Privacy policy

Privacy policy of Enjoylingua

When you use our platform, you trust us with your data. This policy explains what data we keep, why, who we share it with, how long we keep it and what you can do yourself: view, download, change, unsubscribe and delete.

1. Who we are

Enjoylingua is a trading name of Oxido Media B.V., which is responsible (the "controller") for what happens to your data on this platform.

This policy applies to enjoylingua.com, enjoydutch.com and leuknederlandsleren.nl.

Our other websites. The same company also runs websites in Dutch (Leuk talen leren and its language sites) and in Spanish (aprendemosingles.com, palabraseningles.es). They run on the same platform. If you create an account on two of our websites with the same email address, it is one account. What only happens on the Spanish websites (a community and a word of the day by email) is described in the Spanish privacy policy. Leuk Spaans leren (leukspaansleren.nl) belongs to the same company but is a separate platform with its own database and privacy policy. We do not exchange data between Leuk Spaans leren and this platform.

We do not have a data protection officer; a company of our size is not required to. You can contact us with any question about your data at [email protected] or through the contact page.

2. In short

• We use your data to let you learn, to handle your orders and to send you the emails that come with your account.
• We do not sell your data. We use no advertising or tracking cookies and no analytics services from other companies. We count ourselves how the site is used, without a cookie and without your IP address (see 3.11).
• If you are logged in, we link what you look at on the site to your account (see 3.11). You can turn this off under Account.
• For emails to your account that you can unsubscribe from, Postmark tracks whether you open them and which link you click (see 3.4). We do not do this for emails about your account and purchases.
• You can download all your data and delete your account yourself, under Account. Only your orders and invoices remain, without your name and email address, because tax law requires it.
• You can unsubscribe from encouragement and offers with the link at the bottom of every email or on the Email preferences page.
• If you have a complaint, you can come to us, and to the data protection authority.

3. What data we use and why

For each part, this section says what we keep, why, and on which legal basis under the GDPR. How long we keep it is in section 5.

3.1 Your account

What: your first name, your email address and a password. We only store your password encrypted (as a "hash"); we cannot read it. Under Account you can also add your surname and a profile photo; both are optional. Of a photo we keep a newly drawn copy of 300 by 300 pixels, without the extra information in the original, such as where it was taken. We record when you created your account, when you last logged in and when you were last active.

When you create an account, we send you a link to confirm your email address. If you later change your email address, we send a link to the new address; it only changes once you click it. Your old address gets an email saying it was changed, with a link to undo this if it was not you.

Logging in with Google or Facebook. You can also log in with your Google or Facebook account. That is your choice; an email address with a password works just as well. If you choose it, we receive your name, your email address and the number of your account there from Google or Facebook. We ask for nothing more. We keep the link between that number and your account. Google and Facebook then see that you log in with us. What they do with that is in their own privacy policy; they are responsible for it themselves.

Why: to give you an account, let you log in and give you access to what you bought. We use when you were last active to help you if you get stuck, or to give you a nudge if you have been away for a while.

Legal basis: the contract with you (Article 6(1)(b) GDPR). For recording when you were last active: our legitimate interest in helping you (6(1)(f)).

3.2 Your progress

What: which lessons you did, which exercises you did and whether your answer was right or wrong, your best score per set of questions, your streak (how many days in a row you studied), your points and badges, each with the time. For each exercise we also keep your most recent answer, so that it is still there when you come back. A new answer replaces the old one. "Start again" clears them.

Your answers are linked to your account. Other members cannot see them, and we do not use them for anything else. If you are not logged in, we keep nothing: your answers then stay in your own browser only (see 3.8).

Why: so you can continue where you left off and see your progress.

Legal basis: the contract with you (6(1)(b)).

3.3 Buying and paying

What: when you buy something, we keep an order with a number, the date, what you bought, the amount and the VAT, your name and email address, and the payment status. We also record what you ticked about your right of withdrawal: the time, the exact wording and the version of the terms and conditions. Once the payment has gone through, we create an invoice.

The country where you live. We charge the VAT of the EU country where you live, and VAT rules require us to record that country with evidence. That is why we keep, with your order, the country you give us, your IP address and the language setting of your browser.

If you order without an account, we ask for your name and email address. After payment we create an account for you at that address, or add your purchase to the existing account.

You pay through our payment provider Mollie. We send Mollie the amount, a description and our order number, not your name or email address. You enter your payment details at Mollie, not with us. Mollie tells us the payment status; this may include the payer's name and account number.

Why: to carry out your order, give you access, send you a confirmation and an invoice, charge the right VAT, and because tax law requires it.

Legal basis: the contract with you (6(1)(b)) and a legal obligation (6(1)(c)): VAT rules and the obligation to keep tax records.

3.4 Email

We send you three kinds of email:

You can unsubscribe with the link at the bottom of the email, without logging in, or on the Email preferences page. It takes effect immediately.

A reminder about an order. If you start an order and it is not paid, we send you one email after a few hours with what was in it and a button to continue, even if you have no account. After that we send nothing more about it. If you have paid after all or already have the course, you do not get this email.

We keep a record of which emails we sent you, when and why, so we can answer "why did I get this?". Our email provider Postmark tells us for each email whether it was delivered, whether it bounced because your address does not work, whether you marked it as spam and whether you unsubscribed. We keep that with the email. If an email bounced because your address does not exist, we only send you emails you ask for after that. If you mark an email as spam or unsubscribe, we stop sending you encouragement and offers. To remember this, even after your account is gone, we keep your address only as an unreadable code.

For emails to your account that you can unsubscribe from (encouragement and offers), our email provider Postmark tracks whether you open them and which link you click. For this, the email contains a small invisible image and the links go through a Postmark address. That shows us which emails mean something to people, so we send fewer emails nobody reads. We do not keep ourselves whether you opened an email or which link you clicked. For emails about your account and purchases (a link to reset your password, your payment confirmation), we do not track this. If you do not want this, unsubscribe from those emails with the link at the bottom, or set your email program not to load images.

Legal basis: for emails about your account and purchases, the contract (6(1)(b)). For encouragement and offers to customers, our legitimate interest (6(1)(f)), with the option to unsubscribe in every email. If you have not bought a course, we only send you offers if you said yes to them (6(1)(a)).

3.5 Searching the lessons

What: when you use the search box while logged in, we keep what you type, when, how many results it gave and what you clicked. This is linked to your account.

Why: so we can see which lessons are missing or are called something different from what you search for, and improve the lessons.

Legal basis: our legitimate interest in improving the lessons (6(1)(f)). You can object to this; see section 7.

3.6 Contacting us

If you write to us through the contact page, we keep your name, email address and message. Nothing else: no IP address and no browser details. If you were logged in, we link the message to your account. If you email or phone us, we keep your message and our reply.

Legal basis: our legitimate interest in answering your question (6(1)(f)), or the contract if it is about your purchase (6(1)(b)).

3.7 Security and logs

When you are logged in, we keep your IP address and type of browser with your session. This lets us spot misuse and log you out on all your devices. Logging in, signing up, resetting a password and deleting an account are rate-limited: if you try too often, you have to wait a moment. If far more requests come from one IP address than a person makes, Cloudflare holds that address back for a while. An ordinary visitor does not notice this.

If your email address changes, we record when this happened and whether you or an administrator did it. We keep your old address only as an unreadable code.

Our server keeps a technical log of errors. An email address or IP address may end up in it.

Looking along with you. If you ask us for help, an administrator can look along with you: they see the platform as you see it, for at most half an hour, without being able to change anything. Each time, we record who looked, at whose account and when.

Legal basis: our legitimate interest in securing the platform and your account and in being able to help you (6(1)(f)).

3.8 Cookies and storage in your browser

We only use cookies that are needed for the site to work. The visit number and "do not measure" are not in a cookie but in your browser's storage; they are not sent to us automatically with every request:

If you are logged in, we also store your theme and display choices with your account, so they apply on every device.

Your browser also remembers a few things itself, without us receiving them: which voice (female or male) you want to hear the sentences in and, if you are not logged in, what you filled in in the exercises. The site deletes the latter after three months. If you share a computer, the next person can see what you filled in.

We use no advertising or tracking cookies and no analytics services from other companies. The visit number and "do not measure" are not cookies; they only serve to count for ourselves how the site is used, and that goes to nobody else (see 3.11). Our fonts are on our own server; your browser does not fetch them from Google. These cookies and this storage do not need your consent, which is why you do not see a cookie banner.

3.9 A code from your email address

For your account we calculate a code (a "hash") from your email address. It is meant for linking data later without using your email address. At the moment we do not send this code anywhere.

3.10 What we do not do

To avoid any misunderstanding:

• The voices in the lessons are made by Microsoft Azure from our lesson texts. None of your data goes there. We never record your own voice.
• There are no pixels from Google, Meta or others on the site. What we measure ourselves is in 3.11.
• We do not build a profile of you for advertising and make no decisions about you that are taken by a computer alone.

3.11 How we measure the site

What: when you open a page, we send ourselves a short message: which page, when, which site you came from (only the name of that site) and which campaign if it was in the link, whether you use a phone, tablet or computer and roughly how wide your screen is, whether you opened the site as an app, and whether you are logged in and have bought something before. Also whether you saw the buy section of a course, started an order, created an account or finished the level test, and whether the payment succeeded. To keep the pages of one visit together, your browser makes a random number that disappears when you close the tab. We do not keep your IP address, what you type in a form or what you search for. It goes to nobody else.

Linked to your account: if you are logged in, linking your visits to your account is on by default. That way we see which pages and courses you looked at, and we can fit the lessons and what we offer more closely to you. If you do not want this, turn the linking off under Account. We then stop straight away and unlink what was linked to your account: it only counts in the totals, without your name. If you turn it back on later, we only link from that moment on. What is linked to your account is in the copy of your data and disappears when you delete your account.

Why: so we can see which pages help people and where they get stuck. We use that to improve the site and what we offer. If it is linked to your account, we also see what you looked at, so we can fit the lessons and what we offer more closely to you.

How long: the messages themselves 30 days. After that only as counts per page, per hour (13 months) or per day, without a number or name.

Legal basis: for counting, our legitimate interest in improving the site (6(1)(f)). For linking to your account, also our legitimate interest: fitting the lessons and what we offer more closely to you (6(1)(f)). You can always object. You turn the linking off yourself under Account. You turn measuring off with "Don't measure on this device" at the bottom of the site and on this page. If Global Privacy Control or "do not track" is on in your browser, we do not measure you either. If you no longer want to be measured on any of your devices, email us and we will turn it off for your account. We then also stop keeping what you search for (3.5).

3.12 The level test

You can take the level test without an account. For each test we keep the language, the level, the score and the course we recommend, without your answers per question, without your IP address and without storing anything in your browser. If you are logged in, the result is linked to your account.

If you ask us to email you the result, we keep your email address with that result. We use it for two things: sending that one email and seeing whether you then buy a course, so we know whether the test helps people on their way. We do not send you a newsletter or advertising because of the test. After three months we remove your address; the result then stays without an address, for our counts. If you took the test without an account, we also remove the email with your result at that moment. If you were logged in, that email stays with your account, like the other emails we sent you (see chapter 5).

Legal basis: for the email, your request (6(1)(b)); for linking it to a later purchase, our legitimate interest in knowing whether the test works (6(1)(f)). You can object to this; we then remove your address straight away.

4. Who else sees your data

We do not share your data with companies, organisations or people outside Oxido Media B.V., except in the cases below.

4.1 Companies that work for us (processors)

We have a data processing agreement with each of these companies: they may only use your data to do this work for us.

For part of the payment, such as the checks the law requires of a payment provider, Mollie is itself responsible. Mollie's privacy policy applies to that.

Google and Facebook only receive something if you choose to log in with them (3.1). They are responsible themselves for what they do with it.

4.2 Tax authorities

If we charge the VAT of another EU country, we declare it to the Dutch tax authorities through the One Stop Shop (OSS). During an audit, the tax authorities, including those of your country, may request the details of your order.

4.3 Outside the European Union

Postmark is an American company and processes your email address and the email in the United States. This is allowed because Postmark takes part in the EU-U.S. Data Privacy Framework, which the European Commission has found to offer adequate protection.

Cloudflare is also an American company. Every visit to the site goes through a Cloudflare data centre, usually the one nearest to you. Cloudflare also takes part in the EU-U.S. Data Privacy Framework, and our agreement with Cloudflare also contains the standard clauses of the European Commission.

Otherwise, your data stays within the European Union.

4.4 For legal reasons

We only pass on data if we believe in good faith that it is necessary to comply with the law, a court order or a binding request from the authorities; to enforce our terms; to deal with fraud or security problems; or to protect the rights and safety of us, our users or others, as far as the law requires or allows.

4.5 If the company changes

If this platform is taken over, sold or merged with another company, we will continue to treat your data confidentially. We will tell you before your data is transferred or becomes subject to a different privacy policy.

5. How long we keep your data

There is currently no fixed period for accounts that are not used for a long time: an account stays until you delete it or ask us to. We never delete an account that was used to buy something without asking you, because you would lose your access. If we introduce such a period, we will first update this policy and warn you by email in advance.

5.1 Backups

Every night we make a backup of the database and of the files we store, such as profile photos. It is kept on our server and in a second location within the European Union. We keep the last 14. If you deleted your account, it therefore stays in a backup for at most 14 days. If we ever restore a backup, we delete the accounts that were deleted in the meantime again before the platform reopens.

6. How we protect your data

• The connection to the site is encrypted (https).
• We only store passwords encrypted.
• Logging in, signing up, resetting a password and deleting an account are protected against guessing.
• Only administrators can access the admin area, and they log in with a second step.
• Each time an administrator downloads your data or looks along with you, we record who did it and when.

7. Your rights

If you delete your account, your name, progress, answers, profile photo, searches, visits that were linked to your account, email preferences, display choices and any emails still waiting to be sent disappear immediately. From your level tests, your name and address are removed. You are logged out on all your devices. Your orders and invoices remain, without your name and email address (see 3.3).

We reply to a request by email as soon as possible, and within one month at the latest. If a request is complex, this can be extended by at most two months; we will tell you so within the first month. We may ask you to show that you are who you say you are, for example by emailing from your account's address.

7.1 Complaints

If you are not happy with how we handle your data, please tell us first; we would like to find a solution together. You can always complain to the data protection authority in the country where you live, or to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the United Kingdom that is the ICO (ico.org.uk).

8. Age

This platform is meant for people aged 16 and over. If you are younger, please ask a parent or guardian to create the account for you.

9. Changes

We may update this privacy policy, for example when the platform changes. Each version stays available at its own address, with the date it took effect. For an important change, we let you know in advance, on the platform or by email.

10. Contact

Questions about this privacy policy? Email [email protected], use the contact page, or write to Oxido Media B.V., Straat van Dover 89, 3825 XB Amersfoort, the Netherlands.