1. Who we are
This notice explains how Communitaal ("we", "us") handles your personal data when you fill in our course registration form. Controller: Communitaal — a trade name of the sole proprietorship (eenmanszaak) The Digital Baron. KvK number: 98294636. Address: Korte Annastraat 7, 2011 ZM Haarlem. Contact for privacy questions: privacy@communitaal.nl. We are the data controller — we decide what data is collected and why.
2. What we collect
When you register interest in a course, we ask for: your name; email address; phone number (for course updates, e.g. via WhatsApp); current Dutch level (to check the course fits you); native language(s) (to help us teach you well); why you want to learn Dutch (optional); how you heard about us; and anything else you choose to tell us. We do NOT collect payment card or bank details through this form — payments are handled separately by our payment provider. In addition, if you consent to marketing cookies, a SHA-256 hashed version of your email address and a pseudonymous internal user identifier may be shared with Google (see section 5c) — never your name, plain email, or phone number.
3. Why we use it, and our legal basis
To process your registration and arrange your place on a course (performance of a contract, or steps before a contract — Art. 6(1)(b)); to contact you about your registration and the course (Art. 6(1)(b)); to keep your details if you enquire but don't yet enrol (your consent, Art. 6(1)(a) — you can withdraw it any time). We only collect what we need.
4. How long we keep it
If you enrol: for the duration of your course and for 7 years afterwards, as required by Dutch tax and administration law. If you enquire but don't enrol: we delete your details after 12 months, unless you ask us to keep them. You can ask us to delete your data sooner.
5. Who we share it with
Trusted service providers ("processors") who handle data on our behalf under a data processing agreement: Lovable / Supabase (EU region) — runs our website and securely stores your registration in the EU, encrypted, access restricted to us; Mollie (Netherlands) — processes your course payment; Moneybird (Netherlands) — issues your invoice; our email infrastructure (Mailgun, EU) sends transactional emails on our behalf; Resend (email delivery for our newsletter; EU region; DPA in place); Google (Analytics + Ads conversion tracking) — only when you have consented to analytics or marketing cookies. We do NOT sell your data or share it for advertising.
5b. Newsletter
If you subscribe to our newsletter, we collect your email address and a consent record (timestamp, IP address, browser) at the moment you sign up. This is stored in our separate EU database and in Resend, our email delivery provider. We use double opt-in: you confirm by clicking a link we email you. We send roughly one email a month. You can unsubscribe at any time via the link in every email. Newsletter emails are sent from news.communitaal.nl.
5c. Analytics & advertising (Google)
We use Google Analytics 4 (GA4) and Google Ads. Both are gated by the cookie banner: nothing runs until you consent, and you can change or withdraw your consent at any time. In detail:
Google Analytics 4 — anonymous usage statistics (pages visited, time on site, device type). IP addresses are truncated before storage. Runs only with the Analytics category enabled.
Google Signals — if you are signed in to a Google account and have turned on Ads Personalization at Google, Google may associate your visit here with cross-device, approximate location, YouTube and search signals to give us aggregated demographic and interest reports. We never see individual profiles. Runs only with the Marketing category enabled. You can view and delete this activity via myactivity.google.com.
User-ID — when you are logged in to your student or teacher area, we may pass a pseudonymous internal identifier (not your name, email or phone) to GA4 so your sessions across devices count as one user. This lets us produce more accurate user counts. It is never personally identifiable on Google's side.
User-provided data (hashed) — with your Marketing consent, we may send a SHA-256 hashed version of your email address to Google to improve conversion measurement. Google receives only the hash — not your plain email. This helps us measure which ads actually lead to registrations. Runs only with the Marketing category enabled.
Ads Personalization — with your Marketing consent, GA4 audiences and key events may be exported to our linked Google Ads account so we can show relevant ads and measure ad performance. You can opt out any time via our cookie banner or via Google Ads Settings.
Hosting platform analytics — our website hosting platform also runs its own first-party Google Analytics measurement for platform product metrics; it is subject to the same cookie-consent choice, so no analytics or marketing storage occurs until you consent.
6. Your rights
Under the GDPR you have the right to access, correct, erase, restrict or object to our use of your data, withdraw consent, and data portability. To exercise any of these, email privacy@communitaal.nl. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. Security
Your data is stored in the EU, encrypted in transit and at rest, with access limited to the people who need it to run the course.
8. Changes to this notice
We may update this notice. The current version is always on this page, with the "last updated" date.
Version: 2026-07-10