Privacy Policy
Last updated: 17-9-2026
Who we are
This website and the courses sold through it are operated by BYBOLT ("Bolt Bows", "we", "us"), registered in the Netherlands.
- Address: Menno ter Braakstraat 6H
- KvK number: 70020523
- Email: [jaap@boltbows.com]
We are the data controller for the personal data described in this policy. If you have any question about how we handle your data, email us at the address above and a real person will answer.
What we collect
When you buy a course. Your name, email address, country, and — where required for tax purposes — your billing location. Card details are entered directly with our payment processor and never reach us; we see only the last four digits, the card type, and whether the payment succeeded.
When you sign up for emails or download a free resource. Your name and email address, and which resource you asked for.
When you visit our pages. Your IP address, browser and device type, the pages you viewed, how you arrived, and how you interacted with the page. Some of this is collected through cookies and similar technologies, and only with your consent where consent is required.
When you email us. Whatever you write to us, and our reply.
We do not knowingly collect data from anyone under 16. We do not collect or store special categories of personal data.
Why we use it, and on what legal basis
| What we do | Legal basis (GDPR Art. 6) |
|---|---|
| Deliver the course you bought, give you access, and provide support | Performance of a contract |
| Send you transactional email about your purchase (receipt, access details, updates to the course you own) | Performance of a contract |
| Send marketing email about our other courses and products | Your consent, which you can withdraw at any time |
| Measure how our pages perform and improve them | Your consent (analytics cookies) |
| Show and measure advertising, including to people who visited our pages | Your consent (marketing cookies) |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud and abuse, and defend legal claims | Our legitimate interests |
You can withdraw consent at any time — see Your rights below. Withdrawing marketing consent does not stop transactional email about a course you've bought.
Who we share it with
We use the following service providers, each of which processes personal data on our behalf under a data processing agreement:
- SamCart — checkout and order processing
- Stripe and/or PayPal — payment processing (they are independent controllers for payment data)
- Kajabi — course hosting, email list, and website pages
- Google (Workspace) — our business email
- Cloudflare — DNS and website delivery
- Meta Platforms — advertising and conversion measurement, where you have consented
- Microsoft Clarity — page analytics, where you have consented
We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.
Some of these providers are based in the United States or process data there. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism.
We may also disclose data where we are legally required to, for example to a tax authority or in response to a valid legal order.
How long we keep it
- Order and invoice records: seven years, as required by Dutch tax law.
- Course access and account data: for as long as you have access to a course you bought.
- Marketing email data: until you unsubscribe, and then only what we need to honour your unsubscribe.
- Analytics and advertising data: as set out in the cookie table on our cookie notice, generally no more than 26 months.
- Email correspondence: up to two years after our last exchange, unless it relates to an order.
Cookies and similar technologies
We use cookies that are strictly necessary to run the checkout and remember your consent choices — these are set without asking, because the site cannot function without them.
Analytics and advertising cookies, including the Meta pixel, are only set after you consent. You can accept, refuse, or change your choices at any time through the cookie banner, and refusing them does not stop you buying or using a course.
Our pages also store small amounts of information in your browser to remember things like your place in a course. That information stays on your device.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Delete your data, where we have no overriding obligation to keep it
- Restrict or object to our processing
- Receive a copy of the data you gave us, in a portable format
- Withdraw consent at any time, where we rely on consent
- Unsubscribe from marketing email — every marketing email carries a one-click link
Email [jaap@boltbows.com] to exercise any of these. We will respond within one month. We won't charge you, and we won't treat you differently for asking.
If you think we've handled your data badly, we'd rather you told us first — but you have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own country of residence.
Security
We use providers that encrypt data in transit and at rest, two-factor authentication on our own accounts, and access limits so that only people who need your data can see it. No system is perfectly secure, but if a breach ever affected your data and posed a risk to you, we would notify you and the regulator as the law requires.
Changes to this policy
If we change how we handle personal data, we'll update this page and change the date at the top. Where the change is significant and we have your email address, we'll tell you directly rather than leaving you to notice.
BYBOLT · Menno ter Braakstraat 6H · KvK 70020523 · [jaap@boltbows.com]
