Version 3.1 · effective from 20 October 2026
In this policy we explain in plain language what data we collect, why, how long we keep it and what rights you have. If anything is unclear — write to us and we will explain.
1. Who is responsible for your data
The data controller is Akademia VCA, ‘s-Gravelandseweg 397, 3125 BJ Schiedam, the Netherlands, KvK 64597237 (“we”, “Akademia VCA”). Akademia VCA® is a registered trade mark.
We process data in accordance with the GDPR (Regulation (EU) 2016/679, in the Netherlands: AVG) and the Dutch implementing act (Uitvoeringswet AVG). Matters not covered by this policy are governed by Dutch law.
Contact on personal data matters: info@akademiavca.nl, tel. +31 10 226 27 74.
2. What data we collect and why
2.1. Bookings for courses and exams
When you book, we ask for the details of the payer (full name or company name, address, email, phone and, for companies, the KvK number or VAT number) and the details of the participants (first name, surname and date of birth — exactly as on their identity document).
- Why: booking you onto a course or exam, registering the participant for the exam, issuing the invoice, contacting you about the order (e.g. when paying by bank transfer or changing the date).
- Legal basis: performance of a contract (Article 6(1)(b) GDPR) and legal obligations — tax law and exam requirements (Article 6(1)(c) GDPR).
We do not contact participants at their email address — correspondence about the order goes to the payer.
2.2. Customer account
You can create an account, but you don’t have to. You log in with a link sent to your email or with a password. In the account we store: your first name, your email, your password (in encrypted form — we do not know it), your chosen language, your orders and enquiries, your invoice details and your marketing consents.
If your company has already used our courses, you can ask to see its history (participants and the validity of their qualifications). Access is granted by our office after verification, and we send a notice of the request to the company address stored in our database — so that nobody can view someone else’s data.
You can delete your account at any time in the “Account” tab. Order data that we have to keep for tax reasons remains in our billing system (section 5).
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
2.3. Date enquiries and the contact form
When you ask about a course date or write to us through the form, we receive your name, email, possibly your phone number and the content of your message. We use them solely to reply and to prepare an offer.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
2.4. VCA practice test
The practice test requires you to log in to your account (section 2.2). We store the course of the test and its result with your account for no more than 24 hours, after which they are deleted automatically — during that time you can also see the result of your latest test in your account. We do this to show you the result (and send it by email if you wish) and to protect the test against abuse (our legitimate interest). The test is protected by Cloudflare Turnstile (section 4). We do not store an email address entered to receive the result (unless you separately consent to marketing information — section 2.6).
2.4a. Online courses and digital content
For online courses (the akademiavca.online platform) we process: the participant’s email and full name, learning progress and test results, as well as login dates and the devices you use. We record logins because the right to a refund depends on the first login (terms and conditions, section 7), and the device limit protects the course against shared access. We mark digital materials (e.g. e-books, PDF files) with the buyer’s details (watermark).
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest in protecting content against unauthorised sharing (Article 6(1)(f) GDPR).
2.5. Kasia — AI assistant
The website features Kasia, an assistant based on artificial intelligence (the Claude model by Anthropic). You always know that you are talking to an AI — in accordance with the EU Artificial Intelligence Act (AI Act, Regulation (EU) 2024/1689, Article 50), we tell you so in the chat window. Kasia does not make any decisions about you and does not create a profile of you. Kasia can make mistakes: the terms and conditions, the offer on the website and the order confirmation are binding.
- What we send to the model: only the anonymised content of the current conversation — email addresses, phone numbers and other identification numbers are masked automatically before sending. We do not send your account details, IP address or cookies.
- What we save: data from conversations with the AI assistant is anonymised and used solely to improve how the assistant works. The record is not linked to your account, IP address or session, and email addresses, phone numbers and other identification numbers are masked automatically when saved. We delete the records after 12 months.
- Please: do not give personal data in your conversation with Kasia — for matters concerning a specific order, call or write to us.
- Legal basis: our legitimate interest (Article 6(1)(f) GDPR) — answering visitors’ questions quickly and improving the quality of those answers.
2.6. Newsletter and marketing information
We send information about new courses and promotions only if you consent to it (a separate checkbox, unticked by default, when ordering or in your account; you confirm your newsletter subscription via a link in an email). You can withdraw your consent at any time — via the link in the footer of the message, in your account or by writing to us.
Legal basis: your consent (Article 6(1)(a) GDPR).
2.7. Accounts from the old website
If you had an account on the previous version of our website, we have transferred it together with your invoice details — without the password. You can log in with a link sent to your email. We transferred only confirmed marketing consents and newsletter unsubscriptions; we did not transfer any other consents.
3. Cookies and similar technologies
On your first visit we ask for your consent in a banner. You can choose “Essential only” or “Accept all”, and change your decision at any time using the “Cookie settings” link in the website footer.
3.1. Essential (no consent needed)
- Website session and security token — login, basket, protecting forms against abuse. They expire when the session closes or after 2 hours of inactivity.
- Remembering your cookie decision — in your browser’s storage, so that the banner does not come back on every visit.
- Convenience settings (e.g. the light/dark theme of the practice test, the history of your conversation with Kasia for 24 hours) — stored only in your browser; they are not sent to us.
3.2. Statistics (with consent)
Google Analytics 4 — lets us see which pages are visited and how the website performs. We use Google Consent Mode (Consent Mode v2): without your consent Google Analytics does not store any cookies, and only anonymous signals without identifiers are sent to Google. Once you consent, the _ga and _ga_* cookies are stored (for up to 2 years). IP addresses are truncated by Google.
The akademiavca.online platform uses the same banner and the same rules, but only for Google Analytics 4 statistics (a separate Google Analytics property) — no advertising and no Meta Pixel.
3.3. Advertising (with consent)
- Meta Pixel (Facebook, Instagram) — measuring the effectiveness of our ads and showing them to people who have visited the website. Cookies
_fbp,fr(for up to 3 months). - Google AdSense — displaying Google ads on the website.
Without your consent, the Meta Pixel and AdSense do not load at all.
3.4. Maps
On the Contact page we show maps with directions to our centres from OpenStreetMap — this service does not store cookies and does not track visitors, which is why the maps are displayed without your consent. The “Get directions in Google Maps” and “Open in Google Maps” buttons open Google Maps in a new tab or in the app; there, the Google privacy policy applies.
4. Who we share data with
We do not sell data. We share it only where necessary:
- Examination bodies — SSVV (Stichting Samenwerken Voor Veiligheid) and the examination centre where your exam takes place (e.g. Examenbureau Rotterdam, Het Certificaat): the participant’s initials, surname and date of birth. Without these, a VCA exam cannot be held and no diploma can be issued.
- Mollie B.V. (Amsterdam) — handling online payments. You enter your card details and bank login details directly with Mollie; we neither see nor store them.
- Synomi — our system for billing, invoices and participant records, run by the same owner (synomi.ai — warmly recommended).
- Anthropic — the language model behind our assistant Kasia (section 2.5). We do not send your personal data to Anthropic — only the anonymised content of the conversation needed to put together a specific answer.
- Google (Analytics, AdSense, Maps) and Meta (Pixel) — solely to the extent described in section 3.
- Cloudflare, Inc. — protection of forms and the practice test against bots (Turnstile). Cloudflare processes your IP address and basic browser information to assess whether there is a human on the other side.
We store data in a data centre in the Netherlands.
5. How long we keep data
- Orders and invoices: 7 years from the end of the tax year — as required by Dutch tax law.
- Participant data and diploma numbers (first names, surname, date of birth and the name, number and expiry date of the qualifications obtained) — for as long as the qualifications are valid. We do not store the number of failed attempts or the number of points scored. On this basis we confirm the validity of diplomas and issue duplicates if documents are lost.
- Customer account: until it is deleted.
- Enquiries and messages from the form: up to 2 years from the last contact.
- Conversations with Kasia: 12 months, anonymised (section 2.5).
- Marketing consents: until they are withdrawn; we remember the fact of withdrawal itself so that we don’t send you anything again.
- Server logs (IP address, browser): up to 90 days, for security purposes.
6. Your rights
You have the right to: access your data and receive a copy of it, rectification, erasure (the “right to be forgotten” — except for data we are required by law to keep), restriction of processing, data portability, object to processing based on our legitimate interest, and withdraw your consent at any time (without affecting what we did before).
How do you exercise these rights? Write to info@akademiavca.nl saying what you would like (e.g. a copy of your data or its erasure). We will respond to your request within one month; in complex cases we may extend this by a further two months — and if so, we will tell you why. Before we carry out your request, we may ask you to confirm your identity, so that we don’t disclose your data to someone else.
If you believe we are processing your data unlawfully, you can lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.
7. Security
- All communication with the website is encrypted (HTTPS).
- We store passwords only in encrypted form — only you know your account password. Remember not to share your login details with anyone.
- Two-step verification: when you log in with a password from a new device, we send a one-time code to your email, without which you cannot access the account. You can mark the device as trusted for 30 days — we remember it in a cookie, and changing your password invalidates all trusted devices.
- Participant data in the billing system is encrypted.
- Only authorised members of our team have access to the data.
- We make regular backups and keep the server software up to date.
If a personal data breach occurs, we will report it to the Autoriteit Persoonsgegevens within 72 hours, and if the breach poses a high risk to you, we will inform you directly.
8. Transfers of data outside the European Economic Area
We process data in the Netherlands. The exceptions are services from companies whose servers may be located in the USA: Google, Meta, Anthropic and Cloudflare. Such transfers take place on the basis of the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.
9. Changes to this policy
When we change this policy, we publish the new version on the website with its effective date. We also inform account holders of significant changes by email.
The previous version was effective from 1 October 2025.
