Privacy statement
Version 25 October 2026
We are careful with your data. Here you can read which data we use, why, who we share it with and what rights you have.
Who is responsible
Zanaro B.V. (trade name Civizon), the Netherlands, Chamber of Commerce (KvK) 99115344. Privacy contact: support@civizon.com. All our company details are on the company details page.
Which data and why
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| Email address, language, country | Account, sending login code, confirmations | Contract (Art. 6(1)(b)) | Up to 12 months after your access ends |
| Name and email address from Google or Apple (if you log in or pay that way) | Logging in without a code, account, name on the account | Contract (Art. 6(1)(b)) | Up to 12 months after your access ends |
| Name on the account | One account per person, pass guarantee | Contract (Art. 6(1)(b)) | Up to 12 months after your access ends |
| Exam date | Countdown, free extension | Contract (Art. 6(1)(b)) | Up to 12 months after your access ends |
| Answers and scores | Learning path, progress, mock exams | Contract (Art. 6(1)(b)) | Up to 12 months after your access ends |
| Purchase (amount, date, Mollie reference, consent to immediate delivery with time) | Payment, proof of your consent, accounting | Contract and legal obligation (Art. 6(1)(b) and (c)) | 7 years (tax retention obligation) |
| Device identifier (random code in a cookie, stored encrypted), encrypted IP address, rough network part of your IP, login times | Security, maximum of 2 devices, detecting account sharing | Legitimate interest (Art. 6(1)(f)): preventing misuse and fraud | 90 days after your last login |
| Exam result (upload) | Assessing the pass guarantee | Contract (Art. 6(1)(b)) | 12 months after our decision |
| Email for practice tips | Tips and offers about Civizon | Consent (Art. 6(1)(a)) | Until you unsubscribe |
| Measuring visits and ads (functional and analytical, always on) | Measuring visits, page views and how ads perform, improving the website | Legitimate interest (Art. 6(1)(f)) | See the cookie policy |
| Marketing cookies and encrypted email address on a purchase | Measuring which ad led to a purchase, more relevant ads | Consent (Art. 6(1)(a)) | See the cookie policy |
For your exam result, we only ask you to send what is needed: your name, the date and the result. You may cover up any other details.
Who processes data for us
| Party | What | Where |
|---|---|---|
| Hostinger (Hostinger International Ltd.) | Server and email for civizon.com | EU (data centre in the EU) |
| Mollie B.V. | Payments | Netherlands, EU |
| OpenAI (OpenAI Ireland Ltd. / OpenAI L.L.C.) | Only if the "free question to the AI" feature is switched on: your question, without name or email | EU and US (EU-US Data Privacy Framework and standard contractual clauses) |
| Google (Google Ireland Ltd.) | Analytics: always. Ads: only with your consent | EU and US (Data Privacy Framework) |
| Meta (Meta Platforms Ireland Ltd.) | Pixel: always. Conversions API (encrypted email address on a purchase): only with your consent | EU and US (Data Privacy Framework) |
| TikTok (TikTok Technology Ltd., Ireland) | Pixel: always. Events API (encrypted email address on a purchase): only with your consent | EU, with transfers outside the EU under standard contractual clauses |
If you log in with Google or Apple, we only receive your name and an email address they have verified from Google Ireland Ltd. or Apple Distribution International Ltd. With Apple this can be a forwarding address (ending in privaterelay.appleid.com); email sent there still reaches you. Google and Apple are themselves responsible for logging in with them; their own privacy statements apply. We never receive your password or access to your Google or Apple account.
Mollie is itself responsible for part of the payment (for example for fraud checks). Mollie's privacy statement applies to that part.
We do not sell your data.
Automated signals
We automatically detect signals that an account is being shared (for example a third device or simultaneous use). A third device is refused until you replace another device. Beyond that, a human looks at the signals before we pause your access. You can always ask for an explanation and for a review by a human.
Your rights
You may access your data, have it corrected or have it deleted. You can object, have the processing restricted and take your data with you. If you gave consent, you can always withdraw it (for cookies via "Cookie settings" at the bottom of every page). To do so, email support@civizon.com. We respond within one month.
You can also file a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or with the data protection authority in your own country, in France the CNIL.
Security
We store login codes, sessions, device identifiers and IP addresses encrypted (hashed). The connection is always encrypted (https). An upload of your exam result can only be viewed by our administrators.
Changes
If we change this statement, you'll see it from the date at the top. We notify you of important changes by email.