Last updated 3 November 2026
1. Who we are
This website, www.neurosuite.nl, is operated by Neurosuite B.V., Ubachsberg, 3453 PV Utrecht (De Meern), Netherlands, on behalf of the Neurosuite group. The group, Neurosuite Holding, consists of three independent companies, each with its own office: Neurosuite B.V. (Netherlands), Neurosuite Ltd (20B Ore Ofe Crescent, off Governor's Road, Ikotun, Lagos, and No. 2, KD Drive, Akobo, Ibadan, Oyo State, Nigeria) and Neurosuite LLC (Al Manazil Building, UBL Business Center, Office 40, Al Garhoud, Dubai, United Arab Emirates). In this notice "Neurosuite", "we" or "us" refers to the company that processes your data as described below.
Neurosuite B.V. is the controller for personal data of website visitors and of business contacts, clients and partners in the European Economic Area and the United Kingdom. Neurosuite Ltd is the controller for personal data of Training Academy participants, candidates, employees and clients in Nigeria. Neurosuite LLC is the controller for personal data of clients, candidates and employees in the United Arab Emirates. Where two companies use the same data (for example, a trainee who later works on a European client engagement), they act as joint controllers and have agreed their respective responsibilities; you can exercise your rights against any of them.
Contact for privacy matters: info@neurosuite.nl (subject line "Privacy") or by post to Neurosuite B.V. at the Netherlands address above.
2. What personal data we process and why
Website visitors. Our web server records technical data (IP address, date and time, requested page, browser type) in standard server logs for security and troubleshooting. Logs are retained by our hosting provider for a limited period and are not used to profile visitors. When you first open the website, we determine from your IP address whether you are visiting from the Netherlands, so that we can show the Dutch version; the IP address is not stored for this purpose and you can change the language at any time. Analytics cookies are set only with your consent. See the cookie notice for details.
Enquiries. When you submit the enquiry form, or email or call us, we process your name, organisation, email address, telephone number, country, the topic you chose and the content of your message. We use this to respond, to send you a confirmation of your enquiry, to prepare a proposal and, if you become a client or partner, to manage the relationship and contract. Legal basis: pre-contractual steps and performance of a contract (GDPR article 6(1)(b)) and our legitimate interest in running our business (article 6(1)(f)). Enquiry data is retained for up to 24 months after our last contact unless a contract follows, in which case it is retained for the duration of the relationship and the statutory retention periods (seven years for financial records in the Netherlands).
Clients and client personnel. During engagements we process contact details of client personnel for communication and service management, and we may access personal data contained in client systems on the client's instructions. For data in client systems we act as processor; the client's own privacy notice applies and a data processing agreement governs our work. See also security and access.
Training Academy and recruitment. When you register interest in the Neurosuite Training Academy or apply for a traineeship or position, the relevant Neurosuite company processes your name, email address, telephone number, background and motivation, and any documents you later provide. We use this to manage your registration, communicate about the programme, allocate venues, run the selection process, make and administer offers, and comply with legal obligations. Legal basis: your consent for the registration of interest (which you may withdraw at any time), steps prior to entering into a contract for the selection process, and our legitimate interest in running a fair selection. Candidate data is retained for the duration of the programme and selection cycle and up to 12 months afterwards, after which it is deleted or anonymised. Successful candidates' data becomes part of their traineeship or employment file. We do not make decisions based solely on automated processing.
Suppliers and other contacts. We process contact and payment details of suppliers and other business contacts to manage contracts and comply with accounting obligations.
3. Who we share data with
We share personal data only with our hosting and email providers (who process data on our instructions), our analytics provider if you have consented to analytics cookies, professional advisers where necessary, the other Neurosuite companies as described above, and authorities where the law requires it. We do not sell personal data and we do not share it with advertisers.
4. International transfers
Neurosuite operates from the Netherlands, Nigeria and the United Arab Emirates. Where personal data of people in the EEA is accessed by or transferred to Neurosuite Ltd in Nigeria or Neurosuite LLC in the United Arab Emirates (for example, a client contact's details used by a consultant), the transfer is protected by the European Commission's standard contractual clauses between the companies concerned, supported by technical and organisational measures such as access controls, encryption and, where selected for an engagement, EU-hosted virtual desktops. Academy and candidate data of people in Nigeria is processed in Nigeria under the Nigeria Data Protection Act 2023; personal data of people in the United Arab Emirates is processed under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where such data is shared with another Neurosuite company, equivalent safeguards apply.
5. Security
We apply technical and organisational measures appropriate to the risk, including multi-factor authentication, least-privilege access, encrypted devices and transport, access logging and staff confidentiality obligations. The enquiry form is transmitted over HTTPS and protected against automated abuse; submissions are delivered by email to our mailbox and the confirmation to yours, and are not stored on the web server.
6. Your rights
Depending on where you are, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting processing before withdrawal). To exercise these rights, email info@neurosuite.nl with "Privacy" in the subject line. We respond within one month (GDPR) or the period required by the applicable law in Nigeria or the United Arab Emirates. We may ask you to verify your identity. You can also complain to a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), in Nigeria the Nigeria Data Protection Commission (ndpc.gov.ng) and in the United Arab Emirates the UAE Data Office.
7. Children
This website and the Training Academy programme are intended for adults (18 and over). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
8. Changes to this notice
We update this notice when our processing or the law changes. The date at the top shows the latest version. Material changes affecting academy participants or candidates are communicated by email.