Last updated: 4 November 2026.
1. Who we are and what these terms cover
1.1 AI Business School NL is a trade name of Blue Star Ventures B.V., KvK 99679833, Sparrendaal 50, 3452 LJ Vleuten, Netherlands (“we”). On this website we use the short form AI Business School.
1.2 These terms apply to course bookings, consultancy packages and cyber security services. A booking confirmation or a quote can add to them; where they differ, the confirmation or quote applies.
2. Course bookings
2.1 You book a course on its course page. You choose online, live, or at your office, a day and the number of participants. You pay in full by bank transfer to the account shown on that page after you reserve. A booking is confirmed when the full amount arrives, and we confirm it by email.
2.1a Bank transfer. We hold your place for 7 days, or until the day before the course if that is sooner; a deadline that falls on a weekend moves to a weekday. We confirm the booking when the full amount arrives. If it has not arrived by then, the reservation lapses and we refund any amount received.
2.2 An online, live course costs a fixed amount per participant, shown on its course page, and excludes VAT. A course day at your office costs a fixed amount for your group, up to the number of participants shown on its course page, and excludes VAT; the number of participants within that limit does not change the price. The VAT that applies to your booking is shown when you reserve and on the invoice.
2.3 Moving or cancelling a private day. For a course online or at your office, you may move or cancel the date by email or WhatsApp:
- more than 30 days before the date: free;
- 14 to 30 days before: 50% of the price;
- less than 14 days before: the full price.
2.4 Online, live. A private online day runs on your own Teams, Zoom or Meet. The periods in 2.3 apply.
2.5 You may send a different participant at any time, free of charge.
2.6 Bookings by consumers. Private persons can book any open day at least 3 days before the course. If you book as a private person, you may withdraw within 14 days of booking without giving a reason. Send us an email at advisory@ai-business.school or use our withdrawal form; using the form is not required. If you asked, when booking, to join a course that starts within those 14 days and then withdraw after it has started, you pay for the part already delivered. Once a course has been fully delivered at your express request, the right to withdraw ends.
2.7 If we cancel. We may cancel a course at any time in case of illness or circumstances outside our control. You then choose between a full refund and another date. We do not pay travel or hotel costs you incurred, unless the law requires it.
3. Courses at your office
3.1 Courses at your office are booked at least 3 days ahead. After you book, we schedule a 30-minute intake call on your tools, data rules and tasks.
3.2 You provide a room, a screen and internet access for participants.
3.3 Travel outside the Netherlands is charged at cost, agreed with you in writing before the date.
4. Online, live courses
4.1 Online courses run on your own Teams, Zoom or Meet.
4.2 Online courses are live and are not recorded. You send us the meeting link. We agree the session times in the intake call.
5. Consultancy packages
5.1 A contract starts when you accept our quote in writing or by email.
5.2 Prices in quotes exclude VAT unless stated otherwise. We invoice after the work or per phase of a package. Invoices are payable within 14 days.
6. What you receive
6.1 Participants receive the course materials and an attendance record for their organisation’s AI literacy file. The attendance record is not a certificate, and the courses carry no formal qualification or recognised award.
6.2 Course materials are for use inside your organisation. You may not resell them or use them to train people outside it without our written permission.
6.3 Documents we produce for you in a consultancy package (policies, tool lists, playbooks) belong to you once paid.
6.4 Confidentiality. We keep confidential all non-public information you share for a course, package or cyber security service, use it only for that purpose, and delete our working copies within 30 days after delivery, unless the law requires us to keep them or article 11 sets other periods. On request we sign your non-disclosure agreement.
6.5 Personal data you control. Where a consultancy package involves personal data for which you are the controller, we process it as your processor under a data processing agreement (GDPR Article 28).
7. Responsibility
7.1 We teach methods and explain rules. We do not give legal advice, and course content does not replace advice on your organisation’s specific situation.
7.2 Our liability is limited to the price of the course or package concerned, except in case of intent or gross negligence. For cyber security services, article 11.12 applies. This does not limit rights consumers have by law.
8. Personal data
How we handle personal data is set out in our privacy notice.
9. Complaints
Send a complaint to advisory@ai-business.school within 30 days of the course or the service. We reply within 14 days.
10. Law and courts
Dutch law applies. Disputes go to the Rechtbank Midden-Nederland (District Court of Central Netherlands). If you are a consumer living in another EU country, you keep the protection of the mandatory rules of that country.
11. Cyber security services
11.1 Scope. We provide cyber security services to business clients only. A contract starts when you accept our written scope and quote in writing or by email. The scope lists the websites, apps, code repositories, cloud accounts and internet addresses we check or test (“systems in scope”).
11.2 Your permission. Before any check or test starts, you confirm in writing that you own every system in scope, or that its owner has given you written permission to let us test it. Where a hosting, cloud or other provider runs a system in scope, you confirm that its terms allow the test or that it has agreed. Your permission covers us and the companies whose software we use for the test. On request, you sign a written permission to test for us and for them. You give us the access, test accounts and contact person we need. We rely on your scope and your confirmation, and we do not check ownership ourselves.
11.3 Penetration tests. We test a test or staging version of your systems, without live customer data. We test a live system only when you and we agree in writing, and we agree only after our software supplier has agreed in writing. Automated attacks can slow down, interrupt or change the system they test, and their behaviour cannot always be predicted. Before a test, you make a backup, tell us about fragile systems, set any stop conditions and name a person we can reach during the test. During the test, you watch your systems where you can and tell us at once about a serious problem. When we become aware of a serious problem, we make reasonable efforts to pause, slow or adjust the test, and we tell your contact person. We are not responsible for alerts, blocks or suspensions by your hosting, cloud or internet provider caused by a test you authorised.
11.4 What checks and tests can and cannot do. A check or test shows the state of your systems at that moment. No check or test finds every weakness, and a finding can be wrong. Some findings come from automated software and cannot always be reproduced or fully explained. Our findings and suggested fixes are advice: you decide what to change, and your developers review every fix before it goes live. No check or test makes your organisation compliant with NIS2, ISO 27001, SOC 2 or any other law or standard.
11.5 Your code, data and reports. Your code, systems and data remain yours. We and the software we use access them only to deliver the service. Code is scanned in an isolated environment, and the copy used for the scan is removed after the scan. Findings, reports and test records are kept while the service runs, and our software supplier may use test data to improve its software. Once paid, you may use our reports and findings for your own business and share them with clients, insurers and auditors. The software and methods behind them remain ours or our supplier’s.
11.6 Sensitive data. You do not send us, and do not put in the systems in scope, sensitive personal data such as health data, financial account data, national ID numbers or data about children, unless we agree in writing first. Where a system in scope holds such data, you remove or mask it in the version we test.
11.7 Confidentiality. Article 6.4 applies to everything you share with us for a cyber security service. For these services, our duty of confidentiality lasts until 3 years after the service ends, and for information still held in backups, until it is deleted. This does not limit our duties under data protection law.
11.8 Software and subprocessors. We deliver the service with specialised security software from other companies. Where the service involves personal data for which you are the controller, such as the names and email addresses of your developers, we process it as your processor under a data processing agreement. That agreement lists our subprocessors and how long data is kept. We tell you about a new or replaced subprocessor as soon as our supplier tells us, and before the change takes effect where we can. If you object in writing within 14 days and we cannot resolve it, you may end the affected service by written notice. Article 11.11 then applies to the fees for the rest of the term.
11.9 Use and suspension. You may not use the service to check or test systems outside the scope, to harm others or to break the law. We may suspend the service straight away if continuing would create a security or legal risk, and we tell you why.
11.10 Payment. Single checks and penetration tests are invoiced after delivery. Managed services are invoiced monthly in advance. Invoices are payable within 14 days. If an invoice remains unpaid 15 days after a reminder, we may suspend the service.
11.11 Term and ending. A managed service runs for the term in the quote and then renews for the same term, unless you or we end it in writing at least 30 days before the term ends. If you end a managed service before the end of its term, the fees for the rest of the term remain due. This does not apply if you end it because we seriously failed to perform and did not put it right within 30 days of your written notice. In that case we refund the fees paid for the unused part. When the service ends, we remove our access to your systems. You can ask for your reports during the 30 days after the end. After that, your data is deleted within the periods in the data processing agreement.
11.12 Liability. Article 7.2 does not apply to cyber security services. Our total liability for a cyber security service is limited to the amounts paid or payable for that service in the 12 months before the event that caused the damage. We are not liable for indirect damage, lost profit, downtime, slower systems, inaccurate findings, work delays, or lost or changed data caused by a check or test you authorised. These limits do not apply in case of intent or gross negligence.
11.13 Claims and fines. You indemnify us against claims by third parties, and against fines and other action by regulators, that arise from the scope you set, your settings, your permission to test or your use of the service. This includes the reasonable costs of dealing with them.