Privacy policy

Draft: this text has not yet been reviewed by a lawyer.

Privacy policy of Enjoylingua

When you use our platform, you trust us with your data. This policy explains what data we keep, why, who we share it with, how long we keep it and what you can do yourself: view, download, change, unsubscribe and delete.

1. Who we are

Enjoylingua is a trading name of Oxido Media B.V., which is responsible (the "controller") for what happens to your data on this platform.

This policy applies to enjoylingua.com, enjoydutch.com and leuknederlandsleren.nl.

Our other websites. The same company also runs websites in Dutch (Leuk talen leren and its language sites) and in Spanish (aprendemosingles.com, palabraseningles.es). They run on the same platform. If you create an account on two of our websites with the same email address, it is one account. What only happens on the Spanish websites (a community and a word of the day by email) is described in the Spanish privacy policy. Leuk Spaans leren (leukspaansleren.nl) belongs to the same company but is a separate platform with its own database and privacy policy. We do not exchange data between Leuk Spaans leren and this platform.

We do not have a data protection officer; a company of our size is not required to. You can contact us with any question about your data at [email protected] or through the contact page.

2. In short

• We use your data to let you learn, to handle your orders and to send you the emails that come with your account.
• We do not sell your data. We use no advertising or tracking cookies, no analytics services from other companies, and we do not measure how you use the site ourselves.
• We do not track whether you open our emails or click a link.
• You can download all your data and delete your account yourself, under Account. Only your orders and invoices remain, without your name and email address, because tax law requires it.
• You can unsubscribe from encouragement and offers with the link at the bottom of every email or on the Email preferences page.
• If you have a complaint, you can come to us, and to the data protection authority.

3. What data we use and why

For each part, this section says what we keep, why, and on which legal basis under the GDPR. How long we keep it is in section 5.

3.1 Your account

What: your first name, your email address and a password. We only store your password encrypted (as a "hash"); we cannot read it. Under Account you can also add your surname and a profile photo; both are optional. Of a photo we keep a newly drawn copy of 300 by 300 pixels, without the extra information in the original, such as where it was taken. We record when you created your account, when you last logged in and when you were last active.

When you create an account, we send you a link to confirm your email address. If you later change your email address, we send a link to the new address; it only changes once you click it. Your old address gets an email saying it was changed, with a link to undo this if it was not you.

Why: to give you an account, let you log in and give you access to what you bought. We use when you were last active to help you if you get stuck, or to give you a nudge if you have been away for a while.

Legal basis: the contract with you (Article 6(1)(b) GDPR). For recording when you were last active: our legitimate interest in helping you (6(1)(f)).

3.2 Your progress

What: which lessons you did, which exercises you did and whether your answer was right or wrong, your best score per set of questions, your streak (how many days in a row you studied), your points and badges, each with the time. For each exercise we also keep your most recent answer, so that it is still there when you come back. A new answer replaces the old one. "Start again" clears them.

Your answers are linked to your account. Other members cannot see them, and we do not use them for anything else. If you are not logged in, we keep nothing: your answers then stay in your own browser only (see 3.8).

Why: so you can continue where you left off and see your progress.

Legal basis: the contract with you (6(1)(b)).

3.3 Buying and paying

What: when you buy something, we keep an order with a number, the date, what you bought, the amount and the VAT, your name and email address, and the payment status. We also record what you ticked about your right of withdrawal: the time, the exact wording and the version of the terms and conditions. Once the payment has gone through, we create an invoice.

The country where you live. We charge the VAT of the EU country where you live, and VAT rules require us to record that country with evidence. That is why we keep, with your order, the country you give us, your IP address and the language setting of your browser.

If you order without an account, we ask for your name and email address. After payment we create an account for you at that address, or add your purchase to the existing account.

You pay through our payment provider Mollie. We send Mollie the amount, a description and our order number, not your name or email address. You enter your payment details at Mollie, not with us. Mollie tells us the payment status; this may include the payer's name and account number.

Why: to carry out your order, give you access, send you a confirmation and an invoice, charge the right VAT, and because tax law requires it.

Legal basis: the contract with you (6(1)(b)) and a legal obligation (6(1)(c)): VAT rules and the obligation to keep tax records.

3.4 Email

We send you three kinds of email:

You can unsubscribe with the link at the bottom of the email, without logging in, or on the Email preferences page. It takes effect immediately.

We keep a record of which emails we sent you, when and why, so we can answer "why did I get this?". Our email provider Postmark tells us for each email whether it was delivered, whether it bounced because your address does not work, whether you marked it as spam and whether you unsubscribed. We keep that with the email. If an email bounced because your address does not exist, we only send you emails you ask for after that. If you mark an email as spam or unsubscribe, we stop sending you encouragement and offers. To remember this, even after your account is gone, we keep your address only as an unreadable code.

We do not track whether you open an email or which link you click. Our emails contain no invisible image, and the links go straight to our website.

Legal basis: for emails about your account and purchases, the contract (6(1)(b)). For encouragement and offers to customers, our legitimate interest (6(1)(f)), with the option to unsubscribe in every email. If you have not bought a course, we only send you offers if you said yes to them (6(1)(a)).

3.5 Searching the lessons

What: when you use the search box while logged in, we keep what you type, when, how many results it gave and what you clicked. This is linked to your account.

Why: so we can see which lessons are missing or are called something different from what you search for, and improve the lessons.

Legal basis: our legitimate interest in improving the lessons (6(1)(f)). You can object to this; see section 7.

3.6 Contacting us

If you write to us through the contact page, we keep your name, email address and message. Nothing else: no IP address and no browser details. If you were logged in, we link the message to your account. If you email or phone us, we keep your message and our reply.

Legal basis: our legitimate interest in answering your question (6(1)(f)), or the contract if it is about your purchase (6(1)(b)).

3.7 Security and logs

When you are logged in, we keep your IP address and type of browser with your session. This lets us spot misuse and log you out on all your devices. Logging in, signing up, resetting a password and deleting an account are rate-limited: if you try too often, you have to wait a moment. If far more requests come from one IP address than a person makes, Cloudflare holds that address back for a while. An ordinary visitor does not notice this.

If your email address changes, we record when this happened and whether you or an administrator did it. We keep your old address only as an unreadable code.

Our server keeps a technical log of errors. An email address or IP address may end up in it.

Looking along with you. If you ask us for help, an administrator can look along with you: they see the platform as you see it, for at most half an hour, without being able to change anything. Each time, we record who looked, at whose account and when.

Legal basis: our legitimate interest in securing the platform and your account and in being able to help you (6(1)(f)).

3.8 Cookies and storage in your browser

We only use cookies that are needed for the site to work:

If you are logged in, we also store your theme and display choices with your account, so they apply on every device.

Your browser also remembers a few things itself, without us receiving them: which voice (female or male) you want to hear the sentences in and, if you are not logged in, what you filled in in the exercises. The site deletes the latter after three months. If you share a computer, the next person can see what you filled in.

We use no advertising or tracking cookies and no analytics services. Our fonts are on our own server; your browser does not fetch them from Google. These cookies do not need your consent, which is why you do not see a cookie banner.

3.9 A code from your email address

For your account we calculate a code (a "hash") from your email address. It is meant for linking data later without using your email address. At the moment we do not send this code anywhere.

3.10 What we do not do

To avoid any misunderstanding:

• The voices in the lessons are made by Microsoft Azure from our lesson texts. None of your data goes there. We never record your own voice.
• We do not measure how you use the site, and there are no pixels from Google, Meta or others on it.
• We do not build a profile of you for advertising and make no decisions about you that are taken by a computer alone.
• You cannot log in with Google or Facebook, so we receive nothing from them.

4. Who else sees your data

We do not share your data with companies, organisations or people outside Oxido Media B.V., except in the cases below.

4.1 Companies that work for us (processors)

We have a data processing agreement with each of these companies: they may only use your data to do this work for us.

For part of the payment, such as the checks the law requires of a payment provider, Mollie is itself responsible. Mollie's privacy policy applies to that.

4.2 Tax authorities

If we charge the VAT of another EU country, we declare it to the Dutch tax authorities through the One Stop Shop (OSS). During an audit, the tax authorities, including those of your country, may request the details of your order.

4.3 Outside the European Union

Postmark is an American company and processes your email address and the email in the United States. This is allowed because Postmark takes part in the EU-U.S. Data Privacy Framework, which the European Commission has found to offer adequate protection.

Cloudflare is also an American company. Every visit to the site goes through a Cloudflare data centre, usually the one nearest to you. Cloudflare also takes part in the EU-U.S. Data Privacy Framework, and our agreement with Cloudflare also contains the standard clauses of the European Commission.

Otherwise, your data stays within the European Union.

4.4 For legal reasons

We only pass on data if we believe in good faith that it is necessary to comply with the law, a court order or a binding request from the authorities; to enforce our terms; to deal with fraud or security problems; or to protect the rights and safety of us, our users or others, as far as the law requires or allows.

4.5 If the company changes

If this platform is taken over, sold or merged with another company, we will continue to treat your data confidentially. We will tell you before your data is transferred or becomes subject to a different privacy policy.

5. How long we keep your data

There is currently no fixed period for accounts that are not used for a long time: an account stays until you delete it or ask us to. We never delete an account that was used to buy something without asking you, because you would lose your access. If we introduce such a period, we will first update this policy and warn you by email in advance.

5.1 Backups

Every night we make a backup of the database and of the files we store, such as profile photos. It is kept on our server and in a second location within the European Union. We keep the last 14. If you deleted your account, it therefore stays in a backup for at most 14 days. If we ever restore a backup, we delete the accounts that were deleted in the meantime again before the platform reopens.

6. How we protect your data

• The connection to the site is encrypted (https).
• We only store passwords encrypted.
• Logging in, signing up, resetting a password and deleting an account are protected against guessing.
• Only administrators can access the admin area, and they log in with a second step.
• Each time an administrator downloads your data or looks along with you, we record who did it and when.

7. Your rights

If you delete your account, your name, progress, answers, profile photo, searches, email preferences, display choices and any emails still waiting to be sent disappear immediately. You are logged out on all your devices. Your orders and invoices remain, without your name and email address (see 3.3).

We reply to a request by email as soon as possible, and within one month at the latest. If a request is complex, this can be extended by at most two months; we will tell you so within the first month. We may ask you to show that you are who you say you are, for example by emailing from your account's address.

7.1 Complaints

If you are not happy with how we handle your data, please tell us first; we would like to find a solution together. You can always complain to the data protection authority in the country where you live, or to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the United Kingdom that is the ICO (ico.org.uk).

8. Age

This platform is meant for people aged 16 and over. If you are younger, please ask a parent or guardian to create the account for you.

9. Changes

We may update this privacy policy, for example when the platform changes. Each version stays available at its own address, with the date it took effect. For an important change, we let you know in advance, on the platform or by email.

10. Contact

Questions about this privacy policy? Email [email protected], use the contact page, or write to Oxido Media B.V., Straat van Dover 89, 3825 XB Amersfoort, the Netherlands.