This policy explains which personal data Freemason (this website, "we", "us") processes when you visit it, create an account, follow the course or buy a pass, and how we protect it. We follow the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The site is run by Micro-Touch & Consult, established in Egmond aan Zee, Netherlands and registered with the Dutch Chamber of Commerce (KvK) under number 32061848. This is the data controller. For any privacy question, or to use your rights, write to jaap.zwart@microtouchconsult.com.
This site is independent. It is not run by, and does not share your data with, any Grand Lodge or Masonic lodge.
2. Visiting without an account
You can read the degrees, the origins, the library catalogue and the course introduction without an account. The site itself then keeps no record of who you are or which pages you open. What remains is:
- Your language: the language you choose is remembered in a cookie (see the Cookie Policy).
- Technical logs and monitoring: our host, Microsoft Azure, keeps standard technical logs and performance and error data (such as the requested address, the time and the IP address) to run and secure the site.
- Abuse protection: to stop password guessing and floods, the number of requests per IP address is counted for a few minutes, in memory only. A failed log-in attempt is recorded with the name or e-mail address that was typed, the time, the IP address and the browser's identification.
3. Your account
When you register, we store:
- your e-mail address (or, for VMHS_ contributor accounts, only the chosen name) and, if you add one, a display name;
- your password, only as a secure hash (PBKDF2); we cannot read it;
- whether your address is confirmed, your role, when the account was created and when you last logged in;
- which pass or course access you have and until when, and the reference of a renewing subscription.
Links in confirmation and password-reset mails contain a one-time code that we store only as a hash, and that expires.
4. The course, exams and certificates
- For each lesson and exam we keep your score and the date, so you can see your progress.
- A certificate or diploma carries the name you enter at the exam, the module, your score and the date, with a certificate number. Anyone who has the number can check it on Verify a certificate and sees that name, module, score and date. That is what makes the certificate verifiable; only share the number with people you want to show it to.
5. Payments
Passes and the course are paid through Stripe. You enter your payment details on Stripe's own page; this site never sees or stores your card or bank details. We send Stripe your e-mail address so it can be filled in for you, and we keep a record of each payment: the Stripe reference, the amount and currency, the status, what was bought and the e-mail address Stripe reports for the payer. Renewing passes are Stripe subscriptions; we ask Stripe about their status to keep your access up to date.
6. Activity and page visits of members
When you are logged in we keep:
- an activity log of important events, such as registering, logging in (and failed log-ins), password changes, opening or downloading a book, lessons, exams, certificates and payments, each with the time, your IP address and your browser's identification (user agent);
- the pages you open, with the time, the page, the page you came from, your IP address and your browser's identification.
We use this to support you, to see how the site is used, and to detect misuse of accounts and paid access. From the IP address we derive an approximate place (city, region, country) with the DB-IP Lite database, which is kept on our own server: your address is not sent to anyone for this. Only the administrators of the site can see this data.
7. E-mail
We send you mail to confirm your address, to reset your password and to confirm a purchase. These mails are sent through Microsoft 365 (Microsoft Graph). The site administrator receives a short notice when someone registers, confirms an address or buys a pass or the course, with the account's name or e-mail address. We do not send newsletters.
When you use the Support form, your name, e-mail address, subject and description are mailed to our support mailbox, so we can answer you. The form is not stored in the site's database.
8. Why we use it (legal basis)
- Contract: your account, course progress, certificates, passes, payments and the mails that belong to them are needed to give you what you signed up for or bought.
- Legitimate interest: technical logs, the activity log, page visits of members and abuse protection, to keep the site reliable and secure and to understand how it is used.
- Legal obligation: payment records, which we must keep for the bookkeeping period required by Dutch law.
Interest in Freemasonry can be personal. We keep data to a minimum, only the site's administrators can see it, and we do not sell it, use it for advertising or share it with any lodge or organisation.
9. Who processes data for us
- Microsoft Azure: hosting (Azure App Service, West Europe), storage, monitoring, and Azure Translator for translations of the site's texts.
- Microsoft 365: sending our e-mails.
- Stripe: payments. Stripe is also responsible for its own processing; see its privacy policy.
- OpenAI: translates the site's own texts (pages, lessons and questions) into other languages. It receives only those texts, never your account details.
- Google: the site's fonts are loaded from Google Fonts, and the books of the library are kept in a public Google Drive collection. When you open a book in the reading room or download it, it comes directly from Google Drive, so Google receives your IP address and may apply its own cookies and policies. Our support mailbox is a Gmail mailbox.
Some of these providers may process data outside the EU under appropriate safeguards (such as the EU Standard Contractual Clauses).
10. How long we keep it
- Account, progress, exam results and access: as long as your account exists. When an account is deleted, its progress, exam results and page visits are deleted with it.
- Page visits of members: deleted automatically after about 13 months.
- Payment records: for the bookkeeping period required by Dutch law, also after an account is deleted.
- Certificates: they stay verifiable by their number, also after an account is deleted, unless you ask us to withdraw them.
- The activity log: as long as it is useful for security and support; when an account is deleted, its entries are no longer linked to it. We remove them on request.
- Support mails: as long as needed to handle your question.
- The language cookie expires after one year; the log-in cookie after 30 days without a visit, or when you log out.
11. Your rights
You have the right to access, correct and erase your personal data, to restrict or object to its processing, and to data portability. You can change your display name and password under My account. To see your data, or to delete your account, write to jaap.zwart@microtouchconsult.com from the e-mail address of your account. You may also complain to a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
12. Security
The site is served over encrypted connections (HTTPS), passwords and e-mail codes are stored only as hashes, forms are protected against cross-site requests, and the number of attempts per address is limited. No system is perfectly secure, but we take reasonable measures to keep your data safe.
13. Children
The site is not aimed at children under 16. If you believe a child has given us data, contact us and we will remove it.
14. Changes
We may update this policy. The date at the top shows the latest version, and important changes will be made clear on this page.
Micro-Touch & Consult · Egmond aan Zee, Netherlands · KvK 32061848 · jaap.zwart@microtouchconsult.com