Privacy statement
How we handle your personal data
Last updated: 2 October 2026
We use your personal data to run our training, audits and adoption support, answer your questions, and keep you informed when you've asked us to. We never sell your data. This policy explains what we collect, why, who sees it, how long we keep it, and how you stay in control, in line with the General Data Protection Regulation (GDPR) and Dutch law.
Who we are
BioGuild ("BioGuild", "we") is the controller of your personal data. That means we decide why and how it's processed, and we're responsible for doing so lawfully. BioGuild operates under the entity of Bioverse Ventures BV.
What this policy covers
This policy applies when you visit bioguild.org, contact us, attend one of our open or private courses, take part in an AI readiness audit or adoption project, subscribe to our updates, or apply for a job with us.
It doesn't cover other websites we link to, such as partner venues or LinkedIn. Those have their own privacy policies. When we process data on behalf of a client organisation, that organisation's policy applies too (see "AI readiness audits and client projects").
What personal data we collect
We collect only what we need for the purpose at hand. Most of it comes from you directly; some comes from your employer when they book a private course for your team.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, job title, organisation, business email, business phone | Contact forms, email, calls, events, your employer |
| Course participation | Course and date, attendance, completion, certificate, pre-course survey answers, course feedback | You, your employer, our trainers |
| Practical needs | Dietary or accessibility requirements | You, only if you choose to tell us |
| Billing details | Billing contact, organisation address, VAT number, payment status | You or your organisation |
| Communications | The content of your emails, messages and call notes | You |
| Website usage | IP address, browser and device type, pages visited | Your browser, via cookies (see “Cookies and analytics”) |
| Job applications | CV, motivation letter, references | You, and referees you name |
We don't ask for sensitive data such as health information. Dietary and accessibility needs can reveal health or religious information, so we only record them with your explicit consent, use them only to arrange your session, and delete them afterwards.
Why we use your data, and on what legal basis
The GDPR only allows processing on a lawful basis. Here's each purpose and the basis we rely on.
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Answering your questions and preparing a proposal or quote | Steps before a contract (b), or our legitimate interest in responding to enquiries (f) |
| Delivering open courses, private courses, audits and adoption support | Performance of a contract (b) |
| Issuing certificates and training records | Performance of a contract (b) |
| Invoicing, bookkeeping and tax | Legal obligation (c) |
| Sending our newsletter | Your consent (a) |
| Telling existing clients and participants about similar services | Legitimate interest (f), with an opt-out in every email |
| Website analytics and non-essential cookies | Your consent (a) |
| Keeping the website secure and working | Legitimate interest (f) |
| Improving our courses using feedback | Legitimate interest (f) |
| Handling job applications | Steps before a contract (b); your consent (a) if we keep your CV longer |
| Establishing or defending legal claims | Legitimate interest (f) |
Where we rely on legitimate interest, we've weighed it against your privacy and kept the impact as small as possible. You can object at any time (see "Your rights").
Training participants and AI literacy records
Documented training is part of what our clients buy. Under the EU AI Act, organisations that use AI at work must take measures to ensure their staff are sufficiently AI literate, and many keep training records as evidence.
For each course, we record who attended, which course, the date, the trainer, and whether you completed it. We use this to issue your certificate.
When your employer books a private course, they usually give us your name and work email. We share your attendance and completion with the booking organisation, because that record is what they need. We may share pre-course survey results and course feedback with them, always anonymised so nothing can be traced back to you. This can include your individual answers.
If you book an open course yourself, we don't share your attendance with your employer unless you ask us to.
AI readiness audits and client projects
During an AI readiness audit or adoption project, we interview staff and review how AI tools are used. We record names, roles and interview notes, and report findings at team level. We don't attribute individual answers in our report unless this was agreed with you beforehand.
Where we handle personal data on a client's instructions, such as their systems or files, we act as a processor. We then sign a data processing agreement with the client, and their privacy policy applies to that data.
Our work doesn't require clinical, patient or unpublished study data. We ask clients not to share it with us. If a project genuinely needs it, we agree the safeguards in writing first.
Newsletters and business emails
We send our newsletter only to people who've signed up for it. Every newsletter has an unsubscribe link, and unsubscribing takes effect immediately.
If you're an existing client or have attended one of our courses, we may email you about similar courses and services. You can opt out when we first collect your details and in every email we send.
We don't send marketing emails to people we've had no prior contact with unless they've given consent. We don't buy email lists.
Cookies and analytics
Our website uses cookies that are strictly necessary for it to work; these don't need your consent. We currently use no analytics or marketing cookies. If we add them in the future, we'll place them only after you accept them in a cookie banner, and you'll be able to change your choice at any time.
Who we share data with
We never sell your personal data. We share it only when needed to deliver our services, and only with parties bound by a data processing agreement or a duty of confidentiality.
| Recipient | Why |
|---|---|
| Website and hosting providers | Running bioguild.org and its forms (Lovable) |
| CRM and email tools | Managing enquiries, bookings and newsletters (HubSpot) |
| Office and video tools | Email, files and online sessions |
| Finance providers | Invoicing, payments, bookkeeping |
| Partner venues | Arranging in-person courses (name and, with consent, dietary needs) |
| Your employer | Attendance and completion for a course they booked (see “Training participants”) |
| Authorities | When the law requires it (tax authorities, courts) |
AI tools in our own work. We use AI tools such as Claude, ChatGPT and Copilot through business accounts whose terms exclude our inputs from model training. We don't enter your personal data into an AI tool unless it's needed for the service and covered by a data processing agreement. We practise what we teach.
Transfers outside the EEA
Some of our providers are based outside the European Economic Area or use sub-processors there, for example in the United States. We only allow such a transfer when the European Commission has decided the country offers adequate protection, or when the provider has signed the EU Standard Contractual Clauses, with extra safeguards where needed.
You can ask us for a copy of the relevant safeguards.
How long we keep your data
We keep personal data no longer than we need it, unless the law requires longer. After that, we delete or anonymise it.
| Data | How long |
|---|---|
| Enquiries that don't lead to a booking | 2 years after our last contact |
| Client and contract records | Duration of the relationship, then 2 years |
| Attendance and certificate records | 5 years after the course, so you and your employer can show the training took place |
| Dietary and accessibility needs | Deleted within 30 days after the course |
| Pre-course surveys and feedback | 1 year, then anonymised |
| Audit interview notes | Duration of the project, then 1 year |
| Invoices and financial records | 7 years (Dutch tax law) |
| Newsletter subscription | Until you unsubscribe |
| Job applications | 4 weeks after the procedure ends, or 1 year with your consent |
| Analytics data | As stated in our Cookie policy |
How we protect your data
We take technical and organisational measures that fit the risk:
- All data sent to and from our website travels over an encrypted (HTTPS) connection.
- Only team members who need your data for their work can access it.
- Our business accounts are protected with multi-factor authentication.
- We use business-grade tools under data processing agreements, not personal accounts.
If a data breach puts your personal data at risk, we report it to the Dutch Data Protection Authority within 72 hours. If the risk to you is high, we tell you directly.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you and receive a copy (Art. 15)
- Correct data that's wrong or incomplete (Art. 16)
- Erase your data when there's no longer a reason to keep it (Art. 17)
- Restrict how we use your data, for example while we check a correction (Art. 18)
- Receive your data in a machine-readable format, or have it sent to another organisation (Art. 20)
- Object to processing based on our legitimate interest, and always to direct marketing (Art. 21)
- Withdraw consent at any time, without affecting processing that happened before
We don't make decisions about you based solely on automated processing, including profiling.
To use any of these rights, email team@bioguild.org. It's free. We reply within one month. For complex requests we may need up to two more months, and we'll tell you why within the first month. To protect your data, we may ask you to confirm your identity, for example by replying from the email address we already know.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in the EU country where you live or work.
Children
Our services are for professionals. We don't knowingly collect personal data from anyone under 16. If you think a child has given us their data, contact us and we'll delete it.
Changes to this policy
We update this policy when our services, tools or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we'll tell clients and participants by email.
Questions?
Email team@bioguild.org or write to BioGuild, Vening Meinesz building C, Princetonlaan 6, 3584 CB Utrecht, the Netherlands. We're happy to explain anything in this policy.