Privacy Policy

Last updated: 4 July 2026 · Applies worldwide · Drafted to meet the EU General Data Protection Regulation (GDPR)

Plaka for Students (“Plaka”, “we”, “us”) is a personal budgeting service by ERAS Business Management (“ERAS DEV”) for students from the Dutch Caribbean living in the Netherlands. This policy explains what personal data we process, why, on what legal basis, and the rights you have. We apply the GDPR standard to all users, wherever they live — including users on Aruba, Curaçao, Sint Maarten and the BES islands.

1. Who is responsible (data controller)

ERAS Business Management is the data controller for the personal data processed in Plaka. For any privacy question or request, contact us at privacy@erasdev.com.

2. What data we collect

• Account data — your name, email address, password (stored only as a secure hash), home island and preferred currencies. You can optionally share your gender; this is entirely voluntary, can be changed or removed in Settings at any time, and is only used in aggregate (never per person) to understand who uses Plaka.
• Financial entries you create — transactions, amounts, categories, notes, wallets, budgets, savings goals and receipt photos you choose to upload. You enter this data yourself; Plaka never connects to your bank.
• Technical data — a session cookie needed to keep you logged in. We do not use advertising or tracking cookies, and we do not build profiles of you.

3. Why we process it (purposes and legal bases, Art. 6 GDPR)

• To provide the service — storing and showing your budget data, converting currencies, generating your dashboard and coach tips. Legal basis: performance of a contract (Art. 6(1)(b)).
• To keep your account secure — authentication, session management, protecting against unauthorised access. Legal basis: legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
• To communicate with you — responding when you contact us. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not sell your data, share it with advertisers, or use it for automated decision-making or profiling within the meaning of Art. 22 GDPR.

4. Exchange-rate data

Daily EUR/USD reference rates are retrieved from the European Central Bank via a public data service. This request is made by our server and contains no personal data about you.

5. How long we keep your data (Art. 5(1)(e))

• Your account and financial entries are kept for as long as your account exists.
• If you delete your account, your personal data is deleted without undue delay, except where we must retain limited records to comply with a legal obligation.
• Session data expires automatically when your session ends.

6. Your rights (Art. 12–23 GDPR)

You can exercise any of these rights at any time, free of charge, by emailing privacy@erasdev.com. We respond within one month.

• Access (Art. 15) — receive a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate data; most data you can edit yourself in Settings.
• Erasure / “right to be forgotten” (Art. 17) — have your account and data deleted.
• Restriction of processing (Art. 18) — limit how we use your data while a request is being handled.
• Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time without affecting prior processing.

7. Security (Art. 32)

We protect your data with appropriate technical and organisational measures: passwords are stored only as salted hashes, connections to the published service are encrypted (HTTPS), access to production data is restricted, and receipt files are stored in access-controlled storage.

8. International transfers (Chapter V)

Plaka runs on cloud hosting infrastructure, which means your data may be stored or processed outside the European Economic Area. Where that happens, GDPR Chapter V requires — and we commit to — an appropriate safeguard for the transfer, such as a European Commission adequacy decision or Standard Contractual Clauses agreed with the hosting provider. You can request details of the safeguard that applies to your data at privacy@erasdev.com.

9. Children

Plaka is intended for students aged 16 and over. We do not knowingly process data of children under 16 without parental consent (Art. 8 GDPR).

10. Complaints

If you believe we handle your data unlawfully, please contact us first — we take every concern seriously. You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular the Dutch authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority of your place of residence.

11. Changes to this policy

If we change this policy in a way that affects you, we will announce it in the app before the change takes effect. The “last updated” date at the top always reflects the current version.