Privacy Policy

Last updated: March 17, 2026

1. Who We Are

Pass EPSO is operated by Cristina Sanchez Romero ("we", "us"), based in Luxembourg. We provide an AI-powered preparation platform for the EPSO AD5 Generalist competition at passepso.com.

2. Data We Collect

We collect the following personal data when you use our platform:

Account data: email address, username, display name, and password (hashed).
Usage data: practice session history, answers submitted, scores, time spent, and feature usage patterns.
Payment data: processed by Stripe. We store your Stripe customer ID but never your card details.
Technical data: IP address, browser type, and device information via server logs.

3. Why We Collect It

To provide and improve the adaptive learning experience.
To process payments securely via Stripe.
To communicate service updates (no marketing emails without consent).
To maintain platform security and prevent abuse.

4. Legal Basis (GDPR)

We process your data based on: (a) contract performance (providing the service you signed up for), (b) legitimate interest (platform security, analytics), and (c) consent (where applicable).

5. Data Sharing

We do not sell your data. We share data only with:

Stripe for payment processing.
Cloudflare for content delivery and security.

All processors are GDPR-compliant.

6. Data Retention

Account and practice data is retained for the lifetime of your account. You can request deletion at any time (see below). Payment records are retained for 7 years per Luxembourg tax law.

7. Your Rights

Under GDPR, you have the right to:

Access your personal data.
Rectify inaccurate data.
Request erasure ("right to be forgotten").
Data portability (export your data).
Object to processing.
Lodge a complaint with the CNPD (Luxembourg data protection authority).

8. Cookies

We use essential session cookies for authentication. No third-party tracking cookies are used.

9. Contact

For privacy requests or questions, use the contact form or write to [email protected].