Privacy policy

Version: 4 April 2024

1. Introduction

Welcome to Werkvolk ("we", "us", or "our"). We highly value the privacy of our Users and are committed to protecting their personal data. This privacy policy explains what information we collect, how we use it, and what rights you have regarding your data.

Werkvolk (SQRL Holding BV), with its registered office at Hoevenstraat 15/202, 3920 Lommel, company number BE1021.989.327, is the data controller within the meaning of the General Data Protection Regulation (GDPR) for the Personal Data collected and processed through the Platform.

2. Definitions

2.1 Werkvolk: The trade name of SQRL Holding BV, which offers the Platform connecting jobseekers and Employers.

2.2 Platform: The online service provided by Werkvolk, consisting of a digital platform (website and/or mobile application) where jobseekers and Employers can connect.

2.3 Employer(s): Any natural or legal person who registers on the Platform with the purpose of posting job vacancies and recruiting Candidates.

2.4 jobseeker(s): Any natural person who registers on the Platform to receive job proposals, review them (e.g., like), and potentially connect with one or more Employers.

2.5 Candidate: A jobseeker who qualifies for an Employer's vacancy and is subsequently matched with that Employer.

2.6 User: Any person or entity using the Platform, including both jobseekers and Employers.

2.7 Match: The situation in which a jobseeker "likes" an Employer and meets the vacancy requirements, creating an opportunity for communication and/or further interaction within the Platform.

2.8 Personal Data: Any information relating to an identified or identifiable natural person, as defined in the GDPR.

3. What data do we collect?

We may collect the following personal data:

• Registration data: including name, first name, date of birth, city, gender, profile photo, phone/mobile number, email address, password. Bank account number (only if necessary for payment of an incentive or referral bonus).
• Profile data: including career history and years, education level, degree, work experience, skills, location, languages. jobseekers can also upload images or videos.
• Usage data: including clicks, interactions, likes, communications via the Platform.
• Feedback: any ratings, reviews, or other feedback provided by Users.

4. How do we collect your data?

We collect data in the following ways:

• Directly from you: when you register on our Platform, complete a form, or contact us.
• Automatically: via internal cookies and similar technologies when you visit our Platform. For more information about cookies, see our Cookie Policy.

5. Legal basis for processing

We process your personal data only on the basis of one or more of the following legal grounds:

• Fulfillment of a contract: to provide you with the requested services.
• Legal obligation: to comply with applicable laws and regulations.
• Consent: when you have given explicit consent.
• Legitimate interest: to improve our services, provided this does not disproportionately affect your rights.

6. Why do we collect your data?

We process your personal data for the following purposes:

• Service provision: Offering and facilitating the Platform, including matching Users.
• AI improvement: Optimizing the AI model and enhancing the service.
• Communication: Sending necessary (system) notifications about the account or other (marketing) messages, if legally permitted and/or with the User's consent.
• Legal obligations: Complying with applicable laws and regulations.

7. How do we use AI and machine learning?

We use artificial intelligence (AI) and machine learning to improve the relevance of Matches between jobseekers and Employers. Based on profile data, preferences, and interactions, suitable vacancies are suggested to jobseekers, and vice versa.

This AI analysis serves only to support the suggestion of potential Matches. The final decision to apply for a vacancy or hire a Candidate rests entirely with the respective Users. The AI does not make automated decisions with legal consequences or otherwise significant impact. Human review and action always occur for important decisions.

For training and optimization purposes, personal data used in the AI model is anonymized or pseudonymized in accordance with applicable privacy laws.

8. Who do we share your data with?

We respect your privacy and do not share your data with external partners. The only exception is when a Match occurs between a jobseeker and an Employer; in that case, relevant data is shared only between the parties involved to facilitate the Match.

Data may also be shared with third-party service providers (such as hosting or analytics) only on behalf of and under the responsibility of Werkvolk:

• Google (Analytics & Ads): We use Google Analytics and Google Ads to analyze traffic, improve our marketing, and measure ad performance. Google processes data (such as IP addresses and device identifiers) on our behalf.
• Microsoft Clarity: We use Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve our products/services. Website usage data is captured using first and third-party cookies.
• Ahrefs: We use Ahrefs Web Analytics to analyze website traffic. Ahrefs operates in a privacy-friendly manner and does not use cookies to track visitors.

9. How long do we keep your data?

To maintain the integrity of the Platform and prevent false profiles or data, your data is retained as follows:

• Registration and account data: retained while your account is active. If a deletion request is submitted, these data will be deleted within 30 days, unless a longer period is required to comply with legal obligations.
• Usage and analytics tracking: aggregated and/or anonymized data is retained for statistical purposes unless otherwise required.
• Chat data: retained for a maximum of 7 days after the jobseeker is hired. For communications between Employer and jobseeker, Werkvolk acts as a processor, not a controller.

10. How do we protect your data?

We implement appropriate technical and organizational measures to protect your personal data against loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

11. International data transfers

Werkvolk processes your personal data primarily within the European Economic Area (EEA). However, some of our service providers (such as Google and Microsoft) may be established outside the EEA or use servers located outside the EEA (specifically in the United States).

Transfers to third countries are only carried out if appropriate safeguards are in place:

• EU-US Data Privacy Framework: Both Google and Microsoft are certified under this framework, ensuring an adequate level of protection for data transferred to the US.
• Standard Contractual Clauses (SCCs): Where the framework does not apply, we rely on SCCs approved by the European Commission, supplemented by additional security measures.

11.1 Data encryption

• Personal data is encrypted during transmission using Transport Layer Security (TLS 1.2/1.3).
• Data at rest is encrypted with strong encryption algorithms to prevent unauthorized access.

11.2 Access control and authentication

• Access to personal data is strictly limited according to the principle of least privilege and managed via Role-Based Access Control (RBAC).
• Privileged accounts and administrators must use Multi-Factor Authentication (MFA) for extra security.

11.3 Logging and monitoring

• All activities related to personal data are recorded in audit logs.
• Logs are periodically analyzed for unauthorized access or unusual behavior.
• Active system monitoring is performed to detect and respond to security incidents early.

11.4 Incident management and data breach prevention

• An incident response procedure is in place to quickly identify and address security incidents and potential data breaches.
• Data breaches are documented in accordance with GDPR and reported to authorities and affected parties within 72 hours if necessary.

11.5 API and database security

• API access is secured with OAuth 2.0 / OpenID Connect for proper authentication and authorization.
• Rate limiting and firewall rules are set to prevent unauthorized use and attacks such as brute-force and DDoS.

11.6 Periodic penetration testing and security audits

• Regular testing ensures security measures are effective and identifies new vulnerabilities.

11.7 Mobile storage security

• Android Keystore and iOS Keychain are used when user data is stored locally on mobile devices.

12. Your rights

You have the following rights regarding your personal data:

• Right of access: request access to the data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to restrict processing: request limitation of processing of your data.
• Right to data portability: request transfer of your data to yourself or another organization.
• Right to object: object to the processing of your data.To exercise these rights, contact us at hello@werkvolkjobs.com.
• Right to lodge a complaint: If you believe Werkvolk is not processing your personal data in accordance with applicable law, you have the right to file a complaint with the supervisory authority: Gegevensbeschermingsautoriteit (GBA): Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, <www.gegevensbeschermingsautoriteit.be>.

13. Use of consent and withdrawal

If the processing of your personal data is based on your consent:

• Consent: is explicitly requested during registration or for specific processing.
• Withdrawal of consent: You can withdraw your consent at any time by contacting hello@werkvolkjobs.com. After withdrawal, processing based on consent will cease, except where required by law.

14. Changes to this privacy policy

This privacy policy was last updated on 4 April 2024. We may update it from time to time. We recommend reviewing it regularly for the latest information on our privacy practices. Users will be notified of changes upon their next login to the Platform. At that time, they can accept the new terms or choose not to use the Platform. Changes take effect when published on the Platform or at a later date if specified in the announcement.

15. Contact

If you have questions about this privacy policy or your personal data, contact us at: hello@werkvolkjobs.com.