Privacy statement
How Maius handles the personal data of students, teachers and visitors to this website.
This is a translation. In case of differences, the Dutch text prevails.
1. Who is responsible?
Maius is a trade name of GeoActive bv, Ganzenvoet 20, 6418 PV Heerlen, the Netherlands (Chamber of Commerce no. 14053719).
Data of students and teachers. The school you work with is the controller of the data in the educational process. Maius is a processor and processes that data only on behalf of the school. In limited cases Maius is itself responsible, for example for security and logging to keep the service secure.
Website visitors and the contact form. Maius itself is responsible for this data.
2. Which data do we process and for what purpose?
| Type of data | Examples | Purpose |
|---|---|---|
| Account | Name, email address, username, role, school, password (stored only as a hash) | Logging in and granting the right permissions |
| Logging in via the school | Name, email address and an account identifier at SURFconext, Microsoft or Google | Logging in with the school account |
| Profile (voluntary) | Profile photo, birthday (day and month) | Recognisability in the system |
| Language choice | The chosen language of the website | Showing the website in your language |
| Organisation of education | Groups, project participation, learning plans, profiles with learning goals | Organising education |
| Learning and assessment | Assessments, feedback and messages from teacher and student, reflections, evidence (files and links), coaching reports, history | Tracking progress, giving feedback, substantiating progression |
| Contact form | Name, email address, subject and message | Responding to your message |
| Technical | Log files, error messages, IP address, browser data | Security, error analysis and stability |
Reports on progress and achieved learning goals are generated from the data in Maius. They are not stored as files in Maius; a printed or downloaded report exists only on your own computer.
3. Legal bases (GDPR)
- Contract with the school and the school's educational task (public task): for the data of students and teachers.
- Legal obligation: where applicable.
- Legitimate interest: for security, improving the service and answering messages via the contact form. We always weigh the interests involved carefully.
- Consent: for voluntary profile data, such as a profile photo.
4. Pre-analysis with AI (Claude)
Teachers can have Claude, Anthropic's AI model, make a pre-analysis of a student's evidence. Claude does not assess; the teacher assesses. This only happens if:
- a teacher or teacher team has entered an Anthropic API key in Maius themselves, and
- a teacher starts a pre-analysis for certain students and learning goals.
What is sent to Anthropic?
The learning goals, the project description, any comment from the teacher and the evidence: files, the student's reflection and links (as references). The student is identified by a pseudonym, not by name or email address. Files may themselves contain personal data, such as a name on a cover page. Teachers should keep this in mind when submitting them.
Who decides?
The result is an analysis with a suggestion for feedback. The teacher reviews it, chooses the judgement themselves and edits or discards the feedback. No decision about a student is taken without the teacher's involvement. Maius stores Claude's original text alongside the released text and records what the teacher chooses, so it stays visible what the teacher changed.
The API key is stored encrypted. Anthropic's terms apply to the use of the API (Anthropic's privacy policy).
5. With whom do we share data?
We do not sell data and do not share it with commercial parties for their own purposes. We do use service providers that process data on our behalf. With processors we make agreements that comply with the GDPR.
| Service | When | Which data |
|---|---|---|
| Hosting and email | Always | All data in Maius; messages via the contact form and emails from the system. The servers are located in the Netherlands, at an ISO 27001-certified hosting partner. |
| SURFconext, Microsoft, Google | When you log in with your school account | Login data (name, email address, account identifier) |
| Anthropic (Claude) | Only for an AI pre-analysis, see section 4 | Learning goals and evidence, with a pseudonym |
| Google Analytics | Only on the public pages and only with your consent, not after logging in | Usage statistics, see section 9 |
| Google reCAPTCHA | On the contact form | Data about the use of the page, to detect spam |
| Font Awesome (icons) | When loading pages | IP address and browser data (technically necessary to load the icons) |
| YouTube and Vimeo | When you play a video on the homepage | Playback data; YouTube is loaded in privacy-enhanced mode |
Otherwise we only share data through or at the request of the school, or if we are legally required to do so.
6. Transfers outside the EEA
Maius itself runs on servers in the Netherlands: the data in Maius is stored within the EEA.
Some of the services above (including Anthropic and Google) are based in the United States. If data is processed outside the European Economic Area, this is done on the basis of appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. Where possible we choose processing within the EEA.
7. Retention periods
- We do not keep data longer than necessary for the purpose, or as long as the law requires. The school may apply its own retention periods.
- An Excel file for importing students is deleted immediately after the import, or on cancellation.
- We keep technical log files for a short time, only for security, error analysis and capacity management.
- We keep messages sent via the contact form for as long as necessary to handle your question.
8. Security
Maius runs on servers in the Netherlands, at a hosting partner with ISO 27001 certification for information security. In addition, we take appropriate technical and organisational measures ourselves, including encrypted connections (TLS), role-based access, passwords stored only as hashes, encrypted storage of API keys, checks on uploaded profile photos, monitoring and backups.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection and portability of your data, insofar as the GDPR allows. If you have given consent, you can withdraw it at any time.
If it concerns data in education (as a student, parent or teacher), please contact your school first: the school is the controller. The school can ask Maius for help. If it concerns the website or the contact form, contact us directly.
11. Contact and complaints
Questions about this privacy statement or your data? Contact us at andre@maius.nl or via the contact form.
If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
12. Changes
We update this privacy statement when Maius changes, for example with a new feature or service. The date of the last change is shown at the top.