Privacy Policy

1. Who we are

EPSO EU Testing is a study tool for EU competition (EPSO) candidates. The data controller is the operator of eutesting.org (see Impressum for full identification and contact details). This site is not affiliated with EPSO or any EU institution.

2. What data we collect

We collect the minimum possible:

• Contact form — when you send a message we process the name, email and message body you type.
• Browser local storage (localStorage / sessionStorage) — we store your language choice, your quiz answers, your progress, your dark-mode preference, and your cookies-consent flag. These remain on your device only and never reach our server.
• Account data (registered users only) — if you create an account we store your email address, a hashed password (we never see the plain-text password), an identifier issued by our authentication provider (Netlify Identity), your registration date, last sign-in date, and (optionally) a copy of your quiz progress so you can resume on another device.
• Subscription data (premium subscribers only) — if you subscribe to a paid plan we store a Stripe customer identifier, the subscription identifier, the subscription status (e.g. active, past_due, canceled) and the current period end date. We do not store, see or transmit your payment-card number, expiry, CVV or billing address — these are handled entirely by Stripe on Stripe's own domain (Stripe Checkout).

We do not collect precise location data, advertising identifiers, biometric data, or any third-party data.

3. Purposes

• Contact form: to reply to your message.
• Local storage: to remember your progress and keep your language and display preferences between sessions. Functionally necessary for normal use of the site.
• Account data: to authenticate you across devices, recover your password if forgotten, and unlock the registered-tier content (currently Set 2).
• Subscription data: to verify your premium access (Set 3 and beyond), bill the recurring monthly fee, and let you cancel or update your plan via Stripe's Billing Portal.

4. Legal basis (GDPR Art. 6)

• Contact form: consent — Art. 6(1)(a) — you click "Send" voluntarily.
• Local storage: strictly necessary for the service the user has requested — Art. 6(1)(b)/(f) and the "strictly necessary" exception of the ePrivacy Directive.
• Account data: performance of a contract — Art. 6(1)(b) — your account is the contractual relationship that enables you to use registered features.
• Subscription data: performance of a contract — Art. 6(1)(b) — and compliance with statutory accounting and tax obligations — Art. 6(1)(c) (German Commercial Code §257 HGB and §147 AO require retaining billing records for up to 10 years).

5. Processors

We rely on the following third-party data processors, each operating under a GDPR-compliant Data Processing Agreement:

• Netlify, Inc. — hosting, contact-form delivery, authentication (Netlify Identity), key-value storage of account and subscription metadata (Netlify Blobs), and serverless backend (Netlify Functions).
• Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment processing, recurring billing, fraud prevention, and customer-billing portal. Stripe receives your name, email, billing country, payment-card details and the price of the subscription. Stripe is itself the controller for some payment-fraud-prevention processing (see Stripe's privacy policy).

Beyond these two processors the site is self-contained: static HTML, self-hosted fonts, no analytics, no advertising networks, no external CDN, no tracking pixels.

6. Retention

• Contact-form messages: kept in the operator's inbox until answered, and at most 24 months thereafter, then deleted.
• Browser local storage: stays on your device until you clear it manually (browser settings → clear site data, or the Reset button in the quiz).
• Account data: retained while your account is active. If you request account deletion (see §10), we remove the account record within 30 days, except for data that is also linked to billing records (see below).
• Subscription / billing data: retained for as long as required by German tax law — up to 10 years from the end of the calendar year of the last invoice (§257 HGB, §147 AO) — even after account deletion. During this period the data is restricted to billing-records use only and is no longer used for any other purpose.

7. Your rights

You have the right to access, rectify, erase (subject to §6 above), restrict the processing of, port, and object to the processing of your personal data. To exercise these rights, use the contact form on the site. You also have the right to lodge a complaint with your national data protection authority (in Germany: the Hamburg Commissioner for Data Protection, datenschutz-hamburg.de).

8. Cookies and tracking

This site uses no analytics (no Google Analytics, Plausible, Matomo or equivalent), no advertising networks, no tracking pixels, and no fingerprinting. No data is sold or shared with marketers. Your IP address is not stored beyond the hosting provider's operational logs.

Cookies and similar storage set on the eutesting.org domain are strictly necessary for the service you request:

• nf_jwt and a refresh token (Netlify Identity) — keep you signed in across page reloads. Deleted when you log out or close the browser.
• cookies_consent_v1 (localStorage) — records that you have dismissed the cookies notice so we do not show it again.

If you proceed to a Stripe Checkout or Billing Portal page, Stripe sets its own cookies on its own domain (checkout.stripe.com, billing.stripe.com) for security, fraud prevention and session continuity. These cookies are controlled by Stripe, not by us — see Stripe's cookies policy.

9. International data transfers

Netlify (data hosting, authentication, serverless functions) is a US-incorporated company that processes data in the EU and the US. It relies on the EU-US Data Privacy Framework and Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection for personal data transferred outside the EEA.

Stripe processes EU customers' data primarily through Stripe Payments Europe, Ltd. in Dublin (Ireland), with some technical processing in the US under Standard Contractual Clauses and the EU-US Data Privacy Framework.

10. Account and subscription deletion

You may cancel your subscription at any time via the Manage subscription link inside your account menu (which opens the Stripe Billing Portal). Cancellation takes effect at the end of the current billing period — premium access remains until then.

You may request the deletion of your account at any time by contacting us through the contact form. Upon deletion, we remove your email address and account record from our database within 30 days, subject to the billing-data retention obligation explained in §6. Cancelling your subscription does not automatically delete your account; closing your account does not automatically refund any unused portion of a paid period.

You may also export your personal data (a copy of what we hold) at any time via the same contact channel.

11. Changes

This policy may be updated to reflect site or legal changes. The date above indicates the current version; material changes will be flagged in the site footer.