House of Ride — Privacy Policy
1. Who we are
This policy explains how House of Ride collects and uses your personal data when you visit our online academy, create an account or buy a course.
House of Ride VOF is the controller of your personal data. This means we decide how and why it is used, and we are responsible for it under the EU General Data Protection Regulation (GDPR).
- Address: Orteliuskade 69-1, 1057 AN Amsterdam, the Netherlands
- Chamber of Commerce (KvK) number: 88900371
- Email for all privacy questions and requests: [email protected]
Our courses are for people aged 18 and over. We do not knowingly collect data from anyone under 18.
2. What data we collect and why
We only collect the data we need. The table shows each type of data, what we use it for, and the legal basis that allows us to use it under the GDPR.
Data | What we use it for | Legal basis |
|---|---|---|
Name, email address, password (stored encrypted) | Creating your account and giving you access to your courses | Contract |
Purchase details: billing name, country, VAT number if a business, amount, date, transaction reference | Processing payments, issuing invoices, keeping tax records | Contract; legal obligation |
Course progress: lessons completed, quiz answers, completion date | Delivering the course and issuing your certificate | Contract |
Login and device data: IP address, device and browser type, approximate location, login times | Keeping accounts secure and detecting account sharing (section 3) | Legitimate interests |
Usage data: pages visited, videos watched, clicks | Understanding how courses are used so we can improve them | Consent (analytics cookies) |
Messages you send us | Answering questions, complaints and requests | Contract; legitimate interests |
Email address for newsletters | Sending news, offers and event updates | Consent, or legitimate interests for existing customers (section 4) |
Seat holders' names and emails provided by a Studio | Setting up seats in a Studio package | Legitimate interests (the Studio's contract with us) |
What the legal bases mean.
- Contract: we need the data to provide the course you bought.
- Legal obligation: the law requires us to keep it, for example for tax.
- Legitimate interests: we have a genuine business reason that does not override your rights, such as protecting our courses from misuse. You can object to this use (section 8).
- Consent: you have agreed. You can withdraw consent at any time.
We do not collect sensitive data, such as health information, and we do not sell your personal data.
3. How we detect account sharing
Each course licence is for one person on up to two devices. To enforce this, we monitor how accounts are used.
- What we look at: login times, IP address, device and browser type, and approximate location (city or region, worked out from your IP address). We do not use precise GPS location.
- How: we use Mixpanel, an analytics service, to record login and usage events and flag unusual patterns, such as more than two devices or logins at the same time from different places.
- Human review: a flag never leads to permanent removal of access on its own. A member of our team reviews it, and we contact you and give you a chance to explain before taking further action, as set out in our Terms and Conditions.
- Why this is fair: we have a legitimate interest in protecting our courses and the customers who pay for them. We only use this data for security and to enforce our licence terms.
- How long we keep it: login and device data is kept for 12 months, or longer only if it is needed for an open account-sharing case.
4. Marketing emails and cookies
Marketing emails. We send newsletters about our courses, trainings and events using Flodesk.
- If you are not a customer, we only email you if you have signed up and agreed to receive our emails.
- If you have bought from us, we may email you about similar courses and events. You can say no when you buy, and in every email.
- Every email has an unsubscribe link. You can also unsubscribe by emailing [email protected].
Emails about your account and purchases, such as receipts and access details, are not marketing. We will always send these.
Cookies. Cookies are small files stored on your device when you visit a website.
- Essential cookies keep you logged in, keep your account secure and make checkout work. These are always on, because the academy cannot work without them.
- Analytics cookies help us understand how courses are used, for example through Mixpanel. We only use these if you agree in our cookie banner.
You can change your cookie choices at any time through the cookie settings link on our website, or by clearing cookies in your browser.
5. Who we share your data with
We share data only with service providers who help us run the academy, and only what they need. They act on our instructions, under data processing agreements.
Provider | What they do for us | Where |
|---|---|---|
Thinkific | Hosts the academy, your account and course progress | Canada |
Thinkific Payments and its payment partners | Process payments | Canada, United States |
Mixpanel | Usage analytics and account-sharing detection | United States |
Flodesk | Sends our newsletters | United States |
Zapier | Moves data between our tools to automate admin | United States |
We may also share data with our accountants and advisers, or with authorities when the law requires it. If House of Ride is restructured or sold, your data may pass to the new owner, who must keep protecting it in line with this policy.
Transfers outside the EU. Some providers are based outside the European Economic Area. We only transfer data where it stays protected to EU standards:
- Canada has an EU adequacy decision, so data can move there under GDPR rules.
- For providers in the United States, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
You can ask us for more information about these safeguards.
6. How long we keep your data
Data | How long |
|---|---|
Account and course progress | While your account is active, then deleted 2 years after your last login or your course access ends, whichever is later |
Purchase and invoice records | 7 years, as Dutch tax law requires |
Login and device data | 12 months (longer only for an open account-sharing case) |
Analytics data | 24 months |
Messages you send us | 2 years after the matter is closed |
Newsletter email address | Until you unsubscribe |
7. How we protect your data
We use reputable providers with strong security, encrypted connections and encrypted passwords. Only people at House of Ride who need your data for their work can access it. If a data breach puts your rights at risk, we will tell you and the authorities as the law requires.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy
- correct data that is wrong or incomplete
- delete your data, where we no longer have a reason to keep it
- restrict how we use your data in certain cases
- object to uses based on our legitimate interests, including the account-sharing checks, and to direct marketing at any time
- receive your data in a portable format, or have it sent to another company
- withdraw consent at any time, without affecting what we did before
To use any of these rights, email [email protected]. We will reply within one month. We may ask you to confirm your identity first.
9. Complaints
If you are unhappy with how we use your data, please contact us first and we will try to put it right. You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also complain to the authority in the country where you live or work.
10. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If we make a significant change, we will tell you by email before it takes effect.