Privacy Statement Striive Academy

This is the privacy statement for all users of Striive Academy. Striive Academy is an online learning platform where professionals can use digital educational resources, such as courses, videos and e-learning.

This privacy statement applies to you if you use Striive Academy. You can find more information on Striive Academy’s terms and conditions in its Terms of Use.

We process your personal data when you use Striive Academy. We do so to ensure that you are able to access Striive Academy and its digital educational resources. Striive Academy also offers you an overview of the digital educational resources you used and your progress.

Who is the controller?

The controller is the party that determines how and why personal data are processed. The controller determines the purpose of and the means for the data processing. Under the General Data Protection Regulation (GDPR), the controller is obliged to handle your personal data with care. The controller is thus the first point of contact for you as a data subject.

HFBG Holding B.V. (hereinafter HeadFirst, we, our, us) is the controller of the data processing in this privacy statement. Our business address is Westwalstraat 17 B (1411 PC) in Naarden, the Netherlands. We are listed at the Chamber of Commerce under number 80349269. You can contact us via email at support@headfirst.nl or by telephone on +31 (0)23 – 568 56 30.

What personal data do we process?

Creating an account

We offer Striive Academy to a pre-selected group of professionals. We therefore keep a record of the services you or your supplier purchases from us and/or our affiliated companies. We also record whether you have been assigned to a position through us or through one of our affiliated companies as well as its start and end dates. On that basis we determine whether you are eligible to create an account and whether you are eligible for an Online Knowledge Subscription without additional charges.

We process your personal data when you create an account yourself or when we do so on your behalf.  In that context we may process the following personal  data: a unique user name, your name, your email address, your password, the date and time of creating the account and accepting the Terms of Use and your IP address. These personal data are necessary to set up your account.

We may link the data from your account to your personal data already in our possession. In that case the following personal data will be added automatically to your account: your name and email address.

Additions to an account

You may add additional information to your account once you have created it. In that context, you have the option to share the following personal data with us: profile picture, address, telephone number, education (professional background) and language.

Using digital educational resources

Once you have created an account, you will be able to use the digital educational resources offered on the Striive Academy platform. In that context, we collect the following personal data: whether you have been deployed with a client, and if so, the start and end date of the assignment, the online knowledge subscriptions you have purchased and their start and end dates, the digital educational resources you have selected or used, data about your use of digital educational resources, such as date and time of use, your progress, any tests, assessments and evaluations, preferences regarding digital educational resources, results, scores, certificates and qualifications. We may also ask you to give us feedback about or an evaluation of the digital educational resources. To the extent possible, we will process that data anonymously.

User support

We offer you support in using Striive Academy via our service provider MyCademy Nederland B.V. (MyCademy). In that context, we and/or our service providers process the following personal data: your name, user name, email address, telephone number, content of your question or request, chat history, the knowledge subscription you use, the digital educational resources that you use or want to use, logging data such as the date and time of your last attempt to log in or your use of the digital educational resources.

Communication and notifications

The notification settings can be easily managed in your account’s environment. You can indicate whether you would like to receive notifications about available courses, your registrations, completed courses and results as well as communications with us, with course suppliers and/or other participants.

In the context of our communication and notifications, we process your name, user name, email address, your notification settings, the knowledge subscription you have purchased and which digital educational resources you use.  In addition, we may (for the purpose of such notifications) process data about the digital educational resources, such as the date and time you have used them, results and certificates.

For what purposes do we process personal data?

Striive Academy gives professionals access to digital educational resources. In that context we process your personal data for the following purposes:

Access to Striive Academy – creating an account

• Selecting users to grant them access to Striive Academy.
• Enabling users to create an account, establishing access.
• Account management, dealing with queries and requests from the professionals.
• Verification of the account, completeness check.

Use of Striive Academy

• Offering one or more digital knowledge subscriptions and, in that context, entering into agreements.
• Offering digital educational resources within Striive Academy’s environment.
• Keeping track of progress, results, diplomas and certificates.
• Evaluating Striive Academy’s services and improving its offering.
• Analysing use, progress and results for the purpose of improving (the use of) digital
  educational resources.
• Client contact, user support, dealing with queries and requests.
• Contract management, financial settlement of contracts, cost and expense calculations.
• Sending notifications and information about the services.

Management, compliance and security

• Technical maintenance and management of Striive Academy.
• Internal audit and security. Preventing, detecting and investigating infringements of our security system.
• Compliance with laws and regulations, preventing, detecting and investigating fraud and illegal activity.
• Handling claims and complaints.
• Compliance with court rulings and orders, implementing requests from public authorities.
• Enforcing our Terms of Use and the terms of agreements.
• Protecting our activities, our rights, security and property.

On what grounds do we process personal data?

We only process personal data if there is a legal basis for doing so.

• Performance of the agreement.We and/or our affiliates conclude agreements with professionals and suppliers on the basis of which we process personal data. These agreements relate to the services we provide, including Striive Academy. We may also request personal data from you before concluding an agreement to enable us to form the agreement, for instance if you want to purchase an online knowledge subscription or if you want to purchase digital educational resources from a third party.
• In certain situations, we may ask for your consent prior to the data processing. For example, we ask for your consent before sending you certain notifications. After giving your consent, you may revoke it at any time, following which we will refrain from any further processing of your personal data for the purposes covered by the consent.
• Legal obligation. In some cases we are required by law to process certain personal data, for instance when we need to register contracts.
• Legitimate interest. We may process personal data because we have a legitimate interest in doing so, or because the organisation to which we disclose your personal data has a legitimate interest, for instance when we want to improve Striive Academy and bring the digital educational resources more in line with your needs. We always weigh up our interests against those of the data subjects. If you want more information on this please contact us via the contact details stated in this privacy statement.

Who can access your personal data?

Our staff members can access your personal data on a need-to-know basis.

In certain situations, we may share personal data with third parties. We will do so only if this is necessary to provide our services and if it is in keeping with the purposes described in this privacy statement.

• We may share personal data with entities that are part of the same group as HeadFirst, with legal successors (including envisaged legal successors) as well as with potential and new group entities and/or their shareholders if they intend to work with us or continue to provide our services.
• In order for us to provide Striive Academy, we collaborate with MyCademy. MyCademy processes personal data for us and can be classified as a processor within the meaning of the GDPR. We have made arrangements with MyCademy on the way in which it processes your personal data.
• If you use Striive Academy through a supplier, we may share your personal data with that supplier, such as data about your use of Striive Academy and the digital educational resources you used. The supplier is a controller for the further processing of these personal data. If you want to know more about the way in which the supplier processes your personal data and for which purposes, we advise you to contact the supplier.
• We may share personal data with service providers we work with, aside from our partner MyCademy. These may include providers of the digital educational resources we use, external advisers and providers of the software we use, including a hosting provider, software developers and an external help desk. We always decide in advance which personal data need to be disclosed to such parties to enable them to provide their services. If necessary, we make additional arrangements about the division of responsibilities.
• We only share personal data with supervisory authorities, tax authorities and investigative bodies if and to the extent that we are obliged to do so by law.

Will your personal data be safe?

We have taken appropriate technical and organisational security measures in order to protect the personal data we process against loss or unlawful use. For example, we secure our systems and applications in accordance with the information security standards currently in force. In addition, we have made arrangements with our service providers and have obliged them to take adequate security measures.

Will your personal data be processed outside the EEA?

In principle, we process your personal data within the European Economic Area (EEA). We use servers that are in Europe and our group companies are established in the EEA. Because we may use the services of processors who have their main establishment outside the EEA, it cannot be ruled out that we may share personal data with organisations outside the EEA, either directly or indirectly. Where this is the case, we will take appropriate measures to legitimise such processing, including entering into a transfer agreement based on standard contractual clauses (SCCs) approved by the European Commission. If required, we will take additional measures to ensure an adequate level of protection. If you want to know more about the transfer of personal data and how this is legitimised, contact us using the contact details provided in this privacy statement.

How long do we retain your personal data for?

We only retain personal data for as long as this is necessary for the purposes described in this privacy statement.  We retain your personal data for as long as you have an account for using Striive Academy. Once your account is closed, we may retain your personal data – including data on the digital educational resources you purchased – for another year. We will delete certain data before your account is actually deleted. For instance, we retain logging data regarding your account for one year, and we retain your questions and requests (for support or otherwise) for one year after they have been dealt with in full.

What are your rights regarding your personal data?

Under privacy legislation, you have a number of rights in relation to your personal data and their processing. You can invoke your rights by contacting us using the contact details provided in this privacy statement. We will assess your request and deal with it within one month. If we need more time to comply with your request, we will let you know within one month that we will need another two months. We may ask you additional questions after you have submitted your request in order to establish your identity. Alternatively, we may ask you to specify your request.

Right of access to personal data

You have the right to hear from us about whether we are going to process your personal data and, if so, to be granted access to those personal data and to obtain additional information about the processing of your personal data. You can access your personal data clearly and easily by logging in to your account. If you want a more complete overview or more information about the data processing, you can submit a request for access to us.

Right to rectification

You are entitled to the rectification of incorrect or incomplete data. You may also supplement your personal data.  It is very easy for you to amend your personal data within your Striive Academy account. If you want to make other changes that are not possible within your account, please send us a written request to that end.

Right to be forgotten

In certain circumstances, you are entitled to the deletion of your data. At your request, we will remove your personal data if their processing is no longer necessary. You can also delete certain personal data yourself within your account.

Right to restriction of processing

In some instances, you are entitled to restrict the processing of your personal data, for example if you are of the opinion that your personal data are not correct. If we grant your request for a restriction, we will not be allowed to process your personal data for as long as that restriction applies.

Right to data portability

You have the right to receive the personal data you have disclosed to us in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller, where the processing is based on your consent or an agreement.

Right to object

You have the right to object to the processing of personal data based on HeadFirst’s legitimate interests. HeadFirst will then no longer process the personal data unless we can demonstrate that there are grounds for the processing which override your interests, rights and freedoms or that this relates to the establishment, exercise or defence of a legal claim.

Where personal data is processed for direct marketing purposes, you can unsubscribe in any communication.

Contact and complaints

If you have any questions, requests or complaints about how we deal with your personal data, you can telephone us on +31 (0)23 – 568 56 30. Alternatively, you can send an email to privacy@headfirst.nl. We would be happy to answer your query or help you find a solution. If you are not satisfied after that, then you can always contact the Dutch Data Protection Authority.

Amendments

Events evolve rapidly, which can sometimes lead to changes to the personal data which we ask of you and process. Laws and regulations can also change. Consequently, we may amend this privacy statement from time to time. The amended privacy statement will be published on our website, stating the date on which the amended version becomes effective. If there are substantial or material changes that could considerably affect one or more data subjects, we will also endeavour to inform them about that directly. This privacy statement was most recently amended on 1 June 2021.

***