Your details remain yours.

The data controller is Mark Paasman. His business is a sole proprietorship registered with the Netherlands Chamber of Commerce under number 63598817 and trades under the names Mark Paasman and Breinhart. In this notice, the controller is referred to as 'Mark Paasman', regardless of which trading name was used in the enquiry or Agreement. To ask a question, object or exercise a privacy right, use the contact form and begin the message with 'Privacy request'. Do not include extensive sensitive information in the first message.

This notice applies to website visitors, people making an enquiry, individual Participants, people taking part in group or organisational programmes, organisational contacts and Business Clients, and people giving permission for a review, personal story, photograph or video.

Depending on the enquiry and agreed Services, Mark Paasman may process a name, email address, telephone number, contact message, date of birth, address, appointment details, organisational information, invoice and payment information, communications, confirmations and consents.

During mentoring, tailored reports record explanations, insights, tips and tools. These relate to the knowledge shared and your conversations about learning and applying it. The app can also store your own notes, audio, practice answers and responses to follow-up questions. Public client stories involve the agreed name or alias, review text, rating, date and permission to publish.

For form security, the website processes technical hashes and temporary security information as explained below.

We only request data needed for the specific purpose. A date of birth requires a concrete need; an address is needed only where the arrangement or invoicing requires it. We do not request a Dutch citizen service number or a copy of an identity document for ordinary enquiries.

Mark shares his knowledge, tailored to what you want to learn and apply. The mentoring looks towards the future. Your tailored reports help you revisit what was explained, what you want to remember and how to use it: explanations, insights, tips and tools from your conversations.

The conversations and reports are intended for sharing and applying knowledge, not for discussing or recording medical matters or private circumstances. This is mentoring, not healthcare or psychological treatment. For an initial enquiry, your question about the mentoring is enough.

To answer your enquiry and prepare a possible offer, we use necessary contact details and your question. The legal basis is taking steps at your request before entering into an agreement. For appointments, knowledge transfer, tailored reports, agreed follow-up support and access to your personal app environment, the basis is performance of your agreement.

For invoicing and payment, we process necessary contact, address, invoice and payment details to perform the agreement. Retention of legally required tax records is based on a legal obligation. That obligation does not automatically extend to all your app content.

For necessary security, preventing abuse and establishing or defending legal claims, we rely on a legitimate interest. We weigh necessity against your privacy interests and limit the data to what is needed for that purpose. You may object to this processing.

The temporary online signal and the first and most recent report openings described in section 7.4 serve a separate purpose: assessing availability during mentoring and being able to ask whether released explanations have reached you. We rely on the legitimate interest of workable mentoring, using limited signals without a continuous presence history. An opening time does not prove that you have read or understood anything. You may object using the contact form; Mark will assess your circumstances and whether the recording remains necessary.

Publication of a review, personal story or image is based on separate consent for the agreed content and publication. Participation does not depend on this consent and you may withdraw it. Optional notifications and voluntary sharing of private content are separate choices.

A general app agreement is not consent to processing special-category data or to publication. If processing special-category data nevertheless proves necessary, both a legal basis and an applicable statutory exception are required, such as separate explicit consent where it can validly be relied on.

There is no automated decision-making or profiling. Data is not sold or used for newsletters or advertising without separate consent.

The contact form sends a name, email address, optional telephone number and message directly to Mark's protected mailbox. The content of the message is not stored in the website's security database.

To prevent abuse, the IP address and email address are converted into non-readable technical hashes. Only these hashes, a time window and request count are temporarily stored for rate limiting. Records with a time window older than 48 hours are removed when the form is next requested.

Mark in the pocket contains the tailored reports and materials released to you, so you can revisit and apply the knowledge shared. During agreed follow-up support, we continue asking questions to keep that knowledge fresh and discuss how you use it.

Depending on your agreement, you can exchange messages and audio with Mark. The scope and duration of support follow your personal offer. Your own notes and the content you choose to share remain distinct, as explained below.

Your account uses identification and contact details, access permissions and security records. If you choose to remember a device, a revocable device credential can recognise it for up to thirty days. This does not grant unrestricted access: session and permission checks still apply. Signing out or a relevant security change can end that recognition.

Reports and support messages form part of your work with Mark. Your private journal, personal audio, lesson notes and practice answers are not visible to Mark in the usual mentor view. Technical access for necessary maintenance remains possible; see section 13.

If you choose to share a reflection, status update or answer with Mark, or send a follow-up question for discussion, that selected content is shared. A voluntary response to a status request may appear in your conversation with him. This does not make your entire private journal or all your practice answers visible.

Push notifications are optional and require permission on your device. Notifications about new app content are generic: they do not include the text of a report or support message. Device and delivery information is processed to send the notification.

If you enable follow-up question or intention reminders, they are scheduled locally on your device. Other personal reminders can display exercise wording if you choose that option. That text may also appear on your lock screen. You can turn notifications and reminders off in the app or your device settings.

A temporary online signal may be visible while you use the app. It is held briefly in server memory: without a new signal, active status expires after ninety seconds, and expired signals are removed during cleanup after five minutes. This does not create an ongoing attendance history.

The first and most recent opening of a report are recorded, so Mark can see that you opened the explanation. How you understand and apply the knowledge is something you discuss together.

For a business Engagement, the Business Client may provide information needed for planning, participation and invoicing. A Business Client does not automatically receive substantive personal information about Participants.

Substantive information is shared only with the Participant's consent or another legal basis. Attendance, planning and invoice details may be shared where necessary for the Engagement.

Professional providers, including Cloudflare, are used for website hosting and security. The app environment and email service are hosted with STRATO. Calendar, video, payment, accounting and storage services may also be used where relevant to the agreed service.

We use Moneybird for invoicing and payment records, and STRATO for invoice emails. This involves the necessary contact, address, invoice and payment details. Personal session reports, mentoring messages and your private journal are not part of the data sent to Moneybird for invoicing.

If you enable push notifications, a device or push token and technical delivery records are processed. Mobile push notifications use Expo and Apple’s or Google’s notification services. Web push uses your browser’s notification provider. These services receive the technical information needed for delivery and a generic notification, not the text of your report or support message.

Professional advisers or competent authorities may receive information where necessary or legally required. Personal data is never sold.

International notification services may process data outside the European Economic Area. Such transfers require a valid international transfer mechanism. You can contact contact@markpaasman.nl for information about the recipients, countries and applicable safeguards.

The website does not use analytics, advertising or tracking cookies. Cloudflare may use the __cf_bm security cookie to identify automated and harmful traffic; it generally expires after about 30 minutes of inactivity.

Pages containing the contact form use mp_contact_token to protect the form from abuse. This necessary cookie is available only over a secure connection and expires after no more than two hours.

Public reviews are displayed from this website. No external review service is contacted for this purpose. A visitor goes to MijnTherapeut or another external site only after following an external link.

Information is kept no longer than necessary. Tax and administrative records are generally retained for seven years. Enquiries are kept only as long as needed to handle and follow them up.

Under the app terms, your app content remains available for twelve calendar months after your support actually ends. There is then a thirty-day period in which to request your data before the app data is removed. Any outstanding privacy or export request is dealt with first. You can also request deletion earlier.

Some records may need to be kept longer to meet a legal obligation or to establish, exercise or defend a legal claim. This does not justify routinely keeping all your app content. When handling a deletion request, Mark explains what, if anything, must be retained, why and for how long. A limited administrative record of how the request was handled may also be needed.

The app has encrypted backups. The configured schedule keeps hourly copies for up to 48 hours, then one daily copy for up to thirty days; old backups are removed after a successful new backup. Separate, manually created archives are not automatically covered by this schedule and need to be assessed individually when a deletion request is received. Removal from the active system therefore does not mean every backup is erased at the same time. The response to your request explains any remaining retention and the reason for it.

Publication material remains in use while consent and the publication purpose continue. The necessary contact cookie expires after no more than two hours. Expired anti-spam records are removed on a later form request when their time window is more than 48 hours old.

Reviews, personal experiences, photographs and videos are published only where consent or a demonstrable publication instruction exists. Participation does not depend on publication consent.

The person concerned decides whether publication uses their full name, first name, an agreed alias or anonymity. Mark Paasman follows that instruction and does not independently replace a name.

Consent can be withdrawn for future use. Mark Paasman will then make reasonable efforts to remove or amend its own publications; copies already shared, search engine caches and third-party publications cannot always be recovered completely.

Mark Paasman uses measures including encrypted connections, restricted access, password and session security, form protection and encrypted app backups.

Private in the app means hidden from the usual mentor view. It does not mean the app is end-to-end encrypted. Technical administrators can access data when necessary for maintenance, security or recovery.

To the extent provided by law, you may request access, correction, deletion, restriction or portability, object to processing and withdraw consent.

You can request deletion of your app account and its associated personal data at https://www.markpaasman.nl/en/delete-account without signing in to the app. You can also use the account and data section under My account in the app, or email contact@markpaasman.nl with the subject ‘Privacy request’. Uninstalling the app alone does not delete your account.

Your identity is checked carefully, preferably using information already held. Do not send identification, passwords, case files or medical details unless specifically asked for information needed to verify your identity. Any request for further verification will explain what is needed and why.

You will normally receive a response within one month. A valid deletion request is carried out without undue delay. If a legal exception or permitted extension applies, you will be told why and what happens next within that month. You will receive confirmation once your request has been handled.

You may also complain to the Dutch Data Protection Authority. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Mark Paasman processes a minor's data only with the required permission of a parent or legal guardian, unless the law provides otherwise in the particular circumstances.

A data breach is assessed and, where required, reported to the Dutch Data Protection Authority and affected individuals under applicable rules.

This privacy statement may change when the service or data processing changes. This is version 4.4.1, effective from 28 October 2026. It links purposes more clearly to legal bases and clarifies data minimisation. The Dutch and English web texts and privacy PDFs belong to the same version.

The public contact address is contact@markpaasman.nl. This contact change does not alter existing agreements.