anthropic (tool for preparing replies, US): the text of your WhatsApp message and the last few messages, with names replaced. Every reply is checked and sent by a person; no automated decision-making takes place.
• Telegram and Matrix: internal notifications to Stephen about sign-ups and lessons, including name, contact details and learning goals.
• Documenso (self-hosted): signing the agreement digitally.
• Tikkie / ABN AMRO: payments.
• Apple/Google (push notification infrastructure): only an anonymous device token, no personal data.

There are no advertising partners and no tracking software is embedded. Our web server keeps a technical log file (requested page, time, referring website and browser type, without IP address). We keep it for at most 7 days and use it only to count anonymised, total visitor numbers per week (legitimate interest). We also use Cloudflare Web Analytics: cookieless, aggregated visitor statistics without profiles or cookies. No data is stored on or read from your device, except the functional language cookie.

5. How long

Data covered by the statutory tax retention duty (lessons, packages, payments, invoices) is kept for 7 years. Other personal data, such as learning goals, notes and push tokens, is deleted when the tutoring agreement has ended and there is no outstanding administration. Sign-ups that never become a student are deleted after 12 months.

6. Your rights (GDPR)

You have the right of access, rectification, erasure, restriction, data portability and objection. Email [email protected] with your request. We respond within one month. To prevent data from reaching the wrong person, we first ask you to confirm your identity; for a minor student the parent/guardian can make the request. For an erasure request we delete everything except the data we must keep for 7 years (see 5); that data is kept and deleted afterwards.

Complaint? You have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

7. Minors

For a student under 18, a parent/guardian signs the agreement and also receives this statement. For a student under 16, the parent/guardian also gives consent for processing that is not necessary for the agreement, such as push notifications. The parent is registered as account owner; the student can optionally get their own read-only PIN after the parent's explicit consent.

8. Cookies

Functional cookies only: NEXT_LOCALE (your language preference) and portaal_session (logging in to the portal, 7 days). No tracking or analytics cookies, no third-party cookies. That is why we do not ask for cookie consent.

9. Changes

Changes are published on the portal. Material changes are also communicated via the known notification channels (email and/or in-app).