Privacy statement

1. Who is responsible

The controller is Count & Cooper Consulting B.V., Chamber of Commerce 57114161, Stationsplein 45 unit A7.194, 3013 AK Rotterdam. Privacy questions: support@countcooper.nl or +31 10 261 3113.

2. Who this statement is for

This statement applies to website visitors, people who send the contact form, sign up for an event, or apply via the site. It does not cover employee HR files; those have a separate internal policy.

3. What data we process

We only process what is needed for the purpose. We do not collect date of birth, gender or bank details via the website.

• Contact form: name, email address and your message.
• C&C Talks: name, email address, job title and your consent to be contacted afterwards.
• Lunch lecture: name, email address, phone number and study details.
• Application: first name, last name, email, phone, preferred start date, motivation, CV, and optionally a cover letter or other files.
• Website visit: pages, language, and (only after consent) analytics or marketing measurement. See the cookie statement.
• Technical data needed to run the site (for example temporary security and error logs).

4. Purposes and legal bases

• Answering contact messages: legitimate interest (GDPR art. 6(1)(f)) to handle questions.
• Organising Talks and lunch lecture sign-ups: consent (art. 6(1)(a)) and, where needed, legitimate interest to run the event.
• Reviewing applications: legitimate interest, or steps prior to a contract (art. 6(1)(b) and (f)). The privacy checkbox confirms you have read this statement; we will not submit the application without it.
• Statistics and marketing cookies: consent, which you give or withdraw via the cookie bar. See the cookie statement.

5. Who we share data with

We do not sell personal data. We use processors who act only on our instructions:

• Personio SE (Germany/EU): applications, CVs and attachments in our ATS.
• Microsoft (Microsoft 365, Graph, Azure, EU): form email and website hosting.
• Google (GTM always; GA4 only after statistics consent): page measurement via Tag Manager.
• YouTube (Google): if you play a video on the site.
• LinkedIn: marketing measurement, only after marketing consent.
• Microsoft Forms: only if you sign up via the external Business Course page.

Some parties (Google, LinkedIn, Microsoft) may process data outside the EEA. Where that happens, it is based on the EU and US Data Privacy Framework, and/or standard contractual clauses.

6. How long we keep data

We do not keep data longer than needed.

• Contact messages: until handled, then up to 12 months.
• Event sign-ups: until the event, then up to 12 months (or until you withdraw consent).
• Applications in Personio: during the process, then up to 4 weeks after it ends, unless you consent to a longer talent pool period.
• Cookie choice: up to 6 months, or until you change it.
• Security and error logs: 90 days.

7. Cookies

We use cookies and similar technologies. Necessary cookies (your consent choice) are always set. Statistics and marketing are set only after your consent. Details are in the cookie statement.

8. Automated decisions

We do not take automated decisions with legal or similarly significant effects. Applications are reviewed by a person.

9. Security

The website runs in Azure. Applications go to Personio over an encrypted connection. Forms go to our mailboxes via Microsoft Graph. Secrets live in Azure Key Vault, not in the browser. If you suspect a breach, email support@countcooper.nl.

10. Your rights

You have the right to access, rectification, erasure, restriction, objection, data portability, and to withdraw consent. Email support@countcooper.nl from the address you used before. We will not ask for a copy of your ID unless we genuinely cannot identify you. We reply within one month.

If we cannot resolve it, you can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).