Privacy notice
How Neurosuite B.V. and Neurosuite Ltd handle personal data from website visitors, business contacts, partners, candidates and academy participants.
Updated:
1. Who we are
This website, neuronsuite.com, is operated by Neurosuite B.V., Raadhuislaan, 3201 EL Spijkenisse, Netherlands, together with Neurosuite Ltd, No. 2, KD Drive, opposite Domino's Pizza, Akobo, Ibadan 200132, Oyo State, Nigeria. Both companies are part of the Neurosuite group and are referred to as "Neurosuite", "we" or "us".
Neurosuite B.V. is the controller for personal data of website visitors, business contacts and partners in the European Economic Area. Neurosuite Ltd is the controller for personal data of academy participants, candidates and employees in Nigeria. Where both entities use the same data (for example, a traineeship candidate who later works on a European client engagement), they act as joint controllers and have agreed their respective responsibilities; you can exercise your rights against either entity.
Contact for privacy matters: info@neuronsuite.com (subject line "Privacy") or by post to the Netherlands address above.
2. What personal data we process and why
Website visitors
Our web server records technical data (IP address, date and time, requested page, browser type) in standard server logs for security and troubleshooting. Logs are retained by our hosting provider for a limited period and are not used to profile visitors. We set a strictly necessary cookie to remember your language and your cookie preferences. Analytics is used only with your consent; see the cookie notice.
Business and partner enquiries
When you submit the business or partner enquiry form, or email or call us, we process your name, organisation, job title, email address, telephone number and the content of your message. We use this to respond, to prepare a proposal and, if you become a client or partner, to manage the relationship and contract. Legal basis: pre-contractual steps and performance of a contract (GDPR article 6(1)(b)) and our legitimate interest in running our business (article 6(1)(f)). Enquiry data is retained for up to 24 months after our last contact unless a contract follows, in which case it is retained for the duration of the relationship and the statutory retention periods (7 years for financial records in the Netherlands).
Clients and client personnel
During engagements we process contact details of client personnel for communication and service management, and we may access personal data contained in client systems on the client's instructions. For data in client systems we act as processor; the client's own privacy notice applies and a data processing agreement governs our work. See also our security and delivery model page.
Recruitment, academy and talent programme
When you register interest in the Neurosuite Academy or apply for a traineeship or position, Neurosuite Ltd processes your name, email address, telephone number, city, education and background, areas of interest, venue preference, motivation and any documents you later provide. We use this to manage your registration, communicate about the programme, allocate venues, run the aptitude test and interviews, make and administer offers, and comply with legal obligations. Legal basis: your consent for the registration of interest (which you may withdraw at any time), steps prior to entering into a contract for the selection process, and legitimate interests in running a fair selection.
Candidate data is retained for the duration of the programme and selection cycle and up to 12 months afterwards, so that we can consider you for future intakes if you ask us to, after which it is deleted or anonymised. Successful candidates' data becomes part of their employment or traineeship file. Aptitude-test results are shared with you and used only for selection. We do not make decisions based solely on automated processing.
Suppliers and other contacts
We process contact and payment details of suppliers and other business contacts to manage contracts and comply with accounting obligations.
3. Who we share data with
We share personal data only with: our hosting and email providers (who process data on our instructions), professional advisers (accountants, lawyers) where necessary, our two group entities as described above, and authorities where the law requires it. We do not sell personal data and we do not share it with advertisers.
4. International transfers
Neurosuite operates in the Netherlands and Nigeria. Where personal data of people in the EEA is accessed by or transferred to Neurosuite Ltd in Nigeria (for example, a client contact's details used by a support consultant), the transfer is protected by the European Commission's standard contractual clauses between the two entities, supported by technical and organisational measures such as access controls, encryption and, where selected for an engagement, EU-hosted virtual desktops. Academy and candidate data of people in Nigeria is processed in Nigeria under the Nigeria Data Protection Act 2023; where it is shared with Neurosuite B.V. (for example, for programme planning), equivalent safeguards apply.
5. Security
We apply technical and organisational measures appropriate to the risk, including multi-factor authentication, least-privilege access, encrypted devices and transport, access logging and staff confidentiality obligations. Website forms are transmitted over HTTPS, protected against abuse, and form submissions are stored outside the public web directory as a delivery safety net and purged regularly.
6. Your rights
Depending on where you are, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting processing before withdrawal). To exercise these rights, email info@neuronsuite.com with "Privacy" in the subject line. We respond within one month (GDPR) or the period required by the Nigeria Data Protection Act. We may ask you to verify your identity.
You can also complain to a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), and in Nigeria the Nigeria Data Protection Commission (ndpc.gov.ng).
7. Children
This website and the academy programme are intended for adults (18 and over). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
8. Changes to this notice
We update this notice when our processing or the law changes. The date at the top shows the latest version. Material changes affecting academy participants or candidates are communicated by email.