Privacy notice

This notice is a draft template prepared for the MITOMAXX waiting list. All bracketed fields [LIKE THIS] must be completed, and the full notice checked by a legal adviser, before this page goes live. It is not legal advice.

1 · Who is responsible

The controller is [LEGAL ENTITY / TRADING NAME], [ADDRESS], registered at the Dutch Chamber of Commerce under [KVK NUMBER]. Contact for privacy questions: [PRIVACY CONTACT EMAIL].

2 · What we collect, and why

• Waiting-list form. First name (optional), email address (required), pathway interest, main goal, and an optional free-text note of at most 200 characters. Purpose: keeping you informed about the founding cohort and the info session. Basis: your consent (GDPR Art. 6(1)(a)), confirmed by double opt-in. Providing the data is voluntary; without it we cannot add you to the list.
• Consent log. We record when and how you confirmed and, later, withdrew consent. Basis: consent; the log itself is our proof of it.
• Screening data — later, and separate. If a place may be offered, a short suitability screen follows only with your explicit consent, in a separate step, after the info session. The waiting-list form deliberately collects no diagnoses, medication, symptoms or other health information. Health-related data, where it applies, is processed under GDPR Art. 9(2)(a) (explicit consent). A screen is not a diagnosis.
• Participants. After payment, participation data (account, progress, check-ins) is processed in the course platform under the participation agreement. See the participant terms.

3 · Who receives data

The waiting list runs on an EU-hosted email tool, [EMAIL TOOL, E.G. MAILERLITE OR BREVO], as a processor under a data-processing agreement. The course platform is [PLATFORM], used for participants only. We do not sell data, and we do not use it for advertising.

4 · How long we keep it

Waiting-list data of people who do not join is deleted or anonymised 12 months after last contact. Consent logs are kept for as long as needed to demonstrate consent. Participant records follow the retention rules given at registration. [CONFIRM FINAL RETENTION SCHEDULE WITH ADVISER]

5 · Your rights

You can ask for access, correction, erasure, restriction, data portability, or object to processing, and you can withdraw consent at any time — easiest via the unsubscribe link in any email. Email [PRIVACY CONTACT EMAIL]. You also have the right to complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens.

6 · Cookies

This website sets no analytics, advertising or tracking cookies. The only storage is what the forms need to work. [UPDATE IF THIRD-PARTY EMBEDS ARE ADDED]

7 · Changes

Material changes to this notice are announced on this page before they take effect. Version and date: [VERSION / DATE].