Privacy Policy
Last updated: June 2026
Focusmet B.V., the provider of Loek, values the protection of your personal data. In this privacy statement, we explain in clear language what data we collect, why we do so, how long we retain it, and what your rights are. This statement complies with the General Data Protection Regulation (GDPR). From your school we deliberately receive a minimal dataset: only agenda data, not student records.
1. Who is responsible for your data?
Focusmet B.V. is the data controller. This means we determine what data we collect and what we use it for. We are responsible for handling your personal data with care.
Focusmet B.V.
Email: privacy[at]focusmet.nl
Chamber of Commerce number: 42076520
For school data (schedule, homework, tests)
Your school is the data controller for this data. Focusmet B.V. (the provider of Loek) acts as a processor on behalf of the school, based on the General processing agreement for education (version 4.0) from the Dutch education councils.
2. What data do we collect?
We only collect data that is necessary to provide our service. Below you will find exactly what data we process and why:
Order & delivery data
- Email address - for order confirmations, shipping updates, and important notices
- Name - for your order and delivery
- Delivery address - so we can ship your Loek
School data (student information)
Via the Somtoday Connect API, we only receive agenda data. The connection is limited to this minimal scope:
- Student ID (technical number) - NO name, email, or SSN
- Schedule (class times, subjects, rooms, teachers, changes)
- Homework and study guide assignments (description, deadline)
- Test information (date, subject, description) - NO grades or results
We do NOT process grades, contact details, SSN, attendance data, care/guidance data, or photos
Device data
- Serial number - to identify your Loek device
- Binding codes - to connect your device to your account
- Connection status - to check if your device is online
- Battery level and technical diagnostics - to support your device and resolve issues remotely
- IP address and technical logs - for security, fraud prevention, and resolving technical issues (retained for up to 30 days)
Payment data
Payments are processed by Mollie, a certified payment service. We do not store credit card or bank details ourselves. Mollie has its own security measures and a privacy policy that you can find at mollie.com.
Email communication
Emails (such as order confirmations, shipping notifications, and password resets) are sent via Resend. This is an email service that only receives your email address for delivering our messages.
3. What is our legal basis for processing your data?
According to the law (GDPR), we need a valid reason to process your data. Below you can find the legal basis we use for each type of processing:
| Processing | Legal basis |
|---|---|
| Providing the Loek service, displaying school data, processing orders | Performance of contract (Art. 6.1.b GDPR) |
| Security, fraud prevention, service improvement, technical support | Legitimate interest (Art. 6.1.f GDPR) |
| Retention of invoices and payment data for tax authorities | Legal obligation (Art. 6.1.c GDPR) |
| Newsletters and optional marketing (if applicable) | Consent (Art. 6.1.a GDPR) |
4. How long do we keep your data?
We do not keep your data longer than necessary. Below you will find the retention periods for each type of data:
| Type of data | Retention period |
|---|---|
| Account data | Until you delete your account, plus 30 days grace period during which you can restore your account |
| Device data | Up to 2 years after last activity |
| School data | Briefly cached for up to 30 minutes between syncs so your device can show a current screen without re-querying your school on every refresh. Each sync overwrites the previous cache - we keep only the latest snapshot needed for the next render, never a history |
| Payment data | 7 years (legal requirement) |
| Technical logs | 30 days |
5. What are your rights?
Under the GDPR, you have various rights regarding your personal data. Below we explain what you can do:
Right of access
You can request what data we have about you. We will then send you an overview.
Send an email to privacy[at]focusmet.nl with the subject 'Access Request' and include the email address you registered with.
Right to rectification
Is your data incorrect? You can ask us to correct it.
Send an email to privacy[at]focusmet.nl with the subject 'Rectification Request' and specify which data is incorrect.
Right to erasure
You can request to have all your data deleted. We will do this within 30 days.
Send an email to privacy[at]focusmet.nl with the subject 'Erasure Request'. Your account will be completely deleted within 30 days.
Right to data portability
You can request your data in a standard digital format (JSON).
Send an email to privacy[at]focusmet.nl with the subject 'Data Export'. You will receive a JSON file containing all your data.
Right to object
You can object to certain processing, such as marketing.
Send an email to privacy[at]focusmet.nl with the subject 'Objection' and explain which processing you object to.
Right to restriction
You can request to temporarily stop processing while we investigate something.
Send an email to privacy[at]focusmet.nl with the subject 'Restriction Request' and explain why you want us to temporarily stop processing.
To exercise your rights, send an email to privacy[at]focusmet.nl
We will respond to your request within 30 days. This is free of charge. You will receive a confirmation when your request is received.
If you are not satisfied with our response, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
6. Who do we share your data with?
We only share your data with parties that are necessary to provide our service. These are processors working on our behalf or controllers with whom we exchange data:
Somtoday (Topicus)
Through the Somtoday Connect API (host2host), we retrieve school data. Topicus (Somtoday) is responsible for the school data itself. We only request the data that you make available to us.
Location: Netherlands (EU)
Mollie
Mollie processes payments. They only receive the data necessary for the payment (amount, description). Mollie has strong security and is certified.
Location: Netherlands (EU)
Resend
Resend handles email delivery. They only receive your email address and the content of the message. Resend processes data in the US under Standard Contractual Clauses (SCCs), the EU-approved model contracts for international data transfers.
Location: United States (with Standard Contractual Clauses and EU-US Data Privacy Framework)
Hosting (Google Cloud)
Our servers run on Google Cloud Platform in the EU. Google processes data on our behalf according to strict security standards.
Location: Europe (EU)
Plausible Analytics
Cookieless website analytics by Plausible (an EU company). Collects anonymized visit statistics (page views, referrals). No personal data, no cookies, no cross-site tracking.
Processed by Plausible Analytics on EU-based servers (Germany)
We never sell your data to third parties. We do not use advertising networks or trackers.
7. How do we secure your data?
We take appropriate technical and organizational measures to protect your data against loss, misuse, or unauthorized access:
- Encryption in transit - All connections are secured with HTTPS/TLS. This means that data sent between you and our servers cannot be intercepted.
- Encryption at rest - Sensitive data such as OAuth tokens are stored encrypted with AES-256-GCM, a strong encryption method.
- Password security - Passwords are stored hashed with bcrypt. This means that even we cannot read your password.
- Access restriction - Only authorized personnel have access to systems with personal data, and only to the extent necessary for their work.
- Security monitoring - We monitor our systems for suspicious activities and perform regular security audits.
8. Is data processed outside the EU?
We try to process your data within the European Union (EU) as much as possible. Our main servers are located in the EU.
If we do share data with services outside the EU (such as Resend in the US), we ensure that there are adequate safeguards. We use Standard Contractual Clauses (SCCs), the model contracts approved by the European Commission. Additionally, Resend falls under the EU-US Data Privacy Framework, which means they must comply with EU data protection standards.
9. Do we use cookies?
We only use strictly necessary cookies. These are small text files needed for the website to function:
Functional cookies (necessary)
These cookies are needed for the website to function. Without these cookies, the website will not work properly:
- Shopping cart (_sommie_cart) - remembers which products you added to your cart
We do not use tracking cookies, advertising cookies, or third-party cookies. We do not follow you on other websites. We use Plausible Analytics, a cookieless and privacy-friendly tool that does not collect personal data or place cookies.
10. How do we handle data of minors?
Loek is purchased and set up by a parent or guardian. The student logs in with their existing Somtoday school account - you do not create a separate account with us. Many of our users are minors and we handle their data with care.
Important: you do not create an account with us. The student logs in with their existing school account (Somtoday); a parent or guardian purchases and sets up the device.
For the school data, Focusmet B.V. acts as a processor on behalf of the school. Because no separate account is created with us for the student, no separate consent from the child is required.
Parental/Guardian Rights
Parents or guardians can request access to, correction of, or deletion of their child's data via privacy[at]focusmet.nl.
There is no separate parent or guardian access and no parent account. Parents or guardians can only see the school information by looking at the screen when the device is placed in a visible spot. Loek shows only the schedule, homework and tests - no grades or attendance.
For questions about your child's data, please contact privacy[at]focusmet.nl
11. How can you contact us?
Do you have questions about this privacy policy, how we handle your data, or do you want to exercise one of your rights? Please contact us:
For privacy-related questions
Email: privacy[at]focusmet.nl
12. What if you have a complaint?
If you believe we are not handling your data properly, we would like to hear about it so we can resolve it. Please contact us first at privacy[at]focusmet.nl. If we cannot resolve it together, you have the right to file a complaint with the supervisory authority:
Autoriteit Persoonsgegevens
P.O. Box 93374, 2509 AJ The Hague, Netherlands
Website: autoriteitpersoonsgegevens.nl
Phone: 088 - 180 52 50
13. Changes to this privacy policy
We may update this privacy policy from time to time, for example when new features are added or when the law changes. For significant changes, we will notify you by email. The most recent version can always be found on this page. We recommend reviewing this policy regularly.
Questions about your privacy?
Contact us at privacy[at]focusmet.nl