Below you can read, per situation, what we keep about you, why, who sees it and how long we hold on to it. You only need the part that fits you: filling in a form, taking lessons or teaching.
Who is responsible
Studystead is a service of SJA Ondernemingen in Utrecht (KvK 99843072). SJA Ondernemingen is responsible for the data on this site and in the portal, and follows the EU General Data Protection Regulation (GDPR). Questions about your data go to info@studystead.nl.
When you fill in a form
We only use what you fill in for what you ask us to do.
- Call back: your name, e-mail address, phone number, subject, level and message, so we can call you with a proposed teacher and e-mail you our offer.
- Learn AI for teams: your name, organisation, job title, e-mail address, phone number, team size and question, as far as you fill them in, so we can contact you about a session for your team.
- No match: your search term and e-mail address, so we can e-mail you as soon as there is a teacher for that subject.
- Become a teacher: your name, e-mail address, phone number, date of birth, subjects, level, grade list and motivation, so we can assess your application.
You get a confirmation by e-mail, and your request reaches our mailbox. If you came through a link that names a source, such as a poster or an e-mail from us, we see that source too. Netlify, the company that hosts this site, also records your IP address and browser with every form, to keep out spam.
The legal basis is your request that we do something for you before there is an agreement. For the no-match notice it is your consent. You withdraw it with one e-mail, and we then delete your address.
When you take lessons with us
A family gets an account from us; you cannot create one yourself. For a student under 18, a parent or guardian is the account holder. From 18, the student manages the account. We keep:
- of the account holder: name, e-mail address, phone number and language;
- of the student: name, date of birth, level and class;
- the lessons: when, which subject, whether the lesson took place and whether it was invoiced;
- the lesson report the teacher writes after every lesson, and the worksheets;
- your requests, cancellations and reports, such as a complaint or a teacher who did not show up;
- your invoices.
We need the date of birth because a teacher is always older than the student, and because a student of 18 or older gets their own account and direct contact with the teacher.
A teacher sees only their own students: name, date of birth, level, class and the lessons. For contact on WhatsApp, the teacher sees the phone number of the account holder, or of the student from 18. Messages about a student under 18 therefore always go through the parent. A teacher never sees complaints, requests or invoices.
A student can get their own login. With it, the student sees the lessons, lesson reports and worksheets, but no invoices. We e-mail the lesson report to the account holder.
The legal basis is our agreement with you. We keep invoices because the law requires it.
When you teach with us
From teachers we keep:
- your profile: name, e-mail address, phone number, date of birth, photo, bio, subjects, Teams link, WhatsApp number and the hours you can teach;
- your lessons and lesson reports;
- your absence: sick reports, leave and cancelled lessons.
We use your date of birth to check that you are 16 or older and older than your students. For a sick report we only record when you fell ill and when you are better, never what you have. The family only hears that the lesson is off.
Everyone with an account sees your name, photo, bio and subjects. Only a family you teach sees your Teams link and WhatsApp number.
Our teachers work for us through a payroll company. That company receives the hours you work and the details needed for your contract and pay, and is itself responsible for your payroll records.
Once it arrives, your application sits in our admin system, and your grade list in a closed folder that only we can open. If you become a teacher, your application becomes part of your teacher file. If we do not take you on, we delete your application and grade list 4 weeks after our decision.
When you visit the site
The site does not track what you do. It runs no analytics, no ads and no third-party trackers, and the fonts come from our own server. Netlify processes your IP address to send you the pages.
When you log in, your browser keeps your login session in its local storage. That is needed to stay logged in. If you turn off "Stay logged in on this device", the session disappears as soon as you close your browser. Logging out deletes it right away.
Who processes your data for us
A few companies process data on our behalf, each under their own data processing terms:
- Supabase: the portal's database, login and files, on servers in Frankfurt;
- Netlify: the site, the forms and the functions that send our e-mails;
- Google Workspace: our e-mail, and the nightly backup, stored encrypted in Google Drive;
- GitHub: runs the backup and the clean-up every night, and keeps no data itself.
These companies are American or have an American parent company. Where they process data outside the EU, they do so under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Lessons run on Microsoft Teams and contact with your teacher on WhatsApp. Microsoft's and WhatsApp's terms apply there. Apart from these parties and our teachers' payroll company, we share your data with no one, unless the law requires us to.
How long we keep it
| Data | Kept for |
|---|---|
| A form with no follow-up | 12 months after our last contact |
| An application we turn down, with grade list | 4 weeks after our decision |
| Account, lesson reports, worksheets, requests and complaints | 12 months after the last lesson |
| Invoices and the lessons on them | 7 years, as the Dutch tax authority requires |
| The log of sent notices | 30 days |
| Backups | 35 days |
The same periods apply to the e-mails we have about it. Because a backup stays for 35 days, anything we delete is also gone from the backups within 35 days.
Your rights
You can ask us to show, correct or delete your data, or to hand it over as a file, and you can object to how we use it. E-mail info@studystead.nl; we reply within a month. For a student under 16, the parent or guardian makes this request.
If you disagree with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.
How we protect your data
The portal only opens with an account we create, and each account sees only what fits its role: a family its own lessons, a teacher their own students. Files sit in closed folders and open through a link that expires after a short time. The backups are encrypted. If something does go wrong with your data, we report it to the Autoriteit Persoonsgegevens within 72 hours, and to you if the risk to you is high.
When this statement changes
When we change this statement, we put the new date at the top of this page.