Privacy Policy
Last updated: 2026-08-20
CertReadiness is a certification-exam preparation service operated by SMP (Security Management Partners), Mark Tissink t/a, Amsterdam, KvK 99988178, BTW NL869216211B01. This page explains what personal data we collect, why, and what your rights are under the GDPR.
Who is the controller
Mark Tissink t/a CertReadiness · Amsterdam, Netherlands Contact: privacy@certreadiness.com
For questions about learner data collected under a cohort agreement (e.g. training bought by your employer), CertReadiness acts as processor and your employer is the controller.
What we collect
- Account: your email address, a password hash, and — if you provide it — your name.
- Entitlement: which certification track you are enrolled in and when it expires.
- Learning events: each question you answer, whether you were correct, how long you took, and the timestamp.
- Exam simulation results: your score per section and overall.
- AI actions (opt-in only): if you enable the AI helpers, we log which helper you used, when, and how many tokens were returned.
- Security log: truncated IP address, browser fingerprint hash and outcome of each login attempt — retained 30 days for abuse prevention.
We do not use analytics or marketing cookies. Vercel Web Analytics is cookieless and IP-less.
Why we collect it
We rely on the following legal bases (Art. 6 GDPR):
- Contract (6.1.b) for account, entitlement, learning events and simulation results — needed to deliver the training.
- Legitimate interest (6.1.f) for the security log — narrow scope, short retention.
- Consent (6.1.a) for the AI features — you can toggle them off any time.
How long we keep it
- Self-serve learners: until you delete your account, or after 24 months of inactivity.
- Cohort learners: 7 days after your entitlement ends, then hard-deleted.
- Security log: 30 days.
- AI action log: 90 days.
- Backups: 30 days.
Who else touches your data
We use these sub-processors, each under a signed Data Processing Agreement and — where relevant — Standard Contractual Clauses:
- Supabase Inc. — managed Postgres and authentication, hosted in Frankfurt (EU).
- Vercel Inc. — application hosting on their global edge network.
- Anthropic PBC — LLM inference for the opt-in AI features (US).
- Cloudflare Inc. — DNS and (optionally) CDN.
- Postmark or Resend — transactional email (EU region), being finalised.
An up-to-date list lives on /security. You will be told 30 days before we add a new sub-processor.
Your rights
Under the GDPR you can:
- ask for a copy of your data (Art. 15)
- correct inaccurate data (Art. 16)
- have your data erased (Art. 17)
- restrict processing (Art. 18)
- object to processing based on legitimate interest (Art. 21)
- receive your data in a portable format (Art. 20)
Mail privacy@certreadiness.com and we will respond within 30 days. You can also complain to the Dutch DPA (Autoriteit Persoonsgegevens).
International transfers
Anthropic, Vercel and Cloudflare have US touch-points. Transfers rely on the European Commission Standard Contractual Clauses (2021/914) plus a Transfer Impact Assessment on file for each.
Cookies
Only strictly-necessary cookies:
sb-*— Supabase session (7 days sliding, HttpOnly, Secure)active-cert— remembers your selected certification (30 days)
No consent banner is required (ePrivacy Art. 5(3) exemption).
Contact
privacy@certreadiness.com — for any privacy question, including requests to delete your account.