Privacy Policy

Last updated: 7 June 2025 — version 1.0

KieSchool.nl is committed to protecting your personal data. This privacy policy explains what data we process, the legal basis for doing so, how long we retain it, and the rights you have as a data subject under the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.

1. Data Controller

The data controller within the meaning of the GDPR is:

KieSchool.nl
71-75 Shelton Street, Covent Garden
London, WC2H 9JQ
United Kingdom
E-mail: [email protected]

For questions about this policy or to exercise your rights, contact us at the email address above or via the contact form.

2. What data do we process and why?

2.1 Account data (Google login)

When you sign in with your Google account we process:

Name (display name from your Google profile)
Email address
Google profile ID (unique identifier)
Profile photo URL (optional)

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — an account is required to save and revisit reports.
Retention: until you delete your account, or within 30 days of a deletion request.

2.2 Purchase data

When you purchase a comparison report we process:

Payment session ID (Stripe)
BRIN codes of the selected schools
Purchase amount and timestamp
Payment status

Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) — Dutch bookkeeping law requires us to retain invoice data for 7 years.
Retention: 7 years after the financial year of the transaction. After this period your purchases are anonymised.

2.3 Reviews and comments

When you post a school review we process the text of your message and the timestamp, linked to your account.

Legal basis: legitimate interest (Art. 6(1)(f)) — publishing user experiences increases the information value for other parents.
Retention: until you delete your account or on your own request.

2.4 Technical data

Our web server retains standard server logs, including IP address, request timestamp and user-agent string. This is necessary for security and error diagnostics.

Legal basis: legitimate interest (Art. 6(1)(f)) — security and availability of the service.
Retention: maximum 90 days, then automatically deleted.

3. Cookies

KieSchool.nl uses only strictly necessary cookies for which no consent is required:

Cookie	Purpose	Retention
session	Login session (Flask)	Session / remember-me: 30 days
lang	Language preference (NL/EN)	1 year
compare_*	School comparison selection (temporary)	Session

We do not place analytics, advertising or social-media tracking cookies.

4. Recipients of your data

We share your personal data only with the following categories of processors, under data processing agreements:

Google Ireland Ltd — authentication service (OAuth 2.0)
Stripe Inc — payment processing
MailerSend — transactional email (confirmations, reports)

We do not sell your data or share it with third parties for marketing purposes.

5. Transfers outside the EEA

Google and Stripe are based in the United States. The transfer of your personal data to these parties is based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. You can request a copy of the SCCs via [email protected].

6. Your rights as a data subject

Under the GDPR you have the following rights, which you can exercise via [email protected] or the contact form. We respond within 30 days.

Right of access (Art. 15)

You can request details of what personal data we hold about you.

Right to rectification (Art. 16)

You can have inaccurate or incomplete data corrected.

Right to erasure / right to be forgotten (Art. 17)

You can request that we delete your personal data, unless we have a legal obligation to retain it. Account data and reviews are deleted immediately; purchase records are anonymised and retained for the statutory bookkeeping period.

Right to restriction of processing (Art. 18)

You can ask us to temporarily restrict processing of your data.

Right to data portability (Art. 20)

You can request a copy of your data in a machine-readable format (JSON).

Right to object (Art. 21)

You can object to processing based on legitimate interest.

Right not to be subject to automated decision-making (Art. 22)

KieSchool.nl does not take automated decisions with legal effects about individual users.

Delete your account and data

Log in and go to your account settings, or send a request to [email protected]. Please include your email address in the request.

7. Lodging a complaint

If you believe we are processing your personal data in breach of the GDPR, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
P.O. Box 93374, 2509 AJ The Hague, Netherlands
www.autoriteitpersoonsgegevens.nl

8. Security

We secure your personal data with appropriate technical and organisational measures, including encrypted connections (TLS), hashed authentication tokens and restricted access to production systems.

9. Changes

This policy may be updated. The date at the top of the page indicates the most recent version. We will notify you of material changes by email or via a notice on the website.