Privacy Policy — PassEBE

1. Who is responsible for your data?

The data controller is Oscar Simonis, operating PassEBE as an independent project based in Belgium. For any privacy-related request, contact us at support@passebe.com. We will respond within 30 days.

2. Data we collect

We collect the following information:

• Account data: your name and email address when you create an account or log in via Google.
• Payment data: your payment information is processed securely by Stripe. PassEBE never stores your card or banking details on our servers.
• Usage data: pages visited, courses accessed, and basic technical information (browser type, device type) used solely to ensure the platform functions correctly.

We do not knowingly collect data from minors under the age of 16. PassEBE is intended for university students aged 17 and above.

3. Why we use your data

Your data is used solely for:

• Managing your account and granting access to purchased courses.
• Processing payments securely via Stripe.
• Sending you order confirmations and important account-related emails.
• Improving the platform based on aggregated, anonymous usage data.

We never sell your data, share it with advertisers, or use it for any purpose unrelated to running PassEBE.

4. Legal basis (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• Contractual necessity — to provide the service you purchased.
• Legitimate interest — to improve platform performance and prevent abuse.
• Consent — where you have explicitly agreed (e.g. if we ever send marketing emails, which will always include an unsubscribe link).

5. Data sharing and third parties

Your data is never sold or shared with third parties for commercial purposes. PassEBE uses the following trusted services to operate:

• Stripe — payment processing. Stripe is PCI-DSS compliant and operates under its own privacy policy (stripe.com/privacy).
• Google (OAuth) — if you choose to log in with Google, we receive your name and email from your Google account only. We do not access any other Google data.

No other third parties receive your personal data.

6. Cookies

PassEBE uses only strictly necessary cookies to keep you logged in and manage your session. We do not use advertising, tracking, or analytics cookies. Because we rely exclusively on essential cookies, no cookie consent banner is required under GDPR or the ePrivacy Directive.

7. Data retention

We retain your account data for as long as your account is active. If you request deletion, your personal data will be permanently removed within 30 days. We may retain certain financial records (e.g. purchase history) for up to 7 years as required by Belgian accounting law.

8. Your rights (GDPR)

As a data subject under GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format (e.g. CSV).
• Objection — object to processing based on legitimate interest.
• Restriction — ask us to temporarily stop processing your data while a dispute is resolved.

To exercise any of these rights, write to support@passebe.com. If you believe your rights have not been respected, you have the right to lodge a complaint with the Belgian Data Protection Authority at dataprotectionauthority.be.

9. Security

PassEBE uses HTTPS encryption on all pages. Payments are handled entirely by Stripe and never pass through our servers. We take reasonable technical and organisational measures to protect your data from unauthorised access, loss, or disclosure.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. For significant updates, we will notify users with an active account by email.