Privacy policy
Draft – pending legal review. This text is a draft (version 0.2) and has not yet been reviewed by a lawyer. It must not be used as the final version before that review.
1. Who we are
TheorieWin (theoriewin.com) is an online study platform for the Dutch CBR driving-theory exam. The controller responsible for your personal data is:
- [NOMBRE LEGAL]
- [DIRECCIÓN], the Netherlands
- Chamber of Commerce (KvK) number: [NÚMERO KvK]
- Email: [EMAIL DE CONTACTO]
For anything related to privacy, you can also email privacy@theoriewin.com.
TheorieWin is independent and is not affiliated with the CBR (Centraal Bureau Rijvaardigheidsbewijzen).
This policy follows the EU General Data Protection Regulation (GDPR, in Dutch: AVG) and the Dutch law that supplements it (UAVG).
2. In short
- We only process the data we need to run your account and your study plan.
- We do not sell your data, we do not show ads and we do not use tracking or analytics cookies.
- You can download your data and delete your account yourself at any time on your account page.
- You must be at least 16 years old to create an account.
3. What data we process
Account
- Email address
- Name (to greet you and show your initials in the menu)
- Password hash: your password is stored only as a hash (Argon2id). We never see your password.
- Whether your email address has been verified
- Preferred language
- Date your account was created
You can also sign in with a one-time link (“magic link”) that we send to your email address.
Personal details
- Year of birth (required): to check that you meet the minimum age and to set the pace of your plan. We keep only the year, never the full date.
- Nationality (optional): helps us decide which languages to add explanations in. We use it only in anonymous, aggregated statistics, never to treat you differently.
- Phone number (optional): only to contact you when you ask us for help. Never for advertising, and we never share it.
You can change these details in “My profile” at any time, and remove your nationality and phone number with one button. They are stored separately from your learning data.
App preferences
Whether you want a sound on a right answer, whether you prefer fewer animations, the intensity of your plan and whether you want email reminders (and at what time).
Study profile (all fields optional)
- Planned exam date
- Exam language and version (Dutch, English, with interpreter, extra time)
- Daily study goal in minutes
- Results of the initial diagnostic test
Learning data
- Each answer you give: question ID, right or wrong, whether you marked it as “unsure”, time taken and study mode
- Your spaced-repetition schedule for each question
- Mock exam results
- Your best streak of right answers in a row while practising (your personal record)
- Optional: the result of your real CBR exam, if you choose to report it. We use it only to calculate the platform’s pass rate as anonymised, aggregated statistics.
Sessions and security
- A session cookie that keeps you signed in (see our cookie policy).
- Session records with an expiry date and your browser type (user agent, shortened), so you can see and end your active sessions.
- We do not store IP addresses with your account. To prevent abuse, failed sign-in attempts are logged with a salted hash of the email address and of the IP address.
- Our server’s technical logs do not contain your IP address or your email address.
- When your browser blocks something because of our security rules (Content Security Policy), it sends us a technical report: the page, the blocked resource and the browser type. It does not contain your IP address or your account data.
Acceptance records
Which version of the terms of use and of this privacy policy you accepted, and when.
Emails
We only send transactional emails: email address verification, magic links, password reset, security notices, inactive-account warnings and confirmation that your account was deleted. We do not send marketing emails. If we ever want to, we will first ask for your separate permission (opt-in). If you turn them on in the app, we also send study reminders: at most one a day, only on days you have not studied yet, and you turn them off with one click from the email itself.
Messages you send us
If you write to us (for example to support@, privacy@ or security@theoriewin.com), we keep your message, your email address and our reply so we can help you.
Data on your device
The app keeps a copy of your progress in your browser so it can work offline. The details are in our cookie policy.
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account, signing in | Account data, session data | Performance of a contract (art. 6(1)(b) GDPR) |
| Checking the minimum age and setting the pace of your plan | Year of birth | Performance of a contract (art. 6(1)(b) GDPR) |
| Deciding which languages to add explanations in (anonymous statistics only) | Nationality (optional) | Consent (art. 6(1)(a) GDPR): you give it by filling in the field and withdraw it by removing it |
| Contacting you when you ask us for help | Phone number (optional) | Consent (art. 6(1)(a) GDPR): you give it by filling in the field and withdraw it by removing it |
| Providing the study service: personalised practice, repetition schedule, mock exams, progress | Study profile, learning data, preferences | Performance of a contract (art. 6(1)(b) GDPR) |
| Sending transactional emails | Email address, language | Performance of a contract (art. 6(1)(b) GDPR) |
| Sending study reminders | Email address, chosen time, activity that day | Consent (art. 6(1)(a) GDPR): you turn them on and off yourself |
| Answering your messages | Email address, content of the message | Performance of a contract (art. 6(1)(b) GDPR) or legitimate interest in handling questions (art. 6(1)(f) GDPR) |
| Security and abuse prevention (failed sign-in attempts, bot protection, session management, browser security reports) | Hashes of the email address and IP address, session data, technical data | Legitimate interest in keeping the platform and your account safe (art. 6(1)(f) GDPR) |
| Aggregated pass-rate statistics | Self-reported exam result (anonymised) | Legitimate interest in understanding and improving the platform (art. 6(1)(f) GDPR) |
| Proving which terms you accepted, and meeting legal obligations | Acceptance records, other data where the law requires it | Legitimate interest (art. 6(1)(f) GDPR) and, where applicable, legal obligation (art. 6(1)(c) GDPR) |
Where we rely on legitimate interest, you have the right to object (see section 9). Where we rely on your consent, you can withdraw it at any time; this does not affect processing that took place before.
We do not take decisions based solely on automated processing that have legal or similarly significant effects for you. The order in which practice questions are shown is adapted to your answers; this only affects your practice.
Payments are not active. If we introduce paid features in the future, we will update this policy before they start.
5. Who receives your data
We do not sell personal data. We use the following service providers (processors). They may only process data on our instructions.
| Provider | What for | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | DNS, content delivery network (CDN) and hosting of the website (Cloudflare Workers), including the videos; bot protection on the sign-in forms (Turnstile); forwarding of the emails you send us (Email Routing); and a secure tunnel to our server. All traffic between your browser and our server passes through Cloudflare’s network, so Cloudflare processes technical data such as your IP address. | United States and worldwide network; EU-US Data Privacy Framework and Standard Contractual Clauses |
| Brevo (Sendinblue SAS) | Sending transactional emails and reminders | France (EU) |
| Google (Gmail) | Mailbox where we receive and answer the emails you send us | Google Ireland Ltd. and Google LLC (United States); EU-US Data Privacy Framework and Standard Contractual Clauses |
| Have I Been Pwned (Pwned Passwords) | Checking whether a new password appears in known data breaches. Only the first 5 characters of a hash of the password are sent (k-anonymity): neither your password nor your email ever leaves our server. | International service; receives no personal data |
Our application server and database run on hardware that we operate ourselves in the Netherlands. Backups are encrypted on that server and kept there and on a second computer of ours, also in the Netherlands.
We may also share data when the law requires it, for example after a binding order from a competent authority.
6. Transfers outside the European Economic Area
Cloudflare and Google may process data in the United States and in other countries outside the EEA. Both companies are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of July 2023), and we have also signed the European Commission’s Standard Contractual Clauses with them. Our database and Brevo are in the EU.
7. How long we keep your data
| Data | Period |
|---|---|
| Account, profile, preferences and learning data | Until you delete your account |
| Nationality and phone number | Until you remove them in your profile or delete your account |
| Inactive accounts | Deleted after 24 months without activity; we warn you by email 30 days before |
| Sessions | Expire after 30 days at most |
| One-time links (verification, sign-in, reset) | Expire within minutes or hours; deleted afterwards |
| Security logs (failed sign-in attempts) | 30 days |
| Browser security reports | 30 days |
| Server technical logs | Overwritten automatically once they reach 30 MB; they contain no IP address, email address or account data |
| Backups | Rotated and expire after 30 days: data you delete disappears from them within that period |
| Acceptance records | As long as your account exists, plus 1 year, only to prove what you accepted and when |
| Messages you send us | 12 months after your question is closed |
| Data on your device | Until you sign out, delete your account or clear your browser data |
Anonymised, aggregated statistics no longer identify you and are not personal data.
8. Security
We protect your data with technical and organisational measures, such as hashing passwords with Argon2id, storing only salted hashes in security logs, encrypted connections (HTTPS), encrypted backups and server access limited to cryptographic keys.
9. Your rights
You have the right to:
- Access your data.
- Export your data (portability): download it as a JSON file on your account page.
- Rectification of incorrect data: you can change most of it yourself in “My profile”.
- Erasure of your data: use the “Delete account” button on your account page. We ask you to have signed in recently, so nobody with an old session can delete it. Deletion is immediate in our database and in your browser (for backups, see section 7).
- Restriction of processing.
- Objection to processing based on legitimate interest.
- Withdrawing your consent at any time: remove your nationality or phone number, or turn off reminders.
How to exercise them: use the options on your account page or email privacy@theoriewin.com from your account’s email address. We answer within one month (extendable by two more months in complex cases; we will tell you if so). We may ask you to confirm your identity first. It is free.
Complaint: you have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag), or with the authority of the EU country where you live. We would appreciate it if you contacted us first, so we can try to solve the problem.
10. Under 16s
In the Netherlands, a person under 16 needs permission from their parents or guardians for a platform like ours to process their data (Art. 8 GDPR and Art. 5 UAVG). TheorieWin does not offer accounts to people under 16 and does not collect that permission:
- When you create an account, you must confirm that you are 16 or older and enter your year of birth. If the year shows that you are under 16, the account is not created.
- If we learn that someone under 16 has created an account, we will delete it.
- If you are a parent or guardian and believe your child under 16 has an account, email privacy@theoriewin.com and we will delete it.
You can try 5 questions without an account; that trial does not store any personal data.
11. Changes to this policy
We may update this policy, for example when we add a new feature or provider. The version and date of the last update are shown at the top. We will announce important changes by email or in the app before they take effect.
12. Contact
Questions about privacy? Email privacy@theoriewin.com or write to [NOMBRE LEGAL], [DIRECCIÓN], [EMAIL DE CONTACTO].