Privacy Policy

In my trainings I ask people to be open about what moves them. That comes with you knowing what I do with your data. This privacy policy explains which personal data I process, why, how long I keep it and what you can do if you want to see it or have it deleted. I follow the General Data Protection Regulation (GDPR).

Who I am

Geweldloze Communicatie Training is the business of Bart Landstra. I am responsible for what happens to your data.

Bart Landstra, Geweldloze Communicatie Training
Temminckstraat 3, 2313 RR Leiden, the Netherlands
bart@geweldlozecommunicatietraining.nl
+31 6 44 34 57 79

I work on my own. There is no data protection officer; you can reach me directly with any question.

What data I process and why

For each situation you can read which data it is, what I use it for, on what legal basis and how long I keep it.

When you get in touch

Through the contact form, a quote request or a coaching request I ask for your name, email address and message, and optionally your phone number. I use this to answer your question and, if you ask for one, to prepare a quote.

Legal basis: steps you request before we may enter into an agreement (Article 6(1)(b) GDPR).

Retention: up to two years after our last contact.

When you book an introductory call

Your name, email address, the date and time, and your phone number if you prefer a phone call. You can add a note if you like. I use this to schedule the call, create a Zoom link and a calendar invitation, and send you a reminder.

Legal basis: steps you request before we may enter into an agreement (Article 6(1)(b) GDPR).

Retention: up to two years after our last contact.

When you register for a training

Your name, email address and phone number, the training and date you choose, the rate and the moment you agreed to the terms and conditions. If you register as a freelancer or through an organisation, also the invoice details: company name, address, Chamber of Commerce and VAT number, invoice email address and a PO number if needed. I also ask how you found me, but you don't have to answer.

I use this to process your registration, arrange payment or an invoice and email you about the training: the confirmation, the preparation, course material and your certificate afterwards.

Legal basis: our agreement (Article 6(1)(b) GDPR). For invoices, my legal obligation to keep accounting records (Article 6(1)(c) GDPR).

Retention: your personal data up to two years after our last contact. Invoices and payment details are kept for seven years, as Dutch tax law requires.

During the sessions

I keep track of who attended a session and for how long, to determine the contact hours on your certificate. Online sessions take place in Zoom; I take your attendance from Zoom's participant report, based on your email address.

Legal basis: our agreement (Article 6(1)(b) GDPR).

Retention: as long as your registration is kept.

In the learning environment

A training comes with an online learning environment. There I process your name and email address to give you access, what you write in exercises, reflections and self-tests, which parts you have completed and what you share with your group on the start page. You only add a profile photo if you want to. When you request a login link, the IP address and browser it was requested from are recorded. I do not use Google Analytics or any other tracking in the learning environment.

What you write in exercises is not visible to your group and is not sent to an AI service. I manage the learning environment, so in theory I could retrieve your answers from the database. That is not what I do. Some assignments have a Send button: if you click it, your answer reaches me with your name, so I can read it before the session. Otherwise I only look at what you wrote if you personally ask me to.

Your group's list shows your first name and your profile photo. What you share on the start page, your group members read with your full name. If someone posts there or replies to you, you may get an email about it that includes the text.

Legal basis: our agreement (Article 6(1)(b) GDPR).

Retention: your access runs until 180 days after the last session. Your answers (including what you sent to me), self-tests, start page messages and profile photo are deleted automatically 30 days after your access ends. Progress and attendance stay with your registration, for your certificate. Login details are removed after a day.

If you take the training through your employer

For an in-company training I am responsible for your data myself, just as for an open training. Your employer arranges the assignment and the invoice, and your group sees your organisation's logo. Your employer does not get to see what you write or share in the learning environment. If you use your work email, keep in mind that login links and messages from the learning environment arrive in that mailbox.

Your certificate

Your certificate shows your name, the training and your contact hours. A unique link lets someone check that the certificate is genuine. That link works as long as your registration is kept, and stops working if you have your data deleted.

The newsletter

If you subscribe to the newsletter, I keep your first name, last name and email address to send it to you.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time: send me an email and I will remove you from the list.

Retention: until you unsubscribe.

When you visit the website

I use Google Analytics to see how the website is used: which pages are visited, for how long, through which link and on what kind of device. Advertising features are switched off, Google Analytics does not store IP addresses and I do not link this data to your name or email address. Google Analytics is not loaded on the pages of the learning environment or on the "my data" pages.

Legal basis: my legitimate interest in improving the website (Article 6(1)(f) GDPR).

Retention: according to the Google Analytics setting, at most 14 months.

To protect forms against spam I use Cloudflare Turnstile and my own filter. If that filter blocks a submission, I keep an unreadable (hashed) version of the IP address and browser for 90 days, based on my legitimate interest in keeping the website secure. The website runs on Cloudflare, which processes technical data of every visit for security, such as your IP address.

Videos and reviews

The learning environment contains videos from YouTube and Vimeo. YouTube videos are loaded through youtube-nocookie.com, so YouTube does not set a tracking cookie until you play the video. When you play a video, your browser connects to YouTube or Vimeo.

The website shows reviews that people posted on Google themselves, with the name they use there.

Who I share data with

I do not sell your data and do not give it to others for their marketing. For a few things I work with companies that process data on my behalf. I have agreements with them about security and confidentiality.

• Cloudflare: the website and learning environment, the database, file storage and spam protection.
• Google: email (Google Workspace), an overview of registrations and forms (Google Sheets) and website statistics (Google Analytics).
• Zoom: online sessions and introductory calls.
• Moneybird: accounting and invoices.

Payments are handled by Mollie, which processes your payment details as an independent party under its own privacy statement. The Dutch Tax Administration may inspect my records; I am legally required to allow that.

Data outside the European Union

Cloudflare, Google and Zoom are American companies, so data may end up in the United States. This is allowed because these companies participate in the EU-US Data Privacy Framework, which the European Commission has found to offer adequate protection. Where the framework does not apply, they use the European Commission's standard contractual clauses. The website's database is located in Western Europe.

Security

• All connections to the website are encrypted.
• You log in to the learning environment with a one-time link, without a password.
• The website's admin area is protected and only I have access.
• Database backups are deleted automatically after 30 days.

Cookies

The website uses cookies it needs to work, and the analytics cookies of Google Analytics. There are no advertising cookies.

• gct_lms_session: keeps you logged in to the learning environment, until your access ends and for at most 180 days.
• mollie_pid: remembers which payment is yours during checkout, for two hours.
• _ga and _ga_…: Google Analytics, see above. At most 14 months.
• Cloudflare may set a functional cookie for security.

Your rights

You have the right to:

• see which data I hold about you;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• receive your data in a file you can take with you;
• object to processing based on legitimate interest;
• withdraw your consent, for example for the newsletter.

You can do much of this yourself. At geweldlozecommunicatietraining.nl/en/my-data you enter your email address and receive a link to view, download or delete your data. If you are taking a training, you can also do this in the learning environment. For anything else, email me. I respond within one month, usually much sooner, and it costs you nothing. Sometimes I first ask you to confirm the request really comes from you.

Deletion has two limits. Invoices must be kept for seven years, so only the amount of a registration remains, without your name or contact details. And if you are in the middle of a training, we first wrap that up together.

Complaints

Not happy with how I handle your data? Please let me know first, so we can look for a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Changes

If anything changes in how I handle data, I update this privacy policy. The date at the top shows when that last happened. If a change affects participants of an ongoing training, I will let them know.