1. Who is responsible for your data?
First Class, KVK 99490153, visiting address shielded in the Business Register, Netherlands is the controller of the personal data described in this policy. You can contact us about privacy through our contact page or at support@firstclassprep.nl.
2. Information we collect
- Account details: name, email address, account identifier, role and account status supplied through our secure sign-in provider.
- Programme access: university, programme, plan, subscription status, renewal date and payment-provider identifiers. First Class does not store complete card details.
- Learning activity: practice answers, accuracy, topic progress, mock-exam attempts, timings and scores.
- Messages: information you submit through contact and course-request forms.
- Security and technical data: limited request, device and diagnostic information needed to protect and operate the service.
3. Why we use it
We use account, programme and learning data to perform our contract with you: providing access, saving progress, delivering questions and administering subscriptions. We use limited technical and support data for our legitimate interests in securing, improving and supporting First Class. We process payment and accounting records to meet legal obligations. If we later introduce optional marketing or non-essential analytics, we will request consent where required.
4. Who receives it?
We share only what is necessary with service providers that help us operate First Class, including our hosting and authentication provider, Stripe for payments, and support or communication providers we activate. These providers act under contractual and confidentiality obligations. We may also disclose information where law requires it or to protect the service and its users.
5. International transfers
Some providers may process data outside the European Economic Area. Where this happens, we use an approved transfer mechanism and appropriate safeguards, such as an adequacy decision or standard contractual clauses.
6. How long we keep it
Account and learning records are generally kept while your account is active so your progress remains available. Contact requests are normally removed or anonymised after 24 months. Short-lived security logs are normally kept for no more than 90 days unless an incident requires longer investigation. Subscription and transaction records may be retained for the period required by tax, accounting and consumer law. When data is no longer required, we delete or anonymise it.
7. Your rights
Depending on the circumstances, you may ask to access, correct, erase, restrict or transfer your personal data, or object to certain processing. Where processing relies on consent, you may withdraw it. Contact us to make a request; we may need to confirm your identity. You may also complain to the Dutch Data Protection Authority or the authority where you live.
8. Cookies and local storage
First Class uses essential cookies or similar storage for account security, sessions and preferences. These are necessary for the service to work. We will not add non-essential advertising or analytics cookies without updating this policy and providing any consent controls required by law.
9. Security
We use access controls, role checks, signed payment notifications and server-side content-release checks to protect accounts and course material. No online service can promise absolute security. Please use a secure device and contact us promptly if you suspect unauthorised access.
10. Changes and contact
We may update this policy when the service or law changes. Material changes will be communicated through the platform or account email when appropriate. Questions, privacy requests and complaints can be submitted through our contact page.