Legal
Privacy Notice
- Effective date
- October 2026
- Controller
- Reality Upgrade B.V.
Von Clermontplein 16, 6291AV Vaals, The Netherlands
info@reality-upgrade.com
This notice applies to our website, enquiries, bookings, online preparation, coaching, retreats, integration activities, communications, newsletter and social-media presence.
Who we are
Reality Upgrade B.V. ("Reality Upgrade", "we", "us" or "our") is the controller for the processing described in this Privacy Notice. You can contact us at von Clermontplein 16, 6291AV Vaals, The Netherlands, or at info@reality-upgrade.com.
This Privacy Notice explains which personal data we process, why we process it, with whom we share it, how long we retain it and which rights you have under the General Data Protection Regulation ("GDPR") and other applicable Dutch data-protection law.
Some coaches, medical professionals, retreat venues or other professionals may process personal data for their own professional purposes and under their own responsibility. Where this is the case, they are independent controllers and must provide their own privacy information. We will identify them where required.
Whose personal data we process
We may process personal data relating to website visitors, prospective and current participants, former participants, newsletter subscribers, people who contact us, persons participating in group communications, business contacts, suppliers and other persons involved in our services.
Our website and services are intended for adults. We do not knowingly offer our services to, or collect personal data from, persons under 18.
Personal data we may collect
Depending on your interaction with us, we may process the following categories of data:
- identity and contact data, such as your name, date of birth, address, telephone number and email address;
- enquiry, intake and eligibility data, including your goals, expectations, personal circumstances and answers provided during consultations or questionnaires;
- health and safety data, including information about physical or mental health, diagnoses, medication, allergies, substance use, contraindications, emergency contacts and other information needed to assess suitability and promote safety;
- contract, booking and participation data, including the selected service, retreat dates, attendance, preferences, accommodation and dietary requirements;
- payment and administration data, such as billing details, transaction status, invoices and payment history. Payment-card or bank credentials may be processed directly by the relevant payment provider;
- coaching and content data, including notes, correspondence, feedback, questionnaire responses, messages and material you choose to share during preparation, a retreat or integration;
- group communication data, including your name, telephone number, profile information and messages where you voluntarily participate in a closed messaging group;
- images, audio or video recordings;
- marketing preferences and newsletter data, including subscription, consent, unsubscribe, delivery, opening and click data where such measurement is enabled;
- website and device data, such as IP address, browser, device, operating system, language, referring page, pages viewed, date and time, log data and cookie identifiers;
- social-media data and public interactions with our accounts; and
- information obtained from third parties, such as booking, payment, technical service or referral information.
Please do not provide personal data about another person unless you are authorised to do so and have informed that person about the disclosure. If you provide an emergency contact, we use those details only where reasonably necessary for safety or emergency communication.
Why we process personal data and our legal bases
| Purpose | Typical data | Legal basis | Typical retention |
|---|---|---|---|
| Responding to enquiries and arranging an introductory consultation | Contact details, correspondence, goals | Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR | Up to 2 years after the last substantive contact |
| Assessing suitability and preparing our services | Intake, eligibility, health and safety data | Art. 6(1)(b) GDPR; in addition for special-category data, Art. 9(2)(a) GDPR; | Unsuccessful application: normally 6 months; participant: see service records below |
| Booking, contracting, payment and administration | Identity, contract, booking, invoice and payment data | Art. 6(1)(b) GDPR | Financial records: normally 7 years; other contract records: as needed for performance and legal claims |
| Providing preparation, coaching, retreats and integration | Participation, communication, coaching, preferences, health and safety data | Art. 6(1)(b) GDPR; in addition Art. 9(2)(a) GDPR for special-category data; | Normally for the service period and up to 2 years afterwards, unless a longer period is required for claims or law |
| Coaching and retreats | Health and safety data | Art. 6(1)(d) and Art. 9(2)(c) GDPR in a genuine emergency | As necessary while protecting the vital interests of the participant |
| Operating closed participant groups | Contact details, profile and group messages | Art. 6(1)(a) GDPR or Art. 6(1)(b) GDPR | Until the group is closed or participation ends, subject to platform settings and members’ own copies |
| Service quality, feedback and improvement | Feedback, survey responses, participation data | Art. 6(1)(f) GDPR | Up to 2 years; anonymised data may be retained longer |
| Sending newsletters and measuring engagement | Name, email, consent and engagement data | Art. 6(1)(a) GDPR for non-participants; Art. 6(1)(f) GDPR for participants | Until withdrawal, plus up to 3 years for evidence of consent or suppression |
| Website operation, security and necessary cookies | IP address, device, logs and necessary identifiers | Art. 6(1)(f) GDPR; applicable cookie rules | Security logs normally up to 90 days, unless needed for an incident |
| Analytics, embedded content and non-essential cookies | Usage, device and cookie data | Consent under Art. 6(1)(a) GDPR | As stated in the cookie settings or until consent is withdrawn |
| Legal compliance and legal claims | Relevant identity, contract, communication and transaction data | Art. 6(1)(c) and (f) GDPR | For the applicable statutory or limitation period |
Where we rely on legitimate interests, those interests include operating and securing our business and website, answering communications, keeping appropriate records, improving our services and defending legal claims. We balance those interests against your rights and interests.
Health data and information about philosophical or religious beliefs may constitute special categories of personal data. We process such data only where an exception under Article 9 GDPR applies, generally your explicit consent. You may withdraw consent at any time, but this does not affect processing that was lawful before withdrawal. Withdrawal may mean that we can no longer safely provide the relevant service.
If data is required by law or necessary to enter into or perform a contract, we will indicate this where appropriate. If you do not provide necessary identity, contact, payment, eligibility or safety information, we may be unable to assess your application or provide the service.
Sources of personal data
We usually obtain personal data directly from you through our website, forms, consultations, questionnaires, correspondence, booking process, online course, group communications and participation in our services. We may also receive data from a person acting on your behalf, a referral source, a service provider or a professional involved in delivering a service, where lawful and necessary.
Website, cookies and similar technologies
When you visit our website, technical log data is processed to display the website, maintain security and diagnose faults.
We use cookies on our website. These are small text files that are sent to your computer, tablet or smartphone through the internet page to make electronic communication easier and faster.
Information about enabling, disabling and deleting cookies can be found in your browser’s Help function.
More information on how we use cookies and an overview of the cookies we use can be found here: cookie statement.
Enquiries, consultations and applications
If you request information or a free consultation, we process your contact details, your enquiry and relevant background information to respond, schedule the consultation and assess whether our services may be suitable. If the enquiry results in a booking, we add the necessary information to the participant record.
We use Typeform on our website. The provider is TYPEFORM S.L., Carrer Bac de Roda 163, 08018 Barcelona, Spain ("Typeform"). Typeform enables us to create online forms and embed them on our website. When you submit information through a Typeform form on our website, the data you provide is processed and stored by Typeform on our behalf. Depending on the purpose of the form, this may include contact details, registration information, questionnaire responses, health-related information, and any other information you choose to provide.
For more information on how Typeform processes personal data, please consult Typeform's Privacy Policy: Privacy Policy | Typeform
Addendum (as of 30 October 2026): forms on this website
For the forms on this website (consultation, contact, e-book, brochure, live webinar and enquiries about the Iconic Leadership Summit) we currently do not use Typeform but the following services. Purposes and legal bases are as described in the section “Why we process personal data and our legal bases”, retention as described in the section “Retention”.
Zoho CRM. We store the information you enter in the forms (for example your name, email address, phone number, your interest and the page on which you submitted the form) in our customer relationship management system Zoho CRM in order to process your request and to contact you. The provider is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. The data is processed in a data centre in the European Union.
ActiveCampaign. If you request the e-book or the brochure or sign up for the live webinar, we transmit your name, your email address and, if provided, your phone number to ActiveCampaign. On our behalf, ActiveCampaign sends the confirmation email (double opt-in), what you requested and the information about the live webinar. If you request a consultation, we also transmit this information and note that you have requested a conversation. The provider is ActiveCampaign, LLC, 1 North Dearborn Street, 5th Floor, Chicago, IL 60602, USA. For the transfer to the United States, the section “International transfers” applies.
Cloudflare. The forms are processed by our hosting provider Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your information is stored there in encrypted form until it has reached Zoho CRM and ActiveCampaign, for no longer than 14 days.
Intake, screening, health and safety information
Before participation, we may ask for information needed to assess suitability, contraindications and support needs. Because this may include health data, we will request explicit consent where required. Access to such data is limited to persons who need the information for assessment, preparation, safety or service delivery.
For the collection, processing and storage of admission, screening, health and safety data, as well as for documenting the provision of information and consent in connection with the Retreat, we use Google Workspace. The participant questionnaire is administered through Google Forms; the responses are processed in Google Sheets and additionally stored as a PDF in Google Drive. The information and consent form completed in connection with the Retreat is also collected via Google Workspace and stored in Google Drive. Google processes these data, as part of the Google Workspace services used by Reality Upgrade, as a processor on the basis of the applicable data processing terms. Access within Reality Upgrade is restricted to those persons who require the data for the screening, the decision on participation, the documentation of the provision of information and consent, or the safe conduct of the Retreat.
We do not use intake or health information to make decisions based solely on automated processing. Suitability decisions involve human assessment. We may decline or postpone participation where information indicates that the service cannot be provided responsibly or safely.
In a genuine emergency, we may disclose necessary information to emergency services, healthcare providers or your emergency contact to protect vital interests. Routine health-related processing is not based on the emergency exception.
Coaching, retreats and integration
We process participant data to plan and provide preparation, online learning, coaching, retreat activities, accommodation, dietary arrangements, support and integration. Only information reasonably necessary for a person’s role will be shared with coaches, guides, venues, caterers or other service providers.
Independent coaches or healthcare professionals may determine their own purposes and means of processing and therefore act as independent controllers. Any professional notes they keep under their own responsibility are governed by their privacy information, not this notice. Other providers act only on our instructions and are processors under Article 28 GDPR.
Group communications and WhatsApp
We may offer access to a closed WhatsApp group for preparation, practical coordination, peer contact or integration. Participation should be optional unless the group is strictly necessary for an agreed service. When you join, your telephone number, profile name, profile picture and messages may be visible to other members. Other members are responsible for how they handle information they receive in the group.
Do not share sensitive information about yourself or others in a group unless necessary and appropriate. Group content must not be copied or shared outside the group without a lawful basis and, where applicable, the consent of the persons concerned.
WhatsApp processes data under its own terms and privacy information and may process data outside the EEA.
Online courses, meetings and digital platforms
Where we provide an online course, video meeting, scheduling tool, electronic signature or participant portal, the relevant provider may process identity, contact, account, usage, communication and technical data. We use providers subject to appropriate contractual and security arrangements. Recordings are made only where there is a clear purpose and an appropriate legal basis, and participants are informed in advance.
Newsletter and direct marketing
We send newsletters where you have consented or where another legal basis permits this. You can unsubscribe at any time using the link in a message or by contacting us. We may retain a minimal suppression record to ensure that we respect your choice.
If enabled and covered by consent, our email provider may record delivery, opening and link-click information to measure and improve communications. You can avoid further measurement by unsubscribing or withdrawing the relevant consent.
Photographs, recordings, testimonials and feedback
We do not publish identifiable photographs, recordings, testimonials or participant stories for marketing merely because you attended a retreat. We will obtain a separate, specific permission where consent is the appropriate legal basis. Refusing or withdrawing marketing consent does not affect your access to our core services. Material already lawfully distributed may not be fully retractable, but we will stop new use where required.
Social media
We maintain social-media profiles, including Instagram. When you visit or interact with a platform, the platform processes personal data under its own privacy information. We receive information you send to us and, in some cases, aggregated audience statistics. Depending on the platform and processing, we and the platform may have separate or joint responsibilities.
We use ManyChat for the processing of certain comments and direct messages on Instagram. Through ManyChat, certain responses may be sent automatically and contact details may be collected. In particular, your Instagram username, email address and the date of the interaction may be processed. The data is automatically transferred via Zoho Flow to our Zoho CRM, where it is stored for the further handling of your enquiry and contact management. Health data is not collected as part of this automated communication. Personal messages that require individual handling are answered by a member of our team.
Recipients of personal data
We may disclose personal data to:
- employees and authorised team members;
- coaches, guides, medical or safety professionals, teachers and other persons involved in service delivery;
- Cooperation partners;
- Sales partners;
- retreat venues, accommodation providers, caterers and logistics providers;
- website hosting, IT, cloud, CRM, online-course, communications, scheduling, electronic-signature and security providers;
- payment providers, banks, accountants, tax advisers, insurers, legal advisers and debt-collection providers;
- newsletter, analytics, cookie, video and social-media providers where activated;
- public authorities, regulators, courts, emergency services or other recipients where disclosure is required or permitted by law; and
- a prospective purchaser, investor or successor in connection with a corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
We enter into processor agreements where Article 28 GDPR applies. We enter into joint controller agreements where Article 26 GDPR applies. Persons who process personal data under the authority of Reality Upgrade may process such data only in accordance with our instructions, pursuant to Articles 29 and 32(4) GDPR. We do not sell personal data.
International transfers
Some providers or recipients may process personal data outside the European Economic Area. We make such transfers only where permitted under Chapter V GDPR, for example on the basis of an adequacy decision, the EU-US Data Privacy Framework where the recipient is certified, Standard Contractual Clauses with supplementary measures where appropriate, or a specific statutory derogation. You may contact us for information about the relevant safeguard and, where available, a copy of the arrangement.
Retention
We retain personal data no longer than necessary for the relevant purpose. The indicative periods in article 4 may be extended where required by tax, accounting or other law, where a complaint, incident or dispute is pending, or where data is needed to establish, exercise or defend legal claims. When retention is no longer justified, data is deleted.
Retention periods of messaging, social-media, payment and other third-party platforms may also be governed by their own settings and policies. Participants may retain messages or other information received by them, over which we may have no control.
Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, confidentiality obligations, secure transmission, backups, supplier controls and incident-response procedures.
Our website uses a secure connection (‘https://’). Information is encrypted so that only the sender and the receiver can read it. The web pages where you enter your data are secured by means of the SSL certificate. This ensures that this information cannot be read by third parties.
Your rights
Subject to the conditions and limitations in the GDPR, you may have the right to:
- obtain access to your personal data and information about its processing (Article 15 GDPR);
- have inaccurate data corrected and incomplete data completed (Article 16 GDPR);
- have personal data erased in certain circumstances (Article 17 GDPR);
- restrict processing in certain circumstances (Article 18 GDPR);
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller (Article 20 GDPR);
- withdraw consent at any time, without affecting prior lawful processing (Articles 7(3) and 9(2)(a) GDPR); and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to Article 22 GDPR.
- object, on grounds relating to your particular situation, to processing based on legitimate interests, and object at any time to direct marketing (Article 21 GDPR);
To exercise a right, contact info@reality-upgrade.com. We may request information necessary to verify your identity. We normally respond within one month, subject to the extensions permitted by law. Exercising a right is generally free of charge.
You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority in the EU or EEA country of your habitual residence, place of work or the alleged infringement. We encourage you to contact us first so we can try to resolve the issue.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about you solely by automated means, and we do not conduct such profiling. We may use audience or engagement information for analytics or marketing only where lawful and, where required, based on consent.
Third-party links
Our website may link to websites or services operated by third parties. We are not responsible for their independent processing. Please review their privacy information before providing personal data.
Changes to this Privacy Notice
We may update this Privacy Notice when our services, providers or legal obligations change. The current version will be published on our website with its effective date. We will provide additional notice where a change materially affects you or requires renewed consent.
Contact
For questions, requests or complaints concerning privacy, contact:
Reality Upgrade B.V.
Von Clermontplein 16
6291AV Vaals
The Netherlands
Email: info@reality-upgrade.com