Privacy Policy

Last updated: 25 July 2026
Version: 1.0

1. Introduction

NLLES respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how NLLES collects, uses, stores, shares and protects personal data when you:

visit or use the NLLES website;
create or manage an NLLES account;
purchase a course, practice-exam package or other digital service;
participate in an online lesson, intake, assessment or speaking evaluation;
complete a Dutch Basic Civic Integration practice examination;
contact NLLES by email, telephone, WhatsApp, a website form or another communication channel; or
otherwise interact with NLLES.

This Privacy Policy also explains the rights available to you under applicable data-protection legislation and how you may exercise those rights.

NLLES provides online Dutch Basic Civic Integration preparation services, including A1-level courses, learning materials, practice examinations and speaking assessments. NLLES operates internationally and may provide its services to learners, purchasers and other users located in Morocco, the European Economic Area, the United Kingdom and other countries.

This Privacy Policy applies to all personal data processed by NLLES in connection with its website and services, regardless of the country from which you access those services.

It does not apply to websites, applications or services operated independently by third parties, even where those services are linked to or integrated with the NLLES website. Those third parties are responsible for their own privacy practices.

2. Who We Are

For the purposes of applicable data-protection legislation, the data controller is:

NLLES may also trade or communicate under the name “NL Les”.

NLLES
17 Operation Badei Lot Amerchi
Morocco

Privacy-related requests may be submitted:

through the Contact page on the NLLES website; or
by post to the address stated above.

Where applicable, references in this Privacy Policy to “NLLES”, “we”, “us” or “our” mean the person or business operating the NLLES website and services.

If a formal data-protection representative is appointed in the European Economic Area, the United Kingdom or another jurisdiction, the representative’s details will be added to this Privacy Policy.

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

the NLLES website and customer-account environment;
course enquiries, intake appointments and registrations;
purchases and payment administration;
online Dutch-language and integration courses;
downloadable, streamed or web-based learning materials;
Dutch Basic Civic Integration practice examinations;
reading, speaking and Knowledge of Dutch Society practice materials;
speaking recordings, transcripts and assessment services;
customer service and technical support;
website security, fraud prevention and access management;
communications relating to NLLES services; and
any other service that refers or links to this Privacy Policy.

This Privacy Policy applies to learners as well as to other persons who purchase or arrange a course or service for a learner, such as a spouse, partner, family member or sponsor.

Where one person purchases or arranges services for another person, both individuals may be data subjects under this Privacy Policy.

4. Meaning of Personal Data

“Personal data” means information relating to an identified or identifiable natural person.

A person may be identifiable directly, for example through a name or email address, or indirectly through information such as an account identifier, device identifier, transaction number or combination of other information.

Personal data does not include information that has been irreversibly anonymised so that no individual can reasonably be identified.

“Processing” means any operation performed on personal data, including collecting, recording, organising, storing, viewing, using, changing, transmitting, sharing, restricting, deleting or destroying it.

5. Personal Data We Collect

Depending on how you use NLLES, we may collect and process the following categories of personal data.

5.1 Identity and contact data

This may include:

first name;
last name;
username or account name;
email address;
telephone or WhatsApp number;
postal or billing address;
country or region;
preferred language;
time zone;
information identifying the learner where the purchaser is another person; and
other contact information you voluntarily provide.

5.2 Account and authentication data

This may include:

account username;
encrypted or hashed password information;
account creation date;
account status;
assigned user role;
package or course access permissions;
account login and logout information;
password-reset records;
account-security settings;
available speaking-assessment credits or review credits;
product entitlements;
access start and expiry dates; and
records of account restrictions, suspensions or closures.

NLLES does not have access to your password in readable form where the website’s authentication system stores passwords securely in hashed form.

5.3 Purchase, transaction and billing data

This may include:

products or services purchased;
order number;
order date;
purchase price;
currency;
payment status;
billing name and address;
applicable tax information;
payment method category;
transaction or payment-provider reference;
refund, cancellation or payment-dispute information;
invoice or receipt information;
records of failed or incomplete payments; and
communications relating to a transaction.

NLLES does not normally receive or store complete payment-card numbers, card security codes or online-banking login credentials. These are generally processed directly by the relevant payment provider or financial institution.

5.4 Course, lesson and enrolment data

This may include:

the course or programme in which you are enrolled;
intake information;
lesson schedule;
attendance;
start and completion dates;
selected lesson frequency;
learning needs and objectives;
language level;
preparation status;
homework or assignments;
submitted answers;
teacher notes;
lesson-related communications;
course progress;
access to learning materials; and
administrative information required to organise or deliver lessons.

5.5 Practice-examination and learning-activity data

When you use practice examinations or online learning tools, we may collect:

examination or exercise selected;
examination start and completion time;
time spent;
questions viewed;
answers submitted;
unanswered questions;
number of attempts;
score;
pass or fail indication;
result;
assessment status;
feedback;
progress;
date and time of an attempt;
product or package through which access was obtained;
country, language or device information associated with an attempt;
technical information relating to interruption or completion of an attempt; and
records showing whether an assessment credit was used.

Practice-examination results are educational practice results only. They are not official Dutch government examination results and do not determine a person’s legal or immigration status.

5.6 Speaking recordings and transcription data

Where you choose to complete a speaking practice examination or request a speaking assessment, we may process:

audio recordings of your spoken answers;
automatically generated speech-to-text transcripts;
corrections or annotations;
pronunciation and answer assessments;
scores;
examiner or reviewer observations;
recording duration;
question number;
submission date;
assessment status; and
technical information needed to create, upload, play or review the recording.

Voice recordings are processed for the purpose of delivering speaking-practice and assessment services. NLLES does not use voice recordings to establish or verify your identity and does not use them to create a voiceprint for biometric identification.

Automated transcripts may contain errors. Where a human assessment has been purchased or requested, the assessment may be based on the audio recording and not solely on the automated transcript.

5.7 Communications data

When you contact us, we may collect:

the content of your message;
your contact details;
the date and time of the communication;
previous correspondence;
attachments;
complaint information;
support-request information;
responses provided by NLLES; and
records of follow-up actions.

This includes communications through:

website contact or registration forms;
email;
telephone;
WhatsApp;
videoconferencing platforms;
social-media messaging; or
other communication channels made available by NLLES.

5.8 Online lesson and videoconferencing data

Where lessons, intake meetings or consultations take place through a third-party videoconferencing platform, the platform may process information such as:

your display name;
email address;
profile image;
IP address;
device information;
audio;
video;
meeting participation times;
chat messages; and
files shared during the meeting.

NLLES does not routinely record live lessons or intake meetings.

If NLLES intends to record a lesson, consultation or meeting, you will be informed before recording begins. Where consent is required, recording will not begin without the required consent.

You may generally participate with your camera switched off unless use of a camera is reasonably necessary for the particular lesson or service and you have been informed of this requirement.

5.9 Technical, usage and log data

When you visit or use the website, we or our service providers may automatically collect:

IP address;
approximate location derived from the IP address;
browser type and version;
operating system;
device type;
screen size;
language settings;
time zone;
referring page;
pages visited;
links or buttons used;
date and time of access;
login activity;
session identifiers;
error messages;
website performance information;
security events;
failed login attempts;
access-control events; and
other server, application or network logs.

We use this information to operate, secure, troubleshoot and improve the website and services.

5.10 Cookie and preference data

We may collect information through cookies and similar technologies, including:

session identifiers;
login status;
cookie-consent choices;
shopping-cart contents;
selected language;
website preferences;
analytics identifiers; and
information required to maintain website functionality.

Further information is provided in Section 15 of this Privacy Policy and, where available, in the separate Cookie Policy or cookie-preference tool.

5.11 Information provided about another person

You may provide information about another person, for example where you:

purchase a course for your spouse or partner;
register a learner;
arrange an intake appointment;
provide a learner’s telephone number or email address; or
communicate with NLLES on a learner’s behalf.

You must ensure that:

the information is accurate;
you are authorised to provide it;
the person has been informed that their data will be shared with NLLES; and
where necessary, the person has agreed to the disclosure.

NLLES may contact the learner directly to confirm their identity, wishes, course details or consent.

5.12 Special-category or sensitive data

NLLES does not normally require information concerning:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade-union membership;
genetic data;
biometric data used for identification;
health information;
sex life or sexual orientation; or
criminal convictions and offences.

Please do not provide sensitive personal data unless it is genuinely necessary for a specific request.

If you voluntarily provide sensitive information, we will process it only where there is an appropriate legal basis and only to the extent reasonably necessary. For example, limited health or accessibility information may be processed to consider a reasonable adjustment or to address an emergency.

6. How We Collect Personal Data

We may collect personal data:

6.1 Directly from you

For example, when you:

complete a contact, registration or checkout form;
create an account;
purchase a product;
enrol in a course;
schedule an appointment;
attend a lesson;
complete a practice examination;
submit a speaking recording;
contact customer support;
request a refund;
exercise a privacy right; or
otherwise communicate with us.

6.2 Automatically

Technical and usage information may be collected automatically when you:

visit the website;
log into your account;
use an online examination;
access course materials;
interact with website functions; or
receive or open certain electronic communications.

6.3 From another person

We may receive your personal data from:

a spouse or partner;
a family member;
a person purchasing services for you;
an authorised representative; or
another person arranging your course, appointment or account.

6.4 From service providers and business partners

We may receive information from:

payment providers;
banks and financial institutions;
website-hosting providers;
e-commerce and account-management systems;
videoconferencing providers;
email-delivery providers;
fraud-prevention and security providers;
analytics providers; and
technical-support providers.

For example, a payment provider may tell us whether a payment was successful, without providing complete card details.

6.5 From publicly available sources

In limited circumstances, we may collect information from a publicly available source where this is reasonably necessary to:

verify business or contact information;
protect against fraud;
establish, exercise or defend a legal claim; or
respond to a dispute or misuse of our services.

7. Purposes and Legal Bases for Processing

We process personal data only where we have a valid legal basis under applicable law.

The legal bases described below include those recognised under the General Data Protection Regulation, the UK General Data Protection Regulation and comparable data-protection principles.

The exact legal basis may depend on your location and the circumstances of the processing.

7.1 To respond to enquiries and arrange intake appointments

We use identity, contact and communication data to:

respond to questions;
provide information about courses and practice examinations;
determine whether a service is suitable;
arrange an intake or trial appointment;
communicate available times; and
prepare for a possible course registration.

Legal basis: taking steps at your request before entering into a contract and our legitimate interest in responding to prospective customers and managing registrations.

7.2 To create and manage accounts

We use identity, contact, authentication and account data to:

create your account;
authenticate you;
enable access to purchased services;
maintain your account;
reset passwords;
display your products, access periods or assessment credits;
prevent unauthorised access; and
provide account-related support.

Legal basis: performance of a contract and our legitimate interest in operating a secure customer-account system.

7.3 To process purchases and payments

We use identity, contact, billing and transaction data to:

process orders;
confirm payment;
issue invoices or receipts;
provide purchased access;
administer refunds or payment disputes;
maintain financial records;
prevent fraud; and
comply with tax, accounting and financial obligations.

Legal basis: performance of a contract, compliance with legal obligations and our legitimate interest in receiving and administering payments.

7.4 To deliver courses and learning services

We use identity, contact, course, attendance, progress and communication data to:

organise and provide lessons;
schedule lessons;
send learning materials;
provide homework;
monitor progress;
communicate about the course;
manage course access; and
provide educational support.

Legal basis: performance of a contract and our legitimate interest in administering and improving our educational services.

7.5 To provide practice examinations

We use account, examination, answer, score, progress, technical and access data to:

deliver practice examinations;
save or display progress;
calculate practice results;
enforce examination time limits;
record completed attempts;
provide access to previous results where available;
manage purchased packages;
prevent unauthorised access;
investigate technical problems; and
improve the reliability of the examination environment.

Legal basis: performance of a contract and our legitimate interest in providing, securing and improving the examination platform.

7.6 To provide speaking practice and assessments

We use speaking recordings, transcripts, answers, scores and related data to:

record and store submitted answers temporarily;
create automated transcripts;
allow playback where the service provides that function;
assess answers and pronunciation;
calculate or assign a result;
allow an authorised reviewer to listen to an assessment;
provide the purchased assessment service;
investigate a timely complaint or technical problem; and
protect the integrity of the assessment system.

Legal basis: performance of a contract and our legitimate interest in delivering and administering speaking assessments.

Where a separate optional use of a recording is proposed, such as using an identifiable recording for training, promotional or research purposes unrelated to the purchased assessment, we will request separate consent before that use.

7.7 To communicate with you

We use identity, contact and communication data to:

send service messages;
confirm appointments;
send payment confirmations;
provide access instructions;
send password-reset messages;
communicate schedule changes;
answer support questions;
provide important account, security or legal notices; and
follow up on an active enquiry or transaction.

Legal basis: performance of a contract, taking steps before entering into a contract and our legitimate interest in communicating with users and customers.

7.8 To send marketing communications

Where permitted, we may use your contact details to send information about:

new courses;
new practice examinations;
service improvements;
relevant offers; or
other NLLES services.

Legal basis: your consent where consent is required, or our legitimate interest in communicating with existing customers about relevant services where applicable law permits this.

You may unsubscribe from marketing communications at any time.

Service-related messages, such as payment confirmations, security notices, lesson information and access instructions, are not marketing messages and may continue where necessary.

7.9 To operate and improve the website

We use technical, usage, log and cookie data to:

operate the website;
maintain website functionality;
diagnose errors;
improve performance;
understand how website functions are used;
test new features;
maintain compatibility across devices;
improve navigation and accessibility; and
develop or improve products and services.

Legal basis: our legitimate interest in operating and improving the website. Where non-essential cookies or similar technologies require consent, we rely on your consent.

7.10 To protect security and prevent misuse

We use account, transaction, technical, usage and communication data to:

prevent unauthorised access;
detect suspicious activity;
prevent fraud;
protect course materials and examination content;
enforce product-access restrictions;
prevent account sharing or abuse;
investigate malicious activity;
protect users, NLLES and service providers;
maintain backups;
respond to security incidents; and
establish, exercise or defend legal claims.

Legal basis: our legitimate interest in protecting our services, content, users and legal rights, and compliance with legal obligations where applicable.

7.11 To comply with legal obligations

We may process personal data to:

maintain accounting and transaction records;
respond to lawful requests from authorities;
comply with tax obligations;
comply with data-protection obligations;
manage complaints;
respond to court orders;
prevent unlawful activity; and
establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and our legitimate interest in protecting our legal rights.

7.12 With your consent

We may request consent where required, including for:

certain non-essential cookies;
particular marketing communications;
recording a live lesson or meeting;
optional publication of a testimonial;
optional use of a learner’s image, voice or success story;
optional promotional content; or
another purpose clearly explained when consent is requested.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Legitimate Interests

Where we rely on legitimate interests, we consider whether:

there is a legitimate business or operational purpose;
processing is necessary for that purpose; and
your interests, rights or freedoms override that purpose.

Our legitimate interests may include:

operating an international e-learning business;
responding to prospective customers;
providing customer service;
maintaining account and website security;
preventing fraud and misuse;
protecting educational content;
enforcing access restrictions;
understanding and improving service performance;
maintaining accurate records;
recovering amounts owed;
managing disputes;
protecting legal rights; and
communicating with existing customers about relevant services where permitted.

You may object to processing based on legitimate interests as explained in Section 18.

9. When Providing Personal Data Is Required

Some personal data is required to enter into or perform a contract.

For example, we may require:

your name;
email address;
account credentials;
payment confirmation;
the identity of the learner;
sufficient information to deliver a course or assessment; and
information necessary to provide purchased access.

Fields marked as mandatory must generally be completed.

If required information is not provided, we may be unable to:

create an account;
process a purchase;
provide access;
arrange a lesson;
assess a speaking examination;
issue a receipt;
respond fully to a request; or
provide another requested service.

Optional information does not have to be provided unless it becomes reasonably necessary for a specific request.

10. Automated Processing and Practice Results

Certain website functions operate automatically.

For example, the platform may automatically:

calculate time spent;
close an examination when the permitted time expires;
count completed questions;
calculate a practice score;
display a pass or fail indication;
reduce an available assessment credit after submission;
assign purchased access;
restrict access when a package expires;
detect technical or security events; or
generate a speech-to-text transcript.

These processes are used to provide and administer the service.

NLLES does not use solely automated decision-making to make decisions that produce legal effects or similarly significant effects concerning you.

Automatically generated practice scores and pass or fail indications:

relate only to the NLLES practice environment;
are not official examination decisions;
do not determine whether you pass an official Dutch examination;
do not determine immigration eligibility; and
do not create a legally binding educational qualification.

Where an assessment includes human review, the reviewer may consider the submitted audio and answers independently of an automated transcript or automated indication.

11. Sharing Personal Data

We do not sell or rent personal data.

We may share personal data only where reasonably necessary and where there is an appropriate legal basis.

11.1 Website and hosting providers

Personal data may be processed by providers that host, maintain, secure or support:

the website;
databases;
user accounts;
backups;
course materials;
practice examinations;
audio files;
email systems; and
other technical infrastructure.

11.2 E-commerce and account-management providers

We may use software or service providers to manage:

products;
orders;
checkout;
customer accounts;
access permissions;
subscriptions or access periods;
invoices;
shopping carts; and
transaction administration.

11.3 Payment providers and financial institutions

We may share transaction-related information with:

payment processors;
banks;
financial institutions;
payment-link providers;
fraud-prevention providers; and
accounting-service providers.

Payment providers process payment information under their own terms and privacy policies and may act as independent data controllers for parts of their processing.

11.4 Videoconferencing and communication providers

Where lessons or appointments take place online, personal data may be processed by providers of:

videoconferencing;
email;
telephone;
messaging;
cloud communications; and
calendar or appointment services.

11.5 Technical and professional service providers

We may use:

IT support providers;
website developers;
security specialists;
cloud-storage providers;
email-delivery services;
analytics providers;
transcription providers;
professional advisers;
accountants;
tax advisers;
insurers; and
legal advisers.

Such providers receive only the information reasonably necessary for their function.

Where a provider acts as our processor, we require it to process personal data only on documented instructions, maintain appropriate confidentiality and security, and comply with applicable data-protection obligations.

11.6 Teachers, assessors and authorised personnel

Personal data may be accessed by:

the course teacher;
an authorised speaking assessor;
an authorised administrator;
an authorised customer-support person; or
another person who reasonably requires access to provide or administer the service.

Access is limited according to role and operational need.

11.7 Authorities and legal recipients

We may disclose personal data where reasonably necessary to:

comply with applicable law;
respond to a valid court order;
respond to a lawful request from a competent authority;
report suspected unlawful activity;
protect a person’s safety;
protect our rights, property or systems;
enforce a contract; or
establish, exercise or defend a legal claim.

11.8 Business transfers

If all or part of the NLLES business is sold, transferred, reorganised or combined with another business, relevant personal data may be disclosed to:

prospective purchasers;
professional advisers;
investors;
financing parties; or
the successor operator.

Any recipient will be required to protect the confidentiality of the information and use it only for the relevant transaction or continued operation of the service.

12. Independent Third-Party Services

The website or services may contain links to, or integrations with, independent third-party services.

These may include:

payment platforms;
banks;
videoconferencing platforms;
social-media platforms;
messaging applications;
embedded media;
external learning resources; and
other websites.

When you use an independent third-party service, that provider may collect and process personal data under its own privacy policy.

NLLES does not control the independent privacy practices of those providers.

You should review the privacy information of any third-party service before providing personal data to it.

13. International Transfers

NLLES is based in Morocco and provides services internationally.

Your personal data may therefore be processed in Morocco and in other countries in which our service providers, payment providers, hosting providers, communication providers or technical-support providers operate.

These countries may have data-protection laws that differ from those in your country.

Where required by applicable law, we use appropriate safeguards for international transfers. Depending on the circumstances, these may include:

transferring information to a country recognised as providing an adequate level of protection;
contractual data-protection provisions;
the European Commission’s Standard Contractual Clauses;
an applicable United Kingdom international-data-transfer mechanism;
consent where legally valid and appropriate;
transfers necessary for the performance of a contract;
transfers necessary to establish, exercise or defend legal claims;
transfers required by law; or
another approved transfer mechanism.

Where Moroccan Law No. 09-08 requires a declaration, authorisation or other formality for an international transfer, NLLES will take the applicable steps with the Moroccan Commission Nationale de contrôle de la protection des Données à Caractère Personnel.

We take reasonable steps to ensure that service providers receiving personal data provide appropriate confidentiality and security protections.

You may contact us for further information about the safeguards applicable to a particular transfer.

14. Data Security

We use reasonable and appropriate technical and organisational measures designed to protect personal data against:

accidental loss;
unlawful destruction;
unauthorised access;
unauthorised disclosure;
alteration;
misuse; and
other unlawful processing.

Depending on the system and the nature of the information, these measures may include:

encrypted website connections;
access controls;
password protection;
secure password hashing;
role-based access;
account authentication;
software updates;
security monitoring;
backups;
firewall or hosting-security measures;
restricted administrative access;
data minimisation;
confidentiality requirements;
service-provider assessments;
incident-response procedures; and
deletion or anonymisation procedures.

Access to personal data is limited to persons who reasonably need that access for an authorised purpose.

No internet transmission, website, storage system or security measure is completely secure. We therefore cannot guarantee absolute security.

You are responsible for:

selecting a strong password;
keeping your login information confidential;
not sharing your account;
logging out when using a shared device;
maintaining the security of your own email account and device; and
informing us promptly if you believe your account has been compromised.

15. Cookies and Similar Technologies

15.1 What cookies are

Cookies are small text files or similar technologies stored on or accessed through your device when you visit a website.

They may be used to recognise a browser, maintain a session, remember preferences, support checkout, measure website usage or provide other functionality.

15.2 Categories of cookies

The NLLES website may use the following categories.

Strictly necessary cookies

These cookies are required for essential website functions, such as:

account login;
authentication;
security;
shopping-cart functionality;
checkout;
maintaining a user session;
remembering privacy choices; and
providing purchased access.

Because these cookies are necessary to provide the website or a service you request, they may not require consent under applicable law.

Functional cookies

These cookies may remember choices such as:

language;
display settings;
account preferences; and
other optional website preferences.

Analytics cookies

These cookies may help us understand:

which pages are used;
how users move through the website;
whether errors occur;
how long pages take to load; and
how website performance may be improved.

Where required, analytics cookies will be used only after consent.

Marketing cookies

If marketing or advertising technologies are introduced, they may be used to measure campaigns or show relevant communications.

Where required, marketing cookies will be used only after consent.

15.3 Cookie choices

Where legally required, the website will provide a cookie banner or preference tool.

You may be able to:

accept optional cookies;
reject optional cookies;
select categories; or
change your choices later.

You may also change browser settings to block or delete cookies.

Blocking strictly necessary cookies may prevent parts of the website from functioning correctly, including login, checkout and account access.

16. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including the need to:

provide the service;
maintain accounts;
answer questions;
comply with legal, tax and accounting obligations;
resolve disputes;
investigate misuse;
maintain security;
enforce agreements; and
establish, exercise or defend legal claims.

The applicable period depends on the nature of the information and the reason for processing it.

Unless a different period is required or justified, our normal retention approach is as follows.

16.1 Enquiry and prospective-customer information

Enquiry and intake information may be retained for up to 24 months after the last meaningful contact, unless:

you become a customer;
you request earlier deletion;
a dispute exists; or
a longer period is required by law.

16.2 Customer-account data

Account and profile information may be retained while the account remains active and for up to 24 months after account closure or the last active product-access period.

Limited information may be retained longer where necessary for security, transaction records, disputes or legal obligations.

16.3 Course and lesson records

Administrative course information, attendance records, progress information and relevant communications may normally be retained for up to three years after completion or termination of the course.

Information may be retained longer where required for:

an unresolved complaint;
a payment dispute;
legal compliance;
fraud prevention; or
legal claims.

16.4 Practice-examination data

Practice-examination attempts, scores and result information may be retained:

during the validity of the purchased package;
for the period during which the account allows previous attempts to be viewed; and
for up to 24 months after the relevant access period expires.

Information may be deleted or anonymised earlier where it is no longer necessary.

16.5 Speaking recordings and raw transcripts

Speaking recordings and raw automated transcripts are retained only for the period reasonably necessary to:

provide the speaking-practice service;
complete a requested assessment;
deliver the result;
investigate a timely technical issue;
address a timely complaint or assessment query; and
protect the integrity of the assessment process.

Unless a longer period is specifically communicated or is necessary for an unresolved dispute, our operational target is to delete or irreversibly anonymise speaking recordings and raw transcripts within 30 days after the relevant assessment has been completed.

Assessment results, scores and administrative records may be retained separately for the periods described for course or practice-examination records.

16.6 Communications and support requests

Customer-service, complaint and support communications may normally be retained for up to three years after the matter is closed.

16.7 Transaction, invoice and accounting records

Transaction, invoice, refund and accounting information will be retained for the period required by applicable tax, accounting, anti-fraud and financial-recordkeeping laws.

16.8 Technical and security logs

Routine website and server logs may normally be retained for up to 12 months.

Logs relating to a specific security incident, misuse investigation or legal claim may be retained for longer where necessary.

16.9 Marketing information

Marketing contact information may be retained until:

you unsubscribe;
you withdraw consent;
we determine that the information is no longer accurate or useful; or
we stop the relevant marketing activity.

We may retain a limited suppression record to ensure that an unsubscribe request continues to be respected.

16.10 Consent records

Where processing is based on consent, we may retain evidence of:

the consent provided;
the information shown when consent was obtained;
the date of consent; and
withdrawal of consent.

Such evidence may be retained for the period necessary to demonstrate compliance and address legal claims.

16.11 Backups

Personal data may remain temporarily in secure backups after deletion from active systems.

Backup copies are protected and are deleted or overwritten in accordance with the applicable backup cycle. Where restoration is necessary, reasonable steps will be taken to prevent deleted data from being returned to ordinary active use.

16.12 Anonymised information

We may retain aggregated or irreversibly anonymised information for longer because it no longer identifies an individual.

17. Accuracy of Personal Data

We take reasonable steps to maintain accurate and up-to-date personal data.

You are responsible for informing us when relevant information changes.

Where account functions permit, you may update certain information directly through your account.

You may also contact us to request correction of inaccurate or incomplete information.

18. Your Data-Protection Rights

The rights available to you depend on the laws applicable to your situation.

Subject to applicable conditions, limitations and exemptions, you may have the following rights.

18.1 Right to information

You have the right to receive clear information about:

who processes your data;
what data is processed;
why it is processed;
the applicable legal basis;
who receives it;
how long it is retained;
whether it is transferred internationally; and
the rights available to you.

This Privacy Policy is intended to provide that information.

18.2 Right of access

You may request:

confirmation of whether we process your personal data;
access to that personal data; and
information about how it is processed.

Where applicable, we will provide a copy of the relevant personal data.

18.3 Right to rectification

You may request correction of personal data that is:

inaccurate;
incomplete;
outdated; or
misleading.

18.4 Right to erasure

In certain circumstances, you may request deletion of personal data.

This right may apply, for example, where:

the data is no longer necessary;
you withdraw consent and no other legal basis applies;
you successfully object to processing;
the data has been processed unlawfully; or
deletion is required by law.

The right to erasure is not absolute.

We may retain information where necessary to:

comply with a legal obligation;
maintain required financial records;
establish, exercise or defend legal claims;
prevent fraud;
protect security;
maintain a valid suppression record; or
exercise another lawful exception.

18.5 Right to restriction

You may request restriction of processing in certain circumstances, including while:

the accuracy of the data is being verified;
an objection is being considered;
the lawfulness of processing is disputed; or
you require information for a legal claim.

18.6 Right to object

You may object to processing based on our legitimate interests.

We will stop the relevant processing unless:

we demonstrate compelling legitimate grounds that override your interests, rights and freedoms; or
processing is required to establish, exercise or defend a legal claim.

You may object at any time to processing for direct-marketing purposes. When you do so, we will stop using your data for that purpose.

18.7 Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format.

Where technically feasible and legally required, you may request transmission to another controller.

18.8 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing that was lawful before withdrawal.

18.9 Rights concerning automated decision-making

Where applicable, you may have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

As explained in Section 10, NLLES does not use solely automated processing to make such decisions.

18.10 Right to complain

You may raise a concern directly with NLLES.

You may also lodge a complaint with the competent data-protection authority.

For processing subject to Moroccan Law No. 09-08, the relevant authority is:

Commission Nationale de contrôle de la protection des Données à Caractère Personnel — CNDP
Avenue Al Arz, Secteur 4, M1
Hay Riad, Rabat
Morocco

Where the GDPR or UK GDPR applies, you may also have the right to complain to the data-protection authority in the country in which you live, work or believe an infringement occurred.

We encourage you to contact us first so that we have an opportunity to address the concern.

19. Exercising Your Rights

To exercise a privacy right, contact us:

through the Contact page on the NLLES website; or
by post using the address in Section 2.

Please clearly state:

your name;
the right you wish to exercise;
the information or account concerned; and
any details reasonably necessary to understand your request.

We may request information necessary to verify your identity.

Identity verification is intended to prevent personal data from being disclosed, changed or deleted at the request of an unauthorised person.

We will not request more identity information than reasonably necessary.

Where a request is made by an authorised representative, we may request evidence of the representative’s authority and may verify the request directly with the individual concerned.

We will respond within the period required by applicable law.

Where permitted by law, the response period may be extended for a complex request or multiple requests. If an extension is necessary, we will inform you.

Privacy requests are generally handled without charge.

Where permitted by law, we may charge a reasonable administrative fee or refuse to act where a request is manifestly unfounded, excessive or repetitive. Where we refuse a request, we will explain the reason and the available complaint options.

20. Marketing Preferences

You may stop receiving marketing communications by:

using the unsubscribe function in the communication;
changing an available account preference; or
contacting us.

Unsubscribing from marketing does not prevent us from sending necessary service communications, such as:

purchase confirmations;
account-security notices;
password-reset emails;
lesson information;
appointment changes;
access-expiry information;
legal notices; or
responses to your requests.

21. Children and Minimum Age

The NLLES website and services are not directed at children under 16 years of age.

Persons under 16 may not create an account, make a purchase or submit personal data directly to NLLES without the involvement and valid authorisation of a parent or legal guardian.

Where the law in a user’s country requires a higher minimum age for independent consent to online services, that higher minimum age applies.

If a parent or guardian believes that a child has provided personal data without appropriate authorisation, the parent or guardian should contact us.

Where we determine that personal data was collected from a child without a valid legal basis or required authorisation, we will take reasonable steps to delete it.

22. Confidentiality of Examination and Course Information

Course records, practice-examination results and speaking assessments are treated as personal information.

We do not normally disclose a learner’s progress, recordings, results or communications to a spouse, partner, family member or purchaser without:

the learner’s instruction;
the learner’s consent;
a valid legal basis; or
another lawful justification.

Where a purchaser arranges and pays for a service for a learner, the purchaser may receive limited administrative information necessary to confirm:

payment;
registration;
scheduling;
activation of access; or
delivery of the purchased service.

This does not automatically entitle the purchaser to receive the learner’s detailed answers, recordings, results or private communications.

23. Testimonials, Reviews and Success Stories

NLLES will not publish an identifiable testimonial, image, recording, examination result, certificate or success story for promotional purposes without an appropriate legal basis.

Where consent is requested, NLLES will explain:

what information will be published;
where it will be published;
whether a name, image, audio recording or result will be included; and
how consent may be withdrawn.

Withdrawal cannot always remove copies already lawfully printed, downloaded, shared or republished by independent third parties, but NLLES will stop future use within its reasonable control.

24. Data Breaches

A personal-data breach may include accidental or unlawful:

destruction;
loss;
alteration;
unauthorised disclosure; or
unauthorised access.

NLLES maintains procedures for identifying, assessing and responding to suspected personal-data breaches.

Where applicable law requires notification, NLLES will notify:

the competent data-protection authority; and
affected individuals where the breach is likely to create the legally required level of risk.

Notifications will be made within the periods required by applicable law.

25. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to our services;
changes to website functions;
new service providers;
changes to data-processing activities;
legal or regulatory developments;
security improvements; or
operational changes.

The updated version will be published on the website with a revised “Last updated” date.

Where a change materially affects how we process personal data, we may provide additional notice through:

the website;
your account;
email; or
another appropriate communication channel.

Unless otherwise required by law, changes take effect when the updated Privacy Policy is published.

We encourage you to review this Privacy Policy periodically.

26. Relationship With Other Documents

This Privacy Policy should be read together with the applicable:

Terms and Conditions;
Cookie Policy;
cancellation and refund policy;
checkout information;
course or product description; and
any additional privacy information displayed when particular data is collected.

If a specific privacy notice is provided for a particular processing activity, that notice supplements this Privacy Policy.

If there is a conflict concerning the processing of personal data, the more specific privacy notice will apply to that particular processing activity, subject to applicable law.

27. Language

This Privacy Policy is written in English.

Translations may be provided for convenience.

Where legally permitted and where there is a difference between the English version and a translated version, the English version will prevail. This does not limit any mandatory rights available under applicable law.

28. Contact

For questions, requests or complaints concerning this Privacy Policy or the processing of personal data, contact:

NLLES
17 Operation Badei Lot Amerchi
Morocco

You may also contact NLLES through the Contact page on the website.

Please include “Privacy Request” in the subject line or at the beginning of your message where possible.

End of Privacy Policy