Legal
Privacy Policy
Last updated · 12 May 2026
This Privacy Policy explains how ClassX Education B.V. processes personal data when you visit our websites or use the AI Essay Grader Europe platform. We comply with the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”).
1. Controller
ClassX Education B.V., established in Amsterdam, the Netherlands, is the controller of personal data described in this Policy. Contact our Data Protection Officer at dpo@classx.eu.
2. Personal data we process
- Account data: name, work email, school, role, password hash.
- Usage data: pages visited, features used, log entries, device and browser information, IP address.
- Content data: essays, scans, rubrics and prompts you submit.
- Billing data: company name, VAT ID, billing address, transaction identifiers (no card numbers — handled by our payment processor).
- Support data: messages and attachments you send to us.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Service | Performance of a contract |
| Billing and tax compliance | Legal obligation |
| Security, fraud prevention, abuse detection | Legitimate interest |
| Service improvement and aggregated analytics | Legitimate interest |
| Marketing emails to existing customers | Legitimate interest (opt-out) |
| Marketing to prospects | Consent |
| Cookies that are not strictly necessary | Consent |
4. AI training
We do not use teacher-uploaded essays, scans, or student data to train AI models. Content sent to model providers is processed under zero-retention agreements where available.
5. Sharing
We share personal data only with vetted processors that act on our instructions under a Data Processing Agreement. The current list is published at classx.eu/legal/subprocessors.
6. International transfers
EU customer data is hosted in the European Union by default. Where a subprocessor processes data outside the EEA, transfers are governed by the European Commission’s Standard Contractual Clauses (2021/914) and supplementary measures (encryption in transit and at rest, access logging, EU-region routing).
7. Retention
- Account data: for the duration of the account and 12 months after closure.
- Uploaded essays and scans: deleted within 30 days of processing, or sooner on request.
- Billing records: 7 years (EU tax law).
- Server logs: 30 days.
8. Your rights
You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interest. Contact dpo@classx.eu. You can also lodge a complaint with the Dutch supervisory authority (Autoriteit Persoonsgegevens) or the authority of your country of residence.
9. Security
See our Security & Compliance page for technical and organisational measures.
10. Changes
We will notify customers of material changes by email at least 30 days in advance.
This document is provided as a starting template adapted for European education providers. It does not constitute legal advice. Have qualified counsel review and tailor it to your jurisdiction and processing activities before relying on it.