Privacy Policy

1. Introduction & Controller Identity

Bila B.V. operates this website as an independent provider of online professional workplace education serving learners throughout Canada. We provide educational courses, virtual workshops, webinars, downloadable learning resources, and self-paced professional development programs. We do not provide consulting, financial services, legal services, accounting, investment services, recruitment, employment placement, or any regulated professional services.

The data controller for the purposes of the EU General Data Protection Regulation (GDPR) is:

• Legal entity: Bila B.V.
• Registered address: Peesterstraat 6A, 9331 BC Norg, Netherlands
• Email: [email protected]
• Phone: +31 50 763 0921

Because our services are educational and delivered online, we do not typically process special-category data at scale. If you contact us with sensitive information anyway, we ask that you avoid including it in free-text fields unless it is strictly necessary for your request.

2. Personal Data We Collect

We collect personal data that you provide directly and personal data that is generated when you use the website. The categories below are typical for an online education provider and are limited to what we need to operate the site, respond to inquiries, and improve learning content.

• Identity and contact details: name, email address, phone number.
• Registration and inquiry content: selected program, preferred workshop (optional), and message content (for example, learning goals and scheduling preferences).
• Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (city/region level, not precise GPS).
• Usage data: pages visited, time spent, referring page, click paths, and how you interact with forms and content.
• Cookies and identifiers: identifiers stored in your browser for essential operation and, if you consent, analytics and marketing measurement (see Section 4).
• Conversion events: whether an inquiry form was started or submitted and related technical signals used for troubleshooting and reporting.

We do not intentionally collect special-category data (such as health information, religious or political views), government identification numbers, or payment card and bank account details through this website. If you believe you submitted sensitive information by mistake, contact us using the details in Section 18 and we will assist with deletion where possible.

3. Why We Process Personal Data & Legal Bases (GDPR Article 6)

We process personal data only for defined purposes and with a lawful basis under the GDPR. The legal basis depends on what you do on the site and what choices you make in the cookie preferences panel.

Contact and registration requests

When you submit a registration or inquiry form, we use the information to respond, confirm the selected program or workshop, and provide educational support. This processing is based on:

• Article 6(1)(b) (steps prior to entering a contract) where your request relates to registering for a program or workshop.
• Article 6(1)(a) (consent) where you explicitly consent to be contacted through the form’s consent checkbox.

Analytics (optional)

If you consent to analytics cookies, we may measure how the website is used so we can improve navigation, clarity, and the way learning resources are presented. This processing is based on Article 6(1)(a) (consent).

Marketing and advertising measurement (optional)

If you consent to marketing cookies, we may measure advertising performance and understand which pages lead to registrations. This processing is based on Article 6(1)(a) (consent). We do not use marketing data to make decisions that have legal or similarly significant effects on you.

Security, abuse prevention, and service reliability

We use basic technical logs and security controls to protect the website, prevent fraud, and keep services stable. This is based on Article 6(1)(f) (legitimate interests). Our legitimate interests include preventing misuse (such as automated form submissions) and maintaining the integrity of our learning resource pages.

Legal compliance

Where we must keep certain records to comply with legal obligations, processing is based on Article 6(1)(c) (legal obligation).

Automated decision-making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects within the meaning of GDPR Article 22.

4. Cookies & Tracking

We use cookies and similar technologies (such as pixel tags) to operate the website and, if you consent, to measure usage and advertising performance. You can manage your choices at any time using the “Manage cookie preferences” link in the footer.

Essential cookies (always active)

Essential cookies are required for core website functionality and security. They include cookies that remember your cookie consent choice and maintain basic session continuity. These cookies do not require consent under EU rules when limited to what is strictly necessary.

• _site_session (session): supports site session continuity.
• cookie_consent (up to 12 months): stores your consent choice for analytics and marketing cookies.
• Security-related cookies (varies): may be used to protect forms and reduce automated abuse.

Analytics cookies (optional, consent-based)

If you opt in, we may use Google Analytics 4 (GA4) to understand aggregated website usage. Where configured, IP addresses are anonymized or truncated before being used for analytics reporting. Examples of cookies include _ga (2 years) and _ga_XXXXXXXXXX (2 years). Analytics data retention is configured for up to 14 months.

Marketing cookies (optional, consent-based)

If you opt in, marketing cookies help measure advertising performance and support relevant offers. Typical cookies may include _gcl_au (Google Ads, 90 days), _fbp (Meta, 90 days), and _fbc (Meta click ID, 90 days when present).

Beyond cookies

In addition to cookies, measurement may use pixel tags (for example, through gtag.js or the Meta Pixel) and may also be supported by server-side event forwarding (for example, Meta Conversion API or server-side tag management). Where server-side forwarding is used, identifiers may be hashed before transfer. These tools are activated only after consent for the relevant category.

5. Consent (EEA/UK)

Users in the European Economic Area (EEA) and the United Kingdom receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, and freely given consent under GDPR Article 6(1)(a).

Your consent choice is recorded in the cookie_consent cookie for up to 12 months. You can withdraw consent at any time by opening the cookie preferences panel from the footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

6. Sharing With Advertising & Service Partners

We share limited data with service providers that help us operate the website and, where you consent, measure analytics and marketing performance. We do not sell personal data. Service providers act as processors or independent controllers depending on the specific service.

Google LLC

If enabled through your cookie choices, Google services may process cookie identifiers, usage data, and conversion events for analytics and advertising measurement. More information: https://policies.google.com/privacy.

Meta Platforms

If enabled through your cookie choices, Meta services may process page views and conversion events for advertising measurement and audience building. More information: https://www.facebook.com/privacy/policy.

Cloudflare

We may use Cloudflare for content delivery and security, which can involve processing IP addresses and security signals to detect threats. More information: https://www.cloudflare.com/privacypolicy/.

We do not permit these providers to use site data for their own independent commercial purposes beyond providing services to us, subject to their contractual and policy terms.

7. International Transfers

Some service providers are located outside the EEA, including in the United States. When personal data is transferred internationally, we rely on appropriate safeguards such as:

• EU–US Data Privacy Framework (where applicable, since July 2023) and the UK Extension to the EU–US Data Privacy Framework
• Swiss–US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (EU 2021/914) as a fallback mechanism
• UK International Data Transfer Agreement (IDTA) as a fallback mechanism

We also apply practical safeguards where relevant, such as limiting transferred fields to what is necessary for measurement or support and using hashing for certain identifiers when supported by a provider.

8. Retention

We keep personal data only as long as necessary for the purposes described in this policy:

• Contact and registration submissions: up to 2 years from the last interaction.
• Analytics data: up to 14 months (where enabled by consent and configuration).
• Marketing cookies: per cookie lifetime (commonly 90 days) and as allowed by your consent choice.
• Email correspondence: for the duration of the relationship plus up to 1 year for continuity and record-keeping.
• Server and security logs: typically up to 90 days, unless needed longer for investigation.
• Consent records: up to 3 years for audit and compliance purposes.
• Legal and tax records: retained as required by applicable law (often 6–10 years depending on record type).

If you request deletion, we will apply it to data that we control unless we must retain certain items to comply with legal obligations or to establish, exercise, or defend legal claims.

9. Your Rights (GDPR & UK GDPR)

If you are in the EEA or UK, you may have the following rights, subject to legal conditions and exemptions:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent at any time (Article 7(3))
• Right to lodge a complaint with a supervisory authority (Article 77)

To exercise a right, email [email protected]. We aim to respond within 30 days. For complex requests, the response period may be extended by up to 60 additional days as permitted by law.

If you are in the Netherlands, the supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Information about supervisory authorities across the EEA is available via the European Data Protection Board: https://edpb.europa.eu.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Third-party providers may have their own policies regarding DNT and similar signals.

12. Data Deletion Requests

To request deletion, email us with the subject line “Data Deletion Request”. We may request additional information to verify your identity before completing the request. We aim to complete verified deletion requests within 30 days, subject to lawful retention requirements.

13. Business Transfers

If Bila B.V. is involved in a merger, acquisition, asset sale, financing, reorganization, or insolvency, personal data may be transferred to a successor entity. If such a transfer materially changes how your personal data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). In the past 12 months, we may have collected the following categories of personal information:

• Identifiers (such as name, email, IP address, and cookie IDs) shared with service providers and, where you consent, advertising partners.
• Internet or network activity information (such as pages visited and interactions) used for analytics and advertising measurement when enabled.
• Inferences (such as general interest categories derived from page views) used by advertising partners when marketing cookies are enabled.

We do not sell personal information as defined by the CCPA. We may share information for cross-context behavioral advertising when you enable marketing cookies. California residents may opt out by using the cookie preferences panel (reject marketing cookies).

You may have the rights to know, delete, correct, and opt out of sale or sharing (as defined by CCPA), and you have the right not to be discriminated against for exercising your rights. To submit a request, email us with the subject line “California Privacy Request”. We will verify your identity before responding. Authorized agents may submit requests with written proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act (VCDPA), including access, correction, deletion, data portability, and the right to opt out of targeted advertising. To submit a request, email us with the subject line “Virginia Privacy Request”.

We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects. If we decline to take action on a request, you may appeal by emailing us with the subject line “Appeal of Refusal — Privacy Request”. We will respond within 60 days.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing us with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service providers. Material changes will be announced on the website at least 14 days before they take effect. The “Last Updated” date at the top of this page will also be revised whenever we publish changes.

18. Contact

If you have questions about this Privacy Policy or want to exercise your rights, contact:

• Bila B.V.
• Peesterstraat 6A, 9331 BC Norg, Netherlands
• Email: [email protected]
• Phone: +31 50 763 0921