Privacy Policy
This privacy policy is drawn up in accordance with the GDPR. RijSys is offered in the Netherlands. Below you can read which personal data we process, on what legal basis, how long we keep it and which rights you have.
Data controller
The data controller is RijSys (add your legal entity, Chamber of Commerce number and address before publishing). For privacy questions: [email protected]. Each driving school may be a (joint) controller for its students’ data; RijSys then processes that data on behalf of the school under a data-processing agreement.
Which personal data we process
- Account data: name, username, email address, phone number
- Lesson data: schedule, lessons, progress, lesson card, homework and exams (CBR)
- Invoice and payment data (payment via Mollie/iDEAL)
- Device and usage data: device type, OS, app identifiers, push token (FCM) and crash logs
Purposes and legal basis (Art. 6 GDPR)
- Providing the service: schedule, lessons, progress and exams (performance of contract)
- Showing invoices and processing payments via iDEAL (contract and legal obligation)
- Notifications about your lessons (contract / legitimate interest)
- Crash logs and optional analytics for stability (legitimate interest or consent)
Where we rely on consent, you can withdraw it at any time; this does not affect prior processing.
Recipients and processors
We never sell your data. We only share it with your own driving school, with Mollie (payments via iDEAL), with Google Firebase (push notifications and crash reporting), with our hosting provider, and with competent authorities when legally required. We conclude data-processing agreements with our processors.
Transfers outside the EEA
Some providers (such as Google/Firebase) may process data outside the EEA. This only happens with appropriate safeguards, such as an adequacy decision or the EU Standard Contractual Clauses (SCCs).
Retention periods
- Account data: while your account is active; deleted or anonymized afterwards
- Invoice and payment data: 7 years (statutory tax retention)
- Crash logs and diagnostics: short-lived, then deleted or aggregated
Security
We take appropriate technical and organizational measures, including encryption in transit (HTTPS), access control and restriction to authorized personnel.
Your rights and account deletion
You have the right to access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. You can have your account and data deleted via [email protected] or in the app; data we are legally required to keep (such as invoices) is retained until the term expires. We respond within the legal term (at most one month).
Lodging a complaint
If you have a complaint about how we handle your data, you can lodge it with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Children
The app is intended for driving-school students (generally aged 16 and over). We do not knowingly collect data from children under 16 without parental or guardian consent.