Privacy & Cookie Policy

Last updated: 27 October 2026

Class26 values privacy, confidentiality and the responsible handling of personal data.

This Privacy & Cookie Policy explains what personal data Class26 collects, how and why we process it, how we protect it, with whom we may share it, how long we retain it and what rights individuals have regarding their personal data.

This Privacy & Cookie Policy applies to the Class26 website, marketplace, platform, applications, accounts, bookings, payments, Expert services, digital products, communications, connected calendar services and other services provided by Class26.

1. Who Is Responsible?

The data controller responsible for the processing of personal data described in this Privacy & Cookie Policy is:

Class26 B.V.

Established in: Culemborg, The Netherlands
Dutch Chamber of Commerce number: 42021638
Email: support@class26.com
Website: https://class26.com

Class26 B.V. acts as a data controller within the meaning of the General Data Protection Regulation (GDPR) for the processing activities for which it determines the purposes and means.

Where independent Experts or third-party service providers determine their own processing purposes and means, they may act as separate data controllers.

2. Applicable Legal Framework

Class26 processes personal data in accordance with applicable data protection and privacy legislation, including:

  • The General Data Protection Regulation (GDPR).
  • The Dutch GDPR Implementation Act (UAVG).
  • Applicable Dutch telecommunications and electronic communications legislation.
  • Applicable consumer protection and digital services legislation.
  • Other relevant Dutch and European laws and regulations.

The specific legal requirements applicable to a processing activity depend on its nature and purpose.

3. Definitions

Account: An account created to access and use the Class26 platform.

Class26, We, Us or Our: Class26 B.V.

Data Controller: The organization that determines the purposes and means of processing personal data.

Data Processor: An organization that processes personal data on behalf of a data controller.

Expert: An independent professional offering coaching, consulting, training, courses, workshops, digital products, programmes or other services through Class26.

Personal Data: Any information relating to an identified or identifiable natural person.

Service: The Class26 website, platform, marketplace, booking system, payment functionality, digital content delivery, calendar integrations and associated services.

User: A visitor, customer, buyer, participant or account holder using Class26.

Usage Data: Information generated through interaction with the Service, including device information, IP addresses, browser information, session data and platform activity.

Connected Calendar: A Google Calendar or Microsoft Outlook Calendar connected to Class26 by an Expert through an authorized integration.

OAuth Authorization: A secure authorization mechanism through which an Expert grants Class26 specific permissions to access a connected service without sharing their account password with Class26.

4. What Personal Data Do We Collect?

Class26 may collect and process the following categories of personal data, depending on how an individual uses the Service.

4.1. Account and Profile Data

  • First and last name.
  • Company name.
  • Email address.
  • Telephone number.
  • Profile picture.
  • Job title.
  • Professional expertise.
  • Biography.
  • Social media profiles.
  • Website information.
  • Chamber of Commerce registration number.
  • VAT identification number.
  • Authentication and account information.
  • Account settings and preferences.

4.2. Expert Data

For Experts, Class26 may additionally process:

  • Professional background and experience.
  • Areas of expertise and specializations.
  • Professional portfolio.
  • LinkedIn profile and professional website.
  • Qualifications and certifications.
  • Professional registrations and permits.
  • Relevant insurance information.
  • Business information.
  • Application and onboarding information.
  • Verification information.
  • Availability and scheduling information.
  • Expert profile activity.
  • Reviews and testimonials.
  • Complaint and refund history.
  • Service performance and engagement information.

4.3. Booking and Payment Data

  • Booking details.
  • Purchased services and products.
  • Order and transaction information.
  • Payment status.
  • Invoice and billing information.
  • Bank account and payout information where applicable.
  • Payment provider identifiers.
  • Refunds and chargebacks.
  • VAT and tax-related information where required.

Class26 does not store full payment card details.

4.4. Communication Data

  • Platform messages.
  • Customer support requests.
  • Emails and correspondence.
  • Feedback and reviews.
  • Complaints and incident reports.
  • User-Expert communications.
  • Customer service notes.

4.5. Technical and Usage Data

  • IP address.
  • Browser type and version.
  • Device information.
  • Operating system.
  • Authentication and login activity.
  • Cookie identifiers.
  • Analytics information.
  • Session information.
  • Pages visited.
  • Dates and times of interactions.
  • Platform usage activity.
  • Diagnostic and security logs.

4.6. Content and Uploads

  • Documents.
  • Videos.
  • Courses and educational materials.
  • Digital products.
  • Workshop and livestream information.
  • Profile content.
  • Images and testimonials.
  • Templates and downloadable materials.
  • Other content uploaded or made available through the Service.

4.7. Checkout and Consent Records

Class26 may record confirmations relating to:

  • Acceptance of Terms and Conditions.
  • Acknowledgement of this Privacy Policy.
  • Cookie preferences and consent.
  • Marketing consent.
  • Immediate delivery of digital content.
  • Withdrawal-right acknowledgements where legally applicable.
  • Cancellation and refund conditions.
  • Expert-specific terms.
  • Other legally required confirmations.

4.8. Connected Calendar Data

When an Expert connects Google Calendar or Microsoft Outlook Calendar, Class26 may access calendar information through the relevant provider's API.

For external calendar availability synchronization, Class26 stores:

  • Event start times.
  • Event end times.
  • External event identifiers.
  • Event version identifiers or synchronization tags.

Class26 also processes the connected account's email address and the OAuth access and refresh tokens necessary to maintain the authorized connection.

Class26 does not store the titles, descriptions or attendee lists of existing external calendar events as part of its availability synchronization records.

Depending on the permissions granted and the API responses received, additional event information may be accessed or processed temporarily during synchronization.

Further information is provided in Section 13A.

5. How Do We Collect Personal Data?

Class26 may collect personal data when individuals:

  • Visit our website.
  • Create an Account.
  • Register as a User.
  • Apply to become an Expert.
  • Complete an onboarding or verification process.
  • Make a booking.
  • Purchase a product or service.
  • Complete a payment.
  • Communicate through the platform.
  • Contact customer support.
  • Submit feedback or a complaint.
  • Leave a review.
  • Upload content.
  • Access courses, workshops or digital products.
  • Subscribe to newsletters or platform communications.
  • Interact with cookies or analytics technologies.
  • Use third-party authentication services.
  • Connect Google Calendar or Microsoft Outlook Calendar.
  • Authorize access through Google OAuth or Microsoft identity services.

Some personal data is provided directly by individuals.

Other information is generated automatically through use of the Service or obtained from authorized third-party services.

6. Why Do We Process Personal Data?

Class26 processes personal data for purposes including:

  • Creating and managing Accounts.
  • Operating the Class26 marketplace.
  • Facilitating bookings and purchases.
  • Processing payments and payouts.
  • Delivering digital products and educational content.
  • Enabling communication between Users and Experts.
  • Providing customer support.
  • Managing Expert applications and onboarding.
  • Reviewing Expert qualifications and professional information.
  • Maintaining platform quality and safety.
  • Preventing fraud and misuse.
  • Handling complaints and disputes.
  • Managing cancellations and refunds.
  • Meeting legal and tax obligations.
  • Improving platform functionality.
  • Performing permitted analytics.
  • Sending service-related communications.
  • Sending marketing communications where legally permitted.
  • Protecting platform security.
  • Enforcing applicable Terms and Conditions.

For connected calendars, Class26 additionally processes information to:

  • Synchronize Expert availability.
  • Identify occupied time slots.
  • Prevent scheduling conflicts.
  • Create and update calendar events associated with Class26 bookings.
  • Maintain authorized calendar connections.
  • Enable Experts to manage their availability through the platform.

Calendar data obtained through Google Calendar or Microsoft Outlook Calendar is not used for unrelated advertising, marketing profiling or general-purpose AI model training.

7. Legal Grounds for Processing

Class26 processes personal data only where an applicable legal basis exists.

7.1. Performance of an Agreement

Processing may be necessary to provide services requested by Users or Experts, including:

  • Account management.
  • Booking administration.
  • Payment processing.
  • Delivery of digital content.
  • Access to purchased services.
  • Optional calendar synchronization requested as part of platform functionality.

7.2. Legal Obligations

Processing may be necessary to comply with legal requirements, including:

  • Tax administration.
  • Accounting obligations.
  • Applicable consumer protection requirements.
  • Legally required recordkeeping.
  • Valid legal requests.

7.3. Legitimate Interests

Class26 may process personal data where necessary for legitimate interests, provided those interests are not overridden by the rights and freedoms of affected individuals.

Examples may include:

  • Platform security.
  • Fraud prevention.
  • Service improvement.
  • Dispute handling.
  • Protection against misuse.
  • Operational continuity.

7.4. Consent

Where required, Class26 relies on consent for activities such as:

  • Optional marketing communications.
  • Non-essential cookies.
  • Certain optional processing activities.

Consent may be withdrawn at any time.

7.5. Vital Interests

In exceptional circumstances, processing may be necessary to protect the vital interests of an individual.

7.6. Connected Calendar Services

Class26 processes calendar information to provide optional scheduling and booking functionality requested by Experts.

The applicable legal basis depends on the specific processing activity and may include performance of an agreement or consent.

OAuth authorization grants Class26 technical permission to access a connected calendar. Such authorization does not automatically constitute consent as a legal basis under the GDPR.

8. Payments and Payment Providers

Class26 uses designated payment service providers to process payments, refunds and payouts.

These may include providers such as Stripe, Mollie, banking institutions and other payment processing services, where applicable.

Information processed may include:

  • Name.
  • Email address.
  • Billing information.
  • Payment method information.
  • Payment status.
  • Transaction identifiers.
  • Bank and payout details.
  • Fraud prevention information.
  • Refund and chargeback information.

Class26 does not store full credit card details.

Payment providers may act as independent controllers or processors depending on the services provided.

Their own privacy notices may apply to processing activities for which they are independently responsible.

9. Digital Products and Checkout

When purchasing digital products, online courses, programmes, livestreams or other digital content, Users may be asked to acknowledge:

  • Immediate delivery of digital content.
  • Applicable statutory withdrawal-right provisions.
  • Cancellation and refund conditions.
  • Expert-specific terms.
  • Class26 Terms and Conditions.

Class26 processes personal data necessary for:

  • Order fulfilment.
  • Content delivery.
  • Access management.
  • Payment verification.
  • Customer support.
  • Fraud prevention.
  • Recording legally required confirmations.
  • Compliance with applicable consumer protection legislation.

10. Experts and Platform Use

Experts provide their services independently through the Class26 platform.

Depending on the nature of their services and the personal data they process, Experts may act as independent data controllers.

Experts must process User personal data lawfully and only for legitimate purposes connected to their services or another valid legal basis.

Experts must not use personal data obtained through Class26 for:

  • Spam.
  • Unauthorized marketing.
  • Unsolicited acquisition.
  • Unauthorized disclosure.
  • Misleading commercial practices.
  • Other uses prohibited by applicable law or contractual terms.

Experts are responsible for protecting confidential information and personal data processed in connection with their services.

Where a security incident or personal data breach involves information processed through Class26, Experts must notify Class26 as required by applicable contractual and legal obligations.

11. Cookies and Tracking Technologies

Class26 uses cookies and similar technologies to operate, secure and improve its Service.

These technologies may include:

  • Browser cookies.
  • Session cookies.
  • Persistent cookies.
  • Tracking pixels.
  • Analytics identifiers.
  • Marketing identifiers.
  • Similar technical tools.

Depending on their purpose, cookies may support:

  • Authentication.
  • Session management.
  • Security.
  • Payment functionality.
  • Language preferences.
  • User preferences.
  • Analytics.
  • Platform performance.
  • Marketing and conversion measurement.

Further details are provided in the Class26 Cookie Policy.

12. Types of Cookies

12.1. Strictly Necessary Cookies

These cookies are required for essential platform functionality, including:

  • Login and authentication.
  • Security.
  • Session management.
  • Payment functionality.
  • Account access.
  • Fraud prevention.

Consent is generally not required for cookies that are strictly necessary to provide a service explicitly requested by the user.

12.2. Functional Cookies

Functional cookies may remember:

  • Language preferences.
  • Account preferences.
  • Previously selected settings.
  • Other user experience preferences.

12.3. Analytics Cookies

Analytics technologies may help Class26 understand:

  • Platform usage.
  • Visitor behavior.
  • Technical issues.
  • Performance.
  • User experience.
  • Conversion processes.

Analytics providers may include Google Analytics, Hotjar, Matomo, Fathom or comparable services where implemented.

Class26 requests consent where legally required.

12.4. Marketing and Tracking Cookies

Subject to applicable consent requirements, Class26 may use marketing technologies for:

  • Advertising measurement.
  • Remarketing.
  • Campaign analysis.
  • Conversion tracking.
  • Personalized advertising.

Relevant third-party services may include Meta, LinkedIn, Google, TikTok and other advertising platforms where implemented.

Calendar information obtained through Google Calendar or Microsoft Outlook Calendar is not used for these marketing or advertising purposes.

13. Third-Party Authentication and Social Media Services

Class26 may offer authentication or account functionality through third-party services, such as:

  • Google.
  • Microsoft.
  • Apple.
  • LinkedIn.
  • Facebook.
  • Other supported identity providers.

Where an individual chooses to use such a service, Class26 may receive account information authorized by that individual, such as:

  • Name.
  • Email address.
  • Profile image.
  • Account identifier.

The information received depends on the service and permissions granted.

The relevant third-party provider may independently process personal data under its own privacy policy.

13A. Google Calendar and Microsoft Outlook Calendar Integration

13A.1. Overview

Class26 provides optional calendar synchronization functionality that allows Experts to connect Google Calendar or Microsoft Outlook Calendar to their Class26 account.

The integration helps Experts manage availability, coordinate bookings and reduce scheduling conflicts.

Connecting a calendar is optional and requires authorization through the relevant Google or Microsoft authorization process.

Class26 does not require Experts to disclose their Google or Microsoft account passwords to Class26.

13A.2. Calendar Information Accessed

When an Expert authorizes a calendar connection, Class26 may access information through the Google Calendar API or Microsoft Graph API.

Depending on the permissions granted, this information may include:

  • Calendar availability.
  • Calendar events.
  • Event start and end times.
  • Event identifiers.
  • Event version information.
  • Event titles and descriptions.
  • Event attendee information.
  • Associated account information.

Access to certain categories of information does not necessarily mean that Class26 permanently stores those categories.

13A.3. Calendar Information Stored

For the synchronization of existing external calendar events, Class26 stores only:

  • Event start time.
  • Event end time.
  • External provider event ID.
  • Event version identifier or synchronization tag.

Class26 does not store the titles, descriptions or attendee lists of existing external calendar events in its availability synchronization records.

Class26 also processes the connected account email address and the OAuth authorization credentials necessary to maintain the integration.

Separate Class26 booking records and calendar events created for Class26 sessions may contain information necessary to administer those bookings.

Such booking records are governed by the relevant provisions of this Privacy Policy.

13A.4. Purpose of Calendar Access

Class26 uses information obtained through connected calendars exclusively for scheduling and booking-related functionality.

This includes:

  • Determining when an Expert is available.
  • Identifying occupied time slots.
  • Preventing overlapping appointments.
  • Synchronizing availability with the Class26 booking system.
  • Creating calendar events associated with Class26 bookings.
  • Updating calendar events associated with Class26 bookings.
  • Maintaining the authorized calendar connection.

Class26 does not use Google Calendar or Microsoft Outlook Calendar information for:

  • Advertising.
  • Remarketing.
  • Marketing profiling.
  • Unrelated behavioral analytics.
  • Selling personal information.
  • Training general-purpose artificial intelligence models.
  • Other purposes unrelated to the authorized calendar integration.

13A.5. Google API Permissions

Class26 currently requests the following Google OAuth scopes for its calendar integration:

  • https://www.googleapis.com/auth/calendar.events
  • https://www.googleapis.com/auth/calendar.readonly
  • https://www.googleapis.com/auth/userinfo.email

These permissions support calendar event management, calendar information access and identification of the connected Google account.

Class26 also requests offline access where necessary to maintain synchronization without requiring the Expert to authorize each individual operation.

13A.6. Microsoft Graph Permissions

Class26 currently requests the following delegated Microsoft permissions:

  • offline_access
  • openid
  • email
  • profile
  • Calendars.ReadWrite
  • User.Read

These permissions support authorized account identification, calendar access, calendar event management and maintenance of the calendar connection.

Class26 uses these permissions only for the functionality described in this section.

13A.7. Visibility of Calendar Information

External calendar events are used to determine whether an Expert is available for bookings.

Customers and other Experts cannot view the titles, descriptions, attendees or reasons associated with an Expert's external calendar events through Class26.

Unavailable time slots are excluded from the Expert's bookable availability.

On their own Availability page, Experts may see occupied periods displayed as grey blocks labelled with the connected calendar provider, such as Google or Outlook.

External calendar event titles and descriptions are not displayed in these availability blocks.

Class26 does not provide a standard customer support or administrative interface for viewing external calendar event data.

Authorized technical personnel with direct database access may access stored availability information and connected account email addresses where necessary for legitimate operational, maintenance or security purposes.

OAuth tokens are protected by separate encryption and are not readable without the applicable encryption key.

13A.8. Storage Location

Class26 stores calendar synchronization information and OAuth authorization credentials using Supabase infrastructure.

The currently configured database hosting region is AWS eu-central-1, Frankfurt, Germany.

This location is within the European Union.

Processing by relevant infrastructure providers and subprocessors may be subject to their applicable service arrangements and international transfer safeguards.

13A.9. Security of OAuth Tokens

OAuth access tokens and refresh tokens are encrypted using AES-256-GCM before being stored.

Calendar integration operations are performed server-side.

OAuth tokens are not transmitted to the Expert's browser.

Calendar connection endpoints use the authenticated Expert's account identity to restrict access to that Expert's own calendar connection.

Experts cannot access or modify another Expert's connected calendar through the normal application functionality.

Class26 implements technical and organizational measures intended to protect calendar data and authorization credentials against unauthorized access, disclosure, alteration and misuse.

13A.10. Sharing and Disclosure

Class26 does not sell information obtained through Google Calendar or Microsoft Outlook Calendar.

Calendar information is not shared with advertising networks, data brokers or third parties for independent marketing purposes.

Relevant information may be processed by authorized infrastructure or service providers where necessary to host, operate, maintain or secure the integration.

Such processing is subject to applicable contractual, security and data protection requirements.

Class26 may disclose information where required by applicable law, subject to the applicable restrictions governing Google API and Microsoft Graph data.

13A.11. Disconnecting a Calendar

Experts may disconnect their Google Calendar or Microsoft Outlook Calendar integration at any time through the Class26 platform by navigating to:

Dashboard → Availability → Calendar sync

When an Expert disconnects a connected calendar, Class26 initiates the following procedures:

Immediate termination of synchronization: Calendar synchronization stops immediately. External busy times from the disconnected calendar no longer affect the Expert's availability or bookable time slots on Class26.

Deletion of OAuth credentials: The OAuth access and refresh tokens associated with the disconnected calendar are permanently deleted from the active Class26 database. These credentials can no longer be used by Class26 to access the disconnected calendar.

Removal of synchronized availability data: Stored external calendar availability records, including busy-event start and end times and associated event identifiers, are deleted from the Class26 database. Related event mapping records are also removed.

Removal of Class26-created calendar events: An automated background cleanup process is initiated to delete calendar events previously created by Class26 in the connected Google Calendar or Microsoft Outlook Calendar.

Termination of ongoing calendar access: Following disconnection and deletion of the relevant authorization credentials, Class26 no longer maintains authorized access to the disconnected calendar. Reconnecting the calendar requires the Expert to complete a new authorization process.

The removal of Class26-created events from an external calendar depends on the successful execution of the background cleanup process and the availability, functionality and permissions of the relevant calendar provider. In certain circumstances, external events may remain in the Expert's calendar if the cleanup process cannot be completed successfully.

Experts may also revoke Class26's access directly through their Google Account or Microsoft Account security settings. Revoking authorization through the external provider may prevent further API access but does not necessarily initiate the same database cleanup procedures as disconnecting through the Class26 platform.

Disconnecting a calendar does not automatically delete independent Class26 booking records, payment information, transaction history or other personal data that Class26 is required or otherwise lawfully permitted to retain for purposes unrelated to the calendar integration.

Experts who require assistance with disconnecting a calendar or deleting associated personal data may contact support@class26.com.

13A.12. Data Retention, Deletion and Database Backups

Class26 retains personal data obtained through Google Calendar and Microsoft Outlook Calendar integrations only for as long as necessary to provide the authorized calendar synchronization and booking functionality, or where another applicable lawful basis requires or permits retention.

Calendar Synchronization Data

For existing external calendar events, Class26 stores only the information necessary to identify occupied time slots and maintain synchronization, including:

Event start and end times.

External provider event identifiers.

Event version identifiers or synchronization tags.

Class26 does not store the titles, descriptions or attendee lists of existing external calendar events as part of its availability synchronization records.

When an Expert disconnects a calendar through the Class26 platform, the stored external busy-event records and related event mappings are deleted from the active database as described in Section 13A.11.

OAuth Authorization Credentials

OAuth access and refresh tokens are encrypted using AES-256-GCM before storage.

These credentials are retained only while necessary to maintain an authorized calendar connection.

When an Expert disconnects their calendar through Class26, the associated OAuth access and refresh tokens are permanently deleted from the active database.

Database Hosting and Backups

Class26 currently stores its calendar integration data using Supabase database infrastructure hosted in Frankfurt, Germany (AWS eu-central-1), within the European Union.

The currently configured Supabase project does not include automated scheduled database backups or Point-in-Time Recovery. Class26 does not currently maintain separate database backup copies of its calendar integration records or OAuth authorization credentials.

This does not exclude limited technical logs, infrastructure-level retention or other data processing carried out by infrastructure providers under their applicable contractual arrangements, security requirements or legal obligations.

Class26 may implement or modify backup and disaster recovery arrangements in the future. Where such changes affect the retention or deletion of personal data, Class26 will review and update its relevant data protection procedures and privacy disclosures as appropriate.

Independent Booking and Transaction Records

Disconnecting a calendar does not automatically result in the deletion of independent Class26 booking records, financial transactions, invoices, payment records or other information retained for legitimate contractual, administrative or legal purposes.

Such information is subject to the general retention provisions of this Privacy Policy and applicable legal requirements.

Data Protection Rights

Experts may request access to, correction of or deletion of their personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR).

Requests relating to calendar integration data may be submitted to support@class26.com.

Class26 will assess and respond to such requests in accordance with applicable legal requirements and statutory timeframes.

13A.13. User Control

Experts may manage their calendar connection through the Class26 dashboard.

Experts may also revoke Class26's authorization through their Google Account or Microsoft Account settings.

Revoking access through the external provider prevents further authorized API access, although the removal of previously stored information may require use of the Class26 disconnection functionality or a separate deletion request.

Experts may contact support@class26.com to exercise applicable privacy rights.

13A.14. Google API Services User Data Policy

Class26's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Class26 uses information obtained through Google APIs only to provide and improve the user-facing calendar synchronization and booking functionality described in this Privacy Policy.

Class26 does not use or transfer Google user data for serving advertisements, determining creditworthiness or other purposes prohibited by Google's applicable policies.

Human access to Google user data is limited to circumstances permitted under the Google API Services User Data Policy, including access authorized by the user, access necessary for security purposes or access required by applicable law.

13A.15. Microsoft Graph Data

Class26 accesses Microsoft Outlook Calendar information through Microsoft Graph using permissions authorized by the Expert.

Microsoft calendar information is processed only for the scheduling, availability synchronization and booking purposes described in this section.

The storage, access restrictions, security measures and disconnection procedures described in this section also apply to the Microsoft Outlook Calendar integration.

13A.16. Changes to Calendar Integrations

If Class26 materially changes the categories of calendar information accessed, the permissions requested or the purposes for which the information is processed, Class26 will update the relevant privacy disclosures.

Additional authorization or consent will be requested where required by applicable law or provider policies.

14. Marketing and Communication

Class26 may process contact information for:

  • Newsletters.
  • Platform updates.
  • Service announcements.
  • Expert communications.
  • Product updates.
  • Marketing campaigns.
  • Educational communications.
  • Customer support.

Marketing communications are sent in accordance with applicable law and consent requirements.

Recipients may unsubscribe from marketing emails through the available unsubscribe mechanism or by contacting Class26.

Service-related messages concerning Accounts, bookings, payments, security or legal obligations may still be sent where necessary.

Class26 does not use connected Google Calendar or Microsoft Outlook Calendar data for marketing communications or advertising targeting.

15. Sharing Personal Data with Third Parties

Class26 may share personal data where necessary with:

  • Payment providers.
  • Hosting and infrastructure providers.
  • Software suppliers.
  • Email delivery services.
  • Customer support providers.
  • Analytics providers.
  • Fraud prevention providers.
  • Accounting and tax service providers.
  • Legal advisors.
  • Insurance providers.
  • Relevant regulatory authorities.
  • Courts or law enforcement authorities where legally required.
  • Experts where necessary to provide booked services.

Class26 does not sell personal data to third parties.

Google Calendar and Microsoft Outlook Calendar information is subject to the additional restrictions described in Section 13A.

16. Service Providers

Class26 uses third-party service providers to support the operation of its platform.

These providers may assist with:

  • Website and application hosting.
  • Database infrastructure.
  • Payment processing.
  • Email delivery.
  • Analytics.
  • Customer support.
  • Security.
  • Fraud prevention.
  • File storage.
  • Course delivery.
  • Livestream functionality.
  • Marketing automation.
  • Calendar synchronization infrastructure.

For connected calendar functionality, Class26 currently uses Supabase infrastructure for the storage of synchronization data and authorization credentials.

Where required, Class26 enters into appropriate data processing agreements with service providers.

Service providers are permitted to process personal data only in accordance with applicable contractual arrangements and data protection requirements.

17. International Data Transfers

Class26 primarily operates from the Netherlands.

Some service providers may process personal data outside the European Economic Area.

Where personal data is transferred internationally, Class26 applies appropriate safeguards as required by applicable data protection legislation.

These safeguards may include:

  • European Commission adequacy decisions.
  • Standard Contractual Clauses.
  • Additional technical or organizational safeguards.
  • Other lawful transfer mechanisms.

The currently configured Supabase database region for calendar synchronization is Frankfurt, Germany.

The location of the primary database does not necessarily determine the location of all processing by subprocessors, support services or technical infrastructure.

18. Retention Periods

Class26 retains personal data only for as long as necessary for the purposes for which it was collected or otherwise lawfully processed.

Retention periods depend on the nature of the information and the applicable legal or operational requirements.

Personal data may be retained for:

  • Account management.
  • Service delivery.
  • Booking administration.
  • Payment and payout processing.
  • Accounting and tax obligations.
  • Fraud prevention.
  • Security.
  • Dispute resolution.
  • Complaint handling.
  • Compliance with applicable laws.
  • Establishment, exercise or defence of legal claims.

Where a statutory retention period applies, Class26 retains the relevant information for the legally required duration.

Where no fixed statutory period applies, retention is determined according to the relevant processing purpose and necessity.

For Google Calendar and Microsoft Outlook Calendar information, the specific retention and disconnection procedures described in Section 13A apply.

OAuth authorization tokens are deleted from the active database when the associated calendar connection is disconnected through Class26.

Booking and transaction records maintained independently of the calendar integration may remain subject to separate lawful retention requirements.

19. Security

Class26 implements appropriate technical and organizational measures to protect personal data against:

  • Unauthorized access.
  • Accidental loss.
  • Unlawful disclosure.
  • Misuse.
  • Unauthorized modification.
  • Destruction.
  • Security incidents.
  • Other unlawful processing.

Depending on the relevant systems and processing activities, measures may include:

  • Authentication and authorization controls.
  • Restricted access to personal data.
  • Encryption.
  • Server-side processing.
  • Security logging.
  • Monitoring.
  • Data minimization.
  • Secure application configuration.
  • Incident response procedures.
  • Appropriate contractual safeguards.

For Google Calendar and Microsoft Outlook Calendar integrations, OAuth tokens are encrypted using AES-256-GCM before storage.

Calendar authorization credentials are processed server-side and are not transmitted to the Expert's browser.

Access to calendar connections is restricted using authenticated account identifiers.

No electronic system can be guaranteed to be completely secure. Class26 therefore cannot guarantee absolute protection against every possible security risk.

20. Data Breaches and Security Incidents

Class26 assesses suspected personal data breaches and security incidents in accordance with applicable law.

Where required, Class26 will notify the Dutch Data Protection Authority and affected individuals within the applicable legal timeframes.

Class26 may take measures to:

  • Investigate incidents.
  • Contain security risks.
  • Prevent further unauthorized access.
  • Restore affected services.
  • Fulfil notification obligations.
  • Reduce potential harm.

Experts and relevant service providers must report suspected incidents involving Class26-related personal data in accordance with applicable contractual and legal obligations.

21. Rights of Data Subjects

Individuals have rights regarding their personal data under the GDPR, subject to applicable conditions and exceptions.

These rights may include:

  • The right of access.
  • The right to rectification.
  • The right to erasure.
  • The right to restriction of processing.
  • The right to data portability.
  • The right to object.
  • The right to withdraw consent.
  • Rights relating to automated individual decision-making.
  • The right to lodge a complaint with a supervisory authority.

Requests may be submitted to:

support@class26.com

Class26 may request reasonable identity verification before fulfilling a request.

Class26 responds to requests within the timeframes required by applicable law.

22. Access, Correction and Deletion

Individuals may request access to personal data processed by Class26.

They may request correction of inaccurate or incomplete information.

They may also request deletion of personal data where the applicable legal requirements are met.

Certain information may need to be retained where necessary to comply with legal obligations, resolve disputes, prevent fraud or establish, exercise or defend legal claims.

Experts may disconnect their Google Calendar or Microsoft Outlook Calendar through the Class26 dashboard.

Additional requests concerning connected calendar information may be submitted to support@class26.com.

23. Withdrawal of Consent

Where Class26 relies on consent as the legal basis for processing personal data, individuals may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Withdrawing consent may affect access to certain optional features.

Experts may also revoke OAuth authorization for connected calendars through the Class26 dashboard or the relevant Google or Microsoft account settings.

OAuth authorization and GDPR consent are separate concepts and may have different legal effects.

24. Objection to Processing

Individuals may object to processing based on legitimate interests.

Class26 will assess such objections in accordance with applicable law.

Where required, processing will cease unless compelling legitimate grounds justify continued processing or processing is necessary for legal claims.

Individuals may object to processing for direct marketing at any time.

25. Automated Decision-Making

Class26 may use automated systems to support:

  • Fraud prevention.
  • Platform security.
  • Analytics.
  • Service functionality.
  • Quality monitoring.
  • Operational processes.

Class26 does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals, unless such processing is legally permitted and appropriate safeguards are provided.

Where applicable, individuals may exercise their rights relating to automated individual decision-making.

26. Children and Minors

Class26 is generally not intended for children under the age of 16 without appropriate authorization from a parent or legal guardian where required.

Experts offering services involving minors are responsible for complying with applicable laws, professional requirements and relevant parental authorization obligations.

Class26 may take appropriate measures where it becomes aware of unauthorized processing of children's personal data.

27. Complaints

Individuals who have concerns about the processing of their personal data may contact Class26 at:

support@class26.com

Individuals also have the right to lodge a complaint with the competent supervisory authority.

In the Netherlands, the relevant authority is:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl

28. Links to Third-Party Websites

The Class26 Service may contain links to third-party websites, applications and services.

These may include:

  • Payment providers.
  • Video conferencing services.
  • Livestream platforms.
  • External educational resources.
  • Social media platforms.
  • Google services.
  • Microsoft services.
  • Other external applications.

Third-party services may process personal data under their own privacy policies.

Class26 is not responsible for processing activities independently determined by third parties.

Users should review the privacy information of relevant external services where appropriate.

29. Business Transfers

If Class26 is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be transferred where lawful and necessary in connection with that transaction.

Class26 will take appropriate measures to protect personal data and comply with applicable notification and data protection requirements.

Any transfer of Google API user data remains subject to applicable Google API Services User Data Policy restrictions.

30. Changes to This Privacy Policy

Class26 may update this Privacy Policy from time to time.

Changes may be necessary due to:

  • Legal or regulatory developments.
  • Changes to platform functionality.
  • New services or integrations.
  • Changes to third-party providers.
  • Security requirements.
  • Operational changes.
  • Updates to Google or Microsoft integration requirements.
  • Changes to data processing activities.

The latest version will be published on the Class26 website.

Where required by applicable law, Class26 will provide additional notice or request consent or authorization before implementing relevant changes.

Disclaimer Regarding Errors and Omissions

Class26 makes reasonable efforts to ensure that this Privacy Policy is accurate, complete and up to date. However, unintentional typographical errors, grammatical inaccuracies or editorial omissions may occur.

Class26 reserves the right to correct such errors at any time. To the extent permitted by applicable law, Class26 shall not be held liable for minor, unintentional editorial inaccuracies that do not materially affect the rights of individuals or the transparency of its data processing activities.

Nothing in this disclaimer limits or excludes any rights or obligations under the General Data Protection Regulation (GDPR) or other applicable laws.

31. Contact

For privacy-related questions, requests, complaints or notifications, please contact:

Class26 B.V.

Culemborg, The Netherlands
Email: support@class26.com
Website: https://class26.com

Privacy Policy: https://class26.com/privacy-policy