Privacy & Confidentiality

1. Who is responsible?

RESET Retreat Spain, the Dutch business of Gert van der Hulst, is responsible for the personal data it processes for its own business and organisational activities. Dutch Chamber of Commerce: 42158817. Postal address: Torenlaan 5, 1402 AT Bussum, Netherlands.

For privacy enquiries about data held by RESET, email info@resetretreatspain.com, for the attention of Gert van der Hulst. Do not send medical information to this address.

2. What information and why?

RESET uses participants’ names, email addresses and telephone numbers for communication and practical arrangements. Business enquiries, contracts and invoicing also require necessary company, contact, order and invoice information and business correspondence. We receive information directly from you or through your employer.

We use this information to answer enquiries, handle proposals and contracts, contact participants, arrange bookings and the programme, and maintain administration. Do not provide medical or psychological information through the general contact form or mailbox.

If a specific booking requires additional information, we will explain this and limit its use to what is necessary. Without necessary contact or booking information, we may be unable to arrange your enquiry or participation.

3. Legal bases

For necessary information about business contacts and participants who are not themselves contracting parties, we rely on our legitimate interest in business communication and careful organisation. We balance this against individuals’ interests and rights and use no more information than necessary (GDPR Article 6(1)(f)).

Where you personally enter into a contract as an individual, necessary processing may be based on preparing or performing that contract (Article 6(1)(b)). A contract with an employer does not itself constitute a contract with an employee. Mandatory administration is based on a legal obligation (Article 6(1)(c)). Where we seek consent for a separate purpose, you may withdraw it for the future.

4. Psychological information and employers

Intake, consultations, evaluation and psychological aftercare take place directly between participants and the relevant professionals. Dutch and Spanish psychologists work in their own secure environments. Necessary professional handovers take place directly between them through the agreed secure process.

RESET has no access to psychological records, intake reports or substantive consultation reports. We oversee organisational compliance with the agreed process without accessing records. Professionals explain their own data processing and record-related rights. Their privacy roles depend on their actual tasks and responsibilities.

RESET and employers receive only necessary organisational information. Even a suitability outcome may constitute health information and is not automatically shared with an employer. Employers cannot give blanket medical consent on behalf of employees. Medical questions and requests concerning professional records should be addressed directly to the psychologist.

5. Suppliers, email and storage

RESET arranges bookings and shares only the information each accommodation provider, transport operator, flight planner or other supplier needs to deliver the agreed service. Not every supplier receives the same information. Psychological records and consultation content are not shared with these suppliers.

RESET uses paid Google Workspace, including Gmail and Google Drive, for business correspondence and organisational documents, not medical records or intake reports. The website is provided through ChatGPT Sites and uses Cloudflare infrastructure and security. Technical information such as IP address, request time, requested page and browser information may be processed for availability and security.

Sending through the website contact form has not yet been configured. Please email info@resetretreatspain.com. Resend has been technically prepared as a possible sending service but has not been activated; this notice will be updated upon activation.

We do not sell personal data. Information is disclosed to competent authorities where required by law or another valid legal basis. A supplier’s privacy role depends on the actual service.

6. Retention periods

Enquiries without an order: we delete or genuinely anonymise information no later than twelve months after the last substantive contact.

Practical participant and booking information: no later than six months after completion of the full programme, including agreed aftercare. Information no longer needed is deleted earlier.

Invoices and tax-required records: generally seven years, calculated under the applicable tax retention rules. This does not justify keeping all participant information for seven years.

For a specific complaint, dispute or legal obligation, we retain only the information needed for as long as justified. This policy also applies to relevant email and Drive information. Technical data processed by providers for their own security follows their applicable terms and retention policies; the six- and twelve-month periods are not a general promise for that data. Psychological records are governed by the relevant professional’s rules.

7. Security and international processing

We limit access to people who need it for their work and must apply appropriate technical and organisational measures. This notice does not certify any specific security standard. If we unintentionally receive medical information, we restrict access and arrange appropriate handling; we do not retain it without necessity or a valid legal basis.

The Netherlands and Spain are within the European Economic Area (EEA). However, using international technical providers does not mean that all processing remains within the EEA. Google and Cloudflare describe their international processing and available transfer safeguards in their data protection terms. Where the GDPR requires safeguards for transfers, an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, must cover the transfer.

Contact RESET for information on recipients and safeguards applicable to your data. Provider information is also linked below.

8. Cookies and visitor measurement

The technical check on 6 November 2026 found no Google Analytics, advertising pixel or comparable measurement code installed by RESET. No localStorage or sessionStorage use was found in the website’s own code examined.

The Cloudflare __cf_bm cookie was observed. It helps protect against automated abuse. Cloudflare states that it expires after thirty minutes of inactivity. It is not an advertising cookie set by RESET. The hosting and security layer may process necessary technical information.

Before introducing new visitor measurement or advertising technologies, we will update this information and request consent where required. No automated decision-making or profiling by RESET was found in the website function examined. Other websites reached through links have their own privacy information.

9. Your rights and requests

You may request access, correction or deletion of your personal data. Where applicable, you may also request restriction or portability and object to processing based on legitimate interests. Rights are not unlimited; a legal retention obligation may prevent deletion.

Email info@resetretreatspain.com, for the attention of Gert van der Hulst, with the subject Privacy request. Explain what you wish to know or change without including medical information. Requests concerning a psychologist’s records should go directly to that professional.

We verify identity appropriately and do not routinely request a full identity-document copy. We normally handle requests within one month, free of charge. Where the GDPR permits, this period may be extended by up to two additional months; we explain the reason within the first month.

You may complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl or another competent data protection authority.

10. Discretion and changes

We do not publish identifiable client names, logos or testimonials without a separate appropriate arrangement. Purchasing a programme does not authorise publicity using employees’ personal information or experiences.

We update this notice when our practices or services change. This version was updated on 6 November 2026.