Privacy Policy GeenXQS

1. Who is responsible?

GeenXQS is responsible for the processing of personal data as described in this privacy policy.

2. What data do we process?

2.1 Via the website (www.geenxqs.nl)

When you visit our website, we process:

• Technical data your browser sends automatically (IP address, browser type, operating system, pages visited, timestamp)
• Data you submit yourself via a contact form or email (name, email address, phone number, content of your message)

2.2 Via the online training platform (trainingen.geenxqs.nl)

When you purchase or follow a training, we process:

• Name and email address
• Payment details (processed by our payment provider, not stored by us)
• Progress within the training

2.3 Via NoXQS (WhatsApp AI coach)

When you use NoXQS via WhatsApp, we process:

• Your phone number (automatically via WhatsApp)
• The content of your messages
• The responses generated by the AI coach
• The timestamp of your messages
• Whether you are a new or returning user

2.4 Via the coaching intake form

When you begin a coaching engagement with us, you first complete an online intake form. In it, we process:

• Your name and email address
• Information about your position, role, and organisation
• Your goals, situation, and development points for the coaching
• Whatever you choose to share about your work, collaboration, and environment

3. Why do we process this data?

• To respond to your questions via the website, email, or WhatsApp
• To deliver AI coaching responses via NoXQS
• To offer and deliver online trainings
• To prepare and deliver a coaching engagement (intake and sessions)
• To improve our services
• To detect situations where a referral to professional help or personal coaching may be appropriate
• To issue invoices and process payments
• To comply with legal obligations

Legal basis: We process your data on the basis of your consent (when starting a WhatsApp conversation), the performance of a contract (when purchasing trainings, a coaching engagement, or a subscription), or our legitimate interest (for improving our services and securing our systems).

4. Who has access to your data?

We only share your data with the following parties, and only to the extent necessary for the service:

Data processing agreements are in place with these parties. Your data is never sold to third parties. Your data is never used for advertising.

About AI processing: Anthropic (the maker of Claude) does not use your messages to train their AI models when the API is used. Your messages are processed to generate a response and are deleted by Anthropic within 30 days by default.

About delivery: Twilio delivers the messages and keeps their content in its own logs while doing so. We have set that period to 7 days, the shortest Twilio allows, and automatic backup is switched off. Twilio states that data may then persist in its back-end systems for up to thirty days before it is permanently removed.

About WhatsApp itself:the conversation also sits in your own WhatsApp, on your phone and in your own backups. We do not delete that part and we cannot delete it; you do that yourself in WhatsApp. Meta's terms and privacy policy apply to your use of WhatsApp.

5. How long do we keep your data?

6. Security

We take appropriate measures to protect your data:

• All WhatsApp communication is end-to-end encrypted by WhatsApp itself
• The connection between our server and the AI (Claude API) is encrypted (HTTPS)
• The server running NoXQS is hosted within the EU
• System access is limited to Nieky Klijn as sole administrator
• Data is automatically deleted after the retention period

7. Your rights

Under the GDPR, you have the following rights:

• Access, you can request which data we hold about you
• Rectification, you can have incorrect data corrected
• Erasure, you can request deletion of your data
• Restriction, you can request restriction of processing
• Portability, you can request your data in a common format
• Objection, you can object to the processing of your data

To exercise any of these rights, send an email to nieky@geenxqs.nl. We will respond within 30 days.

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

8. Specifically about NoXQS (WhatsApp AI coach)

NoXQS is an AI-powered coaching service. Here is what you need to know:

Consent

By sending a message to NoXQS via WhatsApp, you consent to the processing of your message by AI. This is also stated in the welcome message you receive upon first contact.

AI processing and referrals

Your messages are processed exclusively by AI; no human reads along and no automatic transfer to Nieky Klijn or third parties takes place. In some situations, NoXQS may suggest that you contact Nieky or another professional yourself, for example, if your question is more complex than AI coaching can handle, or if there are signs of serious stress or burnout. Whether you do so is entirely your own decision. NoXQS never shares your data with Nieky or third parties on its own initiative.

No automated decision-making

No automated decisions with legal consequences for you are made based on your messages.

Talking about others

As a manager, you may share information about employees, colleagues, or other third parties with NoXQS. These people have not given consent for this processing. You are therefore personally responsible for how you speak about them. We strongly recommend that you do not use full names or other identifiable information about others, speak in roles (“my team lead”, “one of my reports”). Do not share health information or other special categories of personal data about third parties. NoXQS is configured not to reuse names of third parties in its responses, and will remind you once if you do mention a name.

Stopping

You can stop using NoXQS at any time by no longer sending messages, or by typing STOP in the chat to have your data deleted immediately. You can also request deletion of your data via nieky@geenxqs.nl.

9. Cookies and website statistics

Our website uses functional cookies necessary for the site to work. We also use analytical cookies to understand how visitors use the site so that we can improve it. On geenxqs.nl there is also one advertising pixel from Meta, see below. We do not sell data to third parties.

Google Analytics measures how many visitors the site receives, which channels they arrive through, and which pages they view. Google Analytics cookies are kept for a maximum of two years.

Microsoft Clarity records how visitors move through the site: clicks, scrolling, and mouse movement. This produces heatmaps and session recordings. These recordings show behaviour, not identity. Anything you type into a form field is automatically masked and not recorded. On the intake form, the drivers questionnaire, and the leadership scan, nothing is recorded at all. Microsoft retains this data for thirty days; the cookies for a maximum of one year.

Meta Pixel (Facebook and Instagram) is used on geenxqs.nl only, not on the training platform. The pixel measures whether visitors who arrive through one of our Facebook or Instagram ads actually view the page, so that we can adjust our ads and not show them more often than necessary. Meta may link this data to your Facebook or Instagram account if you are logged in there. We do not use the pixel for retargeting (ads aimed at people who visited our site before). The cookie is kept for a maximum of three months.

These are US providers that may process data outside the EU, under the EU-US Data Privacy Framework.

You can refuse or delete analytical cookies and the Meta pixel through your browser settings. For Google Analytics you can also opt out using Google's browser extension; for Meta through the ad preferences in your Facebook or Instagram account.

The training platform (trainingen.geenxqs.nl) additionally uses functional cookies for login and session management. At checkout, Stripe may set its own cookies for fraud prevention; when playing training videos, Cloudflare Stream may set technical cookies. Both are necessary for functionality.

10. Changes

This privacy policy may be updated. The most recent version is always available on our website. We will inform you of significant changes through the channels we use to contact you.

11. Contact

Questions about this privacy policy or how we handle your data?