Privacy Notice

Cookies and your choice

We place no analytics or advertising cookies until you agree. On your first visit a window asks you to choose, and until you have chosen, the measurement tools on this site are switched off and store nothing on your device.

Two things are stored regardless, because the site cannot work without them: your language choice and your cookie choice itself. They stay in your own browser, we never see them, and they are not used to follow you.

You can change your mind whenever you like. At the bottom of every page there is a link called Cookie preferences. It reopens the same panel, and switching something off stops it straight away. Our cookie notice lists the categories in full.

What we measure once you agree

• Google Analytics 4: which pages get visited, how people move through the site and where they drop off. We use this to improve the site.
• Google Ads: whether an advert brought you here and what you did afterwards, so we do not keep paying for adverts that lead nowhere.
• Apollo: recognises which organisation a visit is likely to come from, based on your network address. This is for our own sales follow-up, and it only runs if you accept advertising cookies.

If you fill in one of our forms and you have accepted advertising cookies, your email address is also sent to Google so it can match your enquiry to the advert you clicked. It is scrambled first, on your own device, using an irreversible calculation called SHA-256. Google receives that scrambled version and never the readable address.

Legal basis: your consent (GDPR Article 6(1)(a)) for everything in this list. For the language and cookie choice stored in your browser: our legitimate interest in a site that works (GDPR Article 6(1)(f)).

Forms on the website

You can leave your details in four places. Each one is voluntary, and you always see beforehand what we ask for.

• The savings calculator: your name, work email address, organisation name and the figures you enter about absence, headcount and average salary. We email you the outcome and store your entry so we can follow up.
• The scientific report: your name, work email address and organisation name. We email you the report and store your request.
• The contact form: your name, email address and message. This is emailed to us and nothing is stored in a database.
• Booking a call: handled by Calendly. You give your name, email address and a time. Calendly's own privacy statement applies to that booking.

Purpose: answering you, sending what you asked for, and following up on your interest. We do not sell your details and we do not pass them to anyone outside the suppliers listed below.

Legal basis: your consent (GDPR Article 6(1)(a)).

How long: for as long as we are still in touch about your enquiry. Ask us to delete it and we will, at any time, at privacy@innerleaps.nl.

Suppliers behind the website

• Netlify: hosts the website. Like any web server it keeps short-lived technical logs, including network addresses, to serve pages and block abuse.
• Supabase: runs the database and the code that handles the forms.
• Resend: sends the emails those forms trigger.
• Google (Analytics and Ads): measurement, only after you agree.
• Apollo: organisation recognition, only after you agree to advertising cookies.
• Calendly: the appointment calendar on our contact page.

Several of these are based in the United States. Where data reaches them, the transfer relies on the EU-US Data Privacy Framework and Standard Contractual Clauses, the same safeguards described further down under international data transfers.

1. Enrolment and programme administration

When you take part in the programme, we process:

• Name
• Work email address
• Your stated training goal (the challenge or goal you hope to address, chosen from a fixed list, with an optional free-text field in which we ask you not to enter sensitive information)

Purpose: enrolling you in the programme, grouping participants, sending you programme materials and communications, and allowing your trainer to tailor the training to the group's needs. Your individual training goal is used only for delivering and tailoring the training. Innerleaps may use aggregated, anonymised insight from these goals (for example the most common reasons for joining) for its own service improvement and marketing; such aggregated insight does not identify you.

Legal basis: consent (GDPR Article 6(1)(a)) where you register via an Innerleaps form; where your employer provides your details, the processing is carried out on your employer's instruction and your employer informs you beforehand.

2. Impact measurement

Via the impact measurement surveys (before the programme, T0, and after the programme, T1) we collect:

• Name and work email address
• Work performance information, including expected and actual work hours and days absent due to a physical or mental health problem
• Life satisfaction, and (where your employer has selected these optional questions) job satisfaction and turnover intention
• Wellbeing measures: vitality, resilience and stress
• Training practice frequency and barriers to practising

Purpose: measuring the impact of the training programme on your wellbeing, productivity and work performance, and comparing your results before and after the programme.

Please note: some of this information relates to your health and wellbeing (such as stress, vitality, resilience and health-related absence) and is special category health data within the meaning of the GDPR. We process it only for the purpose stated above and with extra care.

Legal basis: consent (GDPR Article 6(1)(a)) and, for the health-related data, your explicit consent (GDPR Article 9(2)(a)), both given via the consent statement on the survey.

Important: your individual responses are never shared with your employer. Management receives only anonymised, aggregated results, and only where the training group contains a minimum of 8 persons. We do not collect any salary data from you; where a return-on-investment figure is reported, it is calculated using an organisational salary average provided by your employer, which is never included in any report shared with management.

3. Course evaluation

Via the evaluation form we collect trainer ratings and open feedback about the programme.

The evaluation form does not collect your name or email address.

Purpose: evaluating and improving the training programme.

Legal basis: legitimate interest (GDPR Article 6(1)(f)). Your individual responses are seen only by Innerleaps and are never shared with trainers or any third party. The Client receives only aggregated average scores.

Please note: anonymised and aggregated insights from evaluations may be used for marketing purposes.

Innerleaps itself

Only Bas ter Haar Romenij (owner) has access to the full dataset. Freelance trainers engaged by Innerleaps receive only the data strictly necessary to deliver their sessions, limited to your name, work email address and your stated training goal. This data is shared on the basis of data minimisation (GDPR Article 5(1)(c)) and is used solely to contact participants about session-related matters and to tailor the training. Trainers do not receive your survey responses or any health-related data. All trainers are contractually bound to confidentiality and data protection obligations before being permitted to deliver any sessions.

Your employer

Your employer receives only anonymised, aggregated results. Individual data is never shared with your employer. No salary data is collected from you; any ROI figure is calculated using an organisational average provided by your employer, which is never included in any report shared with management.

Sub-processors

We use Google (Google Workspace and Google Cloud) to collect, store and process data via Google Forms, Google Sheets, Google Slides, Google Drive, Gmail and Google Calendar, and to run our report automation. We have set the Google data region to Europe, so that covered data is stored at rest within the European Union. Google is a global provider, and for support and certain background processing some limited data handling may take place outside the European Economic Area; where that occurs it is governed by Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework.

The suppliers behind the website are listed higher up, under Visiting innerleaps.nl. All sub-processors are bound by data processing agreements with Innerleaps.