Last updated: 11 October 2026
Privacy Policy
This policy describes how the WAIMAKERS Academy learning platform handles personal data. It is provided for transparency and should be read together with any data processing agreement between WAIMAKERS and your organisation.
This Privacy Policy explains how WAIMAKERS B.V. ("WAIMAKERS", "we", "us") collects and uses personal data when you use the WAIMAKERS Academy learning platform (the "Platform"), available at academy.waimakers.com and any company-branded version of it.
WAIMAKERS Academy is a multi-tenant, white-label corporate learning platform. Where your account was created by your employer or another organisation, that organisation is generally the controller of your personal data and WAIMAKERS acts as its processor under a data processing agreement; for individual (self-service) accounts, WAIMAKERS is the controller. This policy applies in either case and, where your organisation is the controller, is supplemented by that organisation's own privacy notice.
1. Who we are
The organisation responsible for the Platform is:
- WAIMAKERS B.V. (trading as WAIMAKERS)
- Chamber of Commerce (KVK): 91822416
- Address: Joop Geesinkweg 201-224, 1114 AB Amsterdam, The Netherlands
- Email: admin@waimakers.com
2. What personal data we collect
Account and profile data
- Name, email address and (optionally) profile photo
- Your job role and the organisation you belong to
- Account language and interface preferences
- Your password, stored only as a salted cryptographic hash (we never see it in plain text)
Learning activity
- Course, module and unit progress, video watch progress and time spent learning
- Quiz answers and scores, start-check (level assessment) results, points and leaderboard position
- Assignment submissions, including text you write and any files or screen recordings you upload
- Feedback survey responses and the certificates you earn
Feedback you send us
- What you write with the Feedback button or under a lesson, the kind of feedback and when you sent it
- The page and lesson it was about, what you pointed at, your AI tool, language, browser, screen size and the app version
- A screenshot of what was on your screen, only when you leave “Add this screenshot” switched on
Billing data (for paying customers and standalone learners)
- Billing contact details, company name and VAT number where applicable
- Subscription, seat and invoice records
- Payment card details are entered directly with our payment provider (Stripe) and are never stored on our servers.
Technical data
- IP address, browser and device type, and approximate region derived from your IP
- Server and security logs, and diagnostic/error information
Your clay figure
- The clay figure you pick for your certificates, or the one made from your own photo
- If you choose to have one made from your own photo: the photo itself (we delete it as soon as your figure is made, at the latest 24 hours after you send it), a short description of what it shows (hair, beard, expression and clothes; never your ethnicity, age, gender, religion or identity), and when you agreed to this, with the version of the words you agreed to
3. How we use your data and our legal bases
We process personal data for the following purposes and on the following legal bases (Article 6 GDPR):
- To provide the Platform, your account and your learning path, and to record and display your progress and certificates, performance of a contract (or the legitimate interest of your organisation in delivering training to you).
- To grade assignments and provide AI-assisted coaching and feedback, performance of a contract; see the AI section below.
- To process subscriptions, seats, payments and invoices, performance of a contract and compliance with legal (tax) obligations.
- To secure the Platform, prevent abuse, and diagnose and fix problems, our legitimate interests in a safe and reliable service.
- To read, answer and act on the feedback you send us, our legitimate interest in improving the courses and the Platform.
- To send you service and account emails (for example invitations, password resets and receipts), performance of a contract.
- To improve the Platform, our legitimate interests, using aggregated or de-identified information wherever possible.
4. Artificial intelligence
The Platform uses AI to grade certain assignments and to power the in-app coach. When you use these features, the relevant content (for example your assignment text or your question to the coach) is sent to our AI provider, Anthropic (Claude), to generate a response.
- AI processing happens server-side; the AI provider processes your content on our behalf under a data processing agreement and does not use it to train its models.
- AI-generated feedback and grades are intended to support learning, not to make legally or similarly significant decisions about you.
- AI output can be inaccurate or incomplete; it should not be relied on as professional advice.
- Per-tenant cost limits and a kill-switch govern AI usage, and where the AI provider is unavailable an assignment may pass through so that it never blocks your progress unfairly.
If you choose to have a clay figure made from your own photo, the photo is sent once to Google (Gemini), our image AI provider. It first checks the photo (one adult, a visible face, nothing inappropriate) and then sculpts your figure from it. Google processes the photo on our behalf under its data processing terms; it does not use the photo to train its models and keeps it only for a limited time, solely to detect misuse of its service. Picking one of the ready-made figures sends nothing to Google.
7. International transfers
Some of our sub-processors are based outside the European Economic Area, primarily in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
8. How long we keep data
We keep your account and learning data for as long as your account is active and, for organisation accounts, for as long as your organisation's agreement with us is in place. After that, we delete or anonymise personal data within a reasonable period, except where we must retain certain records (such as invoices) to meet legal obligations.
Feedback you send stays with your account, so you can read our answers under Profile → Your feedback, and is deleted when your account or your organisation's account is deleted. A screenshot sent with feedback can show personal data, so we delete it 180 days after we close that feedback, and in any case no later than 365 days after you sent it.
A photo you upload for a clay figure is deleted from our systems as soon as the figure is made, and in any case within 24 hours of being uploaded. Your figure stays until you delete it under Profile → Your figure, or until your account or your organisation's account is deleted; figures you turn down are deleted straight away.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to certain processing;
- receive your data in a portable format; and
- withdraw any consent you have given, without affecting prior processing.
To exercise these rights, contact us at admin@waimakers.com. If your account was provided by your organisation, you may need to direct some requests to that organisation as the controller, and we will assist them. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
10. Security
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, tenant isolation with row-level security, hashed passwords and access controls. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.
11. Children
The Platform is intended for use by professionals in a workplace context and is not directed at children. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and, where changes are significant, provide a more prominent notice.
13. Contact
For any question about this policy or your personal data, contact us at admin@waimakers.com.