Privacy Policy GeenXQS

1. Who is responsible?

GeenXQS is responsible for the processing of personal data as described in this privacy policy.

2. What data do we process?

2.1 Via the website (www.geenxqs.nl)

When you visit our website, we process:

• Technical data your browser sends automatically (IP address, browser type, operating system, pages visited, timestamp)
• Data you submit yourself via a contact form or email (name, email address, phone number, content of your message)

2.2 Via the online training platform (trainingen.geenxqs.nl)

When you purchase or follow a training, we process:

• Name and email address
• Payment details (processed by our payment provider, not stored by us)
• Progress within the training
• If you buy a training via Springest, we receive your name, email address and the details you provide when enrolling, such as your billing details, from Springest

2.3 Via NoXQS (WhatsApp AI coach)

When you use NoXQS via WhatsApp, we process:

• Your phone number (automatically via WhatsApp)
• The content of your messages
• The responses generated by the AI coach
• The timestamp of your messages
• Whether you are a new or returning user

2.4 Via the coaching intake form

When you begin a coaching engagement with us, you first complete an online intake form. In it, we process:

• Your name and email address
• Information about your position, role, and organisation
• Your goals, situation, and development points for the coaching
• Whatever you choose to share about your work, collaboration, and environment

3. Why do we process this data?

• To respond to your questions via the website, email, or WhatsApp
• To deliver AI coaching responses via NoXQS
• To offer and deliver online trainings
• To prepare and deliver a coaching engagement (intake and sessions)
• To improve our services
• To detect situations where a referral to professional help or personal coaching may be appropriate
• To issue invoices and process payments
• To comply with legal obligations

Legal basis: We process your data on the basis of your consent (when starting a WhatsApp conversation), the performance of a contract (when purchasing trainings, a coaching engagement, or a subscription), or our legitimate interest (for improving our services and securing our systems).

4. Who has access to your data?

We only share your data with the following parties, and only to the extent necessary for the service:

Data processing agreements are in place with these parties. Your data is never sold to third parties. Your data is never used for advertising.

About Springest:our trainings are also sold via Springest (Springest B.V., Utrecht, the Netherlands). If you enrol there, Springest shares your enrolment details with us so we can give you access and invoice you. Springest and GeenXQS are each independently responsible for their own processing. Once we receive your data, this privacy policy applies. What Springest itself does with your data is described in Springest’s privacy policy; you can contact them with questions about that.

About AI processing: Anthropic (the maker of Claude) does not use your messages to train their AI models when the API is used. Your messages are processed to generate a response and are deleted by Anthropic within 30 days by default.

About delivery: Twilio delivers the messages and keeps their content in its own logs while doing so. We have set that period to 7 days, the shortest Twilio allows, and automatic backup is switched off. Twilio states that data may then persist in its back-end systems for up to thirty days before it is permanently removed.

About WhatsApp itself:the conversation also sits in your own WhatsApp, on your phone and in your own backups. We do not delete that part and we cannot delete it; you do that yourself in WhatsApp. Meta's terms and privacy policy apply to your use of WhatsApp.

5. How long do we keep your data?

6. Security

We take appropriate measures to protect your data:

• All WhatsApp communication is end-to-end encrypted by WhatsApp itself
• The connection between our server and the AI (Claude API) is encrypted (HTTPS)
• The server running NoXQS is hosted within the EU
• Logging in to the training platform uses a one-time login link; no passwords are stored
• The training platform database is located in the EU (Frankfurt)
• Training videos and workbooks can only be opened after logging in, through temporarily signed links
• The login page and the free module are protected against automated abuse with Cloudflare Turnstile; for this, Cloudflare processes your IP address and technical characteristics of your browser, without setting cookies
• System access is limited to Nieky Klijn as sole administrator
• Data is automatically deleted after the retention period

7. Your rights

Under the GDPR, you have the following rights:

• Access, you can request which data we hold about you
• Rectification, you can have incorrect data corrected
• Erasure, you can request deletion of your data
• Restriction, you can request restriction of processing
• Portability, you can request your data in a common format
• Objection, you can object to the processing of your data

To exercise any of these rights, send an email to nieky@geenxqs.nl. We will respond within 30 days.

If you have an account on the training platform, you can also delete it yourself from your dashboard. Your name, email address, enrolments, progress and certificates are then erased. We only keep the invoice details of earlier purchases for as long as the law requires (seven years).

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).

8. Specifically about NoXQS (WhatsApp AI coach)

NoXQS is an AI-powered coaching service. Here is what you need to know:

Consent

By sending a message to NoXQS via WhatsApp, you consent to the processing of your message by AI. This is also stated in the welcome message you receive upon first contact.

AI processing and referrals

Your messages are processed exclusively by AI; no human reads along and no automatic transfer to Nieky Klijn or third parties takes place. In some situations, NoXQS may suggest that you contact Nieky or another professional yourself, for example, if your question is more complex than AI coaching can handle, or if there are signs of serious stress or burnout. Whether you do so is entirely your own decision. NoXQS never shares your data with Nieky or third parties on its own initiative.

No automated decision-making

No automated decisions with legal consequences for you are made based on your messages.

Talking about others

As a manager, you may share information about employees, colleagues, or other third parties with NoXQS. These people have not given consent for this processing. You are therefore personally responsible for how you speak about them. We strongly recommend that you do not use full names or other identifiable information about others, speak in roles (“my team lead”, “one of my reports”). Do not share health information or other special categories of personal data about third parties. NoXQS is configured not to reuse names of third parties in its responses, and will remind you once if you do mention a name.

Stopping

You can stop using NoXQS at any time by no longer sending messages, or by typing STOP in the chat to have your data deleted immediately. You can also request deletion of your data via nieky@geenxqs.nl.

9. Cookies and website statistics

Our websites use only functional cookies necessary for the site to work. We do not set analytical or advertising cookies, which is why we do not ask for consent through a cookie banner. We do not sell data to third parties.

Visitor statistics are measured with Vercel Web Analytics, the statistics service of our hosting provider. It counts page views and visitors without cookies and without personal data: each visit is turned into a non-identifiable code that expires after one day. We see how many people view a page, through which channel and from which country, but not who. On a few pages we also record an action, such as starting the leadership scan or checking out a training course, again without identifiable data.

The training platform (trainingen.geenxqs.nl) additionally uses functional cookies for login and session management. At checkout, Stripe may set its own cookies for fraud prevention; when playing training videos, Cloudflare Stream may set technical cookies. Both are necessary for functionality.

10. Changes

This privacy policy may be updated. The most recent version is always available on our website. We will inform you of significant changes through the channels we use to contact you.

11. Contact

Questions about this privacy policy or how we handle your data?