At Think Up I consider it crucial to secure the privacy of pupils and other interested parties. This privacy statement describes how I process personal data. Please contact Think Up if you have any questions about this privacy statement. Think Up’s contact details are as follows:
Contact details
Think Up, Maaike Aarts
Email: m@thinkup.nl
Website: www.thinkup.nl
Address: Jan Olphert Vaillantlaan 45, 1086 XZ Amsterdam
Telephone:+31 (0)6-41439664
Chamber of Commerce no.: 50.696.556
VAT no.: NL001785362B59
1. Definitions
This privacy statement uses the following definitions:
Personal Data: Personal Data are all data relating to natural persons.
Practice: Think Up
Pupil: a person who takes Alexander Technique lessons at the Practice.
Interested Person: a person who has shown an interest in the Practice.
Data Subject: an identified or identifiable natural person (Article 4(1) of the General Data Protection Act (“GDPR”)).
Processing: any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4(2) GDPR).
Controller: Think Up, Maaike Aarts.
2. Applicability
This privacy statement applies to all the Practice’s Processing of Personal Data of Pupils and Interested Persons.
3. Description of the Data
The Practice Processes your Personal Data because you use our services and/or you yourself disclose your Personal Data to us. If you choose not to disclose your Personal Data, then the Practice does not guarantee that it will achieve the purposes of data Processing.
The Practice may Process the following Personal Data:
- forename and family name:
- sex:
- date of birth:
- address particulars:
- telephone number:
- email address:
- bank account number:
- information about lessons.
4. Purposes and principles of data Processing
The Practice Processes your Personal Data on the basis of a legitimate interest and for the following purposes:
- registering you as a pupil of the Practice
- settling payments
- keeping accounts
- sending out the Practice newsletter
- keeping track of your lessons
- contacting Pupils if we need to do so to provide our services
- informing Pupils and Interested Persons about any changes to or innovations in our products and services
- sending products and services
- distributing questionnaires and evaluations.
5. Sharing data with third parties
- The Practice treats your Personal Data confidentially;
- The Practice imposes a duty of confidentiality on its staff and any external parties that it engages for its activities;
- The Practice does not share Personal Data of Pupils or Interested Parties with third parties without the consent of the Data Subject;
- The Practice only discloses data to third parties for the purposes described above under the heading “Purposes and principles of data Processing”.
The Practice concludes a Processing agreement with companies that Process your Personal Data on the Practice’s instructions. It does so to ensure the security and confidentiality of your Personal Data. The Practice remains responsible for this Processing (in its capacity as the Controller).
The person who collects/receives Personal Data from the Practice is Mr de Rooy, the Practice’s accountant.
The Practice uses the following computer programmes or systems to Process Personal Data: Dropbox, Digi-BTW, Gmail, Apple mail.
6. Retention period
The Practice does not keep your Personal Data for any longer than is strictly necessary to achieve the purposes for which it collects them. Your Personal Data will be deleted from the Practice’s records no later than 1 year after you stop having lessons. Your tax data will be kept for up to seven years after your lessons end, pursuant to the statutory records and accounting requirement (Section 52 of the Dutch State Taxes Act (Algemene wet inzake rijksbelastingen)). Information about the content of your lessons will be kept for up to five years after your lessons end in order to ensure the continuity of lessons if you decide to resume them later. None of this information will be traceable to you.
7. Your rights
You have the right to access, correct or remove your Personal Data, as well as to withdraw your consent for data Processing or to object to the Practice Processing your Personal Data. You also have the right to data portability. This means that you can ask us to send a computer file containing any Personal Data we have about you to you or to an organisation of your choosing. You can email us with this request. To help us ensure that it is you that has made this request, please attach a copy of your identity document to your email. The MRZ (machine readable zone, or the row of numbers at the bottom of your passport) as well as your passport number and citizen service number (Burgerservicenummer (‘BSN’)) should be rendered illegible on this copy. This is to protect your privacy. We will respond to your request as soon as possible but no later than four weeks after receiving it.
8. Information security
The Practice takes appropriate technical and organisational measures that are reasonably possible to ensure the security of your Personal Data. These include: (a) using passwords on computers; (b) using secured and encrypted connections; (c) keeping data contained in paper format in a safe.
If, however, you feel that your Personal Data are not properly secured or that there are any indications of abuse, please contact us.
9. Amendments
The Practice may unilaterally amend this privacy statement, for example in the event of an amendment to legislation. In that case we will notify you via our website.
10. Complaints
Although the Practice does everything it can to ensure your privacy, you may still not be satisfied with how we Process your Personal Data. If you have a complaint, please discuss it with me, Maaike Aarts. You can also submit a complaint by email.
You are entitled to submit a complaint at any time to the national supervisory authority, the Dutch Data Protection Authority. You can do so by clicking on
https://autoriteitpersoonsgegevens.nl/nl/meldingsformulier-klachten
