Limitless

Privacy and cookies

Privacy and Cookie Policy

Website text for Limitless, operated by Beyond IQ.

Effective date: 27 August 2026 · Last updated: 27 August 2026

1. Who we are

This policy applies to Limitless and the website https://www.limitlessinschools.com. The service is operated by Beyond IQ, trading as Limitless, at Neuweg 330, 1215 JH Hilversum, the Netherlands. KVK: 77754581. VAT identification number: NL003237675B89.

Privacy enquiries may be sent to info@beyond-iq.com or made by telephone on +31 (0)6 383 36 422. You may also use the contact option published on https://www.limitlessinschools.com. Beyond IQ is the controller of personal data described in this policy unless a contract expressly states that it acts as a processor for a school or another organisation.

2. Personal data we collect

  • Identity and contact information, including name, organisation, role, email address, telephone number and correspondence.
  • Transaction and administration information, including the service purchased, payment status, invoice details and tax records. Payment card details are processed by the payment provider and are not stored by Beyond IQ.
  • Website and device information, including IP address, browser/device details, cookie identifiers, consent choices and website interaction data.
  • Communication, feedback, survey responses, testimonials and preferences, including newsletter choices.
  • Student and parent information needed for enrolment and programme delivery, such as student name, age, school, parent/guardian contact details, attendance, learning interests, reflections and relevant support information voluntarily provided by the parent or school.
  • Account information for any Limitless digital platform, such as username, role, access status, submitted work and moderation records. Students should not use a full name as a public username.
  • Photographs, video, audio, interviews or identifiable student work only where the relevant, specific consent has been obtained.

3. Why we use personal data and our legal bases

  • To answer enquiries, prepare quotations, manage registrations, deliver services, provide materials and customer support, and administer accounts: necessary to take steps at your request or perform a contract.
  • To invoice, keep financial records and comply with safeguarding, tax, accounting or other legal duties: compliance with a legal obligation.
  • To operate securely, prevent misuse, maintain service quality, understand aggregated website use and protect legal rights: legitimate interests, balanced against individual rights.
  • To send optional marketing, place non-essential cookies, publish identifiable testimonials or media, or process information where consent is the appropriate basis: consent, which may be withdrawn.
  • To protect a person’s vital interests in a genuine emergency, where applicable.

4. Children and school-provided information

Limitless is designed for children and young people. The participating school remains the educational and practical programme partner. The school normally pays the programme fee, but where Beyond IQ and the school have agreed this arrangement in advance, participating parents or guardians may pay Beyond IQ directly for their child’s place. Parents or guardians also remain involved where their consent is required for participation, optional media use or another child-related purpose. Beyond IQ does not knowingly ask a child under 16 to provide consent for optional marketing, public media use or other consent-based processing directly. A parent/guardian must provide that consent where required.

A school that shares student information must have an appropriate legal basis and must tell families how information is shared. The applicable school agreement will clarify whether Beyond IQ acts independently or on the school’s documented instructions for a particular activity. Only information reasonably necessary for safe and effective programme delivery should be shared.

5. Sharing information

We share personal data only when needed for the purposes above, under appropriate contractual and security arrangements. Recipients may include:

  • Lovable and its infrastructure providers, for website hosting and technical delivery.
  • Google Fonts, for website typography. The implementation should be configured to minimise unnecessary transfer of visitor data.
  • YouTube in privacy-enhanced mode (youtube-nocookie.com), for embedded video. The player must remain blocked until consent if it stores or accesses non-essential information.
  • Microsoft 365/Teams and Google Workspace/Drive where agreed with a school for secure educational collaboration, document storage or temporary processing.
  • Zoom where used for live online workshops or consultations.
  • Professional advisers, insurers, auditors, public authorities or courts where necessary or legally required.
  • Schools, parents/guardians and programme partners where necessary for the agreed educational service and consistent with the information given to the individuals concerned.

We do not sell personal data. If a provider processes data outside the European Economic Area, we use an available lawful transfer mechanism, such as an adequacy decision or approved Standard Contractual Clauses, and apply additional safeguards where required.

6. Retention

  • Enquiries that do not lead to a contract: normally up to 24 months after the last meaningful contact.
  • Contracts, invoices and core financial administration: normally 7 years, or longer where Dutch law requires.
  • Workshop and service administration: the contract period plus up to 2 years, unless a longer period is needed for a dispute or legal claim.
  • Student programme records: normally up to 2 years after participation ends; safeguarding or incident records may be retained longer where necessary and lawful.
  • Newsletter records: until consent is withdrawn, plus a minimal suppression record to honour the opt-out.
  • Consent and media-release records: while the material is used and for an appropriate period afterwards to demonstrate consent.
  • Cookie consent records and cookie durations: as stated in the live cookie settings; consent should be renewed when required and at least after material changes.

7. Your rights

Subject to the GDPR and any applicable limitations, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You may also object to direct marketing at any time.

Send requests to info@beyond-iq.com. We may ask for information reasonably necessary to verify identity, but do not send an unredacted passport or BSN unless specifically and lawfully required. We normally respond within one month. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Security

We use proportionate technical and organisational measures, including access controls, secure service providers, limited access, backups and staff/contractor confidentiality. No system is completely secure. If a personal-data breach creates a legally reportable risk, we will follow the applicable notification duties.

9. Cookies and similar technologies

We use strictly necessary technologies to operate the website, remember privacy choices, secure forms and support checkout. These do not require consent where the law permits, but they are explained in the cookie settings.

Analytics, embedded media, advertising or other non-essential technologies are used only after valid consent where required. Rejecting them must be as easy as accepting them. Non-essential technologies must remain blocked until consent, and visitors must be able to change or withdraw consent through a persistent “Cookie settings” link.

  • Necessary: security, network management, forms, checkout and consent storage.
  • Preferences: optional settings remembered for the visitor.
  • Analytics: measurement of website use. Use only the configured privacy-protective setup and obtain consent when required.
  • Media/marketing: services such as YouTube, Vimeo, Meta or advertising pixels. Block before consent where required.

Providers currently in use on this website are Lovable (hosting), Google Fonts (typography) and YouTube in privacy-enhanced mode (embedded video, blocked until consent). Google Analytics, Meta Pixel, Calendly and Vimeo are not active website providers on this site.

10. Changes

We may update this policy when our services, providers or legal obligations change. The current version and effective date will be published on this page. Material changes will be highlighted where appropriate.