Privacy & Cookies

1. Who is responsible

European Paradox Academy BV is the controller of the personal data described in this notice. This means that we decide why and how that data is used.

To ask a privacy question or exercise a right, email niky.dieben@hotmail.com or use the contact form and say that it is a privacy or data-protection request. Please do not send sensitive information through the form. We may need enough information to confirm your identity before acting on a request.

2. Data we use, why we use it, and our legal bases

The data we receive depends on how you use the website. We do not ask for special-category data through our public forms.

You provide contact and subscription data directly. Information in published biographies, highlights, or images may come from the person concerned, an author, a public source, or another approved editorial source. Our website, browser technologies, and service providers generate the technical, security, analytics, and campaign data described below when the relevant feature is used.

We may also use information when necessary to comply with a legal obligation (Article 6(1)(c)) or establish, exercise, or defend legal claims. We do not use the website data described here for decisions based solely on automated processing that produce legal or similarly significant effects.

Providing information is voluntary. The online contact and privacy request forms require a return email address and message; you can instead use the postal contact in section 1. We cannot create a newsletter subscription without an email address and confirmation, or register you for a webinar without an email address, event selection, and required registration acknowledgement. A name is optional. The security check is required to submit a protected form. Optional Analytics and Marketing tracking are not required to use the website or send a form.

After an accepted newsletter request, the screen says: “If the address can receive email, a confirmation link will arrive shortly. You are not subscribed unless you confirm within 24 hours.” The webinar screen uses the same conditional first sentence and says that registration is not active unless you confirm within 24 hours. This deliberately does not confirm that an address exists or that an email was delivered: the same accepted outcome can be shown after an email-delivery rejection or a private address-based request limit, or if the link token cannot be created. After the security check succeeds, these outcomes and a successful send are held behind the same minimum 17-second response period. The application waits for the email provider up to its bounded delivery deadline, so a slower send can take longer; it does not automatically retry an uncertain send. Nothing is activated unless a link arrives and you explicitly confirm it. An email-delivery or token-creation failure emits only a fixed operational signal for restricted monitoring; its payload excludes your email address, token, confirmation link, provider error, and caller-supplied context.

3. Service providers, recipients, and transfers

Access is limited to European Paradox Academy BV and vendors that need the data to provide their services. Those vendors may act as processors for us and, for some of their own activities, as independent controllers. Current services include:

• Contentful for website content management and delivery, including original assets served through its content delivery network;
• Combell for SMTP and email delivery when you contact us or request a newsletter subscription, webinar registration, or newsletter-withdrawal confirmation;
• ActiveCampaign for newsletter subscriptions and withdrawals, suppression and consent evidence, webinar registration, delivery administration, and optional consent-based site tracking;
• Vercel for website hosting and delivery and, where you consent, analytics and performance insights, including edge and optimized-image caching; and
• Upstash for short-lived, pseudonymous form abuse-prevention counters; confirmation replay, subject-lease, withdrawal-cutoff, and privacy-operation retry state; and encrypted subscription-reconciliation records shared across application instances;
• Google reCAPTCHA for form security and abuse detection after you interact with a protected form.

We may also disclose data where the law requires it, to competent authorities, or where necessary to protect legal rights. We do not sell personal data.

International transfers

Some vendors or their sub-processors may process data outside the European Economic Area. Where applicable, transfers must rely on a lawful safeguard such as an adequacy decision or Standard Contractual Clauses, together with supplementary measures where required. The location and safeguard can vary with each provider, sub-processor, and account configuration.

You can ask us which transfer safeguard applies to your data and how to obtain a copy by using the privacy contact details in section 1. Copies may be redacted where necessary to protect confidential information or the rights of others.

4. How long we keep data

We keep personal data only for as long as needed for the purpose for which it was collected, taking account of legal, accounting, security, and dispute-resolution requirements. In particular:

• Contact inquiries are kept while we handle and resolve the inquiry, and afterwards only for as long as reasonably necessary for follow-up, legal obligations, or possible legal claims.
• Unconfirmed email links and browser state are accepted for no more than 24 hours after the request. The encrypted fragment link can be used during that window, while the temporary browser cookie is kept across a temporary retry response received before that request starts its update, so you can try again without requesting another email. Once an update starts, an error is terminal because repeating an update whose result is uncertain could be unsafe. The cookie is then cleared and you must request a fresh link. It is also cleared on success or a terminal missing, invalid, expired, or revoked result. Every temporary cookie expires with its link. The email itself and related SMTP, mailbox, security, and delivery logs follow their separately configured retention periods.
• Subscription-reconciliation records are created when a final subscription, webinar-registration, or newsletter-withdrawal update begins so an uncertain provider result can be resolved without blindly repeating the update. Each authenticated-encrypted record can contain your normalised email address, confirmation identifier, relevant list and consent or withdrawal details, and timestamps. A separate keyed-HMAC subject index lets authorised privacy staff find and delete these records without putting the raw email address in that index. A record is deleted after verified completion, an authorised subject purge, or expiry. Unresolved pending records use a configured period of 2–30 days; records moved to reviewed quarantine use a configured period of 7–90 days from that move. The exact production periods require documented approval, and encryption does not make these records anonymous.
• Newsletter records are needed while the subscription remains active. After you unsubscribe, delivery must stop; we may retain a minimal suppression or proof record for an approved period so that we respect your choice and do not re-add you unintentionally. The self-service unsubscribe changes only the newsletter-list delivery status and preserves the existing consent evidence; it does not create or reactivate a contact, erase other records, or change webinar registration or browser-tracking choices.
• Optional marketing-tracking records are separate from newsletter status. New collection stops when you withdraw Marketing consent. Previously collected provider-side history must be assessed under the approved marketing retention rule and any applicable erasure request; withdrawing consent does not by itself prove that historic provider data has already been deleted.
• Webinar registration records are kept while needed to administer the event and afterwards only for operational follow-up, legal obligations, or possible claims. They are not used to create a newsletter subscription.
• Your optional tracking preference is accepted for no more than six months, after which we ask again. An expired local-storage record may remain physically present until your next ordinary visit or until you clear browser storage, but the site ignores and removes it when the consent component next runs.
• Analytics, performance, security, and technical logs are retained for the shortest period needed for their purpose, subject to the retention options and operational requirements of the relevant provider account.
• Published content and images may remain in caches after correction or removal at the source. Our application invalidates its published-text cache when Contentful reports a change and also marks it stale after five minutes as a fallback; the first later request that triggers a refresh may still receive the prior version. Contentful delivery caches, Vercel/Next optimized-image or edge caches, and visitors' browser caches can have different periods. Where required, our erasure process must address controllable copies and record any remaining cache or backup period.
• Request and security rate-limit counters for forms, confirmation steps, restricted preview, and privacy operations expire within one hour. Redis keys contain keyed HMAC digests rather than raw IP or email addresses.
• Confirmation replay and revocation state uses purpose-separated, HMAC-keyed Redis records rather than raw email addresses or confirmation or privacy-operation IDs. A claimed link keeps a replay-prevention marker through its expiry, or through the later end of a fifteen-minute settlement window when it starts near expiry. A separate subject-mutation lease lasts no more than fifteen minutes and is removed after verified completion. While that lease exists, another final request is told when it may retry. If the lease is gone but the claim marker remains, the earlier result is treated as uncertain: the old link is not replayed, its cookie is cleared, a fixed identifier-free operational event is emitted, and a fresh link is required. Successful consumed state never outlives the link. A privacy operation may retain an email-derived cutoff until 24 hours after its five-minute clock-skew-adjusted effective time to reject older opt-in links, without blocking a newsletter withdrawal from deactivating a remaining contact. Its HMAC-keyed retry record contains pseudonymous operation and subject references, four timestamps, purge status, and the cumulative aggregate deletion count. It remains until 24 hours after the unchanged fifteen-minute final-settlement point so an uncertain retry cannot accidentally broaden the erasure scope. The API timestamps do not extend during that grace. This retry record remains personal data and must be covered by an approved retention rule. Stable retry and conflict detection end when it expires, so we never reuse an expired operation identifier and start any final purge retry with at least the fifteen-minute processing lease plus its one-minute route budget still available. Starting a valid final self-service newsletter-withdrawal attempt keeps a separate email-derived, newsletter-only cutoff until 24 hours after its five-minute clock-skew-adjusted effective time, including when later provider work fails. That cutoff rejects older newsletter opt-in links but does not block webinar confirmations.
• Backups and provider systems may retain limited copies for a further period before they are overwritten or deleted under the applicable provider schedule.

When data is no longer needed under an approved retention rule, our process requires deletion or irreversible anonymisation where supported, subject to documented legal holds and bounded provider backup periods. Actual provider periods depend on the production account settings that we are responsible for maintaining, verifying, and reviewing.

5. Cookies and similar browser technologies

A cookie is a small file stored by a website in your browser. Similar technologies include local storage and identifiers sent with network requests. Essential technologies support the service or remember your privacy choice. Analytics and marketing technologies are optional and remain off unless you consent.

Vendor updates and browser context can change the exact cookie or storage names. Your browser developer tools provide the current technical values for your visit.

Manage your choices

Use the Tracking preferences control at the bottom of the website to allow, reject, or later change optional categories. Withdrawing consent does not affect processing that was lawful before withdrawal. You can also remove stored browser data in your browser settings. These controls apply to this browser, device, and website origin; repeat the choice on other browsers, devices, or site origins. Blocking essential technologies may prevent a protected form from working.

Tracking preferences are separate from newsletter delivery. To stop newsletter delivery, use the unsubscribe link in any newsletter email . Every newsletter we send carries that link. Links from ordinary site pages use a fresh document load so previously enabled telemetry cannot carry into the withdrawal flow.

6. Your data protection rights

Subject to the GDPR conditions and exceptions, you may ask us to:

• give you access to your personal data;
• correct inaccurate or incomplete data;
• erase data;
• restrict how data is used;
• provide portable data where applicable;
• object to processing based on legitimate interests;
• object at any time to direct marketing; and
• withdraw consent at any time.

To withdraw newsletter consent, use the unsubscribe link in any newsletter email . To exercise another right, use our contact form, marking it as a privacy request. We normally respond within one month, although the GDPR permits an extension for complex or numerous requests. We will tell you if an extension applies. These rights are not absolute, and we will explain any lawful reason for refusing or limiting a request.

You may also lodge a complaint with the Belgian Data Protection Authority. See its official complaint guidance (opens in a new tab). You may contact another competent supervisory authority where the GDPR allows it.

7. Security and changes

We take proportionate technical and organisational measures to protect personal data. No website, transmission, or storage system can be guaranteed completely secure, so please do not send confidential or special-category information through the public contact form.

We will update this notice when our processing, providers, or legal obligations materially change. The date at the top shows the latest revision. This notice is a transparency statement; it is not a claim of regulatory or vendor certification.