Skip to main content

Privacy Policy

Last Updated: March 14, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how N&D B.V. ("we", "us", or "our") collects, uses, and protects personal data when you visit this website and when you contact us about our online workplace education programs and workshops. N&D B.V. operates this website exclusively as an independent provider of online professional education serving learners throughout Canada. The services described on this website are educational and informational in nature.

Data Controller (GDPR): N&D B.V., Broekbeeklaan 34, 1861 TP Bergen, Netherlands. You can reach us at [email protected] or by phone at +31 72 541 3311.

We do not appoint a Data Protection Officer (DPO) because we do not conduct large-scale, systematic monitoring of individuals or large-scale processing of special-category data. If you have any privacy questions, contact us using the details above.

Effective Date: March 14, 2026.

2. Personal Data We Collect

The personal data we collect depends on how you interact with the website. We aim to collect only what is necessary for clear communication, security, and optional measurement of website performance and advertising effectiveness (where you provide consent).

  • Identity and contact details: name, email address, phone number, and any other information you choose to provide.
  • Form content: messages you submit through registration or enquiry forms, including learning interests, preferred timing, and program selection.
  • Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (country/region level).
  • Usage data: pages viewed, time spent on pages, referrer URLs, click paths, and basic interaction events (for example, a form submission event).
  • Cookies and identifiers: cookie values and similar identifiers described in Section 4 and our Cookie Policy.
  • Conversion events: information indicating that an enquiry or registration request was submitted, and the page or campaign context where available.

We do not intentionally collect special-category personal data (such as health information, political opinions, or religious beliefs), financial account details, or government identification numbers through this website. Please do not include such information in free-text fields. If such data is submitted unintentionally, we will handle it in line with this Privacy Policy and delete it where appropriate.

3. Why We Process Personal Data & Legal Bases (GDPR Art. 6)

We process personal data for specific purposes and rely on the legal bases available under the General Data Protection Regulation (GDPR). Where consent is required (for example, for marketing cookies), we request it through a consent notice and you can withdraw it at any time.

  • Responding to enquiries and registration requests: to communicate with you, route your request to the correct educational support workflow, and provide information about programs and workshops. Legal basis: GDPR Art. 6(1)(b) (steps prior to entering into a contract) and, where required, Art. 6(1)(a) (consent).
  • Website analytics (optional): to understand aggregated usage patterns and improve content structure and navigation. Legal basis: Art. 6(1)(a) (consent) for analytics cookies and related tools.
  • Marketing and advertising measurement (optional): to measure conversion performance and support remarketing or lookalike audiences where enabled. Legal basis: Art. 6(1)(a) (consent).
  • Security and fraud prevention: to protect the website, prevent abuse, and investigate suspicious activity. Legal basis: Art. 6(1)(f) (legitimate interests), balanced against your rights and expectations.
  • Legal compliance: to comply with legal obligations that may apply to us (for example, responding to lawful requests or maintaining records required by law). Legal basis: Art. 6(1)(c) (legal obligation).

Automated decision-making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any segmentation used for marketing measurement (if consented) is limited to standard advertising audiences and does not determine eligibility for services.

4. Cookies & Tracking

Cookies are small text files stored on your device. We also use similar technologies such as pixel tags or conversion APIs when enabled. Our website uses three categories of cookies and identifiers. Details and examples are also provided in our Cookie Policy.

Essential cookies (always active)

Essential cookies are required for the site to function and cannot be switched off in our preference tool. These include:

  • _site_session for session continuity and basic security.
  • cookie_consent for storing your consent choices.
  • Security-related cookies such as CSRF protection where applicable.

Retention: session to 12 months depending on the cookie. The consent preference cookie typically persists for 12 months.

Analytics cookies (consent required)

If you opt in, analytics cookies help us understand usage at an aggregated level. We may use Google Analytics 4 (GA4) with IP anonymization where available. Examples include:

  • _ga (GA4 user identifier; typical retention 2 years)
  • _ga_XXXXXXXXXX (GA4 session state; typical retention 2 years)

Analytics data retention is typically 14 months within the analytics platform settings.

Marketing cookies (consent required)

If you opt in, marketing cookies support conversion attribution and remarketing. Examples include:

  • _gcl_au (Google Ads conversion linker; typical retention 90 days)
  • _fbp (Meta Pixel browser identifier; typical retention 90 days)
  • _fbc (Meta click identifier when present; typical retention 90 days)

Where enabled, marketing measurement may also use server-side signals (for example, via a conversion API) using limited event data. We do not use marketing consent to collect sensitive categories of information.

5. Consent (EEA/UK)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Marketing and analytics cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Consent is recorded in the cookie_consent browser cookie (typically stored for 12 months).

You can withdraw consent at any time by selecting “Manage cookie preferences” in the footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing With Advertising & Service Partners

We share limited data with service providers to operate and secure the website and, where you consent, to measure performance and support advertising. We do not sell personal data.

  • Google LLC (Google Analytics 4, Google Ads, Tag Manager, remarketing): cookie identifiers, usage data, and conversion events where enabled and consented. Privacy information: policies.google.com/privacy.
  • Meta Platforms (Pixel, Custom/Lookalike Audiences, Conversion API): page views, conversions, audience membership signals, and potentially hashed identifiers where enabled and consented. Privacy information: facebook.com/privacy/policy.
  • Cloudflare (CDN and security): IP-based threat detection and performance optimization. Privacy information: cloudflare.com/privacypolicy.

We use service providers under appropriate contractual safeguards. We do not permit providers to use site data for their own independent commercial purposes beyond providing services to us and improving their services in line with their terms.

7. International Transfers

Some service providers may process data outside the European Economic Area (EEA) and the UK, including in the United States. Where international transfers occur, we rely on appropriate safeguards such as:

  • EU-US Data Privacy Framework (primary mechanism where applicable, in force since July 2023)
  • UK Extension to the EU-US Data Privacy Framework
  • Swiss-US Data Privacy Framework (where applicable)
  • Standard Contractual Clauses (EU 2021/914) as a fallback
  • UK International Data Transfer Addendum (UK IDTA/Addendum) as a fallback

We also apply data minimization and limit transfers to what is necessary for the specific purpose.

8. Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Typical retention periods include:

  • Contact and registration submissions: up to 2 years from last interaction.
  • Email correspondence: for the duration of the relationship plus 1 year.
  • Server and security logs: typically up to 90 days, unless required for investigation.
  • Analytics: typically 14 months within analytics platform retention settings (if consented).
  • Marketing cookies: per cookie lifetimes (for example, 90 days) if consented.
  • Cookie consent records: up to 3 years for audit and compliance tracking.
  • Legal/tax records: retained as required by applicable law (commonly 6 to 10 years for certain records).

9. Your Rights (GDPR & UK GDPR)

If you are in the EEA or UK, you may have the following rights under data protection law:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent at any time (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise your rights, email [email protected]. We aim to respond within 30 days. If a request is complex, we may extend by up to 60 additional days as permitted by law.

Supervisory authority (Netherlands): Autoriteit Persoonsgegevens (AP). Website: autoriteitpersoonsgegevens.nl. EU information: edpb.europa.eu.

10. Children

This site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe a child under 16 has provided personal data without verifiable parental consent, contact us and we will delete the data promptly where required.

11. Do Not Track

This website does not respond to Do Not Track (DNT) browser signals. Third-party providers may have their own approaches to DNT and similar mechanisms.

12. Data Deletion Requests

You may request deletion of personal data we hold about you by emailing [email protected] with the subject line “Data Deletion Request”. We may ask for additional information to verify identity and to locate relevant records. Where deletion is not possible (for example, due to a legal obligation), we will explain the reason and restrict processing where appropriate.

We aim to complete verified deletion requests within 30 days.

13. Business Transfers

If we are involved in a merger, acquisition, asset sale, financing, reorganization, bankruptcy, or insolvency event, personal data may be transferred to a successor entity. If such a transfer materially changes how personal data is used, we will provide a notice on this website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). In the past 12 months, we may have collected the categories below:

  • Identifiers: name, email, IP address, device identifiers. Shared with service providers and, if consented, advertising partners for measurement.
  • Internet/network activity: browsing interactions and site usage. Used for analytics and, if consented, advertising measurement.
  • Inferences: basic preferences derived from interactions, used to improve content and (if consented) to support advertising audiences.

We do not sell personal information as defined by CCPA. We may share information for cross-context behavioral advertising when you opt in to marketing cookies. You can opt out by using our cookie preferences panel.

Rights may include the right to know, delete, correct, and opt out of sale/sharing, and the right to non-discrimination. To submit a request, email [email protected] with the subject line “California Privacy Request”. We will verify your identity before fulfilling requests. Authorized agents may submit requests with written proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act (VCDPA), including access, correction, deletion, portability, and the right to opt out of targeted advertising. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject line “Virginia Privacy Request”. If we decline to act on a request, you may appeal by emailing with the subject line “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days. If an appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. If we make material changes, we will post a notice on the homepage at least 14 days before the changes take effect, where reasonably practicable. The “Last Updated” date at the top of this page indicates when the policy was most recently revised.

18. Contact

If you have questions about privacy, data handling, or this Privacy Policy, contact:

N&D B.V.
Broekbeeklaan 34
1861 TP Bergen
Netherlands
Email: [email protected]
Phone: +31 72 541 3311