Privacy Policy

Last updated: 15 January 2026

Geldwijs ("Geldwijs", "we", "us" or "our"), located at Oudegracht 145, 3511 AL Utrecht, the Netherlands, is the data controller for the personal data processed through this website and our services. We take your privacy seriously and are committed to processing your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

This Privacy Policy explains what personal data we collect, why we collect it, on what legal grounds we process it, how long we retain it, with whom we share it, and what rights you have. If you have any questions after reading this policy, you can contact us at [email protected].

1. Who we are

Geldwijs is a financial education practice based in Utrecht, offering online courses, company workshops and one-on-one financial coaching. For the purposes of the GDPR:

Controller: Geldwijs, Oudegracht 145, 3511 AL Utrecht, Netherlands
Email: [email protected]
Phone: +31 30 576 42 39

2. What personal data we collect

2.1 Data you provide to us directly

Contact details — name, email address, phone number and the content of your message when you contact us through the contact form, by email or by phone.
Account and enrolment data — name, email address, billing address and course progress when you register for a course or workshop.
Payment data — billing details and payment references. We do not store full credit card numbers; payments are processed by our payment provider.
Coaching data — information you voluntarily share during coaching sessions, such as your income, expenses, debts or savings goals, so we can tailor our guidance.
Newsletter data — your email address when you subscribe to our newsletter.

2.2 Data collected automatically

Technical data — IP address, browser type and version, device type, operating system and language settings.
Usage data — pages visited, time on page, referral source and other interaction data, collected via cookies and similar technologies.

For detailed information about cookies, please read our Cookies Policy.

3. Purposes and legal bases for processing

We process your personal data only when we have a valid legal basis under Article 6 GDPR:

Purpose	Data	Legal basis
Answering your questions and providing quotes	Name, email, phone, message content	Legitimate interest (Art. 6(1)(f)) — responding to prospective customers
Delivering courses, workshops and coaching	Name, email, billing details, coaching notes	Performance of a contract (Art. 6(1)(b))
Processing payments and invoicing	Billing details, payment references	Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for tax records
Sending our newsletter	Email address	Consent (Art. 6(1)(a)) — withdrawable at any time
Analytics and website improvement	Technical and usage data	Consent (Art. 6(1)(a)) via our cookie banner
Security and fraud prevention	Technical data, log files	Legitimate interest (Art. 6(1)(f))

4. Retention periods

We do not keep your personal data longer than necessary:

Contact form enquiries: up to 12 months after the conversation ends, unless it leads to a customer relationship.
Customer and invoicing records: 7 years, as required by Dutch tax law.
Coaching notes: up to 24 months after your last session, so we can support your progress; deleted earlier on request.
Newsletter subscriptions: until you unsubscribe; unsubscription records kept to demonstrate consent.
Analytics data: maximum 25 months, or less depending on the tool configuration.

5. Sharing your data with third parties

We never sell your personal data. We only share data with parties that help us run our business, under data processing agreements where required:

Payment providers — to process course payments securely.
Hosting and email providers — to operate our website and communicate with you. Where possible, we use providers hosting data within the EU/EEA.
Course platform providers — to give you access to online lessons.
Accounting and tax advisors — as required for legal bookkeeping obligations.

If data is transferred outside the EU/EEA, we ensure an adequate level of protection through EU Standard Contractual Clauses or an adequacy decision of the European Commission.

6. Your rights under the GDPR

You have the following rights regarding your personal data:

Right of access (Art. 15) — to know which personal data we process and receive a copy.
Right to rectification (Art. 16) — to correct inaccurate or incomplete data.
Right to erasure (Art. 17) — to have your data deleted, subject to legal retention obligations.
Right to restriction (Art. 18) — to temporarily restrict processing while a dispute is resolved.
Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format.
Right to object (Art. 21) — to object to processing based on legitimate interest, including direct marketing.
Right to withdraw consent (Art. 7) — at any time, for processing based on consent, without affecting prior lawful processing.

To exercise any of these rights, email us at [email protected] or write to Geldwijs, Oudegracht 145, 3511 AL Utrecht. We will respond within one month of receiving your request. To protect your data, we may ask you to verify your identity.

7. Right to lodge a complaint

If you believe we do not handle your data correctly, please contact us first so we can resolve the matter. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Hoftoren, Wilhelmina van Pruisenweg 52, 2595 AN Den Haag, the Netherlands.

8. Data security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption for data in transit, access controls and the principle of least privilege for our staff, encrypted storage and regular backups, and staff training on data protection. Despite these measures, no system can be guaranteed fully secure; we do however treat any incident seriously and will notify the supervisory authority and affected individuals where required by Articles 33 and 34 GDPR.

9. Children's data

Our services are aimed at adults. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe a child has provided us with data, contact us and we will delete it promptly.

10. Changes to this Privacy Policy

We may update this policy to reflect changes in our services or legislation. The version shown at the top of this page indicates when it was last revised. Material changes will be announced on our website or by email where appropriate.

11. Contact

For any privacy-related questions or requests, contact:

Geldwijs, Oudegracht 145, 3511 AL Utrecht, Netherlands
Email: [email protected]
Phone: +31 30 576 42 39