Privacy Policy

1. Introduction & Controller Identity

Coupé B.V. is the data controller for the processing described in this Privacy Policy. This means we determine the purposes and means of processing your personal data under the General Data Protection Regulation (GDPR) and applicable Dutch privacy rules.

Controller details:

• Legal entity: Coupé B.V.
• Registered address: Volewijkshof 16, 1031 AH Amsterdam, Netherlands
• Email: [email protected]
• Phone: +31 20 673 2121

We do not appoint a Data Protection Officer (DPO) because our activities do not involve large-scale processing of special-category data and we do not carry out systematic monitoring on a large scale. If you have a privacy-related question, you can contact us using the details above.

2. Personal Data We Collect

We collect personal data in a few common situations: when you browse our pages, when you send an enquiry through a form, and when you interact with optional cookies (analytics or marketing) after providing consent. The categories below describe the types of data that may be processed.

• Identity and contact details: name, email address, phone number, and organisational details you choose to provide.
• Form content: messages, programme selections, learning goals, and any project or training context included in your enquiry.
• Technical data: IP address, device type, browser type and version, operating system, language settings, and approximate location derived from IP (city/region level).
• Usage data: pages viewed, time spent, referral source, click paths, and interaction events (for example, a form submission event).
• Cookies and identifiers: first- and third-party cookie identifiers, consent status, and similar technologies described in Section 4 and in our Cookie Policy.
• Conversion events: basic data indicating that an enquiry was made (for example, a “thank-you” page visit) used for measurement when marketing consent is given.

Data we do not intentionally collect: We do not request special-category data (such as health information, biometric data, religious or political opinions), government identification numbers, or financial account details through our contact forms. If you voluntarily include such information in a message, we may process it only to the extent needed to respond, and we encourage you not to share sensitive personal data through this website.

3. Why We Process Personal Data & Legal Bases (GDPR Article 6)

We process personal data only when there is a lawful basis under GDPR. The lawful basis depends on what you do on the site and which cookie preferences you choose.

• Contact and programme enquiries: We process your details to respond to requests for information, provide programme details, and arrange consultations. Legal basis: Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(a) (consent) where consent is requested via the form checkbox.
• Website analytics: If you opt in, we measure usage patterns to improve content and navigation. Legal basis: Article 6(1)(a) (consent).
• Marketing and remarketing: If you opt in, we may support advertising measurement and audience building (for example, conversion attribution). Legal basis: Article 6(1)(a) (consent).
• Security and fraud prevention: We protect the website, prevent abuse, and maintain service reliability (for example, suspicious traffic handling). Legal basis: Article 6(1)(f) (legitimate interests).
• Legal and compliance obligations: We may retain certain records where required by law (for example, responding to lawful requests). Legal basis: Article 6(1)(c) (legal obligation).

Automated decision-making (GDPR Article 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any evaluation of programme fit is performed by staff based on the information you provide.

4. Cookies & Tracking Technologies

We use cookies and similar technologies to run the site, to understand how it is used, and (if you consent) to support marketing measurement. Cookies may be first-party (set by our domain) or third-party (set by providers). You can review categories and manage your preferences through the cookie interface and via our Cookie Policy.

In addition to cookies, tracking can be implemented through pixel tags (for example, Google tags or Meta Pixel) and, where configured, server-side measurement (for example, via Meta Conversion API or server-side tag management). If used, server-side events may rely on device signals such as IP address and User-Agent, and may use hashed identifiers for matching where appropriate. These optional mechanisms are governed by your analytics/marketing consent choice.

5. Consent (EEA/UK)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent under Article 6(1)(a). Your consent choice is recorded in the cookie_consent browser cookie, typically for 12 months.

You can withdraw or change consent at any time by using “Manage cookie preferences” in the footer. You can also clear cookies in your browser to remove stored consent. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

6. Sharing With Advertising & Service Partners

We use service providers to operate the website and, if you consent, to support analytics and marketing measurement. We do not sell personal data. When data is shared, it is limited to what is reasonably necessary for the stated purpose and is subject to contractual protections where applicable.

• Google LLC (Google Analytics 4, Google Ads, tag management, remarketing): cookie identifiers, usage data, and conversion events (where consent is provided). Privacy policy: https://policies.google.com/privacy
• Meta Platforms (Pixel, custom/lookalike audiences, conversion measurement): page events and conversions, audience membership, and where configured, hashed identifiers for matching (where consent is provided). Privacy policy: https://www.facebook.com/privacy/policy
• Cloudflare (CDN and security): IP-based threat detection and performance delivery. Privacy policy: https://www.cloudflare.com/privacypolicy/

We do not permit these providers to use site data for their own independent commercial purposes beyond providing services to us and operating their platforms according to their policies. Where required, we rely on consent for analytics and marketing operations and provide mechanisms to manage that consent.

7. International Transfers

Coupé B.V. is based in the Netherlands, but some service providers and infrastructure may process data outside the European Economic Area (EEA) or the United Kingdom, including in the United States (for example, Google and Meta). When personal data is transferred internationally, we use recognised safeguards.

• EU-US Data Privacy Framework (DPF) where applicable (primary safeguard since July 2023)
• UK Extension to the EU-US DPF where applicable
• Swiss-US DPF where applicable
• Standard Contractual Clauses (EU 2021/914) as a fallback
• UK International Data Transfer Agreement (IDTA) as a fallback

We also apply practical measures where appropriate, such as minimising shared data fields and enabling settings like IP anonymisation for analytics.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods vary by category and by operational need.

• Contact submissions: up to 2 years from the last interaction (to maintain continuity for follow-up questions and repeat enquiries).
• Email correspondence: for the duration of the relationship plus 1 year, unless legal obligations require longer retention.
• Analytics data: 14 months (GA4 retention setting), subject to your consent.
• Marketing cookies: retained according to cookie lifetimes (typically 90 days), subject to your consent.
• Server logs: typically 90 days for security and operational troubleshooting.
• Cookie consent record: up to 3 years for audit and compliance demonstration.
• Legal/tax records: retained for the period required by applicable law (often 6–10 years for certain records, depending on context).

When retention periods expire, we delete, anonymise, or securely archive data. If deletion is not immediately possible due to backups, it will be removed when backup cycles rotate.

9. Your Rights (GDPR & UK GDPR)

If GDPR applies to your data, you may have the following rights, subject to legal conditions and exceptions: the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), and the right to withdraw consent (Article 7(3)). You also have the right to lodge a complaint with a supervisory authority (Article 77).

To exercise rights, email [email protected]. We respond within 30 days. If a request is complex, we may extend the response time by up to 60 additional days, and we will explain why.

Supervisory authorities:

• Netherlands: Autoriteit Persoonsgegevens (AP) – https://autoriteitpersoonsgegevens.nl/
• EU guidance: European Data Protection Board – https://edpb.europa.eu/
• UK: Information Commissioner’s Office – https://ico.org.uk/

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data without verifiable parental consent, please contact us and we will delete the data promptly where required.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Some third-party services may have their own DNT handling; consult their policies for details.

12. Account & Data Deletion Requests

We do not provide user accounts on this website. If you want us to delete personal data associated with your enquiry, email [email protected] with the subject line “Data Deletion Request”. For security, we may need to verify your identity before completing a request. We aim to complete deletion within 30 days, unless legal obligations require us to retain certain records.

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred to a successor entity or relevant advisers. If such a transfer materially changes how personal data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

Although Coupé B.V. is based in the Netherlands, our educational services may be accessed by users in the United States. This section provides disclosures for California residents where applicable.

Categories of personal information disclosed in the last 12 months may include:

• Identifiers (name, email, IP address, device identifiers) shared with service providers and, if consented, advertising partners.
• Internet or network activity (pages viewed, interactions) shared with analytics and advertising providers if consented.
• Inferences (interests or preferences derived from site usage) shared with advertising partners if consented.

We do not sell personal information as defined by CCPA. We may share information for cross-context behavioural advertising where marketing cookies are enabled; California residents may opt out via our cookie preferences panel available from “Manage cookie preferences” in the footer.

California rights may include the right to know, delete, correct, opt out of sale/sharing, and non-discrimination. To submit a request, email [email protected] with the subject line “California Privacy Request”. We may require identity verification. Authorised agents must provide written proof of authorisation.

15. Virginia (VCDPA)

Virginia residents may have rights including access, correction, deletion, portability, and the right to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling producing legal or similarly significant effects.

To submit a request, email [email protected] with the subject line “Virginia Privacy Request”. If you believe a request was improperly denied, you may appeal by emailing with the subject line “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days. If an appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legal requirements, service providers, or how the website operates. If changes are material, we will provide a site notice and, where appropriate, announce changes at least 14 days before they take effect. The “Last Updated” date at the top of this page will be revised whenever we publish an update.

18. Contact

For questions about this Privacy Policy, your personal data, or your rights, contact:

• Coupé B.V.
• Volewijkshof 16, 1031 AH Amsterdam, Netherlands
• Email: [email protected]
• Phone: +31 20 673 2121