Privacy notice
Careful with what you share.

EnergyJoy®, the business of Lisette Lucas, is the controller. EnergyJoy® is registered with the Dutch Chamber of Commerce under number 27268703 and has VAT ID NL002043645B20. Contact: info@lisettelucas.nl.

This notice applies to lisettelucas.nl, its Dutch and English forms, The Signal Audit™, the 21-day Above the Golden Line Journey, Soul Connection Calls, contact, media and private enquiries, transactional email and Li’s Private Leadership Notes. An external payment, Academy or event platform may provide additional privacy information.

• Enquiries and appointments: name, email, telephone number, organisation, role, message, intake, language, source and booking details. To answer and prepare your request, based on your pre-contractual request and our legitimate interest in careful business communication.
• The Signal Audit™: answers are used in your browser to determine a reflective profile. Free-text answers are not sent with the result email or stored in the CRM. Only when you actively choose this, we process name, email, profile, timestamp and consent evidence to send your personal result and three Signal Integration emails within 72 hours. The sequence then stops automatically. Li’s Private Leadership Notes require a separate voluntary choice and confirmation email.
• Above the Golden Line Journey: when you actively request this free method, we process name, email, language, source, timestamp and consent evidence to send the PDF, Hypnotation and fifteen supporting emails across listening days 1 through 21. This requested finite sequence then stops automatically. Li’s Private Leadership Notes remain a separate voluntary choice with a confirmation email.
• Client, purchase and administration data: services, participation, invoice, payment and accounting information. To perform the contract, administer the relationship and meet legal obligations.
• Technical data: IP address, date, time, browser, device and necessary error or security logs. For secure and reliable operations, based on legitimate interests.
• Measurement after consent: visited page, source, campaign attributes, clicks, scroll, engagement checkpoints, language, video, form and booking actions, and pseudonymous browser or advertising IDs. For website analytics, conversion measurement, audience creation and more relevant advertising, based solely on your consent.
• Email preferences and consent evidence. Li’s Private Leadership Notes use separate consent, except where a narrow statutory existing-customer exception applies. Every marketing email includes an unsubscribe option.

Most data comes directly from you. Additional relationship, source or purchase information may come from our own records or from a platform you use for a booking, purchase or participation.

Fields marked as required are needed to handle your enquiry or perform a contract. Without that information, this may not be possible. The marketing choice is always voluntary.

In an initial free-text field, share only what is necessary. Sensitive information about matters such as health or beliefs is processed only where needed and legally permitted, including with your explicit consent where required. Do not send a national identification number, identity-document copy, password, full medical record or payment-card details through a free-text field.

Only parties needed for their agreed task receive appropriate access. These include website hosting and security, Brevo for CRM and email, Calendly for scheduling and, where relevant, payment, accounting, Academy and professional providers. Calendly and YouTube load on this site only after your active choice. After following an external link, such as Spotify, Apple Podcasts, Substack or social media, that provider's policy also applies.

For optional measurement, Google Analytics, Meta Pixel and Conversions API, Brevo Tracker may also receive data after you have consented. For a consented lead conversion, Meta may receive normalised and hashed contact details to improve measurement. We do not send free-form text or sensitive intake answers to analytics or advertising platforms.

Providers may use data only for their assignment or their own legal responsibility. We do not sell personal data.

Read the short cookie notice

Some providers or subprocessors may process data outside the European Economic Area. Where necessary, we use valid safeguards such as an adequacy decision, the EU-US Data Privacy Framework for certified recipients, or standard contractual clauses with appropriate supplementary measures. You may request information about the applicable safeguard via info@lisettelucas.nl.

• Closed or unsuitable enquiries: generally no more than 24 months after the last meaningful contact.
• Client, programme and contract data: during the relationship and afterwards as needed for delivery, evidence, complaints or statutory limitation periods.
• Invoice and accounting data: generally seven years, or longer where required by law.
• Marketing data: until unsubscribe; a minimal suppression record may remain longer to prevent renewed sending.
• Technical logs: for as short as possible, unless an incident, investigation or legal need requires longer retention.

Afterwards, data is deleted or anonymised unless a legal duty or ongoing dispute requires longer retention.

Depending on the situation, you may request access, correction, deletion, restriction or portability, or object to processing. You may withdraw consent for the future at any time. Where we rely on legitimate interests, we balance our interest against your privacy interests.

Email your request to info@lisettelucas.nl. We may ask for additional information to verify your identity securely and generally respond within one month. You may also complain to the Dutch Data Protection Authority or your local privacy regulator.

We use appropriate technical and organisational measures, including secure connections, restricted access, provider management and data minimisation. Report suspected misuse via info@lisettelucas.nl.

The public website is not directed at children. Where a minor's data is needed, we involve a parent or legal guardian where the law requires it. We do not make solely automated decisions that produce legal or similarly significant effects.

We update this notice when our systems, services or the law materially change. The current version is always available on this page. Version: 13 August 2026.