Privacy Statement

1. Who is responsible for your data

I am Marin, a freelance Dutch teacher running Doe Maar Dutch. I am responsible for the personal data described in this statement (in GDPR terms, I am the “controller”). If you have any question about your data, you can contact me at the email address above.

2. What data I collect

When you contact me (by email, WhatsApp or through my website):

• your name and contact details, and what you write to me, such as your learning goals.

When you take lessons with me and use the student portal:

• your name and email address;
• your login details (handled by Supabase, see section 6). If you log in with Google, Google shares your name and email address with the portal;
• the dates and times of your lessons;
• lesson notes and debriefs, such as what we covered, grammar, themes and homework;
• materials I share with you;
• your personal word list (Mijn woorden) and anything else you add to the portal yourself;
• your invoices and payment details, such as amounts, dates and whether they have been paid.

I may also keep some short teaching notes for myself, to help me prepare your lessons. These are only visible to me and are never shown in your portal.

Technical data: the portal only uses a few small cookies that it needs to work: two that keep you logged in, one that protects the forms against misuse, and one that remembers whether you chose Dutch or English. I do not use advertising or tracking cookies, and I do not use analytics.

3. Why I use your data, and on what legal basis

I do not sell your data, and I do not use it for advertising.

4. Your word list: anonymous use

I may take words from your personal word list and add them to the general word list in the portal, so other students can learn them too.

This is always anonymous. Only the word itself is copied (with things like its translation, level or theme). Your name, your email address or anything else that could identify you is never attached to it, and nobody can see which student a word came from. Because these words no longer say anything about you, they are not personal data and they can stay in the general word list after your own data is deleted.

5. Who can see your data

Only you and I can see your data in the portal.

If you take two-to-one lessons, you and your lesson partner share one student profile in the portal. You can each log in with your own account, but you both see the same information: your lessons, notes and debriefs, homework, shared materials, word list and invoices.

6. Who processes data for me

I use a few services to run my business. They only process your data on my behalf and only for this purpose.

• Hosting: the portal and its data are stored on a secure server in the Netherlands.
• Supabase: my login provider. Supabase handles logging in to the portal (email and password, or Google) and stores your email address and login details for that purpose, in the European Union. The login page loads Supabase’s login code from jsDelivr, a public code service, so your browser connects to jsDelivr when you log in.
• Cloudflare: the portal’s address and secure connection run through Cloudflare, which passes your visits on to the server.
• Google: my email address is a Gmail address, so emails between us go through Gmail. If you choose to log in with Google, Google is involved in that login too. The website and the portal also load their fonts from Google Fonts, which means your browser connects to Google when you open a page.
• Microsoft: online lessons take place through Microsoft Teams, so Microsoft processes the call and your name or email address as shown in Teams.
• WhatsApp: only if you choose to contact me that way.

Some of these companies are based outside the European Union, such as in the United States. Where data may leave the EU, they use the legal safeguards the GDPR requires, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

7. How long I keep your data

You can always ask me to delete your portal data sooner (see section 8). I will then delete it, except for what I must keep by law, such as invoices.

8. Your rights

Under the GDPR you have the right to:

• see the personal data I have about you;
• correct it if it is wrong;
• have it deleted;
• limit how I use it;
• object to how I use it;
• receive a copy of it in a common format, to keep or pass on. For example, you can ask me for a copy of your personal word list (Mijn woorden), and I will send it to you.

Just send me an email. I will reply within one month. To protect your data, I may ask you to confirm that the request really comes from you.

9. Security

I protect your data with care: the portal only works over a secure (https) connection, every student only sees their own account, and only I have administrator access. No system is perfect, but if something ever goes wrong with your data, I will let you know and, where required, report it to the Dutch Data Protection Authority.

10. Complaints

If you are not happy with how I handle your data, please tell me first so I can try to put it right. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl

11. Changes to this statement

I may update this statement from time to time. If I make a change that matters to you, I will let you know by email or through the portal.

12. Contact

For any question about your privacy, email me at [email protected].