Privacy policy

1. Who is responsible for your data

The legal entity below operates Razom Werkt and decides why and how your data is processed (GDPR).

2. What data we collect

We collect only what you enter yourself and a minimum of technical data.

• Account: e-mail, name, language, Telegram ID (if you use the bot), password hash.
• Profile: trade and experience, certificates, languages, job preferences, city and postcode (4 digits), optionally a photo, CV and documents.
• We do not store BSN, passport or residence-permit numbers, date of birth or exact address.
• Applications and messages: applications to vacancies, messages to the coordinator, interviews.
• Requests through site forms (callback, contact, Waadi complaint, subscription): name, e-mail or phone, text.
• Technical data: session ID and IP address as an irreversible hash (we do not store the IP itself), device, activity log.

3. Why and on what legal basis

Each purpose has a legal basis under Article 6 GDPR.

• Account, login, abuse prevention — contract and legitimate interest.
• Job matching, applications, interviews, placement — performance of a contract and pre-contract steps.
• Showing your profile to employers in the pool and revealing your contact details — only with your separate consent; you can withdraw it in your account and access ends immediately.
• Right-to-work check (only a ‘checked’ flag is stored) — legal obligation.
• Answering requests and complaints — your consent and legitimate interest.
• The 18+ confirmation and your agreement to this text are recorded with the text version and time.

4. Who sees your data

We do not sell data and use no advertising trackers or third-party analytics.

• Employers: first only an anonymised profile (no name, contacts or exact address); contact details after your consent.
• Platform coordinators see the data needed for matching and support.
• Processors: hosting on the operator's server; mail service for e-mails with links; Telegram if you use the bot.
• City search: the city name or postcode is sent to the Dutch government service PDOK to compute distances.
• Vacancy map: your browser loads map tiles from OpenStreetMap, so OpenStreetMap sees your IP address.

5. How long we keep data

Your profile and related data are kept until you delete your account. Technical data is deleted automatically.

• Login sessions: 7 days after expiry. One-time login links: 2 days.
• Notifications: 90 days. Translation cache: 180 days.
• Form requests: 180 days after handling, unresolved ones up to 365 days.
• Activity log (IDs only, no content): 2 years.
• After you delete your account personal data is erased; only what the law requires us to keep remains (for example financial records).
• Back-ups are kept for a limited time and then overwritten.

6. Your rights

You have rights under the GDPR. Most are available yourself in the ‘Privacy’ section of your account; we answer a request within 30 days.

• Access and a copy of your data (download in your account).
• Correction of inaccurate data.
• Deletion of your account and data (request in your account).
• Restriction of and objection to processing.
• Portability of your data in a common format.
• Withdraw consent at any time (profile visibility, contact reveal) — without affecting past processing.
• Complaint to the supervisory authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Cookies and local storage

We use strictly necessary cookies only. There are no advertising or analytics cookies, so no consent banner is needed.

• Login session — until you log out or it expires.
• Form security token (CSRF).
• Chosen language — 1 year.
• In your browser: colour theme and registration draft (on your device only, cleared after you submit).

8. Security

We protect data with technical and organisational measures.

• The connection is encrypted (HTTPS); contacts, names and message contents are stored encrypted.
• Uploaded files are virus-scanned and are not available at public addresses.
• Staff access is role-based and sensitive actions are logged; in case of a breach we will notify you and the authority within the legal deadlines.

9. Changes and contact

We will announce material changes to this text on the website. For privacy questions write to the address below.

Data controller

company details to be confirmed
rs@sulerr.com