Privacy Policy

1. Introduction & Controller Identity

The data controller for the processing described in this Privacy Policy is The BdB Company B.V., Arnhemseweg 130, 3817 CL Amersfoort, Netherlands. You can contact us about privacy matters at [email protected].

This Policy applies to personal data collected through our website, including when you submit a registration or contact request for our educational programs, workshops, webinars, downloadable learning materials, and learner support.

We do not appoint a Data Protection Officer for routine operations. If this changes (for example, due to changes in processing scope), we will update this Policy and provide relevant contact details.

Effective Date: March 14, 2026.

2. Personal Data We Collect

We collect only the data reasonably needed to provide and support our educational services, keep the website secure, and measure how the site is used. Depending on how you interact with the site, we may collect:

• Identity and contact data: name, email address, phone number.
• Form content: selected program, comments or questions you submit, and any other information you include in a message field.
• Technical data: IP address, browser type and version, device type, operating system, language preference, and approximate location derived from IP (country/region level).
• Usage data: pages viewed, time spent on pages, referrer information, click paths, and interaction events (for example, button clicks).
• Cookies and identifiers: cookies that store session continuity and cookie consent preferences; and, with your consent, analytics and advertising identifiers.
• Conversion events: signals that a registration or contact request was submitted (for measurement and troubleshooting).

We do not intend to collect special-category data (such as health information, religious beliefs, or political opinions), financial account details, or government-issued identification numbers through this website. Please do not submit such information through our forms.

3. Why We Process Personal Data & Legal Basis (GDPR Art. 6)

We process personal data under the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws. The legal bases we rely on include:

• Registration and contact forms: to respond to your request and provide information about our educational programs. Legal basis: Art. 6(1)(b) (steps at your request prior to entering into a contract) and, where required, Art. 6(1)(a) (consent).
• Learner support and service communications: to answer questions about program content, workshops, materials, and scheduling. Legal basis: Art. 6(1)(b) and/or Art. 6(1)(f) (legitimate interest in delivering support).
• Analytics (when enabled by consent): to understand how the site is used and improve navigation, content clarity, and performance. Legal basis: Art. 6(1)(a) (consent).
• Marketing / remarketing (when enabled by consent): to measure advertising performance, build audiences, and show relevant ads. Legal basis: Art. 6(1)(a) (consent).
• Security and fraud prevention: to protect the website, prevent abuse of forms, and ensure availability. Legal basis: Art. 6(1)(f) (legitimate interest).
• Legal and compliance obligations: to meet legal requirements where applicable. Legal basis: Art. 6(1)(c) (legal obligation).

Automated decision-making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

4. Cookies & Tracking

We use cookies and similar technologies to run the site, remember your cookie preferences, and (if you consent) measure site usage and marketing performance. Cookies can be “session” cookies (deleted when you close your browser) or “persistent” cookies (stored for a defined period).

Essential cookies (always active)

These are required for the site to function and cannot be switched off in our consent settings. Examples include:

• _site_session to maintain basic session continuity and protect against abuse.
• cookie_consent to store your consent choices.
• CSRF-related tokens to protect form submissions.

Retention for essential cookies is typically session-based up to 12 months, depending on the cookie.

Analytics cookies (consent required)

If you enable analytics cookies, we may use Google Analytics 4 (GA4) configured to anonymize IP where applicable. Analytics helps us see which pages are read, where visitors come from, and how the site performs. Examples include _ga and _ga_XXXXXXXXXX. Analytics data retention is set to 14 months in the analytics platform.

Marketing cookies (consent required)

If you enable marketing cookies, we may use identifiers such as _gcl_au (Google Ads) and _fbp/_fbc (Meta). These support remarketing, conversion attribution, and audience creation (including custom and lookalike audiences).

In addition to cookies, marketing and analytics measurement may use pixel tags and server-side event forwarding (for example, Meta Conversion API or server-side tag management). Where supported, identifiers may be hashed before being transmitted to partners.

5. Consent (EEA/UK)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent under Art. 6(1)(a). Your choice is recorded in the cookie_consent cookie (typically for 12 months).

You can withdraw or change consent at any time by selecting “Manage cookie preferences” in the website footer or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing With Advertising & Service Partners

We use a limited number of service providers to operate the website and (when you consent) to measure analytics and marketing performance. Depending on your settings, we may share limited data with:

• Google LLC (Google Analytics 4, Google Ads, Tag Manager, remarketing): cookie identifiers, usage information, and conversion events. Reference: policies.google.com/privacy
• Meta Platforms, Inc. (Meta Pixel, Custom/Lookalike Audiences, Conversion API): page views, conversions, audience membership signals, and hashed identifiers where applicable. Reference: facebook.com/privacy/policy
• Cloudflare (CDN and security): IP-based threat detection and performance delivery. Reference: cloudflare.com/privacypolicy

We do not sell personal data. Where we use advertising partners, data may be used to provide measurement and advertising services to us. We do not permit these providers to use site data for their own independent commercial purposes beyond providing their services, subject to their platform terms and controls.

7. International Transfers

Some service providers may process data outside the European Economic Area (EEA), including in the United States. Where international transfers occur, we rely on appropriate safeguards such as:

• EU–US Data Privacy Framework (where applicable)
• UK Extension to the EU–US Data Privacy Framework (where applicable)
• Swiss–US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (EU 2021/914) as a fallback
• UK International Data Transfer Agreement (UK IDTA) as a fallback

We also apply reasonable technical and organizational measures (for example, access controls and minimization) to protect data transferred internationally.

8. Data Retention

We keep personal data only as long as necessary for the purposes described in this Privacy Policy. Typical retention periods include:

• Contact/registration submissions: up to 2 years from the last meaningful interaction.
• Analytics: 14 months within the analytics platform (where enabled by consent).
• Marketing cookies: retained according to the cookie lifetime (for example, 90 days for certain marketing identifiers), where enabled by consent.
• Email correspondence: generally the duration of the relationship plus 1 year, unless a longer period is needed for dispute handling.
• Server logs: typically up to 90 days for security and troubleshooting.
• Cookie consent record: up to 3 years for compliance/audit evidence.
• Legal and tax records: retained as required by applicable law (commonly 6–10 years for invoicing documentation, where relevant).

When retention periods expire, data is deleted or anonymized in accordance with our internal procedures.

9. Your Rights (GDPR & UK GDPR)

Subject to applicable law and certain limitations, you may have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (“right to be forgotten”) (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))
• Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise these rights, email us at [email protected]. We respond within 30 days, with a possible extension of up to 60 additional days for complex requests.

If you are in the Netherlands, you may contact the Dutch supervisory authority: Autoriteit Persoonsgegevens (AP). Website: autoriteitpersoonsgegevens.nl. For general EU guidance, you may also refer to the European Data Protection Board: edpb.europa.eu.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data without verifiable parental consent, contact us and we will delete the data promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Some third-party providers may have their own DNT handling or opt-out mechanisms.

12. Data Deletion Requests

To request deletion of personal data, email [email protected] with the subject line “Data Deletion Request”. We may ask for limited information to verify identity before completing the request. We aim to complete verified requests within 30 days, unless we must retain certain data to comply with legal obligations or defend legal claims.

13. Business Transfers

If we are involved in a merger, acquisition, asset sale, financing, reorganization, or insolvency, personal data may be transferred to a successor or affiliated entity as part of that transaction. If such a transfer materially changes how personal data is used, we will provide notice through the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (as amended by the CPRA). Over the past 12 months, we may have collected the following categories of personal information:

• Identifiers: name, email, IP address, cookie identifiers (shared with service providers and, with consent, advertising partners).
• Internet or network activity: pages viewed, clicks, and interactions (used for analytics and advertising measurement where enabled).
• Inferences: interests or preferences derived from site usage for advertising measurement (where enabled).

We do not “sell” personal information as defined by CCPA. We may “share” personal information for cross-context behavioral advertising when marketing cookies are enabled. California residents may opt out via our cookie preferences panel (footer link: “Manage cookie preferences”).

California rights may include: the right to know, delete, correct, and opt out of sale/sharing, and the right to non-discrimination. To submit a request, email [email protected] with the subject “California Privacy Request”. We may need to verify identity. Authorized agents may submit requests with written permission and verification.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject “Virginia Privacy Request”. If we decline a request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service providers. Material changes will be announced through a website notice at least 14 days before the changes take effect. The “Last Updated” date at the top of this page will be revised whenever we publish an update.

18. Contact

For privacy questions or requests, contact:

The BdB Company B.V.
Arnhemseweg 130
3817 CL Amersfoort
Netherlands
Email: [email protected]
Phone: +31 33 760 1208