Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

Last updated: 29 October 2026

1. Controller

The controller for data processing on examelia.com and in the Examelia learning environment is:

Examelia – Vico Development B.V.

Walserij 4, 2211 SJ Noordwijkerhout, The Netherlands

Email: info@examelia.com

We have not appointed a data protection officer. For privacy questions, write to us at info@examelia.com.

2. Visiting the website (hosting)

The website is operated by the hosting provider Lovable. Each time a page is accessed, technically necessary data is processed: IP address, date and time, page accessed, previously visited page (referrer), browser and operating system. The purpose is to deliver the website and keep it stable and secure. The legal basis is our legitimate interest (Art. 6(1)(f) DSGVO, the EU General Data Protection Regulation). The hosting provider processes the data on our behalf (Art. 28 DSGVO).

3. Order, account and learning environment

When you book Examelia, we process your name, email address, chosen course parts and term, contract and payment data (amount, date, status, payment method) and your login details. In the learning environment (currently at login.cursus-group.nl) we store your learning progress, such as answered questions and results, to show it to you.

The legal basis is performance of the contract (Art. 6(1)(b) DSGVO) and, for invoice and accounting data, our statutory retention obligation (Art. 6(1)(c) DSGVO). The data is stored in a database at Supabase (servers in the EU), which works on our behalf.

4. Payment

Payments are processed by Mollie B.V. (Amsterdam, the Netherlands). You enter your card or account details directly with Mollie or the chosen payment method; we only receive the amount, date, status, payment method and a reference that allows Mollie to collect the monthly instalments. Depending on the payment method, PayPal, Apple, Google and the card-issuing bank also process data under their own responsibility. Legal basis: Art. 6(1)(b) and (c) DSGVO.

5. Emails

Contract emails (order confirmation, login details, payment, cancellation and withdrawal confirmations) are sent via Brevo (Sendinblue SAS, Paris, France) as our processor. Legal basis: Art. 6(1)(b) DSGVO.

Scratch card promotion: if you enter your email address for it, we use it to assign and send you the discount (Art. 6(1)(b) DSGVO).

Marketing emails and newsletter (e.g. study tips and offers) are only sent if you consented by ticking a separate box that is not pre-ticked and confirmed your address via the link in our confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) DSGVO, Section 174 TKG 2021, Austrian Telecommunications Act). As proof we store the time and IP address of sign-up and confirmation (Art. 6(1)(c) and (f) DSGVO). Brevo may record whether an email was opened and a link clicked; we use this only to improve our emails. You can unsubscribe at any time via the link in every email or by emailing us.

6. Contact

If you write to us or call us, we process your details to handle your request (Art. 6(1)(b) DSGVO, otherwise (f)). Our email mailbox is hosted by Microsoft (Microsoft 365).

7. Cancellation and withdrawal via the website

If you cancel or withdraw via examelia.com/at/en/kuendigen or examelia.com/at/en/ruecktritt, we process the details from the form (type of declaration, reason if any, name, email address, contract number, requested date) and the time of receipt in order to carry out the declaration, confirm it to you and be able to prove it (Art. 6(1)(b) and (c) DSGVO).

8. Cookies and similar technologies

So that the website works, we store on your device your language choice, whether you have closed the cookie notice, your login to the learning environment and the progress of your order and the scratch-card offer (Section 165(3) TKG 2021).

In addition, from the first page view we load the Meta pixel and the Google tag (Google Ads, Google Analytics) and store which ad or campaign brought you to us (UTM parameters and click IDs such as fbclid, gclid, gbraid or wbraid). We do not ask for consent beforehand; the notice at the bottom of the page informs you about it. This creates, among others, these cookies and entries: _fbp and _fbc (Meta, 90 days), _gcl_… (Google Ads, 90 days), _ga (Google Analytics, up to two years), _tracking_… (campaign and click ID, 30 days) and Meta’s click ID in your browser’s local storage (90 days).

You can prevent this in your browser by blocking third-party cookies, deleting cookies and site data or using an ad blocker. For the reports sent from our server (section 9), your right to object applies (section 14).

9. Advertising and measurement

Meta pixel and Conversions API. The provider is Meta Platforms Ireland Ltd. (Dublin, Ireland). The pixel records page views and events such as viewing an offer, starting an order, signing up with an email address and a purchase (with value), together with IP address, browser details and cookie identifiers. We also send the same events from our server directly to Meta (Conversions API), with IP address, browser identifier, cookie and click ID and, once you provide them, your email address and name in hashed (irreversibly converted) form. Meta may link this data to your Facebook or Instagram account. This shows us which ads work and lets us target ads more precisely. We are jointly responsible with Meta for the collection and transmission (Art. 26 DSGVO); the agreement for this is Meta’s “Controller Addendum”. Meta alone is responsible for any further processing.

Google Analytics and Google Ads. The provider is Google Ireland Ltd. (Dublin, Ireland). Google Analytics evaluates how the website is used (page views, device details, approximate location, events). Google Ads conversion tracking records whether an order follows a click on a Google ad; for this we also report an order from our server to Google (click ID, time, value, IP address, browser identifier and your email address and name, and if you provide them your postcode and country, in hashed form).

The legal basis is our legitimate interest in measuring the effect of our advertising and managing it economically (Art. 6(1)(f) DSGVO). You can object at any time (section 14); an email to info@examelia.com is enough. The providers store the cookies as stated in section 8. If you sign up or place an order, we store the ad, campaign and click ID details together with that sign-up or order.

10. Videos

We embed learning videos via Bunny Stream (BunnyWay d.o.o., Ljubljana, Slovenia). The player only loads when you click the video; your IP address and device information are then sent to Bunny to deliver the video (Art. 6(1)(b) or (f) DSGVO, Section 165(3) TKG 2021).

11. Fonts

The fonts are hosted on our own server. No connection to Google Fonts is made when you visit the website.

12. Recipients and transfers to third countries

We do not sell your data. It is only received by:

Lovable – website hosting (processor);
Supabase – database and login, servers in the EU (processor);
Mollie (Netherlands) – payment processing;
Brevo (France) – sending emails (processor);
Microsoft – customer service mailbox (processor);
Bunny (Slovenia) – video delivery (processor);
Meta and Google – advertising and measurement (sections 8 and 9);
tax advisers and authorities where we are legally obliged.

Meta, Google, Supabase and Microsoft have parent companies in the USA; access from there cannot be ruled out. Transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and additionally on the Commission’s standard contractual clauses (Arts. 45, 46 DSGVO).

13. Retention periods

Invoices and accounting records: as long as tax law requires – seven years under Dutch law, ten years for records of sales under the OSS scheme.
Account and learning progress: until the end of the contract; after that we delete them as soon as you ask us to.
Cancellations, withdrawals and proof of consent: three years after the end of the year in which they were received.
Email address for the newsletter: until you unsubscribe.
Ad and campaign details: 30 to 90 days in the browser (section 8); with a sign-up or order, together with it.
Customer service requests: as long as needed to handle them and any follow-up questions.

14. Your rights

You have the right of access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An email to info@examelia.com is enough; we reply within one month. To avoid giving data to the wrong person, we may ask you to verify your identity.

Right to object (Art. 21 DSGVO): where we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO). If you live in Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at. You can also contact the supervisory authority of the country where you live or work, or the authority where our company is established: our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

15. Obligation to provide data, no automated decisions

For the contract we need your name, email address and payment; without them we cannot give you access. All other information is voluntary. We do not make automated decisions within the meaning of Art. 22 DSGVO.

16. Security and changes

The connection to the website and the learning environment is encrypted (TLS). Only people who need access for their work can access the data. We update this policy when our processing or the law changes; the version published here applies.

Examelia