Privacy Policy

Introduction

bol.com B.V. (referred to as "we," "us," "our," or "the Company") is committed to protecting your privacy and ensuring you have a positive experience on our website and when using our piano education services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, contact us, or enroll in our online piano lessons and music education programs.

This policy applies to all users visiting our website from Canada and any other jurisdiction. Please read this Privacy Policy carefully. If you do not agree with our practices, please do not use our website or services.

Contact Information

If you have questions about this Privacy Policy or wish to exercise any of your rights, you may contact us at:

1. What Data We Collect

We collect information you provide directly and information collected automatically through your use of our website and services. The types of data we collect include:

• Full name
• Email address
• Phone number
• Age or date of birth (when relevant to program enrollment)
• Mailing address
• Program preferences and learning goals
• IP address and browser type
• Device type and operating system
• Cookies and tracking identifiers
• Pages visited, time spent on site, and click paths
• Form submission content and inquiry details
• Conversion events (form submissions, calls, enrollments)

2. Cookies: Three Categories

Essential Cookies

Essential cookies are necessary for the core functionality of our website. These cookies enable basic features such as session management, security, and user preferences. They are not subject to consent and are activated automatically.

• Examples: session_id, csrf_token, cookie_consent_status
• Consent required: No
• Retention: Session duration or up to 12 months for preference storage

Analytics Cookies

Analytics cookies help us measure website traffic, understand user behavior, and improve site performance. These cookies collect anonymized data and are activated only after you provide consent.

• Tool: Google Analytics 4
• Examples: _ga, _ga_XXXXXXX, _gid, _gat
• Consent required: Yes
• Retention: Up to 14 months

Marketing and Advertising Cookies

Marketing cookies enable personalized advertising and conversion tracking. These cookies are activated only after you provide explicit consent and are used by our advertising partners to deliver relevant ads based on your interests and browsing history.

• Purpose: Remarketing, personalized ad delivery, conversion tracking
• Consent required: Yes
• Retention: Up to 540 days
• Partners: Google Ads, Meta Pixel

3. Marketing Cookies and Advertising Technologies

4. Consent and Cookie Preferences

When you first visit our website, you will see a cookie consent banner. This banner provides you with three options:

• Accept All: Activates essential, analytics, and marketing cookies
• Reject Non-Essential: Activates only essential cookies
• Manage Preferences: Opens a detailed panel where you can choose which categories to accept

Analytics and marketing cookies are not activated until you explicitly consent. Your preference is stored in your browser for 12 months. You may withdraw consent at any time through the cookie preferences panel without affecting the lawfulness of processing that occurred while consent was active.

5. GDPR Compliance for EEA and UK Users

Users in the European Economic Area and the United Kingdom receive this Privacy Policy in compliance with the General Data Protection Regulation (GDPR) and UK GDPR. The following protections apply:

• Marketing and analytics cookies are activated solely after explicit, informed, freely given consent under GDPR Article 6(1)(a)
• Consent is recorded with a timestamp and may be audited upon request
• You have the right to withdraw consent at any time
• Withdrawal does not affect processing that occurred while consent was valid
• We provide transparency about how your data is processed

6. Data Sharing with Advertising Partners

We share certain data with advertising partners for campaign delivery and measurement. Recipients and the data categories shared include:

Google LLC

Data shared: Cookie identifiers, conversion events, anonymized behavioral data, remarketing lists. Governed by Google's Privacy Policy.

Meta Platforms, Inc.

Data shared: Pixel events, conversion data, custom audiences. Governed by Meta's Data Policy.

7. Lead Forms and Contact Requests

When you submit a contact form, request information about our programs, or register interest in our services, we collect the information you provide. This typically includes:

• Full name
• Email address
• Phone number
• Message and inquiry details
• Program preferences

Legal basis: Consent (GDPR Article 6.1.a) and, where a service relationship exists, performance of a contract (GDPR Article 6.1.b).

Retention: Form submission data is retained for up to 2 years from the date of submission, unless a longer period is required by applicable law.

Your rights: You may request deletion of your data at any time by contacting us at the email address in this policy.

A link to this Privacy Policy appears adjacent to every submission button on this site. Submitting a form constitutes acknowledgment of this policy.

8. Google Services and Advertising

This website uses the following Google services:

Google Analytics 4

Collects anonymized usage data, device info, and behavioral signals. IP anonymization is enabled. Data retention is set to 14 months. Users may opt out via the Google Analytics Opt-out Browser Add-on.

Google Ads Conversion Tracking

Records when a user completes a defined action (form submission, call, enrollment) after clicking one of our ads. This data is used solely for measuring ad campaign performance.

Google Remarketing

Allows us to show ads to previous visitors across Google's network. Remarketing lists are not created from sensitive data categories (health, finance, religion, sexual orientation).

Google Tag Manager

Deploys tracking tags on our behalf. No personal data is collected by GTM itself. It acts as a container for the tags listed above.

Google's advertising products are governed by Google's Advertising Policies.

9. Meta Advertising Services

This website uses the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram. The pixel may record:

• Page views and time on site
• Specific conversion events (form submissions, enrollments)
• Custom audience membership for retargeting purposes

We do not use the Meta Pixel to collect sensitive personal data, nor to target users based on health status, financial situation, religion, political views, sexual orientation, or any other special-category attribute prohibited under Meta's advertising policies.

Meta acts as an independent data controller for data collected via its Pixel and processed within its own platform. To manage your ad preferences on Meta platforms, visit Facebook Ad Preferences.

10. Prohibited Content Declaration

This website does not promote, sell, or facilitate access to prohibited product or service categories including but not limited to:

• Weapons or firearms
• Controlled substances
• Counterfeit goods
• Unlicensed gambling services
• Adult content
• Services making misleading health or financial claims

All advertising conducted through Google Ads and Meta Ads complies with the respective platform policies in full.

11. Landing Page Integrity and Transparency

The content of this website accurately represents the products and services advertised. We do not employ bait-and-switch practices. The experience delivered to users arriving from paid advertisements is identical to the experience for all other visitors. Cloaking, automatic redirects, and content variation by traffic source are not used on this website.

12. Children's Privacy

This website is not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If we discover that data has been collected from a person under 16 without verifiable parental consent, we will delete it promptly. Contact us at the email address in this policy if you believe we have received data from a minor.

13. International Data Transfers

Personal data collected through this website may be transferred to and processed in countries outside the European Economic Area, including the United States, where Google LLC and Meta Platforms, Inc. are based.

These transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for personal data. A copy of the applicable SCCs can be requested by contacting us directly at the email address provided in this policy.

14. Your Privacy Rights

If you are located in the European Economic Area, United Kingdom, or other jurisdictions with similar data protection laws, you have the following rights:

• Access (GDPR Article 15): Request a copy of data we hold about you
• Rectification (GDPR Article 16): Correct inaccurate or incomplete data
• Erasure (GDPR Article 17): Request deletion ("right to be forgotten")
• Restriction (GDPR Article 18): Limit how we process your data
• Portability (GDPR Article 20): Receive your data in a structured, machine-readable format
• Objection (GDPR Article 21): Object to processing based on legitimate interest
• Withdraw Consent (GDPR Article 7.3): Revoke consent at any time without penalty

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority:

• European Data Protection Board (EU users)
• Information Commissioner's Office (UK users)

15. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contact form data: Consent (Article 6.1.a) and contract performance (Article 6.1.b)
• Analytics data: Consent (Article 6.1.a)
• Marketing/remarketing data: Consent (Article 6.1.a)
• Security and fraud prevention: Legitimate interest (Article 6.1.f)

16. Data Retention Periods

We retain personal data only for as long as necessary to achieve the purposes outlined in this policy. Specific retention periods by category:

• Contact form submissions: 2 years
• Analytics data (GA4): 14 months
• Marketing cookies (Google Ads): Up to 540 days
• Email communications: Duration of relationship + 1 year
• Server logs: 90 days
• Cookie consent records: 3 years (audit compliance)

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by updating the "Last Updated" date at the top of this policy and, for significant changes, by placing a notice on our homepage at least 14 days before the changes take effect.

Your continued use of our website and services after such changes constitute your acceptance of the updated Privacy Policy.

18. Security of Your Information

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, secure socket layers (SSL), regular security audits, and access controls. However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

19. Third-Party Links

Our website may contain links to third-party websites and services that are not operated by us. This Privacy Policy applies only to information collected through our website. We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party sites before providing your personal information.

20. Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We aim to respond to all privacy inquiries within 30 business days.