Privacy policy
What we collect, why, where it's kept, and how to get it changed or deleted. In plain words.
Last updated 18 October 2026
Who we are
This site is run by , the organiser of the Company of One course, in Amsterdam, the Netherlands. We decide what happens to your data, so we are responsible for it under the GDPR (the EU data protection law).
- Registered address:
- Chamber of Commerce (KvK) number:
- Privacy questions: write to us through
What we collect, and why
| When | What | Why, and our legal basis |
|---|---|---|
| You reserve a seat | Name, email, the package and place you chose, what's on your mind (if you tick any), and your note (if you write one). | To send your welcome email, tell you the dates first, and help you join. Basis: your consent, and steps you ask for before booking. |
| You use the contact form | Name, email, topic and your message. | To reply to you. Basis: your consent. |
| You visit any page | Your IP address, browser type and the page asked for, in the hosting provider's short-lived server logs. | To deliver the site and keep it safe. Basis: our legitimate interest in a working, secure site. |
We also measure how long a form takes to fill in, only to block spam robots. It is not stored. We don't run analytics, ads or tracking of any kind, and we never sell your data.
Who handles it for us
A few trusted providers process data on our behalf, under contracts that bind them to protect it:
| Provider | What they do | Where |
|---|---|---|
| Aatam Studio | Runs our contact list and email system. | Uses the providers below |
| Supabase | Stores the contact list. | EU: Ireland (AWS eu-west-1) |
| Resend | Sends our emails. | EU: Ireland (AWS eu-west-1) |
| Vercel | Hosts this website and runs the forms. | Forms run in Frankfurt, Germany; pages are served from the location nearest you |
| jsDelivr | Delivers the code library behind the 3D scene at the top of the home page. Your browser asks it for that file, so it sees your IP address. | Worldwide network |
Some of these companies are based in the United States. Where data can reach the US, it is protected by the EU's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Seat reservations: until you unsubscribe or ask us to delete it, and at most 24 months after we last heard from you if you don't book.
- Contact messages: 12 months after our last reply.
- If you book and pay: booking and payment records for 7 years, because Dutch tax law requires it.
- Server logs: a short time only, under the hosting provider's own rules.
Cookies
This site sets no cookies. It saves one small setting in your browser, called theme, to remember whether you chose the light or dark look. It never leaves your device. That's why there is no cookie banner.
Your rights
You can ask us at any time to:
- see the data we hold about you, and get a copy;
- correct it, or delete it;
- stop or limit how we use it, or object to it;
- withdraw your consent. Every email has an unsubscribe link, and withdrawing never affects what happened before.
Write to us through . We reply within one month. If you're unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in your own country.
Changes
If we change this policy, we update it here and change the date at the top.