Privacy & cookie policy

This policy explains what personal data Slaagkans collects when you use slaagkans.nl, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR). The exam content you read stays in Dutch; this policy is provided in English (a Dutch version follows).

1. Who we are

Slaagkans (“we”, “us”) provides practice exams for the Dutch integration and NT2 state exams. We are the data controller for the personal data described here.

Slaagkans is operated by Anjaneai Srivastava Enterprise, established in Poland and registered under REGON 529478657. Full identity and registration details: Anjaneai Srivastava Enterprise · ul. Nowy Świat 40/3, 50-135 Wrocław, Poland · REGON 529478657 · NIP 8971941904 · VAT PL8971941904. Contact: contact@slaagkans.nl.

We are established in Poland and offer this service cross-border to users in the Netherlands and elsewhere in the EU. That does not reduce your rights: the GDPR applies in full wherever you live in the EU.

2. What data we collect

• Account data— your email address, a password (stored only as a salted hash, never in plain text), your first and last name, date of birth, nationality, and the exam you’re preparing for. If you sign in with Google, Facebook, Instagram or X, we receive the basic profile that provider shares (typically name and email).
  Why date of birth and nationality: the exams have a minimum age, and which exam applies to you (the Basisexamen taken abroad, the inburgeringsexamen, or the Staatsexamen NT2) depends on your nationality — EU/EEA and Swiss nationals are generally not subject to the integration requirement. We use them to show you the right exam and nothing else, and we do not use them to profile you.
• Practice data — your mock attempts and scores per part, and a daily counter of how many AI-feedback requests you make (to protect a fair-use limit). For each question in an attempt we also keep the answer you gave, the answer that was correct, and the answer options you were shown, so that any score we report can be checked and explained afterwards.
• Answers you submit for AI feedback — the writing text or spoken answer (and its transcript) you choose to have graded.
• Payment data — handled by our payment provider (Stripe). We receive confirmation of a successful payment and store your access entitlement and the payment reference; we never see or store your full card details.
• Technical data — standard server/hosting logs (e.g. IP address, browser type, timestamps) needed to run and secure the service.
• How you found us — for each visit we keep the date, the page you landed on, the website that linked you, any campaign tag on the link, and whether you were on a phone or a computer. Alongside it we store a code that is generated fresh every day and cannot be traced back to you: it is derived from your IP address and browser string, it is never sent to your browser, it is never stored next to your email, and it stops matching you at midnight — so this record can tell us how many people arrived from a search engine, and can never follow one person from one day to the next. We place no cookie for it and we do not store the IP address itself.
• Email you give us on the free sample — if you answer free questions on the home page and tick the box asking us to email you your result, we store that email address, the exam you tried, your score on those questions, your language, and the moment you gave consent. This is separate from an account: no password, no profile. Every email we send on this basis carries a one-click unsubscribe link that needs no login.

3. How we use it, and the legal basis

• To provide your account and the practice exams — basis: performance of our contract with you.
• To be able to prove and correct a score — basis: contract, and our legitimate interest in the results we publish being accurate. Keeping each question’s answer alongside the correct one is what lets us re-check a result if you query it, and lets us find and correct a marking error instead of asking you to take our word for it.
• To grade your writing and speaking with AI — basis: contract; the answer is used only to produce your feedback (see §4).
• To take payment and give access — basis: contract; keeping invoices/records — basis: legal obligation (tax law).
• To keep the service secure and prevent abuse (rate limits, fraud, debugging) — basis: our legitimate interest.
• Optional analytics and advertising measurement — basis: your consent (see §8, Cookies). We measure which pages and which adverts lead to sign-ups and purchases, so we can tell whether advertising is worth paying for. We do not build advertising profiles about you, we have turned off personalised advertising, and we never sell your data.

4. AI feedback

When you ask for feedback, the answer you submit is sent to our AI provider (Cloudflare Workers AI) to generate the feedback and, for speaking, to transcribe your audio. It is used only to produce your result. We do not use your answers to train AI models. AI feedback is a study aid — it is not an official grade.

5. Who we share data with

We do not sell your data. We use a small number of processors that handle data on our behalf:

• Cloudflare — hosting, database, and the AI that grades your answers.
• Stripe — payment processing.
• Resend — sending the account-verification email, and the result email you can request from the free sample.
• Sign-in providers (Google, Meta, X) — only if you choose social sign-in.

Each processor acts under a data-processing agreement and may only use the data to provide its service to us.

6. International transfers

Some of our processors are established in, or process data from, the United States— in particular Cloudflare (hosting, database and AI) and Stripe (payments). Where personal data is transferred outside the European Economic Area, the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified) or by the European Commission’s Standard Contractual Clauses, together with the additional safeguards in our agreements with them.

7. How long we keep it

• Account and practice data — for as long as your account exists; deleted on request or after prolonged inactivity.
• The per-question record of your attempts (your answer, the correct answer, the options shown) — kept for as long as your account exists, and not deleted on a rolling schedule the way our technical logs are: a result we have reported to you should stay checkable for as long as you might ask about it. It is deleted with the rest of your data when you ask us to erase your account (see §9).
• Answers submitted for AI feedback — kept only as needed to return your result and are not retained long-term.
• Payment and invoice records — retained as required by Dutch tax law (up to 7 years).
• The visit record described in §2 — 400 days, so that a month can be compared with the same month a year earlier. It holds no name, no email and no IP address.

8. Cookies

We keep cookies to a minimum. We use:

Both optional items are measurement, not profiling.With your consent we load Cloudflare Web Analytics — aggregated page-view statistics with no cookies, no fingerprinting and no cross-site tracking — and Google Analytics 4 with Google Ads conversion measurement, which does set the cookies listed above. We use Google’s Consent Mode: before you choose, every storage type is set to “denied”, so no analytics or advertising cookie is placed until you accept. IP addresses are anonymised, we have disabled personalised advertising, and we do not sell your data or build advertising profiles about you. Everything else in the table is essential, and neither analytics tool stores anything on your device if you choose “Essential only”.

Google Analytics is operated by Google Ireland Limited, with data transfers to the United States covered by the EU–US Data Privacy Framework and Google’s standard contractual clauses (see §7). You can opt out at any time via Cookie settings, or with Google’s own browser add-on.

You can change your choice at any time via Cookie settings in the footer. During payment, Stripe may set its own cookies on its checkout page under its own policy.

9. Your rights

Under the GDPR you can ask us to:

• access a copy of your data, or correct it;
• delete your data (“right to be forgotten”) or restrict how we use it;
• receive your data in a portable format;
• object to processing based on legitimate interest, and withdraw consent at any time.

Email contact@slaagkans.nl to exercise any of these.

You also have the right to complain to a data-protection supervisory authority. Because we are established in Poland, our lead supervisory authority is the Polish Urząd Ochrony Danych Osobowych (UODO). You may always complain instead to the authority where you live or work — for users in the Netherlands that is the Autoriteit Persoonsgegevens.

We have not appointed a Data Protection Officer: we do not carry out large-scale monitoring or process special categories of data on a large scale, so the GDPR does not require one. Privacy questions go to the contact address above and are handled by us directly.

10. Security

Passwords are stored only as salted hashes, data is encrypted in transit (HTTPS), and access is limited to what is needed to run the service. No system is perfectly secure, but we take reasonable measures to protect your data.

11. Children

Slaagkans is intended for people aged 16 and over; you must be at least 16 to create an account.

12. Changes to this policy

We may update this policy as the service evolves. We’ll change the “last updated” date above and, for significant changes, tell you in the app.

Questions? Email contact@slaagkans.nl.