Privacy Statement

1. Who we are

This privacy statement explains how Flashgroup B.V., trading as Flash Group XR (“Flash Group XR”, “we”, “us” or “our”), handles your personal data. It applies to our website, our communications and our relationships with customers, partners, suppliers, and job applicants.

For these activities, we are the data controller within the meaning of the EU General Data Protection Regulation (GDPR). This means we determine why and how your personal data is processed.

Flashgroup B.V.
Haagweg 1, 4814 GA Breda, the Netherlands
Chamber of Commerce (KvK) number: 85507229
Email: info@flashgroupxr.com

2. Personal data we process

Personal data is any information that can directly or indirectly identify a natural person. We receive it when you provide it to us, when you use our website or services, and occasionally from public business sources.

Data you provide to us:

Identity and contact details: name, job title, organization, business address, email address, and phone number.
Contract and financial details: quotes, orders, invoices, bank account details, and payment information.
Correspondence: the content of emails, contact forms, demo requests, and other messages you send us.
Event and marketing details: registrations for demos, webinars, trade fairs and newsletters, and your communication preferences.
Application details: your resume, cover letter, date of birth. and other information relevant to a job application or agreement.

Data we collect when you use our website and services:

Technical data: IP address, device and browser type, operating system. and device identifiers.
Usage data: pages visited, clicks, referring website and time spent on the site, collected through cookies and similar technologies (see section 5).
Customer satisfaction data, such as feedback and survey responses.

Data from other sources:

We may obtain business contact details from public sources, such as company websites, the Chamber of Commerce register, and professional networks like LinkedIn.
We do not intentionally collect special categories of personal data, such as health information, through our website or business relationships.

3. Data in our XR training software

When organizations use our XR training software, such as Academy and Elementary, they decide whose data is processed and for what purpose. In that case, the organization is the data controller and Flashgroup B.V. acts as a data processor under a data processing agreement.

Depending on how the software is used, this may include:

User account details: name, email address, organization, and role.
Training data: sessions, scenarios completed, choices made, results, and progress.
Device and technical data: headset or device identifiers, software version, and error logs.

We use this data only to provide, secure, and support the software on behalf of our customer. We may use aggregated or pseudonymized usage data, which no longer identifies individual users, to improve our products.

If you are a trainee or user of our software, please contact your own organization first with questions about your data. We will assist them in handling your request.

4. Purposes and legal bases

We only process personal data when we have a legal basis under Article 6 of the GDPR: your consent, the performance of an agreement with you, a legal obligation, or our legitimate interests. We process personal data for the following purposes:

Responding to questions, contact forms, and demo requests [legal basis: performance of an agreement (pre-contractual steps); legitimate interest].
Entering into and performing agreements, including delivery, licenses, invoicing, and administration [legal basis: performance of an agreement; legal obligation].
Customer support, warranty obligations, and handling complaints [legal basis: performance of an agreement; legal obligation; legitimate interest].
Sending newsletters, offers, and other commercial information [legal basis: consent; legitimate interest for existing customers].
Organizing demos, webinars, trade fairs, and other events [legal basis: performance of an agreement; legitimate interest].
Market research, measuring customer satisfaction, improving our website, products, and services [legal basis: legitimate interest; consent for non-essential cookies].
Linking website cookie data to known customer data to tailor our communication [legal basis: consent].
Recruitment and selection [legal basis: performance of an agreement (pre-contractual steps); consent for keeping your application longer].
Security, fraud prevention, and IT management [legal basis: legitimate interest].
Complying with legal obligations, settling disputes, and enforcing our rights [legal basis: legal obligation; legitimate interest].

Our legitimate interests include business-to-business marketing, security, IT management, product development, business administration, and legal affairs. Where we rely on legitimate interest, we weigh it against your interests and rights. You can always object, as explained in section 11.

You can unsubscribe from commercial messages at any time via the link in each message or by contacting us.

5. Cookies and similar technologies

Our website uses cookies and similar technologies, such as pixels and web beacons in emails. We place functional cookies without asking, because the website cannot work properly without them. We only place analytics cookies that affect your privacy, and marketing or tracking cookies, after you have given consent via our cookie banner.

Functional cookies: make the website work, for example by remembering your cookie choices.
Analytics cookies: help us understand how visitors use the website so we can improve it.
Marketing cookies: let us and our partners measure campaigns and show relevant content or ads.

You can change or withdraw your consent at any time via the cookie settings on our website, or delete cookies through your browser settings. More information about the specific cookies we use is available in our cookie statement.

6. Sharing personal data

We do not sell your personal data. We only share it when this is necessary for the purposes in section 4.

Processors working on our behalf:

We use service providers that process personal data on our instructions, such as providers of hosting and IT services, our website and content management system, email and newsletter tools, CRM software, analytics tools, and accounting and invoicing software. We conclude a data processing agreement with each of them.

Other recipients:

Our affiliated companies, for central administration, customer service, and the performance of agreements.
Advisers who are not processors, such as accountants, auditors, and lawyers.
Government authorities, supervisory authorities or the Public Prosecution Service, when we are legally required or permitted to share data, or to prevent fraud or misuse.
Potential buyers or investors, in the event of a merger, acquisition, reorganization, or sale of business activities.

7. Transfers outside the EEA

We aim to process personal data within the European Economic Area (EEA). Some of our service providers may process data outside the EEA. In that case we only transfer data to countries or frameworks for which the European Commission has issued an adequacy decision, or we use the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

You can contact us for more information about these transfers and the safeguards we use.

8. How long we keep your data

We keep personal data no longer than necessary for the purpose it was collected for, or as long as the law requires.

Contact and demo requests that do not lead to an agreement: up to 2 years after our last contact.
Customer and contract data: for the duration of the relationship, plus up to 2 years.
Financial and tax records: 7 years, as required by Dutch tax law.
Job applications: up to 4 weeks after the procedure ends, or up to 1 year with your consent.
Newsletter subscriptions: until you unsubscribe.
Website analytics data: as set out in our cookie statement.

After these periods, we delete or anonymize the data.

9. Security

We take appropriate technical and organizational measures to protect personal data against misuse, loss, unauthorised access, unwanted disclosure, and unauthorized modification. These include encrypted connections (HTTPS), access controls based on need-to-know, secure authentication, backups, and confidentiality obligations for staff and service providers. We review these measures periodically against current threats.

If a data breach occurs, we report it to the Dutch Data Protection Authority where required, and we inform you if the breach is likely to pose a high risk to your rights and freedoms.

10. Automated decision-making and minors

We do not make decisions based solely on automated processing, including profiling, that have legal effects for you or similarly significantly affect you.

Our website and services are aimed at professionals and organizations. We do not intend to collect personal data from people under 16 through our website. If you believe we have collected such data without consent from a parent or guardian, please contact us and we will delete it. Where customers use our software with users under 16, they are responsible as data controller for obtaining any required consent.

11. Your rights

Under the GDPR you have the following rights regarding your personal data:

The right of access: to know which personal data we hold about you and with whom we have shared it.
The right to rectification of inaccurate or incomplete data.
The right to erasure of your data.
The right to restriction of processing.
The right to data portability.
The right to object to processing based on our legitimate interests or those of a third party.
The absolute right to object to direct marketing.
The right to withdraw your consent at any time, where processing is based on consent. This does not affect processing that took place before withdrawal.
The right not to be subject to a decision based solely on automated processing.

To exercise your rights, email us at info@flashgroupxr.com. We respond within one month. For complex or numerous requests we may extend this by two further months, in which case we will let you know. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

We may ask for additional information to verify your identity. If we ask for a copy of an identity document, please mask your passport photo, the machine-readable zone (the strip of numbers at the bottom), your document number and your citizen service number (BSN).

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl. We would appreciate it if you contact us first, so we can try to resolve your concern.

12. Changes and contact

The way we process personal data may change, so we may update this privacy statement from time to time. The latest version is always available on our website. We will inform you of significant changes where required.

For questions or comments about this privacy statement or our handling of personal data, contact us at:
info@flashgroupxr.com

This privacy statement was last updated on 28 October 2026.