Skip to main content

Privacy Policy

Last Updated: March 12, 2026

1 — Introduction & Controller Identity

This Privacy Policy explains how Stichting J.C.Y.L. (“Stichting J.C.Y.L.”, “we”, “our”, or “us”) collects, uses, discloses, and protects your personal data when you visit this website (the “Site”), interact with our online educational resources, request information, or participate in our financial and business education programs available across Canada. We are committed to transparency, responsible data practices, and privacy-by-design principles that align with applicable laws.

Data Controller: Stichting J.C.Y.L., Oudezijds Voorburgwal 65, Centrum, 1012 EK Amsterdam, Netherlands. Contact email: [email protected]. If you have questions about this Policy or how we handle personal data, you may contact us using the email address provided. We do not process special categories of personal data at scale and have not appointed a Data Protection Officer; privacy inquiries are handled by our internal team.

This Policy applies to all visitors and participants, including individuals located in the EEA, the UK, and Canada. By using the Site, you agree to the practices described here, in conjunction with our Terms of Use and Cookie Policy.

2 — Personal Data We Collect

We collect the following categories of personal data, depending on your interactions with the Site and our programs:

  • Identity and contact information: name, email address, and phone number provided via forms or correspondence.
  • Program details and messages: program selections, information requests, and the content of messages submitted through our forms.
  • Technical data: IP address, browser type and version, device/OS, language preferences, approximate location derived from IP, and basic security signals.
  • Usage data: pages viewed, time on page, navigation paths, referrer URLs, click interactions, and conversion events (for example, successful form submissions).
  • Cookies and similar identifiers: cookie_consent, _site_session, analytics identifiers (such as _ga, _ga_XXXXXXXXXX), and marketing identifiers (such as _gcl_au, _fbp, _fbc). Details appear in Section 4 and in our Cookie Policy.

We do not request or intentionally collect sensitive categories of personal data (for example, health, religious beliefs, or union membership), financial account numbers, or government identification numbers through this Site. Please do not include sensitive data in free‑text fields.

3 — Why We Process Personal Data & Legal Basis

We process personal data for the purposes and on the legal bases set out below (GDPR Art. 6):

  • Responding to inquiries and providing program information: to communicate with you after you submit our forms. Legal basis: performance of a contract or steps prior to entering a contract (Art. 6(1)(b)) and, where applicable, your consent (Art. 6(1)(a)).
  • Operating and securing the Site: to ensure availability, detect abuse, and prevent fraud. Legal basis: our legitimate interests (Art. 6(1)(f)) in maintaining a reliable and safe service.
  • Analytics: to understand how visitors use the Site and improve content. Legal basis: your consent (Art. 6(1)(a)).
  • Marketing/remarketing: to reach audiences interested in our educational programs. Legal basis: your consent (Art. 6(1)(a)).
  • Legal compliance: to meet legal, tax, and regulatory obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).

Automated decision-making: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects within the meaning of GDPR Art. 22.

4 — Cookies & Tracking Technologies

We use cookies and similar technologies to operate the Site, understand audience interest, and support advertising. Our consent banner and preferences panel control the activation of non‑essential categories. Categories used on this Site are:

  • Essential: required for core functionality, such as session continuity and consent storage. Examples: _site_session (session), cookie_consent (12 months). These run without consent.
  • Analytics (consent): used to measure visits and improve content. Examples: _ga (2 years) and _ga_XXXXXXXXXX (2 years) for Google Analytics 4 (with IP anonymization).
  • Marketing (consent): used for advertising and remarketing. Examples: _gcl_au (90 days), _fbp (90 days), and _fbc (90 days, when a click ID is present).

Beyond cookies, our partners may use pixel tags or server‑side measurement endpoints to associate events with cookie IDs, IP address, and user agent. You can manage your preferences anytime via the “Manage cookie preferences” link in the footer or by revisiting the banner. For full details, see our dedicated Cookie Policy.

5 — Consent in the EEA and UK

If you are located in the EEA or the UK, analytics and marketing cookies are used only after you provide explicit, informed consent through our banner or preferences panel. Your choices are stored in the browser cookie cookie_consent for 12 months. You may withdraw consent at any time via the footer link “Manage cookie preferences” or by clearing cookies. Withdrawal will not affect the lawfulness of processing before your withdrawal.

6 — Sharing With Advertising & Service Partners

We do not sell personal data. We share limited personal data with the following categories of recipients solely for the purposes described above and subject to appropriate safeguards:

  • Analytics and advertising providers: Google (Google Analytics 4, Google Ads) and Meta (for advertising, including custom or lookalike audiences). Shared data may include cookie identifiers, IP‑based signals, page views, conversion events, and hashed contact data where applicable and permitted by law.
  • Security and content delivery: infrastructure and CDN providers used to deliver the Site and defend against abuse, which may receive IP addresses and basic traffic metadata for threat detection.
  • Professional advisors and legal authorities: where necessary to comply with the law, enforce our agreements, or protect rights, safety, and security.

We require our service providers to process personal data only on our instructions and not to use it for their own independent purposes. When legally required, we also establish appropriate data protection terms and transfer safeguards (see Section 7).

7 — International Transfers

Personal data may be transferred to countries outside your jurisdiction, including to the United States where some of our processors operate. Where applicable, we rely on the EU‑US Data Privacy Framework and the UK Extension, or on Standard Contractual Clauses (EU 2021/914) and the UK International Data Transfer Addendum. We take steps to ensure that recipients provide a level of protection essentially equivalent to that in your home jurisdiction.

8 — Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy or as required by law. Typical periods include:

  • Contact and inquiry records: up to 2 years from the last interaction.
  • Analytics data: typically 14 months in aggregated analytics tools.
  • Marketing identifiers: retained per cookie lifetime or audience policy (for example, 90 days for certain advertising cookies).
  • Server logs and security records: up to 90 days, unless needed for investigations.
  • Legal and tax records: as required by applicable law (often between 6 and 10 years).

When retention periods expire, we delete or irreversibly anonymize the data. Where automatic deletion is not feasible, we archive securely until deletion is possible.

9 — Your Rights

Depending on your location, you may have rights over your personal data. For individuals in the EEA and UK under GDPR/UK GDPR, these include the right to access, rectify, erase, restrict, object, portability, and the right to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority. To exercise any rights, contact us at [email protected]. We respond within 30 days, extendable for complex requests.

For Canadian visitors, our practices are designed to align with the core principles of applicable Canadian privacy laws (including fairness, purpose specification, consent, access, correction, and safeguards). You may request access to or correction of your personal information by contacting us. Where consent is the basis for processing, you may withdraw consent, subject to legal or contractual restrictions and reasonable notice.

10 — Children’s Privacy

This Site and our programs are not directed to individuals under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us without verifiable parental consent, please contact us so we can take appropriate action, including deletion where required.

11 — Do Not Track

Some browsers offer a “Do Not Track” (DNT) setting. Because there is no common industry standard, our Site does not respond to DNT signals. Our cookie preferences panel provides practical control over analytics and marketing cookies regardless of your browser’s DNT setting.

12 — Account & Data Deletion Requests

You may request deletion of personal data that we hold about you by emailing [email protected] with the subject “Data Deletion Request”. We will verify your identity, review legal retention obligations, and delete or de‑identify data where permitted. We typically complete validated requests within 30 days.

13 — Business Transfers

If Stichting J.C.Y.L. is involved in a merger, acquisition, reorganization, asset sale, financing, or insolvency event, personal data may be transferred to a successor or affiliate as part of the transaction, subject to this Policy and any pre‑existing consents. We will post a notice on the Site if material changes to data use occur in connection with such a transfer.

14 — California Privacy Notice (CCPA / CPRA)

For California residents, the categories of personal information collected in the last 12 months include: identifiers (such as name, email, IP address, and cookie or device IDs), internet or network activity (such as page views and interaction data), and inferences (such as general interest segments for advertising). We disclose these categories to service providers and advertising partners as described in Sections 3 and 6. We do not sell personal information; we may “share” personal information for cross‑context behavioral advertising as defined by CPRA. California residents have the rights to know, access, correct, delete, and opt out of sale/sharing, and not to be discriminated against for exercising rights. To exercise, email [email protected] with “California Privacy Request” in the subject line. Authorized agents must provide written authorization and proof of identity.

15 — Virginia Privacy Notice (VCDPA)

For Virginia residents, you may request access, correction, deletion, and portability of personal data, and opt out of targeted advertising. We do not sell personal data and do not engage in profiling that produces legal or similarly significant effects. Submit requests to [email protected] with “Virginia Privacy Request” in the subject line. If we decline your request, you may appeal by writing “Appeal of Refusal — Privacy Request” in the subject line. We will respond within the timelines set by law.

16 — Nevada Privacy Notice

Nevada residents may submit a verified request directing us not to sell personal information. While we do not currently sell personal information as defined by Nevada law, you may email [email protected] with “Nevada Do Not Sell Request” in the subject line for more information.

17 — Changes to This Policy

We may update this Policy to reflect changes in our practices, technologies, or legal requirements. Material changes will be announced via a prominent notice on the Site at least 14 days before they take effect, unless immediate changes are required to comply with law. The “Last Updated” date at the top of this page indicates the latest revision.

18 — Contact

If you have questions, concerns, or wish to exercise your privacy rights, please contact us:

  • Legal entity: Stichting J.C.Y.L.
  • Address: Oudezijds Voorburgwal 65, Centrum, 1012 EK Amsterdam, Netherlands
  • Email: [email protected]

We aim to respond to privacy inquiries within 30 days. If your request is complex or involves multiple systems, we may extend this timeline as permitted by law, and we will inform you of any delay.