Privacy Statement
Privacy Statement VDCbase B.V.
Version 30 September 2026 · accompanies article 12 of the General Terms and Conditions · vdcbase.com/privacyverklaring
This statement sets out which personal data VDCbase processes, why, with whom it is shared and how long it is kept.
This is the English translation of the Dutch “Privacyverklaring VDCbase B.V.”. In case of any difference between the two texts, the Dutch version prevails.
Who processes your data
VDCbase B.V., Axwijk 11a, 1472 GA Middelie, the Netherlands, Chamber of Commerce number 77534220, is the controller. Questions about this statement: info@vdcbase.com.
VDCbase has no data protection officer; this is not required for a company of this size.
What data, for what purpose, on what basis
|
Purpose |
Data |
Legal basis |
|
Issuing quotations and keeping in touch |
name, job title, organisation, email, phone |
legitimate interest |
|
Performing an assignment |
contact details, project information, correspondence |
performance of the agreement |
|
Administering an enrolment |
name, organisation, country, language preference, chosen cohort |
performance of the agreement |
|
Assessing admission to Practitioner |
openBIM experience, earlier certifications, CV if you send one |
performance of the agreement |
|
Invoicing and bookkeeping |
billing address, VAT number, purchase order number, payment details |
legal obligation |
|
Delivering and supporting the training |
submitted assignments, questions, attendance |
performance of the agreement |
|
Recording sessions for the cohort |
image, sound, transcript, summary |
performance of the agreement |
|
Registering for the examination |
name and email address |
performance of the agreement |
|
News about new training dates |
name, email address |
consent |
|
Handling complaints |
correspondence about the complaint |
legitimate interest |
You are not obliged to provide this data, but without the data listed under “performance of the agreement” VDCbase cannot deliver the training or assignment.
Who we share data with
VDCbase does not sell data and shares it only where necessary for the purpose.
|
Recipient |
Purpose |
Location |
|
buildingSMART International |
examination registration and certification |
Germany |
|
Fathom Video Inc. |
recording, transcription and summary of the online sessions |
United States |
|
Microsoft |
Teams for the sessions, Outlook and SharePoint |
EU, with possible transfer to the US |
|
Tylko Advisors sp. z o.o. |
the learning platform: access to course material and submission of assignments |
Poland |
|
Pipedrive |
administration of enquiries, enrolments and correspondence |
EU |
|
Exact |
invoicing and bookkeeping |
Netherlands |
|
Accountant and Dutch Tax Administration |
legal obligations |
Netherlands |
VDCbase concludes a data processing agreement with each processor.
Transfers outside the EU. Fathom Video Inc. is based in San Francisco and hosts the service in the United States. Fathom is certified under the EU-U.S. Data Privacy Framework, supervised by the Federal Trade Commission, and additionally applies the Standard Contractual Clauses of the European Commission. DataRep acts as its EU representative. Fathom’s data processing agreement is available at fathom.ai/dpa.
In practice this means the video and transcripts of the sessions are stored on servers outside the EU. Participants are told this in advance and may ask not to appear in them, under article 24.5 of the General Terms and Conditions.
AI models. Fathom may use de-identified data from recordings to improve its own AI models. Fathom does not permit third parties such as OpenAI, Anthropic or Google to use recordings or personal data to train their models. VDCbase has switched off that use in Fathom, both at account level and for the whole organisation, so that training recordings are not used to train Fathom’s models.
The learning platform sits with a partner. Tylko Advisors sp. z o.o. provides the platform holding the course material and receiving participants’ practical assignments. This is within the EU, so no transfer question arises. Tylko is also the party selling the self-paced version of the Foundation course. VDCbase has a data processing agreement with Tylko recording that they use participant data solely for the platform and not for their own marketing.
How long we keep data
|
Data |
Period |
|
Invoices and accounts in Exact |
7 years, statutory retention obligation |
|
Agreements and correspondence about an assignment |
7 years after completion |
|
Recordings, transcripts and summaries |
12 months after the last session |
|
Submitted assignments and accounts on the Tylko platform |
3 months after the last session |
|
CVs and certificates for admission |
up to 3 months after assessment |
|
Participant records for accountability as a Registered Training Provider |
as long as buildingSMART International requires, and in any event while the certificate is valid |
|
Complaints |
5 years |
|
Contact details for news about training dates |
until you withdraw your consent |
|
Quotations that did not lead to an assignment |
2 years |
Security
VDCbase protects data through account-level access restrictions, two-factor authentication where the service supports it, encrypted connections, and limiting staff access to what they need for their work. In the event of a data breach posing a risk to data subjects, VDCbase reports it to the Dutch Data Protection Authority within 72 hours and informs those affected.
Your rights
You have the right to:
- access your data and receive a copy
- have inaccurate data corrected
- have your data erased, to the extent VDCbase is not legally required to keep it
- have processing restricted while an objection is pending
- object to processing based on legitimate interest
- port your data in a common file format
- withdraw your consent, without affecting the lawfulness of processing before withdrawal
Send your request to info@vdcbase.com. VDCbase responds within one month. For a request to erase recorded material, VDCbase removes what can reasonably be removed; in a group recording an individual contribution cannot always be separated out.
If you disagree with how VDCbase handles your data, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.
Automated decision-making
VDCbase does not take decisions based on automated processing that produce legal effects for you. The assessment of whether you meet the admission requirements is made by a person, at the intake.
Cookies
The website uses functional cookies needed to make the site work. These require no consent. In addition, embedded services place cookies: the enrolment and contact forms from Pipedrive, and videos where a page contains them. The cookie banner asks consent for these in advance. If you decline, the rest of the site works as normal but you will not see the form; use info@vdcbase.com instead.
Changes
VDCbase may amend this statement. The current version is always available at vdcbase.com. In the event of a significant change, VDCbase informs those affected directly.
Version 30 September 2026. Questions: info@vdcbase.com. This English text is a translation; in case of any difference, the Dutch version prevails.
We’re always excited about new projects and partnerships. Feel free to send us a message!