Privacy Policy

Klaas Kroezen values your privacy. This statement explains which personal data we process, why, on which legal basis, for how long and with whom we share it. You will also find out how to exercise your rights under the General Data Protection Regulation (GDPR).

1. Data controller

CXIA Group B.V., trading under the name KlaasKroezen.com, with its registered office at Oude Parklaan 111, room 0.11, 1901 ZZ Castricum, the Netherlands, registered with the Dutch Chamber of Commerce under number 87171481, is the controller for the processing operations described in this statement.

• Email: klaas@klaaskroezen.com
• Phone: +31 6 1809 8906
• Visiting address: Oude Parklaan 111, room 0.11, 1901 ZZ Castricum, the Netherlands

2. Which personal data do we process?

Depending on the service or product you purchase, we process the following categories of personal data:

2.1 Identification and contact details

• First and last name
• Email address
• Phone number
• Company name, job title and website (business customers)

2.2 Order and invoice details

• Delivery address (physical products only)
• VAT number (business customers)
• Order and invoice details (product selection, price, payment status)
• Payment references from Mollie (no credit card numbers; we only receive a payment reference from Mollie)

2.3 Account and usage data

• Login details (email address and password hash)
• Progress in training programmes and quizzes
• Purchase history and access rights

2.4 Communication data

• Content of contact forms or email correspondence
• Email engagement (sent, opened, clicked) for delivery quality purposes
• Tags and interests (for example whether you signed up for the newsletter)

2.5 Technical data

• IP address (encrypted in logs and stored only temporarily)
• Browser and device data (only with analytics and marketing cookies, and only after cookie consent)
• Ad click IDs (such as the LinkedIn click ID) when you reach our website via an advertisement, only after consent for marketing cookies

3. Purposes and legal bases

We process personal data only for specific purposes, always based on a legal ground under Article 6 GDPR:

• Performance of the agreement: delivering products and services, managing your account, processing payments and sending transactional emails (order confirmation, invoice, shipping updates).
• Legal obligation: retaining invoice data (7-year Dutch fiscal retention obligation) and complying with information requests from competent authorities.
• Legitimate interest: improving our services, fraud prevention, system security and sending service emails (for example recovering an abandoned order).
• Free scan (legitimate interest): when you complete the free scan, we use your email address to send you your personal result and to record your scan as a lead for possible follow-up about your scan. We do not store the scores themselves. You can object to this at any time. You only receive marketing or newsletter emails if you give explicit consent for that.
• AI chat on the website (legitimate interest): a few pages carry a chat where an AI assistant answers your questions about sales, customer experience and our offering. The chat states that you are talking to an AI and not to a person. Your question and the answer are sent to our AI supplier (see section 5) and stored by us so we can improve the chat and check what was said. We ask you not to share personal data in the chat, and we filter out email addresses and phone numbers before storing a conversation. We do not link chat conversations to your account.
• Consent: sending newsletter emails (only after explicit opt-in), using analytics and marketing cookies, and sharing purchase data with advertising platforms for ad measurement and audience building (see sections 5 and 6).

4. Retention periods

We do not keep personal data longer than necessary for the purposes for which it was collected:

• Invoices and orders: 7 years (fiscal retention obligation).
• Account and training progress: up to 24 months after the last activity, or for as long as the account is active.
• Marketing data: until you unsubscribe from the newsletter, or after 24 months of complete inactivity.
• Contact form messages: 24 months after the last correspondence.
• Chat conversations with the AI assistant: 90 days, after which they are deleted automatically.
• Logs and technical data: a maximum of 6 months, unless longer retention is necessary for security investigations.

5. With which parties do we share data?

We only provide personal data to third parties insofar as this is necessary for the performance of the agreement, based on a legal obligation or with your consent. We have concluded data processing agreements with our processors:

• Mollie B.V. (NL): payment processing.
• Resend, Inc. (US): sending transactional and marketing emails.
• Vercel Inc. (US): website hosting and privacy-friendly analytics (see section 6.2).
• Convex, Inc. (US): database and backend hosting of customer data.
• Cloudflare, Inc. (US): spam protection via Turnstile (no cookies, no profiling).
• Anthropic PBC (US): the AI assistant in the chat on our website and the AI parts of our measurement tools. Only text is sent: your question and the earlier questions and answers in the same conversation. Anthropic does not use that text to train models.
• Postal and delivery services: name and delivery address, exclusively for shipping the physical book.
• Advertising platforms (only with your consent): LinkedIn, Meta (Facebook/Instagram), Google and Leadinfo, for ad measurement and audience building. These platforms only load after you have given consent via the cookie banner (see section 6.3).

Transfers to processors outside the European Economic Area (such as the US) take place on the basis of the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, with appropriate additional safeguards. For questions about specific data processing agreements, contact klaas@klaaskroezen.com.

6. Cookies and similar technologies

6.1 Functional cookies

Our website uses functional cookies that are necessary for its operation, such as remembering your login session and language preference. No consent is required for these cookies.

6.2 Analytics cookies

For analytics we use Vercel Analytics and Vercel Speed Insights. These only load when you have given consent via the cookie banner. Vercel processes anonymised usage data; no tracking IDs or third-party cookies are placed.

6.3 Marketing cookies and ad measurement

With your explicit consent, we load marketing scripts such as Google Tag Manager, the Meta Pixel, the LinkedIn Insight Tag and Leadinfo. Data about your visit is then shared with these platforms, such as the pages visited, your IP address, device and browser characteristics and the time of your visit. The platforms use this data to show us aggregated reports on the audience and effectiveness of our advertisements, and to show you more relevant advertisements (retargeting). Without your consent, these scripts are not loaded and no data is shared with these parties.

If you make a purchase, we pass on, only with that marketing consent, an encrypted (hashed) email address, the order amount and, if you arrived via an advertisement, the corresponding click ID to the relevant advertising platform (for example via the LinkedIn Conversions API), so that we can measure the effect of our advertisements and reach similar audiences. Without marketing consent, we do not share purchase data with advertising platforms.

These platforms are (jointly) responsible for their own processing. See the LinkedIn privacy policy, the Meta privacy policy and the Google privacy policy.

6.4 Withdrawing consent

You can withdraw your consent for analytics and marketing cookies at any time. Use the button at the bottom of this page: your saved preference will be cleared and the cookie banner will reappear, allowing you to make a new choice.

7. Your rights

Under the GDPR you have the following rights regarding the personal data we process about you:

• Right of access to the data we process about you.
• Right to rectification if data is incorrect or incomplete.
• Right to erasure ("right to be forgotten"), insofar as this does not conflict with our fiscal retention obligation.
• Right to restriction of processing.
• Right to data portability: receiving your data in a common machine-readable format.
• Right to object to processing based on legitimate interest or for direct marketing.
• Right to withdraw your consent for processing based on consent.

You can exercise these rights by sending a request to klaas@klaaskroezen.com. We will respond within four weeks. We may ask for additional information to verify your identity.

8. Unsubscribing from the newsletter

Every marketing email contains a link at the bottom allowing you to unsubscribe with one click. After unsubscribing, you will no longer receive marketing emails; we will continue to send transactional emails (such as invoices and shipping confirmations) because they are necessary for the performance of the agreement.

9. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Among other things:

• HTTPS encryption across the entire website
• Role-based access to the admin panel
• Passwords stored as one-way hashes (no plain text)
• Regular software updates and security patches

10. Data breaches

We follow a data breach procedure in accordance with Articles 33 and 34 GDPR:

• When a data breach is identified, we immediately assess its nature, scope and possible consequences.
• If the breach is likely to result in a risk to the rights and freedoms of data subjects, we report it without undue delay, and in any case within 72 hours of discovery, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
• If the breach is likely to result in a high risk for data subjects, we inform them without delay in clear language, including the nature of the breach, the measures taken and contact details.
• All data breaches are recorded in an internal register, regardless of whether they were reported to the authority.
• Do you suspect a data breach? Contact us immediately via klaas@klaaskroezen.com.

11. Filing a complaint with the Data Protection Authority

If you believe we do not handle your personal data with care, we ask you to contact us first so we can try to resolve it together. In addition, you always have the right to file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

12. Changes to this privacy statement

We reserve the right to amend this privacy statement, for example because laws and regulations change or because we introduce new services. Changes will be published on this page; the version indication at the top shows the latest version. In the event of significant changes, we will inform active customers by email.

This privacy statement is available in Dutch, English and German. In the event of discrepancies between the language versions, the Dutch text prevails.