Privacy policy
Who is responsible
Hugo Zanelli, trading as Who Pays, Sarphatistraat 14, 1017 WS Amsterdam, KvK [KvK number], is responsible for your personal data. Contact: [contact email], [phone number].
What we collect
- From the application form: what you are interested in (Briefing, Programme, Private Session, In-house, Verdict or partner seats), your preferred date, for the Briefing and the Programme who pays (your company or you) and, if your date is close, your request to hold the session within the withdrawal period, for a Private Session whether you come alone or as a team, for In-house your city, team size and preferred format, then your name, email, phone (optional), organisation (optional), role, website (optional), the type of product, a short description of it, its stage, the countries that interest you, the evidence so far (optional), your question and any notes.
- For bookings: invoicing details and payment records.
- From emails and calls you have with us.
Fields marked as required are needed to assess your application. Without them we cannot reply.
Please don't include patient data, or trade secrets you aren't allowed to share. The form doesn't ask for health information about you.
Why, and on what basis
- To assess your application and contact you: steps you asked for before a contract (GDPR art. 6(1)(b)). If your organisation books, we rely on our legitimate interest in dealing with its contact persons (art. 6(1)(f)).
- To deliver the session and prepare it: performance of the contract.
- To invoice and keep accounts: legal obligation (art. 6(1)(c)).
- To tell past participants about later dates: legitimate interest (art. 6(1)(f)). We offer an opt-out when we collect your email address and in every message.
How long we keep it
- Applications that don't lead to a booking: 12 months, then deleted.
- Participant records: 2 years after your last session.
- Invoices and accounting records: 7 years, as Dutch tax law requires.
Who else sees it
Nobody else at the table sees your application. We use a small number of processors under a data processing agreement: the provider that receives form submissions [form provider: Resend, Inc. (USA), under the EU Standard Contractual Clauses], our email provider [email provider], our website host [website host] and our accountant [accountant]. Our payment provider [payment provider] (iDEAL and card) processes payment data under its own privacy policy. We don't sell data and don't use advertising trackers on this site.
This site loads its fonts and scripts from its own server. Your visit sends no request to any other company. The address link opens a map service only when you click it.
Outside the EU
We aim to keep your data in the European Economic Area. If a provider processes data outside it, we rely on an adequacy decision, such as the EU-US Data Privacy Framework (decision of 10 July 2023) for certified US providers, or the EU standard contractual clauses.
Your rights
You can ask to see, correct, delete or receive a copy of your data, restrict or object to processing, by emailing [contact email]. We reply within one month. We make no automated decisions about you. You may also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Cookies
This site uses no tracking cookies. Your browser may keep an unfinished application on your own device so you don't lose it. It is removed once you send it, or when you clear your browser data. Nothing is sent to us.
Changes
We may update this policy. The date at the top shows the current version.