Privacy Statement

Introduction

TopMind B.V. (“TM”, “we”, “us”, or “our”) is responsible for all data processing. TopMind is situated in 'Vogelenzang' the Netherlands, on the 2e Leijweg 1, 2114BG. The company is registered at the Dutch Chamber of Commerce under the number 34299780. In this privacy statement, we explain which personal data we collect and for what purpose we use it. We advise you to read this carefully.

In this Privacy Statement we will discuss:

The identity of TopMind and the considerations we take into account while processing
The purposes for which we process personal data and the legal grounds we use to do so
What categories of personal data we might use
How we make use of 'profiling'
With which parties we share your personal data
Our data retention policy
The rights of a TopMind client in relation to our use of their personal data
The security measures we take in order to secure the safety of the client's personal data
Who you can contact for information, or to invoke your rights

TopMind

TopMind is a company that offers guidance to its clients in order to improve their leadership effectiveness. TopMind helps its clients to improve the fitness of their minds, in order to be able to perform better. In order to help our clients, TopMind collects and uses certain types of personal data from its clients. TopMind aims to be as careful in precise as possible in the process of processing this data. TopMind is committed to protecting the privacy of its customers and endeavours to ensure that their personal data are held securely and treated with the utmost care. Furthermore TopMind deems it to be essential to inform people over the processing of their personal data. This privacy statement serves as a way to comply with the obligations that TopMind has under the General Data Protection Regulation (GDPR), specifically the obligations that follow from articles 12 and 13 of the GDPR.

In our processing, we adhere to the requirements of the GDPR. That means, amongst other things, that:

We clearly state the purpose for which we process personal data. We do this via this privacy statement; A further specification of these purposes can be found below. We only process data for these specified purposes and will not process your personal data further in a way that is incompatible with those purposes.
We limit our collection of personal data to only the personal data necessary for the purposes of data processing.
We first ask you for explicit permission to process your personal data in cases where your consent is required;
take appropriate security measures to protect your personal data and also require this from third parties that process personal data for us;
We respect your right to view, correct or delete your personal data;
We do not share your personal data with third parties; unless this is required for the purpose
We aim to limit the time that we store personal data to what the time that is absolutely essential for the purposes for which the personal data is protected
We will process your personal data in a manner that ensures appropriate security of the data
We will inform you about the rights that the GDPR provides for you in relation to the processing of your personal data

Purposes of processing and lawful bases for processing

The purposes of processing that TopMind has can be categorized in three categories. Firstly the data that is processed in order to perform our side of a contract with the client, or in order to take steps at the request of a data subject prior to entering in such a contract. Secondly the data that is processed in order to perform the services that the client requests when he/she becomes a TopMind client. This entails the processing of data in order to track the clients behaviour and help them become fitter. Thirdly, for the purpose of improving the quality and effectiveness of the TopMind program. Fourthly, we collect and store personal data in order to inform you of TopMind activities through our newsletter. Fifthly, we collect and store personal data of (potential) clients in order to advertise the TopMind program.

Data processed in order to perform a contract
The purpose of this processing is to perform our contractual obligations to the client, or in order to take steps at your request that are necessary in order to enter in a contract with you. If you want us to deliver TopMind's services to you, we sometimes need to use your personal data to be able to contact you, send you a bill or make and appointment with you. This data is processed based upon the lawful base of article 6 (b) which entails processing data in order to enter into, or perform, a contract.

Data processed in order to perform the services of the TopMind programs
The purpose of this processing is to perform the services that a client looks for when he engages in a TopMind program. The goal of the program is to improve client's mental and physical health and make them more effective as leaders and professionals. The TopMind program is focused on giving people more knowhow about their own behaviour and to help them change their behaviour wherever they deem that to be necessary. In order to do so, TopMind and the client create a framework in which TopMind helps the client by tracking certain aspects of the client's behaviour. By tracking this behaviour for the client, TopMind collects and stores large amounts of personal data. The personal data that is collected in this process is therefore collected in order to perform the services for which a client comes to TopMind, which is helping the client track his own behaviour and helping the client become fitter and more effective. This data is processed on the legal basis of consent (article 6(a) GDPR) which means that we ask your explicit consent for processing the personal data you share with us in order to help you.

Data processed in order to improve the quality and effectiveness of the TopMind programs
Another purpose for which TopMind processes data is to improve the quality of the TopMind program. TopMind aims to provide its client with the best and most effective services that we can offer. Therefore, after clients have completed their TopMind program, TopMind anonymizes the client's personal data and stores it in its database. This anonymized data is used in order to do statistical research into the effectiveness and effects of the TopMind programs. This data is processed on base of the lawful ground of the legitimate interests of TopMind to improve our products and improve the way we help our clients. TopMind is always looking to become better and improve our products, therefore we use your anonymized data to for example assess whether our program works better for certain persons, or which features of our program work best.

Data processed in order to send our TopMind newsletter
For the purpose of keeping you up to date with all of TopMind's activities, we have our TopMind newsletter. In order to send it to people, we process their personal data. This processing is based upon the explicit consent of the receivers of the newsletter.

Data processed for the purpose of advertisement
Even though many clients get acquainted with TopMind via their employer, TopMind also actively tries to advertise its programs directly. This means that TopMind actively targets both companies as well as individuals in order to advertise our programs to. This use of personal data for the purpose of advertisement is based upon the ground of consent.

Use of personal data

By using our service, you entrust us with certain information. We need this personal data in order to help our clients. We only keep and use the personal data provided by you directly, in the context of the service you request, or of which it is clear that they are provided to us to process.

We process the following data of clients for the purposes mentioned in this privacy statement. The following categories of data are processed for both clients and individuals that want have indicated that they want to receive advertisement or the TopMind newsletter:

Name of the client
Address
Phone number
Billing address
E-mail address
Gender
Date of birth

Furthermore, TopMind also uses certain data that can be categorized under 'special categories of personal data' as named in article 9 of the GDPR. It is important to emphasize that this data is only collected from TopMind clients who have explicitly given their consent to these activities.

Article 9 prohibits the processing of personal data that reveals information regarding these special categories of data, unless one of the exceptions under paragraph 2 applies. TopMind possibly processes the following data that might fall under the special categories of data for the purposes mentioned in this privacy statement:

Data concerning the physical health of the client; TopMind collects data concerning the physical fitness of the client in order to asses their fitness and help clients improve their physical fitness. An example of this would be the collection of data such as the client's weight, height and data concerning the client's heart rate.

Lastly, an element of major importance in the TopMind program is the sessions with TopMind's professional in which the client aims to develop a better understanding of his own behaviour. In these sessions, TopMind professionals take notes of certain important matters that are discovered through these talks. These notes might contain all sorts of personal data. Furthermore the client develops his own 'tracking questions', the answers to which might contain personal data. TopMind stores the answers to these questions. Considering all this, it is impossible to exactly pinpoint which information TopMind will collect, since it depends on whatever the client wishes to share and utilize in order to fully profit from the program. TopMind does not aim to collect and store this data, nevertheless certain data that is stored might hold information concerning these (special) categories of data. TopMind always aims to limit the amount of data that is stored, especially data that contains information regarding these special categories of data.

Data that lies in the information that is shared by the client with the TopMind professionals, both through the sessions, as through the questions and answers the client provides in his own program.
An example of what is stated above, is data that contains information regarding the client's mental health; TopMind does not aim to collect data concerning the client's mental health. Nevertheless, whenever the client decides to share this information through either conversations with TopMind professionals, or through his/her own tracking questions, TopMind might collect and store this data which might hold information concerning the client's mental health. Nevertheless TopMind always aims to minimize the storage of personal data relating to client's mental health.

Profiling

It is very important for every TopMind client to be aware of the fact that TopMind's program makes use of 'profiling'. This means that TopMind uses automated processing of data in order to evaluate the personal aspects that are related to a client. This is particularly relevant because these profiles are used to analyse the client's health, performance at work, personal preferences and behaviour.

Every client in the TopMind program creates his own set of tracking questions, with help of a TopMind professional. The client answers these questions on every working day. When designing the questions, the client also creates a 'rating' of his/her own behaviour.

Example: cups of coffee

For example, one of the client's tracking questions concerns the amount of coffee he/she drinks on a day. The client than connects different scores, to different amounts of coffee per day. Everyday the client answers his own tracking questions, thereby generating a score that is based on the way he/she rated his own behaviour. All these questions together generate a score, which demonstrates the extent to which the client has succeeded at changing his/her behaviour in the way he/she wanted it to be changed.

It is important to emphasize that these profiles are never used in order to base any (automated) decision-making based on the profile. They are simply a means of evaluating the effectiveness of the client and the effectiveness of the client in changing his/her own behaviour.

Contact form and newsletter

We send out a newsletter to keep interested parties up-to-date about our products and/or services. Each newsletter contains a link where you can unsubscribe. Your e-mail address is automatically added to the list of subscribers.

If you fill out a contact form on the website, or send us an e-mail, the data you sent us will be kept for as long as the nature of the form or the content of your e-mail is required for processing the request/question.

Provision of personal data to third parties

TopMind aims to limit the amount of third parties that we share your data with. However, in order to realize the purposes of processing above, we sometimes have to share your information with third parties

MoneyBird: TopMind shares your contact details with MoneyBird. MoneyBird is a service that helps companies do their bookkeeping. TopMind uses this service to send quotations to its clients and track the completion of payments. Therefore TopMind needs to share client's contact details with MoneyBird.
MessageBird: TopMind shares your name and phone number with MessageBird. MessageBird is a service that sends 'text messages'. TopMind uses this service to send its clients links to digital forms that contain the clients 'tracking questions'. The client answers these questions in the form, which is then uploaded in the TopMind web application. In order to facilitate this essential process, TopMind has to share certain personal data with MessageBird. TopMind shares the client's contact details with MessageBird, as well as the link that contains the client's 'tracking questions'.
PostMark: TopMind shares your name and phone number with 'PostMark'. PostMark is a service that sends 'text messages'. TopMind uses this service to send its clients links to digital forms that contain the clients 'tracking questions'. The client answers these questions in the form, which is then uploaded in the TopMind web application. In order to facilitate this essential process, TopMind has to share certain personal data with PostMark. TopMind shares the client's contact details with PostMark, as well as the link that contains the client's 'tracking questions'
Creativeorange V.O.F.: TopMind's web application is maintained and supported by 'Creativeorange V.O.F.' (From here on: CO). CO support sus in providing our services and to help provide, run and manage our IT systems. Furthermore CO supports us in the storage in sever management and the storage of our web application and database on these servers. The servers powering and facilitating that cloud infrastructure are located in secure data centres around the world, and personal data may be stored in any one of them.
Hartslag Coaching: TopMind shares client's contact details with Hartslag Coaching in order for them to be able to make an appointment with clients. TopMind clients are sent to this company in order to assess their physical fitness.

Google Analytics

We use Google Analytics to keep track of how visitors use our website. We have signed a processor agreement with Google to make agreements about the handling of our data. Furthermore, we have not allowed Google to use the obtained Analytics information for other Google services, and finally we anonymize the IP addresses.

Security

We take security measures to limit abuse of and unauthorized access to personal data. In particular, we take the following measures:

TopMind aims to store all collected data in the TopMind web application
Access to personal data in the web application is protected with an e-mail address and password
Only TopMind employees that are either system administrators, or that personally coach you, have access to your personal data that is stored in the TopMind web application.
The web application and its data are stored on a sever that is secured by TransIP
We use secured connections (Secure Sockets Layer or SSL) which protects all information between you and our website when you enter personal data
In order to assess the risks to your personal data due to processing by TopMind, we have initiated a 'Data Protection Impact Assessment'.

Third party websites

This privacy statement does not apply to websites of third parties that are connected to this website by means of links. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We encourage you to read the privacy statement of these websites before using these websites.

Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation). This means that the information is stored for as long as someone is a client at TopMind, or as long as one does not revoke his/her consent for the processing of certain personal data in the case of our newsletter and advertisement.

In our experience, clients regularly return to TopMind after they followed their first program. Whenever they do so, they want to continue where they 'left off'. Therefore, whenever a client finishes his TopMind program, we will ask consent to keep his personal data for whenever the client wishes to continue with another TopMind program. If the (former) client does not want us to do so, his/her personal data will be anonymized within a month.

The client's rights as a data subject

TopMind is very serious about protecting your personal data, but we also want you to be aware of the rights that you have under the General Data Protection Regulation. TopMind will, at all times, support you in exercising these rights over your personal data that is processed by TopMind. If you want to exercise any of the rights mentioned below, or have any questions, comments or objections, please send an email to: privacy@topmind.com

The rights that the client has (data subject) under the GDPR are, amongst others:

The right of access (Article 15 GDPR). This right gives the client the power to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information.
The right to rectification (Article 16 GDPR). This right gives the client the power to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. This also entails the right for the client to have its personal data completed, if it is not yet complete.
The right to erasure (Article 17 GDPR), this right is also known as the 'right to be forgotten'. This means that the client has the right to have its personal data removed by TopMind, while TopMind has the obligation to do so without further delay.
The right to withdraw consent (Article 17 GDPR). This means that TopMind clients that have given us their consent in order to process their personal data can withdraw this consent at any given time.
The right to restricted processing (Article 18 GDPR). This rights means that under certain circumstances, the client can order TopMind to restrict processing.
The right to data portability (Article 20 GDPR). This right means that you have the right to request an oversight of you personal data that is stored by TopMind. Furthermore you can also request TopMind to transfer your data to another controller.
The right to object (Article 21 GDPR). This means that you have the right to object to processing of you data that is lawfully based on the legitimate interest of TopMind or a third party (Article 6(f) GDPR).
We would also like to notify you of the fact that whenever you are not satisfied with the way TopMind processes your personal data, you have the right to lodge a complaint

Changes to this privacy statement

We reserve the right to make changes to this privacy statement. It is advisable to consult this privacy statement regularly so that you are aware of these changes. The last changes to this statement were made on the 22nd of May 2018

Contact information

For questions about our privacy policy or questions regarding access and changes to (or deletion of) your personal data, you can contact us at any time via the information below. If you want to exercise any of the rights mentioned in this privacy statement, or exercise another right that was not included, please do not hesitate to contact us via the contact details below:

TopMind B.V.- Anne Johan Willemsen
2e Leijweg 1
2114BG Vogelenzang
privacy@topmind.com
+31 (0) 6 150 206 14