TCN✨
TCN

Privacy Policy

Last updated: 5 August 2026

This Privacy Policy explains how The Consolidator Network ("TCN", "we", "us") collects, uses, and protects your personal data when you use theconsolidatornetwork.com and the associated member platform. We comply with the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG.

1. Data Controller

The controller responsible for your personal data is The Consolidator Network. For any privacy-related question or to exercise your rights, contact privacy@theconsolidatornetwork.com.

2. Personal Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, hashed password, membership tier, sign-up date.
  • Enrollment data: date of birth, city, profession, business goals, time available.
  • Payment data: billing name, address, and card details are processed by Stripe. We only store your Stripe customer ID, subscription status, price, and renewal / cancellation dates. We never see or store your full card number.
  • Platform activity: step progress, daily logs, acquisition entries, messages sent to your mentor, community waitlist submissions, and Expert-tier applications.
  • Technical data: IP address, browser/user-agent, session cookies, timestamps of logins and API calls, and standard server logs.

3. Purposes and Legal Basis

We process personal data on the following GDPR Article 6 bases:

  • Contract (Art. 6(1)(b)) — to create your account, deliver the training program, process payments, and provide mentorship.
  • Legitimate interest (Art. 6(1)(f)) — to secure the platform, prevent fraud, analyze usage in aggregate, and improve the service.
  • Legal obligation (Art. 6(1)(c)) — to keep tax and financial records for the periods required under Dutch law (typically 7 years).
  • Consent (Art. 6(1)(a)) — for optional marketing emails and for joining the community waitlist. You can withdraw consent at any time without affecting prior processing.

4. Sub-processors and Third Parties

We share personal data only with the service providers necessary to operate TCN. Each is bound by a Data Processing Agreement and applies its own security controls.

  • Supabase (database, authentication) — EU / US, GDPR-compliant, Standard Contractual Clauses.
  • Vercel (application hosting, edge network) — US, DPF-certified, SCCs.
  • Stripe (payments, billing portal) — US, DPF-certified, PCI-DSS Level 1.
  • Resend (transactional and mentor notification emails) — US, SCCs.

We do not sell, rent, or trade your personal data to anyone.

5. International Transfers

Some of the sub-processors above process data outside the European Economic Area (primarily in the United States). Where this happens, transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission, together with supplementary technical safeguards.

6. Cookies and Similar Technologies

We use a small number of strictly necessary cookies to keep you logged in (NextAuth session cookies, CSRF tokens) and to keep the platform functional. We do not use advertising cookies or third-party trackers. Because these cookies are strictly necessary, no consent banner is required under Dutch cookie law (Article 11.7a Telecommunicatiewet). Browser-level controls can be used to block cookies, but the platform will not function without the session cookie.

7. Retention

  • Active account data — kept for the duration of your membership.
  • After account deletion — most personal data is deleted or anonymised within 30 days.
  • Payment / invoice records — retained for 7 years as required by Dutch tax law (Art. 52 AWR).
  • Security and audit logs — retained for up to 12 months.
  • Marketing consent records — retained as long as needed to prove consent, then deleted.

8. Your Rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Correct inaccurate data (Art. 16).
  • Have your data erased (Art. 17), subject to legal retention obligations.
  • Restrict or object to processing (Art. 18 and 21).
  • Receive a machine-readable copy of your data (Art. 20).
  • Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy@theconsolidatornetwork.com. We respond within 30 days.

9. Right to Complain

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.

10. Security

We apply industry-standard measures including TLS in transit, encryption at rest via our database provider, bcrypt-hashed passwords, least-privilege access to production systems, and audited logs. No online service can guarantee absolute security; if a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the Dutch DPA within 72 hours as required by Article 33 and 34 GDPR.

11. Children

TCN is intended for adults engaged in business acquisition activity. The service is not directed at persons under 16, and we do not knowingly collect personal data from children. If we learn that we have inadvertently collected such data, we will delete it promptly.

12. Automated Decision-Making

We do not make decisions about you that produce legal or similarly significant effects solely by automated means. Expert-tier applications are reviewed by a human operator.

13. Changes to this Policy

We may update this policy from time to time. Material changes will be announced by email and in-app before they take effect. Continued use of TCN after the effective date constitutes acceptance of the updated policy.

14. Contact

Questions about privacy? Contact privacy@theconsolidatornetwork.com.