Privacy Policy

4.1 Account and contact details

We may process the following data:

• first name
• last name
• email address
• phone number
• profile photo, if you choose to add one
• user ID
• account status
• date and time of registration
• date and time of login
• authentication data, including a technically secured password hash
• preference settings within your account

WorkChain has no access to your readable password.

4.2 Business details

We may process the following business details:

• trade name
• Chamber of Commerce (KvK) number
• VAT identification number
• industry or professional field
• business address
• legal form
• business contact details
• information about your business activities
• details about your clients
• information about the work you perform
• hourly rates or fixed rates
• invoice amounts
• income and revenue registered via WorkChain
• payment statuses
• other data you add to your business profile yourself

4.3 Data about clients

When you add a client to WorkChain, we may process:

• company name
• name of a contact person
• email address
• phone number, if added
• business address
• Chamber of Commerce (KvK) number
• VAT number
• invoice details
• payment status
• communication about invoices and payments

You are responsible for ensuring that you lawfully provide WorkChain with the personal data of contact persons at clients.

4.4 Invoice data

When you create or send an invoice via WorkChain, we may process and store:

• invoice number
• invoice date
• description of the work performed
• number of hours worked
• hourly rate
• quantities
• fixed amounts
• amount excluding VAT
• VAT percentage
• VAT amount
• amount including VAT
• client details
• invoice PDF
• payment status
• transaction reference
• date of payment
• platform fees and service fees
• information about corrections
• information about refunds
• information about failed payments

The invoices and invoice PDFs are stored within the WorkChain environment.

4.5 Payment and verification data

WorkChain may receive limited information from Rootline that is necessary to display the status of a payment or verification within the app, such as:

• Rootline account ID or merchant ID
• verification status
• onboarding status
• payment status
• transaction reference
• payout status
• reasons why a verification has not yet been completed, to the extent Rootline makes this information available

WorkChain itself does not receive or store copies of identity documents or complete KYC documentation that is provided directly to Rootline.

4.6 GEOS Academy and assessment data

For the GEOS Academy we process, among other things:

• which modules you have started
• which modules you have completed
• progress per module
• start and completion date
• answers to assessment questions
• scores achieved
• number of assessment attempts
• passed and failed assessments
• date and time of each assessment
• version of the module taken
• version of the assessment questions
• digitally accepted declarations
• any additional explanations

4.7 Certification data

For the GEOS certification we may process:

• certification status
• certificate number
• date of issue
• expiry date
• date of signing
• qualification level, if applicable
• professional field or description of activities
• assessment results
• evaluation results
• certificate PDF
• status of the certification, such as active, expired, suspended or revoked
• date and result of a periodic review or recertification, once this functionality is used
• reasons for approval, rejection, suspension or revocation
• audit and review data, if a review takes place
• verification logs

The GEOS certificate is a supporting piece of evidence. It does not guarantee that the Dutch Tax Administration (Belastingdienst), UWV or a court will qualify a specific working relationship as an independent contractor engagement.

4.8 Documents and uploads

Depending on the features you use, we may process documents, such as:

• invoices
• agreements
• Chamber of Commerce (KvK) documents
• proof of insurance
• declarations of independence
• certificates
• supporting documents regarding entrepreneurship
• business documents you upload yourself

We use these documents exclusively for the WorkChain service for which they were provided, such as certification, administration, invoicing, support, review or compliance with legal obligations.

4.9 Technical and usage data

When you use our website or app, we may automatically process data, such as:

• IP address
• device information
• browser type
• operating system
• app version
• language settings
• screen resolution
• session ID
• date and time of use
• duration of a session
• pages visited
• features used
• click and navigation behaviour
• error messages
• crash data
• technical log files
• download and installation statistics

4.10 Analytics and marketing data

With your consent, we may use the following on the public WorkChain website:

• Google Analytics
• Microsoft Clarity
• Meta Pixel
• campaign and conversion measurements

In doing so, the following may be processed, among other things:

• pseudonymous identifiers
• page views
• session data
• click behaviour
• scroll behaviour
• device and browser characteristics
• referring websites
• campaign data
• conversions, such as a registration or app download

Microsoft Clarity may create session recordings and heatmaps to understand how visitors use the public website.

Google Analytics may not receive directly identifying data, such as names, email addresses or phone numbers.

In the EEA, Microsoft Clarity requires a valid consent signal for the full operation of cookies and session features.

Meta Pixel is only activated after a visitor has given consent for marketing cookies.

These analytics and marketing services are not used on sensitive parts of the account environment, such as:

• invoices
• payments
• profile data
• GEOS assessments
• certification data
• uploaded documents

WorkChain does not send names, email addresses, phone numbers, invoice data or other directly identifying information to these analytics and marketing services.

4.11 App Store and Google Play statistics

WorkChain may receive aggregated data from Apple and Google about:

• downloads
• installations
• app versions
• crashes
• device types
• use of the app

To the extent these statistics cannot be traced back to an individual user, they do not constitute personal data.

4.12 Communication data

When you contact us, we may process:

• your name
• email address
• phone number
• content of your message
• documents or images sent along
• date and time of contact
• correspondence history
• support requests
• complaints
• technical reports

5.1 Creating and managing a WorkChain account

We process personal data to:

• create a user account
• record your identity within the platform
• enable secure login
• manage your account
• store your settings
• provide support

5.2 Offering the GEOS Academy

We process personal data to:

• provide access to the GEOS Academy
• make modules available
• store progress
• record assessment results
• record completed modules
• synchronise your progress across devices

5.3 Assessing tests

After each GEOS module, it is automatically assessed whether the user has achieved the minimum required score.

If the minimum score is not achieved, the user can retake the test. There is no maximum number of retakes.

The user only receives a GEOS certificate after all required modules have been successfully completed.

5.4 Issuing a GEOS certificate

When all certification requirements have been met, we process personal data to:

• generate a certificate
• store certification data
• make certificates available
• record the certification history
• manage the validity of certificates

5.5 Invoicing and payments

We process personal data to:

• create invoices
• store invoices
• send invoices
• record payments
• display payment statuses
• process platform fees
• comply with administrative obligations

5.6 WorkChain Payments

For processing payments, we work with Rootline.

We process only the data that is necessary to:

• display the payment status
• display the verification status
• guide the user through the onboarding process

Identity documents, KYC documentation and other verification data are processed directly by Rootline or its payment service providers.

5.7 Communication

We process personal data to:

• answer questions
• provide support
• send notifications about your account
• send service messages
• send security notifications

5.8 Push notifications

If you have given consent for this, we may send push notifications about, among other things:

• new invoices
• payments
• verifications
• GEOS Academy
• certifications
• important account notifications
• security notifications

You can disable push notifications at any time via the settings of your device.

5.9 Newsletters

If you have given consent for this, we may send newsletters and other commercial communications.

These may relate to, among other things:

• new features
• product updates
• events
• changes within WorkChain
• relevant information for self-employed professionals

You can unsubscribe at any time via the unsubscribe link in every email or by contacting us.

5.10 Improving our services

We process data to:

• fix errors
• improve performance
• develop new features
• improve usability
• increase security
• prevent misuse

5.11 Analytics and marketing

With your consent, we use analytics and marketing services to:

• analyse the use of our website
• measure campaigns
• improve advertisements
• measure conversions
• further develop our services

Where legally required, we ask for prior consent before placing non-essential cookies.

6.1 Performance of a contract

We process personal data to the extent necessary to perform our contract with you.

This includes, among other things:

• account registration
• GEOS Academy
• certification
• invoicing
• payments
• support

6.2 Legal obligation

In some cases, we are legally required to process personal data.

This includes, among other things:

• tax retention obligations
• administrative obligations
• fraud prevention
• legal requests from competent authorities

6.3 Legitimate interest

We may process personal data when this is necessary for a legitimate interest of WorkChain, such as:

• security
• fraud prevention
• improvement of our services
• network and system security
• protecting our rights

In doing so, we always carefully balance the interests involved.

6.4 Consent

For certain processing activities, we ask for prior consent.

This applies, for example, to:

• newsletters
• marketing cookies
• Microsoft Clarity
• Google Analytics
• Meta Pixel
• push notifications where consent is required

You can withdraw your consent at any time.

8.1 Rootline Payments

For the processing of payments, onboarding of payment accounts and verification, WorkChain works with Rootline.

Rootline processes personal data that is necessary for payment processing, verification and compliance with legal obligations, including Know Your Customer (KYC) checks.

WorkChain does not receive copies of identity documents or complete KYC documentation that is provided directly to Rootline.

8.2 Hosting and cloud providers

To offer our services, we use professional cloud and hosting services, including:

• Supabase
• Vercel
• Railway
• DigitalOcean

These parties process personal data exclusively on behalf of WorkChain and only to the extent necessary to provide their services.

8.3 Email services

For sending emails, we use Mailgun.

This includes, among other things:

• account verification
• password recovery
• security notifications
• service messages
• certification notifications
• invoice notifications
• newsletters for which consent has been given

8.4 Analytics and marketing services

With consent, we may use:

• Google Analytics
• Microsoft Clarity
• Meta Pixel

These services help us improve our website, analyse campaigns and gain insight into the use of our services.

We do not send directly identifying personal data, such as names, email addresses or phone numbers, to these analytics and marketing services.

8.5 Legal obligations

We may share personal data when:

• we are legally required to do so
• a competent supervisory authority requests this
• this is necessary for legal proceedings
• this is necessary to prevent or investigate fraud, misuse or security incidents