Privacy policy
Version 2.3, published on 9 November 2026.
This is an English translation of the Dutch privacy policy (Privacybeleid). If the two versions differ, the Dutch version prevails.
This privacy statement explains how LearnLLM handles your personal data. We explain which data we process, why we do so, who we share it with, how long we keep it and what rights you have. This statement applies to visitors to learnllm.nl, course participants, customers of our services, contact persons of business customers and newsletter subscribers.
1. Who is responsible for your personal data?
LearnLLM offers e-learnings about AI through learnllm.nl and provides services for organisations, such as the tailored AI policy. LearnLLM is the controller within the meaning of Article 4(7) GDPR for the processing operations described in this privacy statement. Legal form: sole proprietorship (eenmanszaak) Trade name: LearnLLM Business address: Philitelaan 61-169, 5617 AL Eindhoven Chamber of Commerce (KvK): 42035044 VAT number: NL005445465B41 Privacy contact email: info@learnllm.nl LearnLLM has not appointed a data protection officer, because this is not mandatory for a business of this size and nature. For privacy questions, requests or reports of a possible data breach, you can contact us at the email address above.1.1 When LearnLLM is a processor
If, as part of a service, LearnLLM processes personal data on behalf of an organisation, for example in sample material supplied by that organisation, that organisation is the controller and LearnLLM is the processor. That processing is not covered by this privacy statement, but by the data processing agreement with that organisation. Without a data processing agreement, we ask organisations to supply anonymised material only.2. Which personal data do we process?
We only process personal data that is necessary to provide our e-learnings and services.2.1 Account data
- First name and surname (if provided)
- Email address
- Password (stored encrypted)
- Account ID
2.2 Order and administrative data
- Order ID
- E-learnings or services purchased
- Billing details, including company name and billing address (if business)
- VAT number (if business)
- Payment status
2.3 Payment data
LearnLLM does not process full payment card details. Payments through the website are handled by external payment providers. LearnLLM only receives:- Transaction ID
- Payment status
- Payment method
2.4 Learning data and progress data
- Progress per module
- Completed sections
- Results of knowledge checks and other quizzes
- Attempts and results of the final test (if applicable): score per attempt and per module, date and time
- Active learning time: how much time you spend on lesson and quiz pages while the tab is visible and you are active, per lesson
- Evaluation of the e-learning (if completed): your rating of the statements, the study time you reported, an overall grade and your answers to the open questions
- Certificate data (if applicable): name, e-learning, completion date, certificate number, verification code, study load, final test score, measured learning time, the learning objectives of the e-learning and your own reflection from the evaluation
- Activity timestamps
2.5 Data of business customers and their employees
- Name, job title, email address and telephone number of contact persons
- Names and email addresses of employees for whom an organisation purchases e-learning access
- Answers in intake questionnaires, such as information about work processes and current AI use
- Notes of conversations and correspondence about an engagement
- Deliverables and feedback that we prepare as part of an engagement
2.6 Support data
- Email correspondence
- Questions submitted by email or contact form
- Feedback
2.7 Technical and security data
- IP address
- Browser and device data
- Log files
- Security logs
- Cookie IDs
2.8 User input in assignments
- Text input
- Answers
- Any uploads
2.9 Newsletter data
- Email address
- First name and surname (if provided)
- Sign-up date and source
- Open and click statistics
3. Purposes and legal bases (Art. 6 GDPR)
We only process personal data on the basis of one or more of the legal bases below.3.1 Performance of the contract (Art. 6(1)(b) GDPR)
We process personal data to perform the contract with you, including:- Account registration
- Processing orders
- Supply of digital content and access to the portal
- Recording progress
- Administering and assessing the final test (if applicable)
- Issuing certificates and learning records (if applicable)
- Performing services, such as the tailored AI policy
3.2 Legal obligation (Art. 6(1)(c) GDPR)
We process personal data to comply with legal obligations, including:- Tax records (7-year retention obligation)
- Requests from competent authorities
- Handling withdrawals and requests under the GDPR
3.3 Legitimate interest (Art. 6(1)(f) GDPR)
We process personal data on the basis of our legitimate interest for:- Security of the platform
- Fraud prevention and automatic blocking in the event of brute-force attacks or suspicious behaviour
- Monitoring and limiting abuse
- Technical logging
- Improving functionality and services
- Limited statistics (aggregated where possible)
- Contact with contact persons of business customers and business relations
- Approaching organisations and potential partners by email with information about our e-learnings and services. For this we only use general email addresses of organisations (such as info@), from public sources: the organisation’s website, Google Maps and the KvK Trade Register (Handelsregister). Every email includes an option to unsubscribe; after an unsubscribe we no longer email that organisation
- Reporting progress and completion to an organisation that has purchased e-learning access for its employees
- Keeping certificate data, so that a completed certificate can be confirmed later, including online via the verification code
- Measuring active learning time and collecting evaluations, to substantiate the study load of our e-learnings, including towards professional bodies that recognise continuing professional development, and to improve the e-learnings. We only report summarised results without names to professional bodies
- Emails to existing customers about similar products of our own, with the option to unsubscribe in every email
- Establishing, exercising or defending legal claims
3.4 Consent (Art. 6(1)(a) GDPR)
We process personal data on the basis of consent for:- Analytical cookies (Google Analytics 4 and Microsoft Clarity)
- Marketing cookies and tracking pixels (if active)
- The newsletter, if you are not an existing customer
- Recording a video call
4. Recipients and processors
LearnLLM uses external service providers that process personal data on behalf of LearnLLM. The main processors are:- Strato AG: hosting of the website and the learning portal
- Brevo (Sendinblue SAS): sending emails from the website, such as order confirmations, access emails, reminders and certificates
- Hetzner Online GmbH: hosting of a server within the EU for our own automation, including the emails to organisations described in section 3.3
- Google Ireland Limited: business email and document storage (Google Workspace), Google Analytics 4 for website statistics and storage of analytics data (Google Cloud BigQuery, location EU)
- Mollie B.V.: payment processing
- PayPal (Europe) S.à r.l. et Cie, S.C.A.: payment processing
- Mailchimp (Intuit Inc.): newsletter and automated email communication, partly via the Mailchimp for WordPress integration
- e-Boekhouden.nl: invoicing and accounting
- Microsoft Ireland Operations Limited: video calls via Microsoft Teams and, after your consent, insight into how the website is used via Microsoft Clarity
- Providers of AI tools, such as Anthropic and Google: support in drafting texts and deliverables. For this we only use business accounts in which the provider does not use the data entered to train models, and we enter as little personal data as possible.
- the organisation that purchased e-learning access for you, insofar as it concerns your progress and completion;
- anyone to whom you give the verification code of your certificate, such as an employer or professional body: via learnllm.nl/en/verify-certificate that person sees your name, the e-learning, the date of issue, the certificate number, the study load and whether you passed the final test. Nothing can be retrieved without the code;
- professional bodies that recognise continuing professional development, only in the form of summarised results without names;
- our bookkeeper or accountant and the Dutch Tax and Customs Administration (Belastingdienst), for our records;
- competent authorities, if we are legally obliged to do so.
5. Transfer outside the EEA
Most processing takes place within the European Economic Area. A number of processors, including Google, Microsoft, Mailchimp, PayPal and Anthropic, may also process data in the United States. For this transfer, we ensure appropriate safeguards, such as:- the EU-US Data Privacy Framework (DPF), insofar as the party concerned is certified under it;
- EU standard contractual clauses (SCCs);
- additional technical and organisational measures where necessary.
6. Retention periods
We do not keep personal data for longer than necessary for the purposes for which we process it, unless a legal obligation requires a longer retention period.- Invoices and records: 7 years (statutory tax retention obligation)
- Account data: as long as the account is active, plus 12 months after the last activity or the end of the last access period
- Learning data and progress: for as long as the access period runs, plus 12 months afterwards
- Certificate data (see section 2.4): 5 years after issue
- Attempts and results of the final test: 5 years
- Measured learning time and evaluations: 2 years
- Intake answers and engagement files: up to 2 years after completion of the engagement, or earlier at the customer’s request, except insofar as they form part of our records
- Sample material supplied by customers: no later than 3 months after completion of the engagement
- Data of contact persons of business relations: up to 2 years after the last contact
- Data of organisations we have approached by email: up to 2 years after the last email. After an unsubscribe, we only keep the email address or domain on a block list, so that we do not email again
- Support data and email correspondence: 2 years
- Withdrawal requests: 2 years
- Security logs: 90 days
- Orders that are pending, failed or cancelled: 30 days
- Newsletter data: until you unsubscribe
- Google Analytics 4 data: 14 months
7. Cookies and tracking
LearnLLM uses cookies and similar technologies. We distinguish:7.1 Functional cookies
These cookies are necessary for the website and the learning portal to function, such as logging in, session management and the WooCommerce shopping cart. No consent is required for these.7.2 Analytical cookies
We use Google Analytics 4 to gain insight into the use of the website. With the same consent we use Microsoft Clarity, which shows how visitors use pages, for example clicks and scrolling. Clarity is not loaded on the shopping cart, checkout, account, certificate and learning pages. We only place these cookies after you give consent via the cookie banner.7.3 Marketing cookies
We only place marketing cookies and advertising pixels if you give consent for this via the cookie banner.7.4 Cookie banner and consent
We use Complianz to request and record consent. You can change your cookie preferences or withdraw your consent at any time via the cookie settings on the website. More information is in our cookie statement (in Dutch).8. Security
LearnLLM takes appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:- SSL/TLS encryption of data traffic
- Encrypted storage of passwords
- Two-factor authentication on administrator and business accounts
- Access management on a need-to-know basis
- Regular updates and security patches
- Logging and monitoring for security purposes
- Backups and recovery procedures
9. Automated decision-making, profiling and AI
LearnLLM does not use automated decision-making or profiling that produces legal effects or significantly affects you. Limited automatic flagging may take place for security purposes, for example in the case of suspicious login attempts or abuse detection. These measures fall under security on the basis of legitimate interest. The final test of an e-learning is marked automatically using a fixed answer key and a pass mark known in advance; no AI is involved. After three failed attempts, a waiting period with a retake plan follows automatically. If you think something is not right with the marking or with that waiting period, email info@learnllm.nl: Dennis van de Velde will then review your attempts himself and can adjust the outcome. We use AI tools as an aid in drafting texts and deliverables. A person always reviews that output before it is used. Decisions about you are not made by AI.10. Your rights
Under the GDPR you have various rights. You can submit a request via info@learnllm.nl.- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR), in particular for processing based on legitimate interest
- Right to withdraw consent, if the processing is based on consent
10.1 Direct marketing
If we use direct marketing, such as a newsletter, you can always object or unsubscribe via the unsubscribe link in the email. After you unsubscribe, we no longer process your data for marketing purposes.11. Lodging a complaint
If you are not satisfied with how we handle your data, please contact us first. You also always have the right to lodge a complaint with the supervisory authority in the country where you live or work:- In the Netherlands: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via autoriteitpersoonsgegevens.nl
- In Belgium: the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), via gegevensbeschermingsautoriteit.be
12. Minors
LearnLLM is not aimed at children under the age of 16. If we establish or reasonably suspect that we are processing personal data of a child under 16 without the consent of a parent or legal representative, we take appropriate measures and delete the data as soon as possible.13. Questions, requests and data breach reports
For questions, requests or to report a possible data breach, you can contact us via info@learnllm.nl.14. Changes to this privacy statement
We may change this privacy statement, for example if our services change or if legislation requires it. The most recent version is always available on learnllm.nl, with the version number and publication date at the top. In the event of material changes, we inform customers with an active account or ongoing engagement by email.Processing activities at a glance
| Purpose | Data | Legal basis | Retention period | Transfer outside EEA |
|---|---|---|---|---|
| Account management and access | Email, name, account ID, login and session data | Contract (Art. 6(1)(b)) | As long as account is active, plus 12 months | No |
| Orders and administration | Order ID, e-learnings or services purchased, billing details, VAT details, payment status | Contract and legal obligation (Art. 6(1)(b) and (c)) | 7 years (tax retention obligation) | No |
| Processing payments | Transaction ID, payment status, payment method, account details for bank transfers | Contract (Art. 6(1)(b)) | 7 years (records) | Possibly (PayPal) |
| Progress and learning data | Progress, module status, quiz results, certificate status, timestamps | Contract (Art. 6(1)(b)) | Access period plus 12 months | No |
| Administering and assessing the final test | Attempts, answers, score per attempt and per module, dates | Contract (Art. 6(1)(b)) | 5 years | No |
| Preparing and confirming the certificate and learning record | Name, e-learning, date, certificate number, verification code, study load, final test score, measured learning time, learning objectives, reflection | Contract and legitimate interest (Art. 6(1)(b) and (f)) | 5 years after issue | No |
| Substantiating study load and improving e-learnings | Active learning time per lesson, evaluation answers | Legitimate interest (Art. 6(1)(f)) | 2 years | No |
| Progress reporting to employer | Name, e-learning, progress, completion | Legitimate interest (Art. 6(1)(f)) | Access period plus 12 months | No |
| Services, such as the tailored AI policy | Contact details, questionnaire answers, conversation notes, correspondence, deliverables | Contract and legitimate interest (Art. 6(1)(b) and (f)) | Up to 2 years after completion of the engagement | Possibly (Google, Microsoft, Anthropic) |
| Support and communication | Email correspondence, support content, feedback | Contract and legitimate interest (Art. 6(1)(b) and (f)) | 2 years | Possibly (Google) |
| Security and abuse prevention | IP address, security logs, log files, device and browser information | Legitimate interest (Art. 6(1)(f)) | 90 days | No |
| Analytics | Cookie IDs, usage data, device and browser information | Consent (Art. 6(1)(a)) | 14 months | Yes (Google, Microsoft) |
| Newsletter and email marketing | Email address, name, preferences, click statistics | Consent, or legitimate interest for existing customers (Art. 6(1)(a) and (f)) | Until unsubscribed | Yes (Mailchimp) |
