Privacy Policy

Last updated: July 11, 2026 · Version 1.0

Privacyverklaring · OfferMarket B.V.

1. Controller

The data controller responsible for your personal data is:

OfferMarket B.V.

KvK: 93075284

Herengracht 420, 1017 Amsterdam, Netherlands

Data Protection Officer: dpo@offermarket.nl

For questions about this privacy policy or your rights under the AVG (Algemene Verordening Gegevensbescherming), contact our DPO at the email above.

2. Personal Data We Process

We process the following categories of personal data:

Category	Examples	Legal Basis
Identity data	Name, email, phone number	Contract performance (Art. 6(1)(b))
Profile data	Skills, experience, education, certifications	Contract performance (Art. 6(1)(b))
Special category data	Work authorization status (immigration data)	Explicit consent (Art. 9(2)(a))
Professional data	Work preferences, salary expectations, availability	Contract performance (Art. 6(1)(b))
Communication data	Messages between users, notifications	Contract performance (Art. 6(1)(b))
Company data	KvK number, company name, billing info	Legal obligation (Art. 6(1)(c))
Verification documents	ID copies, certificates, diplomas	Legal obligation (Art. 6(1)(c))
Financial data	Invoices, payment records	Legal obligation (Art. 6(1)(c))
Technical data	IP address, browser, device info	Legitimate interest (Art. 6(1)(f))
Usage data	Page views, feature usage, search history	Consent (Art. 6(1)(a))

3. Special Category Data

⚠️ Important — AVG Article 9

We process work authorization status (EU citizen, work permit holder, etc.) which may reveal immigration status and, by extension, national origin. This constitutes special category data under AVG Article 9.

We only process this data with your explicit consent. You may withdraw this consent at any time through your privacy settings. If consent is withdrawn, your work authorization status will not be shown to employers, though a simple yes/no flag (hasWorkAuthorization) may still be displayed.

We strongly advise against including other special category data (nationality, gender, health information, union membership) in your profile. Our free-text fields are not designed for this type of data, and we are not authorized to process it.

4. Legal Bases for Processing

We process your personal data on the following legal bases:

Consent (Art. 6(1)(a)) — Analytics, marketing communications, work authorization processing, cookie usage
Contract performance (Art. 6(1)(b)) — Providing the platform, matching workers with employers, processing offers, messaging
Legal obligation (Art. 6(1)(c)) — KvK verification, tax record retention (7 years), fraud prevention
Legitimate interest (Art. 6(1)(f)) — Security, platform improvement, audit logging, anonymized analytics

5. Data Sharing & Recipients

We share your personal data with the following categories of recipients:

Employers/Workers — Anonymized profile data until offer acceptance, then identity data as agreed
Amazon Web Services (AWS) — Cloud infrastructure, file storage (S3), email (SES)
Stripe — Payment processing and invoicing
PostHog — Anonymized analytics (only with your consent)
Twilio — SMS notifications
Sentry — Error monitoring (minimal personal data)

We have Data Processing Agreements (DPAs) with all processors. We do not sell your personal data.

6. Data Retention

We retain your personal data only as long as necessary:

Active accounts — Until account deletion
Invoices & financial records — 7 years (Dutch tax obligation)
KvK verification data — 7 years after account closure
Messages — 2 years after conversation closure
Verification documents — 30 days after verification complete
Consent records — 7 years after consent withdrawal
IP addresses — 6 months
Audit logs — 7 years (anonymized after account deletion)
Analytics data (PostHog) — Until consent withdrawal

7. Your Rights Under the AVG

You have the following rights regarding your personal data:

Right of Access (Art. 15)

You can request a copy of all personal data we hold about you. Request your data →

Right to Rectification (Art. 16)

You can correct inaccurate personal data through your profile settings or by contacting us.

Right to Erasure (Art. 17)

You can request deletion of your personal data. Some data must be retained by law. Request deletion →

Right to Restriction (Art. 18)

You can request that we restrict the processing of your data while a dispute is resolved. Restrict processing →

Right to Data Portability (Art. 20)

You can receive your data in a machine-readable format (JSON/CSV). Export your data →

Right to Object (Art. 21)

You can object to processing based on legitimate interest or for direct marketing purposes.

Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you can withdraw it at any time. Manage consents →

To exercise any of these rights, use your Privacy Dashboard or contact our DPO at dpo@offermarket.nl.

If you are not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

8. Automated Decision-Making & Profiling

We use automated systems to match workers with employers based on skills, experience, and preferences. These are not decisions that produce legal effects or significantly affect you. Our matching algorithm does not use special category data (such as nationality or health data) as input factors.

Workers can always control their profile visibility and what information employers can see. Our anonymous profile system ensures that employers cannot identify you until you accept an offer.

9. International Data Transfers

Our primary infrastructure is hosted within the European Union (AWS EU regions — Ireland and Frankfurt). However, some of our processors operate outside the EU:

Processor	Processing	Country	Safeguard
AWS (Amazon Web Services)	Infrastructure, hosting	Ireland / Germany (EU)	EU-hosted — no third-country transfer
PostHog	Analytics (EU-hosted instance)	Germany (EU)	EU-hosted — no third-country transfer
Stripe	Payment processing	United States	SCCs + Stripe Data Processing Agreement; EU-US Data Privacy Framework
Twilio (SendGrid)	Email delivery	United States	SCCs + Twilio DPA
Sentry	Error monitoring	United States	SCCs + Sentry DPA; Data Processing Agreement

Where data is transferred to countries outside the EEA that do not have an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by Data Processing Agreements that include the mandatory Art. 28 GDPR provisions. You may request a copy of the relevant SCCs by contacting our DPO.

10. Security Measures

We implement appropriate technical and organizational measures to protect your data:

Encryption in transit (TLS 1.3) and at rest (AES-256)
Role-based access control for admin access
Anonymized worker profiles until offer acceptance
Regular security audits and penetration testing
Breach notification within 72 hours to the Dutch DPA
Two-factor authentication available for all accounts
IP address hashing for analytics

11. Cookies

For detailed information about the cookies we use, please see our Cookie Policy.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email and through a prominent notice on our website. We will always obtain your consent for any new processing that requires it.

13. Contact

For any questions about this privacy policy or your data protection rights:

Data Protection Officer: dpo@offermarket.nl

OfferMarket B.V.

Herengracht 420, 1017 Amsterdam, Netherlands

KvK: 93075284