Privacy Policy
1. Who we are
Expat Institute is a trade name of Ava Houkes, a sole proprietorship (eenmanszaak) registered in the Netherlands. Ava Houkes (“we”, “us”, “our”) is the controller of your personal data.
- Chamber of Commerce (KvK): 42153968
- Address: Van Doornstraat 30, 1851 JK Heiloo, the Netherlands
- Email: contact@expat-institute.com
This policy applies to everything we do under the name Expat Institute and on www.expat-institute.com. For work under the name Ava Houkes, see https://www.avahoukes.com/privacy-policy.
We handle your personal data in line with the General Data Protection Regulation (GDPR) and Dutch privacy law. This applies wherever you live.
2. Scope
Expat Institute supports expats, their partners and the organisations that send them abroad. This policy covers personal data we collect through:
- Our programmes, workshops and coaching, including online sessions and, where we use one, an online learning platform
- Webinars and other events
- Research to evaluate our programmes, where a programme includes research
- Training and advice for organisations
- Our website, forms and mailing list
- Messages you send us
If you take part in a programme or in research, you also receive separate participant information beforehand. It explains in more detail what happens with your data in that programme, including the exact retention periods.
3. What personal data we collect
We collect only what we need for the purposes in section 4.
When you register for a webinar or event: your name and email address, whether you attended, and any questions you ask. Microsoft Teams also asks you to accept Microsoft’s own event terms when you register. If we record a webinar, we say so in the invitation. We keep only the part in which our presenters speak, without names, voices or images of participants, and we delete the full recording within 48 hours.
When you sign up for a programme or workshop: your name, email address and the answers you give on the sign-up form. If you sign up together with your partner, some programmes ask your partner to sign up themselves, for example through a personal link that you pass on. If we ask you for your partner’s email address, we use it only to match your sign-ups, never to contact your partner.
When you take part in a programme: for example your account on the learning platform, worksheets, reflections, personal notes, messages, and agreements and notes from coaching sessions. This can include information about your health, wellbeing or relationship (see section 7).
When you take part in research: your answers to questionnaires and, if you agree, notes from an interview.
For organisations: names, roles and business contact details of contact persons.
On our website: your name, email address and message when you fill in a form, and general usage statistics (see section 10).
4. Why we use your data, on what legal basis, and for how long
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Webinars and events | Name, email, attendance, questions; the recording, if we record | Your consent (art. 6(1)(a)) | We use your registration until sign-up for the related programme closes, so we can send you a reminder; otherwise until the follow-up email. After that we no longer use it, unless you sign up or join our mailing list. Copies we download are deleted within 48 hours. The registration itself is stored in Microsoft Teams, which keeps it for us under Microsoft’s retention terms; we cannot delete it there ourselves. Full recording: deleted within 48 hours |
| Signing up for a programme or workshop | Name, email, sign-up answers | Your consent (art. 6(1)(a)); if you pay yourself: the agreement with you (art. 6(1)(b)) | If you do not take part: deleted within the period stated in the participant information, unless you join our mailing list |
| If you sign up with your partner: matching your two sign-ups | The email address you give for your partner | Our legitimate interest in matching sign-ups that belong together (art. 6(1)(f)) | Deleted when sign-up for the programme closes. Never used to contact your partner |
| Delivering the programme | Platform account (where possible under a pseudonym), worksheets, reflections, personal notes, messages, session agreements and notes | Your consent (art. 6(1)(a)); if you pay yourself: the agreement with you (art. 6(1)(b)) | Deleted at the end of the programme, unless you choose to export your data first or to keep your account for a limited period |
| Health, wellbeing or relationship information | As above, where it concerns these topics | Your explicit consent (art. 9(2)(a)) | As above |
| Showing that you gave your consent | What you agreed to, when, and which version of the consent text | Legal obligation to be able to show your consent (art. 6(1)(c) with art. 7(1)) | For the period stated in the participant information, and no longer than needed to show that you gave your consent |
| Coaching log for ICF credentialing, only if you agree | Name, contact details, hours of coaching, paid or unpaid; never the content of sessions | Your consent, asked separately (art. 6(1)(a)) | As long as needed for our ICF credential. Only shared with ICF (United States) if it audits that credential |
| Evaluating a programme (research), where this applies | Questionnaire answers; interview notes if you agree; where used, a list linking codes to names | Your explicit consent (art. 6(1)(a) and 9(2)(a)) | For the period stated in the information about that research, and no longer than necessary for the evaluation and for checking its results |
| Training and advice for organisations | Contact persons: names, roles, contact details | Performance of the agreement (art. 6(1)(b)) | 2 years after the end of the engagement |
| Answering your message | Name, email, message | Our legitimate interest in replying (art. 6(1)(f)) | 1 year after we last replied. Messages about a programme you take part in: as for that programme |
| Mailing list, including updates you ask for about an event or information session | Name, email, opens and clicks | Your consent (art. 6(1)(a)) | Until you unsubscribe |
| Website statistics | Pages visited, general usage | Your consent via the cookie banner (art. 6(1)(a)) | As set by our website platform, Systeme.io |
| Invoicing and accounting | Invoice details; for programmes paid by an organisation, never names of participants | Legal obligation (art. 6(1)(c)) | 7 years (Dutch tax law) |
| Handling your privacy requests | Your request and our reply | Legal obligation (art. 6(1)(c)) | 1 year after we handled it |
If you take part in a programme or in research, you receive separate privacy information beforehand, with the exact retention periods for that programme.
Where we rely on consent, you can withdraw it at any time. This does not affect what we did before. When we delete a contact from our website platform, Systeme.io keeps it for up to 30 days before removing it permanently.
You are not required to give us your personal data, but without your contact details we cannot let you take part in a programme. How research relates to taking part in a programme is explained in the participant information for that programme.
5. Our programmes
When an organisation commissions a programme, we are responsible for your personal data, not that organisation. Our starting point is that the organisation never receives what you share in coaching, workshops, worksheets, reflections or personal notes, and from research only aggregated results that cannot be traced back to individuals. What the organisation does receive, and anything that works differently in a specific programme, is agreed in advance and explained in the participant information before you start.
- If you take part with your partner, each of you makes your own choices, for example about consent. Where we use an online platform, each partner has their own account.
- Reflections and personal notes are optional. Where the platform allows it, you choose what your coach can see.
- Where we use an online learning platform, we may ask you to use a pseudonym for your account, so that your full name is not stored on the platform. The participant information explains how.
- In joint coaching sessions, agreements are recorded together and visible to both partners. In individual coaching, we keep notes in your client record, which you can see yourself; if you prefer, we keep no notes. Some programmes have different arrangements, which the participant information explains.
- We do not record workshops or coaching sessions, unless we tell you in advance and you agree.
- At the end of a programme we delete your account, unless you choose to export your data first or to keep your account for a limited period.
6. Research to evaluate our programmes
Some of our programmes are evaluated through research, for example with questionnaires or interviews. When that is the case, you receive separate information beforehand, and you give your consent for the research separately from the programme.
- Coaching and research are kept apart. We never use your individual answers in coaching, and we never use what we hear as coaches in the analysis.
- Where possible, we store your answers under a code instead of your name. Any list linking codes to names is kept separately and securely, and only the researchers can access it.
- We report only aggregated results, in a form that cannot be traced back to individuals. From interviews, we report only themes and, with your consent, anonymised quotes.
- We may use an AI tool to analyse aggregated results. We never enter names, individual answers or open answers into an AI tool.
7. Information about your health, wellbeing or relationship
A move abroad affects wellbeing and relationships, so these topics can come up in our programmes and research. Under the GDPR, information about your health is a special category of personal data. We process it only with your explicit consent, which you give separately for a programme and for any research. You can withdraw your consent at any time.
Our programmes are not therapy or medical treatment. If we believe you need other help, we will tell you and point you to the right support.
8. Who has access and which providers we use
Only Ava Houkes and the professionals who work with us on your programme, such as Rutger Peters (Spill The Beans coaching & consultancy), have access to participant data. They work for us under a data processing agreement and see only the data of the participants they work with.
These are the providers we currently use. Not every programme uses all of them: the participant information for your programme states which ones apply. If we start using a new provider, we update this policy first.
| Provider | What for | Where data is stored |
|---|---|---|
| CoachAccountable, LLC | Learning platform, where a programme uses one: accounts (where possible under a pseudonym), worksheets, personal notes, messages | United States |
| LimeSurvey GmbH | Research questionnaires, under code, where a programme includes research | Germany |
| Systeme.io | Website, sign-up forms, mailing list, website statistics | European Union (Ireland) |
| Microsoft 365 and Microsoft Teams | Email, files, webinars, workshops, video calls | European Union |
| Anthropic (Claude) | Analysis of aggregated results only | United States |
| Cookiebot (Usercentrics A/S) | Cookie banner and records of your cookie choices | European Union |
All providers that process personal data for us do so under a data processing agreement. We never sell your data.
We share information without your permission only if the law requires it, or if there is an immediate or serious risk of harm to you or someone else. In that case we share only what is needed, and only with the people or services who can help, such as emergency services.
9. Transfers outside the European Union
CoachAccountable stores data in the United States, partly with its provider Cloudflare. CoachAccountable is certified under the EU–US Data Privacy Framework. The European Commission has decided that this framework offers an adequate level of protection. We check this certification every year.
10. Cookies and website statistics
Our website runs on Systeme.io. It uses cookies that are strictly necessary for the website to work, and Systeme.io’s own statistics to see how the website is used. On some sign-up pages we also place a functional cookie that briefly remembers which personal sign-up link you came from, so that your sign-up can be matched. It stores only that code, not your name or email address.
We ask your consent through a cookie banner (Cookiebot) before placing any cookies that are not strictly necessary. You can see which cookies we use, and change your choice, through the cookie icon on every page of our website or the link below. We do not use advertising or tracking pixels from third parties.
11. Security
We protect your data with:
- Multi-factor authentication on all accounts
- Encrypted laptops and phones with automatic locking and updates
- Where research uses a list linking codes to names: that list kept offline on hardware-encrypted drives
- Access limited to the people who need it for your programme
- A procedure for handling data breaches, including reporting to the Dutch Data Protection Authority and informing you where required
12. Your rights
You have the right to:
- access your personal data
- have it corrected
- have it deleted
- restrict or object to its processing, including for direct marketing
- receive it in a usable format (data portability)
- withdraw your consent at any time
Send your request to contact@expat-institute.com. We may ask you to confirm your identity. We respond within one month. If a request is complex, we may extend this by up to two months and will tell you why. Once research data can no longer be linked to you, we cannot show or delete it.
13. Automated decisions
We do not make decisions about you based solely on automated processing, and we do not use profiling.
14. Changes to this policy
We update this policy when our services or tools change. The latest version is always on our website, with its date and version number. If a change affects you significantly, we will let you know.
15. Questions and complaints
Expat Institute, a trade name of Ava Houkes
Van Doornstraat 30, 1851 JK Heiloo, the Netherlands
contact@expat-institute.com · www.expat-institute.com
If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (https://www.autoriteitpersoonsgegevens.nl) or with the authority in the EU country where you live or work.
Privacy Policy — Expat Institute · Version 2.7 · 5 November 2026