Privacy Policy, Erudiam
This English version is a translation provided for information only. The French version is the only authentic text and prevails in the event of any discrepancy.
1. Introduction
This privacy policy (the "Policy") explains how ERUDIAM processes your personal data when you use its website (https://erudiam.com), its web application (https://erudiam.com/en-GB/dashboard) and its mobile applications for iOS and Android (together, the "Service").
ERUDIAM is a preparation service for the European civil service competitions (EPSO), offering in particular practice questions, mock exams, a placement test, written essays, live sessions and shared sessions.
This Policy is drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") and with the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Please read it carefully.
In this Policy:
- "data" or "personal data" means any information that makes it possible to identify you, directly or indirectly (for example, your name, your email address or your username);
- "process" means any operation performed on that data (collecting, storing, using, transmitting, erasing it, and so on);
- "processor" means a service provider that processes data on our behalf and in accordance with our instructions.
2. Who are we?
The controller of your data is:
- Jean de Loynes, trading as ERUDIAM, a self-employed sole trader (natural person) under Belgian law;
- enterprise number (Crossroads Bank for Enterprises) and VAT number: BE 1043.189.468;
- address: Avenue du Préau 20, 1040 Etterbeek, Belgium;
- email address for any question about your data: privacy@erudiam.com.
In this Policy, "ERUDIAM", "We", "Us" or "Our" refers to this controller. No data protection officer has been appointed: for any question, you can write to us at the address above.
3. What data do we process, why, and on what basis?
We only process the data needed for the purposes described below. Data marked as "optional" is provided entirely at your own initiative.
| When? | Data processed | Why? (purposes) | On what legal basis? |
|---|---|---|---|
| Creating and managing your account | Email address, surname, first name, password (stored in encrypted form, never in plain text), interface language, name of your organisation (optional) | To create your account, authenticate you, give you access to the Service and send you the necessary emails (sign-in link, account confirmation) | Performance of the contract (Art. 6(1)(b) GDPR) |
| Signing in with Google or Apple (optional) | Identifier assigned by the provider, email address and, if the provider shares them, your surname and first name | To create your account or sign you in without a password, at your request | Our legitimate interest in offering you more convenient ways to sign in (Art. 6(1)(f) GDPR) |
| Your profile | Profile photo or avatar (optional), surname, first name, email address, username (optional), target competitions and countries, exam date (optional) | To manage and personalise your account | Performance of the contract (Art. 6(1)(b) GDPR) |
| Your practice | Answers to questions, spaced repetition state, practice streaks, sessions, scores, mock exams (phases, answers, duration, score), placement test (questions, answers, estimated level), questions set aside | To provide the Service, calculate your progress and offer you suitable revision | Performance of the contract (Art. 6(1)(b) GDPR) |
| Written essays | Text you write, word count, time spent, a friend's feedback where applicable | To provide the written essay feature and, at your request, sharing with a friend | Performance of the contract (Art. 6(1)(b) GDPR) |
| Assessment by artificial intelligence | Text of your free-text answer, without any direct identifier (see section 6) | To produce a mark and educational feedback, only if you ask for it | Your consent (Art. 6(1)(a) GDPR) |
| Leaderboard | Username (optional), scores in the various exams | To calculate your position within a band of the cohort of participants | Your consent (Art. 6(1)(a) GDPR) |
| Cohort comparison statistics (optional) | Aggregated scores | To show where you stand compared with other candidates, at your request | Your consent (Art. 6(1)(a) GDPR) |
| Friend requests | Your name as displayed, the email address or username of the invited user, optional message | To pass your request on to the user concerned and manage the friendship between you | Performance of the contract with you (Art. 6(1)(b) GDPR); for the invited user, our legitimate interest in passing on a request from another user (Art. 6(1)(f) GDPR) |
| Shared sessions | Your username (or, failing that, the display name of your profile), your scores and your avatar | To compare your results with those of the people taking part in the same session | Performance of the contract (Art. 6(1)(b) GDPR) |
| Live sessions | Random participation identifier, display name you choose (or "Anonymous") and, only if you tick the corresponding boxes, your photo or avatar, your first name, your surname or your username; your answers, whether they are correct, your response times and your score; a lightweight technical fingerprint of your browser or device | To run the session, show the live leaderboard to the host, the participants and on the presentation screen, and prevent abuse | Performance of the contract (Art. 6(1)(b) GDPR); your consent for the display of your profile data (Art. 6(1)(a) GDPR); our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR) |
| Push notifications | Subscription identifier of your browser or notification token of your device, preferences (types of reminder, time, time zone) | To send you revision reminders | Your consent (Art. 6(1)(a) GDPR) |
| Newsletter and launch announcement | Email address, language, your choice to receive the newsletter | To send you news about the competitions and the Service | Your consent (Art. 6(1)(a) GDPR) |
| Application to the private beta (optional) | Email address, first name, last name, organisation (optional), language, invitation link used, your choice to receive the newsletter, date of the application, and the status, rank and access code assigned to you | To review your application, select the testers, and send you your invitation and access code or tell you your place on the waiting list | Steps taken at your request prior to entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR) |
| Contact form | Name, email address, content of your message | To reply to your request | Our legitimate interest in replying to requests sent to us (Art. 6(1)(f) GDPR) or, if you are already a customer, performance of the contract (Art. 6(1)(b) GDPR) |
| Suggestions and error reports | Free-text message (typed or dictated), reported question, reason, screenshot if any, technical data (platform, version, language) | To review your suggestions, correct errors and improve the Service | Our legitimate interest in improving the Service (Art. 6(1)(f) GDPR) |
| Subscription and billing | Name, billing address, VAT number where applicable, chosen plan, payment history, customer identifier with the payment provider, proof of your request for immediate performance, withdrawal requests | To manage your subscription, issue invoices and comply with our accounting and tax obligations | Performance of the contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR) |
| Introductory offer | Fingerprint of your email address, hashed (that is, irreversibly transformed) | To reserve the introductory offer for new subscribers | Our legitimate interest in preventing repeated use of an offer reserved for new subscribers (Art. 6(1)(f) GDPR) |
| Referral | Lightweight technical fingerprint of the device and IP address, both hashed | To prevent referral fraud | Our legitimate interest (Art. 6(1)(f) GDPR) |
| Mobile applications: authenticity | Result of the authenticity check of the application and the device (Apple App Attest, Google Play Integrity), without any account identifier | To check that the application in use is genuine and to protect the Service | Our legitimate interest in ensuring the security of the Service (Art. 6(1)(f) GDPR) |
| Security and abuse prevention | IP address, technical browser signals, technical logs, technical errors | To protect the Service against attacks and automated account creation, and to detect and correct errors | Our legitimate interest in ensuring the security of the Service (Art. 6(1)(f) GDPR) |
| Prolonged inactivity | Date of your last sign-in, date the warning was sent | To warn you and then delete unused accounts | Our obligation not to keep data for longer than necessary (Art. 5(1)(e) and 6(1)(c) GDPR) |
| Exercising your rights | Data needed to verify your identity and handle your request | To reply to your requests and keep proof of our reply | Legal obligation (Art. 6(1)(c) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR) |
| Audience measurement on the website (only if you accept it) | Pseudonymous online identifiers (Google Analytics cookies), pages viewed, where visits come from, events (sign-up steps, clicks on sign-up buttons, choice of a plan), technical information about the device and browser, approximate location at country and region level | Understanding how the website is used and improving it | Your consent (Art. 6(1)(a) GDPR and Article 10/2 of the Belgian Act of 30 July 2018) |
We do not process sensitive data (health, political opinions, religion, etc.), precise geolocation data or biometric data. We do not use targeted advertising.
Audience measurement on the website: only if you accept it in the cookie banner, we use Google Analytics to understand how the website is used and to improve it. This processing is based on your consent (Article 6(1)(a) GDPR and Article 10/2 of the Belgian Act of 30 July 2018). The recipient is Google Ireland Limited, acting as our processor; data may be transferred to the United States, under the EU-US Data Privacy Framework and the standard contractual clauses (see section 7). The data is kept for 14 months in Google Analytics. You can withdraw your consent at any time using the "Manage cookies" link at the bottom of every page of the website. The mobile applications do not use Google Analytics.
We do not store your IP address in plain text in our database. It is, however, processed by some of our technical providers to ensure network security (see section 5) and, in the case of a referral, it is hashed immediately.
Voice dictation: if you use dictation to write a suggestion, your voice is converted into text by the speech recognition service of your phone or browser (Apple, Google or the publisher of your browser). Only the resulting text is sent to us.
4. Do you have to provide your data?
Data marked as "optional" is provided entirely at your own initiative.
The other data is needed to create your account and use the Service: without it, we cannot provide you with these features.
5. Who has access to your data?
Our processors
We do not sell your data. We use providers that process data on our behalf, under data processing agreements (DPAs):
| Provider | Role | Data concerned | Location and safeguards |
|---|---|---|---|
| Supabase, Inc. | Authentication, database, storage, real-time features of live sessions | Account, profile, practice and session data | Data stored in Ireland (EU). Access from the United States is possible (support): standard contractual clauses of the European Commission |
| Cloudflare, Inc. | Sub-processor of Supabase: protection against attacks and bots | Requests between the application and the database (IP address, headers) | Global network. Safeguards provided for in the agreement concluded with Supabase |
| Amazon Web Services | Creating and storing a weekly backup copy of our database: checking the copy on a temporary server, then storing it in encrypted form | All the data in the database, unencrypted for a few minutes each week on the temporary server, then encrypted; Amazon Web Services does not hold the key to the copy | Sweden (EU). Standard contractual clauses of the European Commission for any access from outside the EU |
| Vercel, Inc. | Website hosting | Technical requests (IP address, session cookies) | Servers in Dublin (Ireland) and a global content delivery network. EU-US Data Privacy Framework (DPF) and standard contractual clauses |
| Brevo (Sendinblue SAS) | Sending emails (sign-in, confirmation, friend request, inactivity warning, subscription-related emails, invitation to the private beta) and the newsletter | Email address, language, content of the email (for example the first name and display name of the person sending a friend request) | France (hosting in France and Belgium). Standard contractual clauses and DPF for any transfers by its own processors |
| Resend (Plus Five Five, Inc.) | Sending, at your request from the mobile application, an email containing the link to the real-conditions test | Email address and link | United States. Standard contractual clauses (Module Two) |
| Sentry (Functional Software, Inc.) | Monitoring errors and performance of the website and the applications | Error type and message, version, browser or device, operating system. No email address, account identifier or IP address | Storage in the EU. DPF and standard contractual clauses |
| Google Ireland Limited (Google Analytics) | Audience measurement on the website, only if you accept it | Pseudonymous online identifiers, pages viewed, where visits come from, events, technical information about the device and browser, approximate location (country and region). According to Google, Google Analytics 4 does not store IP addresses | Ireland (EU). Possible transfer to the United States: EU-US Data Privacy Framework (DPF) and standard contractual clauses |
| Intuition Machines, Inc. (hCaptcha) | Protecting forms against bots | IP address, technical browser signals (for example pointer movements) | United States. DPF and standard contractual clauses |
| Anthropic PBC | Assessment by artificial intelligence, only if you ask for it | Text of your free-text answer, without any direct identifier | United States. Standard contractual clauses |
| GitHub, Inc. (Microsoft) | Tracking the feedback received in the application (tickets) | Random feedback identifier, category, severity, platform, version. Neither the text of the feedback nor the email address | United States. DPF and standard contractual clauses |
| Expo (650 Industries, Inc.) | Delivering notifications and updates of the mobile applications | IP address of the device, random installation identifier, platform and version of the application, notification token, content of reminders (no name, email address, score or rank). For data relating to the use of its services, Expo also acts as an independent controller (https://expo.dev/privacy) | United States. DPF and standard contractual clauses (Module Two) |
| Apple Inc. and Google LLC | Signing in with Apple or Google (at your request); delivering notifications of the mobile applications (APNs, FCM); checking the authenticity of the application (Google Play Integrity: integrity token decoded by Google, without any account identifier; Apple App Attest: check carried out on our servers, nothing is sent to Apple) | Sign-in identifier, notification token, content of reminders, integrity token | United States. Google: DPF; Apple: standard contractual clauses |
| OVH SAS | Mailboxes for our email addresses | Messages you send us | France (EU) |
| Stripe Payments Europe, Limited (Stripe) | Payment processing. Stripe acts as a processor when processing your payments and as an independent controller for its own purposes (in particular fraud prevention and compliance with its legal obligations) | Billing and payment data (processed by Stripe; we do not keep your card details) | Ireland (EU). Possible transfer to Stripe, LLC (United States): EU-US Data Privacy Framework (DPF) and, failing that, standard contractual clauses |
| Browser notification services | Delivering the website's push notifications | Subscription address assigned by your browser; the content is encrypted | Depends on the publisher of your browser |
Other recipients
Your data may be disclosed to our advisers (lawyers, accountant) to the extent necessary for them to carry out their work, and to the authorities where the law requires us to do so.
Visibility to other users
Leaderboards: if you turn on this option (off by default), you see your position within a band of the cohort. Other users see neither your username nor your scores in this leaderboard. You can turn the option off at any time in the "Leaderboard" tab; you are then no longer included in the calculation.
Live sessions: the name you display, your score and your rank are visible to the host, to the other participants and to anyone in front of the presentation screen. The host also sees your answers. Your photo, your first name, your surname or your profile username are only displayed if you tick the corresponding boxes before joining; they are unticked by default.
Shared sessions: your username (or, failing that, the display name of your profile), your scores and your avatar are visible to the other participants in the session.
Friend requests: information for invited users
Only a user who already has an account can be invited. If a user enters your email address or your username to invite you, we process this information and any message solely in order to pass the request on to you.
We do not send you any other messages. If you do not reply, the request is deleted after 30 days. The message is erased as soon as you reply; if you decline, only a record of the refusal is kept for 30 days so that the same request is not sent to you again. You can also ask us to delete them by writing to privacy@erudiam.com. You have the rights described in section 9.
6. Artificial intelligence
The feature that assesses free-text answers (written essays) relies on an artificial intelligence model provided by Anthropic PBC.
It is only used if you ask for it and after you have given your consent, which you can withdraw at any time.
Only the text of your answer is sent, without your name or your email address.
Under Anthropic's commercial terms, content sent through its application programming interface (API) is not used to train its models.
The assessment is an educational aid. It does not produce any automated decision that has legal effects concerning you or similarly significantly affects you.
We ask you not to include unnecessary personal data in your text, whether your own or that of third parties.
7. Transfers of data outside the European Union
Your data is mainly stored in the European Union. Some of the providers listed above are established in the United States or may access your data from there.
These transfers are based on:
- the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), for providers certified under it; and/or
- the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914).
You can ask for a copy of the applicable safeguards by writing to privacy@erudiam.com.
8. How long do we keep your data?
The retention period depends on the processing carried out:
| Data | Retention period |
|---|---|
| Account, profile and practice data | For as long as your account is active. In the event of prolonged inactivity (no sign-in), we warn you by email after 24 months, then delete the account at 36 months, unless a paid subscription is in progress |
| Account closure at your request | A 30-day cooling-off period, during which you can cancel the deletion by writing to us at privacy@erudiam.com, followed by permanent deletion |
| Immediate erasure at your request | Permanent deletion without delay |
| Backups | Deleted data disappears from backups when their retention cycle expires (between 7 and 30 days depending on the configuration) |
| Shared written essays | Sharing link accessible for 30 days |
| Leaderboard | For as long as you take part; removal as soon as you turn the option off |
| Friend requests | Until the invited user replies and for no more than 30 days; record of a refusal, without the message: 30 days after the refusal |
| Live sessions | 30 days after the session is created, followed by automatic deletion; a session that is never started is deleted 24 hours after it is created. The link to your photo stops working 12 hours after you join the session |
| Shared sessions | Until the session expires (14 days) |
| Newsletter and launch announcement | Until you unsubscribe or withdraw your consent |
| Application to the private beta | Until your account is deleted, together with which it is erased; if you have not created an account, until the end of the private beta |
| Push notifications | Until you turn them off; inactive subscriptions are cleaned up periodically |
| Contact form | 12 months after the last exchange |
| Suggestions and error reports (and screenshots) | 12 months after they have been handled, followed by deletion or anonymisation |
| Consent relating to artificial intelligence | For the life of your account, plus 12 months |
| Logs of calls to artificial intelligence | 90 days |
| Billing data | 10 years, in accordance with accounting and tax obligations |
| Introductory offer fingerprint | 2 years after the offer is used |
| Referral anti-fraud fingerprints | 90 days, followed by automatic deletion |
| Authenticity checks of the mobile applications | 90 days |
| Technical security logs | 12 months at most |
| Notification sending logs | 90 days |
| Audience measurement on the website (Google Analytics) | 14 months in Google Analytics; measurement cookies on your device: 13 months at most; your choice (consent or refusal): 6 months |
| Exercising your rights | The time needed to handle your request, then 5 years at most as proof |
At the end of these periods, your data is deleted or anonymised, unless the law requires it to be kept for longer or in the event of a dispute.
9. What are your rights?
You are in control of your data. You have the following rights:
- Right of access: to obtain confirmation that we process your data and to receive a copy of it;
- Right to rectification: to have inaccurate or incomplete data corrected (you can change most of your data directly in your account);
- Right to erasure: to ask for your data to be deleted in certain cases (you can close your account with a 30-day cooling-off period, or ask for its immediate erasure, from the "Account" > "Privacy" tab; if you can no longer sign in, write to us);
- Right to restriction of processing: to ask us to suspend the processing of your data temporarily in certain cases;
- Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interest;
- Right to data portability: to receive your data in a structured, commonly used and machine-readable format, where the processing is based on your consent or on a contract (an export of your data is available in the "Account" > "Privacy" tab);
- Right to withdraw your consent at any time (notifications, leaderboard, newsletter, assessment by artificial intelligence, display of your profile in a live session, audience measurement on the website using the "Manage cookies" link), without affecting the lawfulness of processing based on consent before its withdrawal;
- Right not to be subject to an automated decision that produces legal effects concerning you or similarly significantly affects you (we do not take any such decisions).
How can you exercise your rights?
Write to us at privacy@erudiam.com. We may ask you to prove your identity. We reply within one month, which may be extended by two months for complex or numerous requests (in which case you will be informed). Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
How can you lodge a complaint?
If you consider that your rights have not been respected, you can lodge a complaint with the Data Protection Authority (APD/GBA):
- Rue de la Presse 35, 1000 Brussels;
- telephone: +32 2 274 48 00;
- email: contact@apd-gba.be;
- website: www.autoriteprotectiondonnees.be.
You can also contact the supervisory authority of your country of residence.
10. How do we protect your data?
We implement appropriate technical and organisational measures to protect your data, including:
- encryption of communications (HTTPS);
- storage of your password in encrypted form;
- restriction of access to data to those people who need it;
- protective measures against unauthorised access and bots;
- a weekly encrypted backup copy, made and stored in the European Union separately from our main hosting provider, and erased no later than 30 days after it is created;
- data processing agreements with our providers;
- a procedure for handling data breaches.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.
11. Cookies
The Service uses cookies and similar technologies that are strictly necessary for it to work (session, security, preferences you choose), which do not require your consent. On the website, and only if you accept it, we also use Google Analytics to measure audience (see section 3). You can withdraw your consent at any time using the "Manage cookies" link at the bottom of every page of the website. No advertising cookies are used.
To find out more, see our Cookie Policy.
If we add other cookies that are not strictly necessary, we will ask for your consent beforehand.
12. Changes to this Policy
We may change this Policy, for example when we add features or providers. The date of the last update appears at the bottom of the document. In the event of a substantial change, we will inform you in the application or by email, giving reasonable notice before it takes effect.
13. Contact
For any question about this Policy or your data, you can contact us:
- by email: privacy@erudiam.com;
- by post: Jean de Loynes (ERUDIAM), Avenue du Préau 20, 1040 Etterbeek, Belgium.
Date of last update: 16 October 2026