Privacy and personal data

Data we collect

Name, email address, phone number, service area, chosen training, appointment preference and payment status. For an Expat Driving Check we also process preferred language, issuing country and limited licence details, EU/EEA status, possible registration date, Expat Scheme status, driving experience and requested service. Nationality is optional. This public intake does not request a citizen service number, identity copies, full licence number, tax documents or payment details. For the MAHES sinds 1981 Lesson Plan, we also process date of birth, payer or legal representative, consents, instalment status and receipts where needed for the agreement and records.

Why we use it

To answer your request, release prepaid training parts, schedule lessons or tests, fulfil an order, process payments and receipts and comply with legal obligations.

Payment details

MAHES sinds 1981 does not store full bank or card details. Digital mandates and payments are handled by the payment provider. MAHES sinds 1981 stores only necessary references, amounts, statuses and administrative receipts.

Processors and recipients

Where necessary, data may be processed by Cloudflare for hosting and security, Mollie for payments, Google Calendar for scheduling, Google Maps for route calculations requested by the instructor when those integrations are active, the email provider for essential messages, and CBR or other competent authorities for requested tests. For live route advice, the server only sends the current start position and destination needed for that calculation. The exact start position is not stored in the route cache; temporary reuse stores only an irreversible key derived from a rounded location area. MAHES sinds 1981 only shares data necessary for that task and does not sell personal data.

Location and lesson route in the app

The app does not request location silently or automatically. Location sharing can only be started by the linked learner or instructor after both have given clear consent for the active lesson. While sharing, route points are visible to the linked learner, assigned instructor and authorised MAHES administrators. Sharing stops when the user switches it off or the instructor ends the lesson. You can request access or deletion via contact@rijschoolmahes.nl unless a legal retention duty or necessary dispute investigation applies.

Specific retention periods

• Contact and intake requests: up to 2 years after the last substantive contact.
• Applications: no later than 4 weeks after the recruitment process ends; longer retention requires separate consent.
• Customer, lesson and scheduling data: during the customer relationship and for up to 2 years afterwards, unless a dispute or legal duty requires longer retention.
• Financial administration, invoices, contracts and payment records: 7 years under tax retention rules.
• Technical security and abuse logs: up to 30 days, unless incident investigation requires longer retention.

After expiry, data is deleted or anonymised, except where a statutory retention duty applies.

Privacy-friendly marketing measurement

MAHES sinds 1981 records anonymous first-party events such as page visits, email or contact-request clicks, form starts and saved requests. Campaign codes may be stored to understand attribution. No external advertising pixels are currently active and measurement does not contain names, email addresses, phone numbers or message content.

Your rights

You can request access, correction, deletion, restriction, portability or object where permitted by law. A financial record that must legally be retained is not erased when incorrect, but corrected through a visible correction entry. You may also lodge a complaint with the Dutch Data Protection Authority. contact@rijschoolmahes.nl.

My MAHES

The customer portal uses secure sign-in and only displays personal lesson, payment and document details after the signed-in account has been verified and linked to the correct customer. Personal portal data is not placed in public URLs or browser storage. A customer only sees their own data and documents released for that account.