Privacy

Who is responsible for your data

Edutiers is operated by Devmon, established in the Netherlands, which is the controller for everything described on this page. Because the site is published from the Netherlands, Dutch and EU data protection law applies to all of it.

What this policy covers

It covers the public site, the reviewer account area, the institution portal and the staff back office. It is written to satisfy Articles 13 and 14 of the GDPR, which is a longer way of saying that it has to tell you about data you gave us and about data you never gave us — and the second half is the one that matters most here.

If you have an account

An account needs an email address and nothing else. We generate a pseudonym for you, which is the only name any other visitor ever sees; your real name is not asked for and not stored. We also keep the language you read in, whether your address is verified, and — if you chose to set one — a hashed password. The lawful basis is the contract you enter into by using the account (Article 6(1)(b)).

Reviews you write

A review is published content: its text, ratings, tags, the years you attended and your relationship to the school (student, alumnus, parent, staff) are all shown publicly under your pseudonym. Alongside it, and never shown, we store one-way hashes of the IP address and browser identification the submission arrived with — the hashes only, never the values themselves, so nothing here can be turned back into an address. They exist so that spam, brigading and duplicate submissions can be detected and so that a moderation decision can be explained months later; the lawful basis is our legitimate interest in a review corpus that is worth reading (Article 6(1)(f)).

Data we hold that you never gave us

This is the Article 14 part, and it is the reason this page exists in the shape it does. Our catalogue is built from public education registers — inspectorates, ministries and statistical offices, each one named on the data sources page. Those registers publish more than school names, and we keep what they publish.

For institutions that means official contact addresses, sometimes several, and in some countries the name of the head teacher or director alongside the address, plus inspection outcomes and official ratings.

Contact addresses and the names of individual staff are never shown on the site, never in an API response, and never in a data export. They exist for one purpose: writing once to a school about its own listing on this catalogue. Nothing else reads them.

The lawful basis is legitimate interest (Article 6(1)(f)): the data concerns a person in their professional capacity, it was published by their own regulator without restriction, we use it to contact them about their own organisation, and we write once. We keep a written assessment of that balance and we record, per address, which register it came from and when.

You can object at any time under Article 21, and you do not have to explain why. An objection is honoured before anything else is decided: the address goes on a suppression list held as a one-way hash, the plaintext is deleted, and no further processing of it happens. The notice form below is the fastest route.

Where our data comes from

Teachers

Programmes are taught by people, so reviews of teaching are reviews of those people. Teachers are therefore never published under their own names: a teacher appears only as a number, real names are held encrypted in a separate table with its own access rules, and a teacher entity is only shown at all once enough colleagues and enough reviews exist that the number cannot be resolved by elimination. Special-category content — health, religion, ethnicity, sexuality — is blocked outright rather than flagged. A teacher may object, ask for erasure, or ask for a right of reply, and an objection outranks every other consideration on this page, including a technical safeguard that is fully satisfied.

If you claim or manage a listing

Claiming a school means giving a work email address and your role there, so that we can check that the person editing a public profile belongs to the organisation it describes. We keep the claim, its outcome and who decided it, along with the edits made from the portal and who made them. The lawful basis is the contract with the institution and our legitimate interest in a catalogue that cannot be edited by strangers. A photograph you attach as proof of a claim is seen by staff only and deleted once the claim is decided.

If you send us a notice or a complaint

The notice form asks for your name, an address we can answer at, the page you are objecting to, the ground and your explanation. We keep all of it, along with what we decided and why. It has to be kept: a moderation decision that cannot be explained later is not a defensible one, and if a decision is ever challenged the record is what answers for it.

How we measure the site

We count what pages are asked for, entirely on our own servers, and store the result in our own database. No third party is involved and no script runs in your browser to do it.

What a row holds

• the page address, without its query string
• which kind of page it was, and which school or programme where that applies
• a country, at country level only, as our CDN guesses it from the network
• the host that linked to us — never the full address, so a search term cannot travel with it
• whether the request looked like a crawler, and the time it happened

What a row never holds

• your IP address — not hashed, not shortened, not temporarily
• your browser identification string
• any cookie, session, device or advertising identifier
• any link to your account, if you have one

Because nothing is stored on your device and nothing already stored there is read, this measurement falls outside the consent rule in the ePrivacy Directive, and no consent is asked for it. That is a design constraint rather than a loophole: the moment this layer needed a cookie, the site would need a banner, so it is built so that it never can. The lawful basis is legitimate interest in knowing whether the product works.

Cookies

The site sets functional cookies only, all of them strictly necessary for something you asked it to do. There are no analytics, advertising or profiling cookies, no third-party tags, and therefore no consent banner — under the ePrivacy rules a banner is required for the cookies we deliberately do not set.

• a session cookie, once you sign in, so that you stay signed in
• a security token that proves a form submission came from this site
• the language you chose, so you are not asked again
• the country and region you filtered to, for the same reason
• whether you asked to see tiers or scores in a ranking, so the list looks the way you left it

Closing your account

You can close your account from your account settings. When you do, the account is deleted and your reviews stay up — the link between you and them is severed rather than the reviews being removed.

We say this plainly because it surprises people. If deleting an account deleted its reviews, then deleting an account would be a way to erase criticism, and the corpus would only ever be as honest as its least happy subject. The pseudonym is what makes this workable: after deletion the review has no author to trace, no address attached and nothing linking it to you. If a review contains something that identifies you personally, tell us through the notice form and we will edit or remove that review itself.

How long we keep things

Nothing is kept because it might be useful one day. Each of these has a reason and an end date, and the deletions run on a schedule rather than when somebody remembers.

• Accounts: until you close them, which you can do yourself at any time.
• Reviews: indefinitely, as published content, detached from any closed account.
• The submission hashes stored with a review: as long as the review itself. They are one-way and cannot be turned back into an IP address or a browser, and they are what makes a brigading pattern provable long after the fact.
• Raw analytics rows: 90 days, deleted by a scheduled job rather than by anyone remembering.
• Daily analytics totals: indefinitely. They are counts per day, page type and country, with nothing in them that could refer to a person.
• Notices, moderation decisions and their reasons: five years from the decision, because that is how long a claim about one could realistically arrive.
• Register contact data: while the register still publishes it. An address that has opted out is reduced to a one-way hash and the plaintext is deleted.

Who else processes it

We use a small number of processors, each under a written data processing agreement, and none of them is allowed to use your data for anything of their own.

• Hosting and database: a provider in the European Union.
• Email delivery, for sign-in codes, notifications and the single outreach message to a school.
• A content delivery network in front of the site, which terminates connections and is where the country guess comes from.
• Error monitoring, which receives technical diagnostics when something breaks.
• A large language model provider, used only when an institution asks us to import its own published material into its own listing.

Transfers outside the EEA

Data is stored in the European Union. Where a processor is established outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses together with the technical measures needed to make them meaningful, and we keep the number of such processors as close to zero as the product allows.

Automated decisions

Submitted reviews are scored automatically for spam, duplication and personal data before they are published, and a submission over the threshold is held for a person rather than rejected by the machine. Scores and tiers are computed arithmetically from reviews and are not decisions about you. Nothing on this site produces a legal or similarly significant effect on a person by automated means alone, and every moderation outcome is reviewable by a human on request.

Your rights

Under the GDPR you have the following rights, and you can exercise any of them through the notice form or by writing to us. We answer within one month; if a request is complex we will tell you before that month is up rather than after. We will ask for enough information to be sure who you are, and no more.

• Access: a copy of what we hold about you.
• Rectification: correction of anything inaccurate.
• Erasure: deletion, where no overriding ground applies. Published reviews are the usual exception, and the account link is severed instead.
• Restriction: processing paused while a dispute about accuracy or grounds is worked out.
• Objection: to any processing based on legitimate interest, including everything taken from public registers. No reason required.
• Portability: your own account data and reviews in a machine-readable file.
• Complaint: to a supervisory authority, at any time, whether or not you have complained to us first.

Notice, takedown and complaints

Complaining to the regulator

If you believe we have handled your data unlawfully you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. If you live in another EU or EEA country you may complain to your own national authority instead. We would rather hear from you first, but you are not required to ask us before you ask them.

Age

Accounts are for people aged 16 and over, which is the age the Netherlands sets for consent to information society services. School reviews often come from people younger than that: if you are under 16, ask a parent or guardian to write on your behalf rather than creating an account. If we learn that an account belongs to someone under 16 we close it and detach anything it published.

Changes to this policy

When this policy changes materially we say so on the site rather than quietly revising the date at the top. The date at the top is the date of the current version.