- By industry
- Pricing
- About us
- LatestCompliance feedAll insights →
39 dated, sourced cases of what happens when employees cross borders without the right paperwork.
Browse the feed →
39 dated, sourced cases of what happens when employees cross borders without the right paperwork.
Browse the feed →This notice explains how WorkFlex International B.V. processes personal data when you visit www.workflex.com, contact us, request a demonstration or other information, register for an event, subscribe to our communications, or interact with the social media pages described below. It also covers our dealings with individual business contacts. The applicable framework includes the EU General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, UAVG) and, where applicable, the Dutch Telecommunications Act (Telecommunicatiewet). Other mandatory local rules may apply depending on the activity and the countries concerned.
Personal data is information relating to an identified or identifiable person. A controller determines why and how that information is processed; a processor processes it on a controller’s behalf and instructions. In this notice, “WorkFlex”, “we”, “us” and “our” mean the legal entity identified in section 1.
This notice provides information; visiting the website or reading this notice does not constitute consent. Where consent is required, we request it separately before the relevant processing begins.
We are committed to protecting your privacy and ensuring that your personal information is handled responsibly.
Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it.
By using our website, you acknowledge that you have read and understood this Privacy Policy.
With the following Privacy Policy, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, the purposes for which we process it, and the scope of such processing. This Privacy Policy applies to the processing described below for which WorkFlex International B.V. acts as controller, in particular on our website www.workflex.com, in related business communications and within external online presences, such as our social media profiles. Where we process employee, travel or other customer data solely on a customer’s instructions in providing the WorkFlex platform, we act as processor. This notice does not replace any separate notices for the platform or mobile applications. Information about recruitment is set out in section 13 and on our career site.
Our website contains links to third-party websites. We are not responsible for the privacy practices of those third parties, and this Privacy Notice does not apply to their independent services. We encourage you to read their privacy notices before interacting with their services. This does not affect our responsibility for personal data we disclose to them or for content we embed on our website. Where we embed third-party content (such as videos), that content is only loaded after you have given consent via our cookie banner.
The terms used are gender-neutral.
The following definitions apply throughout this notice:
"WorkFlex", "we", "us" and "our" means Workflex and the companies within the Workflex group.
"Personal data" means any information relating to an identified or identifiable natural person (a "data subject").
"Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure, and destruction.
"Sensitive data" or "special category data" is commonly used to describe personal data that carries a higher risk for individuals if misused. Under the EU GDPR, it means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for unique identification, data concerning health or data concerning a person’s sex life or sexual orientation; data relating to criminal convictions and offences is regulated separately but is often treated as similarly sensitive.
"Controller" means the party that determines the purposes and means of processing personal data.
"Processor" means a party that processes personal data on behalf of a controller.
"Joint controllers" means two or more controllers that jointly determine the purposes and means of processing.
"Sub-processor" means a processor engaged by another processor to assist with processing on behalf of the same controller.
"Data Protection Impact Assessment" ("DPIA") means the risk-assessment process required for processing activities that are likely to result in a high risk to data subjects' rights and freedoms.
"International transfer" means a transfer of personal data from one jurisdiction to another, where this triggers additional legal requirements.
"Services" means WorkFlex products and services.
WorkFlex International B.V
Hildegard von Bingenstraat 44, 1081 LH Amsterdam, Netherlands
hello@getworkflex.com
Depending on your relationship with us, we may collect the following categories of personal data. We only collect what we need for the specific purpose, in line with the data-minimisation principle.
You can browse the public website without providing your name or contact details. Technical connection data is necessary to deliver and secure the website. Optional analytics and advertising are not a condition for using the public website.
Where a form requests information necessary to respond to an enquiry, arrange a demonstration, register you for an event or prepare or perform a contract, we identify the required fields. If you do not provide that information, we may be unable to fulfil that request. Other fields are optional. Where information is required by law, for example for invoicing, we explain that requirement in the relevant context. Consent to marketing or optional tracking is voluntary and can be withdrawn without affecting access to the underlying service.
The level of detail varies – for a casual website visitor, the volume of data is minimal (usage log and, with consent, cookie data); for a customer authorised user, it can include account credentials and a log of actions taken in the service.
The data we process depends on how you interact with us. We limit collection to what is needed for the stated purpose. The main categories are:
Contact and professional information: first and last name, business email address, telephone number, employer, job title, business address and, where relevant, professional profile (e.g. LinkedIn), or correspondence details.
Communications and requests: information you enter in contact, demo, download or registration forms; correspondence, chat messages, support requests and feedback; meeting or event registration and participation information.
Business and transaction information: enquiries, proposals, contract details, business correspondence and, where relevant, invoicing, payment and tax information.
Technical information: IP address, browser and device information, operating system, requested pages or files, referring page, date and time of access, response status and diagnostic or security logs and browsing behavior.
Consent, marketing and interaction information: your choices and evidence of consent or objection, subscription details, and, where you have consented, cookie or similar identifiers, page interactions, campaign responses, session-replay data and newsletter engagement information as described in the relevant sections below.
Account and credential data – username, hashed passwords, authentication tokens, multi-factor authentication metadata, user-account permissions and roles, session information.
Cookies and tracking technologies: information collected through cookies, web beacons, and similar technologies that allow us to improve our website and provide you with a better browsing experience. Please refer to our Cookie Policy for more information: https://www.workflex.com/en-uk/cookie-policy.
Recruitment data – see our separate career policy https://careers.workflex.com/privacy-policy and section 13.
We obtain information directly from you, automatically when your browser communicates with our website, and through the optional technologies you enable. We may receive business contact information from your employer, an existing customer or business partner who introduces you to us, or public professional sources such as company websites and professional networking profiles. The relevant categories are professional contact details, role, employer and the context of the introduction or enquiry.
If we obtain your personal data indirectly, we provide the information required by Article 14 GDPR, including the source and whether it is publicly accessible, within a reasonable period and at the latest within one month, at our first communication with you, or before the first disclosure to another recipient, whichever occurs first, unless a statutory exception applies.
Our general website forms and chat are not intended for sensitive information such as health data, identity documents or criminal-record information. Please do not submit such information through these channels. If a particular process requires special-category data or criminal-record information, we provide specific information and identify the additional conditions required by Articles 9 or 10 GDPR and applicable Dutch law before processing it for that purpose.
Meta and process data. We collect personal data from these types of sources:
Directly from you – when you visit our website, submit a form, book a demo, register for an event, subscribe to our newsletter, apply for a role, or enter into a contract with us.
Automatically – via cookies, pixels, and similar technologies on our websites (subject to consent), via application and server logs, and via necessary technical records of the services, within the scope explained above.
From third parties – from publicly available sources (such as corporate websites, professional networks, and business directories), from our customers or business partners, from our sub-processors. These sources may provide professional contact details, job roles, enquiry details or, for recruitment, professional background and reference information. Where we obtain your personal data from another source, we tell you the specific source, the data categories and the relevant purpose and legal basis, unless you already have the information or a statutory exception applies.
Visitors of our Website.
Job applicants.
Clients and their contact persons and employees.
Prospective clients.
Communication partners.
Users.
Participants in promotions and contests.
Business and contractual partners.
Depending on the service you use, we use your personal data for the following purposes. The applicable legal bases, legitimate interests, recipients and retention details are explained in the relevant sections below:
To provide and improve our services, products, and user experience.
To respond to your inquiries, comments, or requests and feedback.
To send you marketing communications if you have provided your consent. To analyze and monitor website usage patterns and trends subject to your consent for optional analytics.
To comply with legal obligations.
Provision of contractual services and fulfillment of contractual obligations.
Security measures and IT Infrastructure.
Direct marketing.
Audience measurement.
Office and organizational procedures.
Target group identification.
Organizational and administrative procedures.
Conducting promotions and contests, where offered and explained in the relevant participation information.
Consent-based analytics and advertising profiles as described in section 15.
Provision of our online services and user-friendliness.
Public relations.
Sales promotion.
Business processes and operational procedures.
Applicable legal bases under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply including the UAVG and Articles 11.7 and 11.7a of the Dutch Telecommunicatiewet. Mandatory rules applicable in other country of residence or establishment may also need to be observed. If more specific legal bases apply in individual cases, we will inform you of these in this privacy notice.
Consent (Article 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request prior to entering into a contract.
Legal obligation (Article 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Article 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that these are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Providing data: You can browse our website without agreeing to optional tracking or marketing. Technical connection data are needed to deliver the site. Required form fields are identified when we collect data; if necessary contact, booking or application information is missing, we may be unable to handle the relevant request. Optional information and consent may be withheld without affecting unrelated services. Where a legal duty requires particular data, we explain that duty when collecting them.
We do not use the website processing described in this notice to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within Article 22 GDPR.
With your consent, analytics and advertising tools may associate visits, interactions and inferred interests with an online identifier to measure campaigns or form advertising audiences. This can constitute profiling even where we do not know your name. You can refuse or withdraw consent through “Cookie settings”(https://www.workflex.com/en-uk/cookie-policy) . Processing within the WorkFlex platform and recruitment processes must be assessed separately and is not covered by the statement about website decisions above.
The sections below link each activity to its purpose and legal basis. In particular:
Operating, protecting and troubleshooting the website: Article 6(1)(f) GDPR, reflecting our legitimate interest in providing a functioning and secure website and preventing misuse (sections 6, 7 and 9).
Handling enquiries, demonstrations and event registrations: Article 6(1)(b) GDPR where you are personally a prospective or actual contracting party; otherwise Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to requests and communicating with business contacts (section 10).
Managing business relationships: Article 6(1)(b) GDPR for contracts with individuals; Article 6(1)(f) GDPR for dealings with representatives of organisations, administration and the establishment, exercise or defence of legal claims; Article 6(1)(c) GDPR for applicable accounting, tax and other legal duties (section 8).
Sending marketing messages: Article 6(1)(a) GDPR where you consent, or Article 6(1)(f) GDPR for the limited existing-customer exception described in section 11. The separate requirements of Article 11.7 Telecommunicatiewet also apply.
Optional analytics, session replay, advertising and personalised newsletter measurement: Article 6(1)(a) GDPR and, for storing or accessing information on your device, Article 11.7a Telecommunicatiewet (sections 11, 15 and 17).
We rely on legitimate interests only where the processing is necessary and our interests are not overridden by your interests or fundamental rights and freedoms. You can object as explained in section 20. Consent is specific to the purposes for which it is requested. Withdrawing consent does not affect processing that was lawful before withdrawal. We do not replace refused or withdrawn consent for optional tracking with a claim of legitimate interests.
So-called error logs are generated for the purpose of identifying and fixing bugs. This is necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content . We process technical error information to detect, investigate and resolve problems and maintain website security and availability. Depending on the error, this includes the website domain or page, browser and operating system, IP address, time of the error and diagnostic details. As a rule, this data is a pseudonym. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in reliable, secure website operation.
IP addresses and pseudonymous identifiers may still be personal data. Diagnostic logs are not treated as anonymous merely because they do not contain a name. We limit their content and access to what is necessary and avoid including form contents, passwords or other confidential information. Routine retention and any incident-specific exceptions are described in section 18.
In accordance with statutory requirements, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.
These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to data, access permissions, data entry and disclosure, the assurance of availability and the separation of data. We have also established procedures to ensure that data subjects can exercise their rights, that data is erased and that we respond to threats to data security. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect users’ data transmitted through our online services against unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between a website or app and the user’s browser (or between two servers), thereby protecting the data against unauthorised access. As the more advanced and secure version of SSL, TLS ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL. This indicates to users that their data is transmitted securely and in encrypted form.
The measures are reviewed and adapted as necessary; no transmission or storage system can be guaranteed to be completely secure.
We process the professional contact details and correspondence of customers, prospective customers, suppliers, partners and their representatives to prepare and administer contracts, arrange services, issue invoices, handle queries and resolve contractual issues. Where needed, we process transaction, payment and tax information. Processing serves, in particular, to fulfil our primary and ancillary contractual obligations. These include providing the agreed services, any obligations to provide updates and information, handling warranty claims and other performance issues, processing withdrawals from contracts, termination of continuing contractual relationships, reversals of transactions and refunds, and handling other contract-related declarations and enquiries. This covers both one-off contracts and ongoing contractual relationships. We also process data to protect our rights and comply with legal obligations. This includes, in particular, retention obligations under commercial and tax law, documentation obligations and, where applicable, obligations to provide evidence and demonstrate accountability. Processing also takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, and in protecting our business operations and contractual partners against misuse and threats to data, confidential information and other legally protected interests. This may also involve external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisers or other persons engaged to assist in fulfilling our obligations, insofar as this is necessary for the performance of the contract or compliance with legal obligations.
Article 6(1)(b) GDPR applies where you are personally party to the contract or request pre-contractual steps. Where you act for an organisation, we rely on Article 6(1)(f) GDPR and our legitimate interest in managing the business relationship and communicating with the appropriate contacts. Accounting and tax records required under Dutch law are processed under Article 6(1)(c) GDPR, including the applicable requirements of Article 52 of the Algemene wet inzake rijksbelastingen and Article 2:10 of the Dutch Civil Code.
Relevant information may be provided to payment and banking providers, professional advisers or competent authorities where necessary for the stated purpose. Retention is described in section 18.
Data is erased as soon as it is no longer required for the purposes stated above and no statutory retention obligations prevent its erasure. Statutory retention periods, in particular under commercial and tax law, may require longer retention. We erase data transmitted in connection with a specific engagement once the engagement has been completed and any retention periods have expired, unless further statutory or contractual retention obligations apply.
Overview:
Categories of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); contract data (e.g. subject matter of the contract, contract term, customer category).
Data subjects: Recipients of services and clients; prospective customers; business and contractual partners.
Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; organisational and administrative procedures; business processes and business management procedures.
Retention and erasure: Erasure in accordance with the information in section 18.
Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); legal obligation (Article 6(1)(c) GDPR); legitimate interests (Article 6(1)(f) GDPR).
When you access our website, your browser sends technical connection data to the hosting infrastructure so that pages and files can be delivered. This includes IP address, request time, requested resource, browser and operating system information, referring page and response status. Access logs are used to maintain availability, investigate errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in operating and protecting the website.
We process the data necessary to deliver, maintain and protect the website.
Overview:
Categories of data processed: Technical usage data (e.g. requested pages, devices and operating systems, metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved); log data (e.g. log files relating to logins, data retrieval or access times).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment, such as computers and servers); security measures.
Retention and erasure: Erasure in accordance with the information in section 18.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR).
Provision of online services using rented storage space: To provide our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a server provider (also referred to as a “web host”).
Collection of access data and log files: Access to our online services is recorded in “server log files”. Server log files may include the addresses and names of the web pages and files accessed, the date and time of access, the volume of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the page previously visited) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, for example to prevent server overload (particularly in the event of malicious attacks known as DDoS attacks), and to ensure appropriate server load management and stability.
Erasure of data: Log file information is stored for a maximum of 90 days and is then erased or anonymised. Data that must be retained as evidence is exempt from erasure until the relevant incident has been definitively resolved.
Hosting and technical service providers process connection and log data on our behalf. Their identities, processing locations and any international transfer safeguards are set out in the service-provider information in section 15.
Web analytics (also referred to as “audience measurement”) is used to analyse visitor traffic to our online services and may include pseudonymous information about visitors’ behaviour, interests or demographic characteristics, where those features are enabled and specifically included in your consent. Audience measurement enables us, for example, to identify when our online services, features or content are used most frequently and which encourage repeat use. It also allows us to identify areas in need of optimisation.
In addition to web analytics, we may use testing procedures, for example to test and optimise different versions of our online services or parts of them.
Unless otherwise stated in this policy, profiles, i.e. data grouped together in relation to a usage session, may be created for these purposes, and information may be stored in and subsequently read from a browser or device. The information collected includes, in particular, the websites visited and the elements used on them, as well as technical information such as the browser and computer system used and information about usage times. Where users have consented to the collection of their location data by us or by the providers of the services we use, location data may also be processed.
Users’ IP addresses are also stored. However, we use IP masking (i.e. pseudonymisation by truncating the IP address) to protect users. As a rule, web analytics, A/B testing and optimisation involve storing pseudonyms rather than directly identifying user data (such as email addresses or names). Such data remain personal data: identifiers and other information can allow a user or device to be recognised or linked to additional information. The degree of IP masking depends on the particular service.
Overview:
Information on legal bases: Optional analytics, advertising and session replay described below are activated only after consent under Article 6(1)(a) GDPR and, for storing or accessing device information, Article 11.7a of the Dutch Telecommunicatiewet and legitimate interest Article 6(1)(f) GDPR. Rejecting or withdrawing consent does not switch this processing to legitimate interests. Necessary technical services rely on the specific basis explained for that service.
Categories of data processed: Usage data (e.g. page views and time spent on pages, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Audience measurement (e.g. access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles); provision of our online services and user-friendliness.
Retention and erasure: Erasure in accordance with the information in section 18 and in the Cookie Policy.
Security measures: IP masking (pseudonymisation of the IP address).
For more information about the service providers see section 15.
If you contact us, book a demonstration, request a resource, or register for a webinar or event, we process the information you provide to respond, arrange the appointment, deliver the requested resource or administer participation. This normally includes your name, business email, employer and role, the subject of your request and any information you choose to include. Event administration can also involve attendance information and questions submitted during the event.
The legal basis is Article 6(1)(b) GDPR where the request concerns a contract with you personally or steps you ask us to take before entering into one. Otherwise, it is Article 6(1)(f) GDPR and our legitimate interest in responding to your enquiry and organising the requested activity. Information about a booked event or demonstration is distinct from subscription to ongoing marketing; we request marketing consent separately where required.
If an event is to be recorded, we tell participants in advance what will be recorded, for what purpose, who will receive the recording and how long it will be retained. We seek separate consent where required for recording or publishing identifiable participant contributions and provide an appropriate way to participate without being included.
Overview:
Categories of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, together with related information such as authorship details or the time of creation); metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Communication; organisational and administrative procedures; feedback (e.g. collecting feedback through an online form); provision of our online services and user-friendliness.
Retention and erasure: Erasure in accordance with the information in section 18.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR) in answering enquiries and maintaining business contacts; (Article 6(1)(b) GDPR) where your enquiry concerns steps at your request or a contract to which you personally are a party.
Contact form: When you contact us via our contact form, by email or through other communication channels, we process the personal data you provide to respond to and handle your enquiry. This generally includes information such as your name, contact details and, where applicable, other information you provide that is necessary to handle the enquiry appropriately. We use this data exclusively for the stated purpose of contact and communication.
Demo bookings, events and requested downloads: We use the contact and professional details you enter, appointment or registration details, and related communications to arrange the demo, deliver the requested material or organise the event. The legal bases follow the distinction above. Sending a requested resource does not automatically subscribe you to marketing. Webinar recordings that identify participants require separate prior information and, where relied upon, valid consent; we offer a way to participate without appearing in a recording. Event-specific recipients and retention information are provided at registration.
We process personal data for the purposes of marketing communications, in accordance with statutory requirements.
Electronic direct marketing requires prior consent unless the conditions of a permitted existing-customer exception under Article 11.7 of the Dutch Telecommunicatiewet and any other applicable rules are met. That exception concerns our own similar products or services, using contact details obtained in a sale, with a clear and free opt-out when the details are collected and in every message. Postal marketing is based on our legitimate interest in promoting relevant business services, subject to your right to object. Telephone marketing is carried out only where permitted by the applicable rules.
Recipients have the right to withdraw any consent they have given at any time or to object to marketing communications at any time, free of charge, using the contact method stated above.
Following withdrawal of consent or an objection, we stop the relevant marketing. We retain only the evidence needed to demonstrate compliance and handle legal claims, separately from active marketing data. Evidence of consent and the relevant electronic marketing messages is retained for up to five years after the last message sent on that basis, in line with Dutch ACM guidance. A minimal suppression record, such as the relevant email address and the objection date, is kept for as long as needed to prevent further marketing to that address. The bases are Article 6(1)(c) GDPR for applicable compliance duties and Article 6(1)(f) GDPR for necessary evidence and suppression records.
Overview:
Categories of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, together with related information such as authorship details or the time of creation).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Direct marketing (e.g. by email or post); marketing; sales promotion.
Retention and erasure: Erasure in accordance with the information in section 18.
Legal bases: Consent (Article 6(1)(a) GDPR); legitimate interests (Article 6(1)(f) GDPR) for permitted postal or existing-customer marketing and suppression records; compliance duties (Article 6(1)(c) GDPR). These bases do not remove any separate requirement for consent to the communication channel.
Form, scheduling, CRM, mailing and event providers used for these activities:
HubSpot (HubSpot Ireland Ltd., Dublin, Ireland): We use HubSpot as our CRM and marketing platform to manage inquiries, contact data and communications with prospective customers. Data is hosted in HubSpot’s EU data centre. To schedule demo appointments, we use HubSpot Meetings, which processes the information you provide when booking (e.g. name, email address, company, selected time slot).
Livestorm (Livestorm SAS, Paris, France): We use Livestorm to host live webinars. When you register for or attend a webinar, Livestorm processes your registration data (e.g. name, email address, company) as well as technical and participation data (e.g. attendance, interactions in chat or polls).
YouTube (Google Ireland Limited, Dublin, Ireland): We embed video content and webinar recordings from YouTube using the privacy-enhanced mode (“youtube-nocookie.com”). In this mode, YouTube does not store information about visitors unless they play the video. Once you start playback, data such as your IP address and information about your interaction with the video may be transmitted to YouTube and may be processed by Google LLC in the United States. Transfers to the United States follow section 14, using an applicable adequacy decision only where the recipient and processing are covered, or appropriate Article 46 safeguards.
We send newsletters, emails and other electronic notifications (collectively referred to as “newsletters”) only with the recipients’ consent or on a statutory basis. Where the content of a newsletter is specified during sign-up, that content determines the scope of users’ consent. Providing your email address is normally sufficient to subscribe to our newsletter. However, to offer you a personalised service, we may ask you to provide your name so that we can address you personally in the newsletter, or request further information if it is necessary for the purpose of the newsletter.
Our usual legal basis is your prior consent under Article 6(1)(a) GDPR and Article 11.7 Telecommunicatiewet.
Where permitted by Article 11.7 Telecommunicatiewet, we may use an email address obtained directly from an existing customer in the context of a sale to market our own similar products or services, provided that a clear, free and easy opportunity to object was offered when the address was collected and is included in each message. For that limited processing, our GDPR basis is Article 6(1)(f) and our legitimate interest in informing customers about similar offerings. A website visit, download, demonstration request or business email address alone does not establish this exception. Telephone marketing is subject to the separate consent and channel-specific rules that apply to the recipient.
You can unsubscribe free of charge using the link in each marketing email or by contacting hello@getworkflex.com. We stop the relevant marketing after withdrawal or objection and retain only the limited information necessary to honour your choice and demonstrate compliance, as described in section 18. Consent to marketing is not required to contact us or use our services.
We record the date, source and content of consent, the relevant notice or consent version, and any withdrawal or objection so that we can demonstrate and respect your choices.
Individual newsletter measurement: Only if you have separately consented, we use a tracking pixel or tracked links to record whether and when an email is opened and which links are clicked. This may involve the recipient identifier, IP address, time and browser or device information. We use this information to assess engagement and improve the relevance of our newsletters. The basis is Article 6(1)(a) GDPR and, where applicable, Article 11.7a Telecommunicatiewet. You may refuse this measurement or withdraw consent without losing the ability to receive the newsletter. Measurement is not assumed to be covered by general consent to receive marketing.
Erasure and restriction of processing: On the basis of our legitimate interests, we may retain email addresses that have been unsubscribed for up to three years before erasing them, in order to demonstrate that consent was previously given. Processing of this data is restricted to the purpose of potentially defending against claims. An individual request for erasure may be made at any time, provided that the previous existence of consent is confirmed at the same time. Where we are required to honour objections permanently, we reserve the right to retain the email address in a suppression list (known as a “blocklist”) solely for that purpose.
Overview:
Content: Information about us, our services, promotions and offers.
Categories of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved); usage data (e.g. page views and time spent on pages, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features).
Data subjects: Communication partners.
Purposes of processing and legitimate interests: Direct marketing (e.g. by email or post).
Legal bases: Consent (Article 6(1)(a) GDPR).
Opt-out: You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to receiving further newsletters. You will find an unsubscribe link at the end of each newsletter. Alternatively, you may use one of the contact methods stated above, preferably email.
When you request a whitepaper through our website, we process the information you provide in the request form to deliver the whitepaper or download link and handle any related enquiries. Mandatory fields are identified in the form; additional information is voluntary. Our legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to your request and providing the information you have asked for. Data is collected solely to fulfil your request. Such communications require your separate consent where applicable, which you may withdraw at any time with effect for the future. Optional analytics or advertising tracking associated with the request or download is subject to the separate consent arrangements described in this notice.
We process feedback and business contact details to respond to comments and improve our services under Article 6(1)(f) GDPR, reflecting our legitimate interest in understanding customer experiences. Where we ask to publish an identifiable testimonial, we explain the intended publication channels and obtain consent under Article 6(1)(a) GDPR. You can withdraw that consent for future use.
If a review is submitted directly to an external platform, the platform’s privacy notice explains its own processing. We do not treat the existence of a customer relationship as permission to upload contact or transaction details to a review platform. Any such disclosure requires a specific legal basis and advance information about the platform and purpose; consent is obtained where required.
Overview:
Categories of data processed: Review content and any publicly displayed name; contact data where used for consent-based review verification;Contract data (e.g. subject matter of the contract, contract term, customer category); usage data (e.g. page views and time spent on pages, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Recipients of services and clients; users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Feedback (e.g. collecting feedback through an online form); marketing.
Legal bases: Legitimate interests (Article 6(1)(f) GDPR) in receiving genuine feedback and presenting our services; consent for transmitting verification data to a review platform (Article 6(1)(a) GDPR). Any advertising invitation by email is subject to the marketing rules in section 10. The relevant platform, recipients and retention details are identified when the review is requested.
We operate a separate career site at https://careers.workflex.com, which identifies Teamtailor AB, Östgötagatan 16, 116 21 Stockholm, Sweden as its platform provider. Information about applications, candidate sourcing, interview activities, any recruitment-related AI tools, recipients and recruitment retention is provided in the dedicated recruitment privacy notice: https://careers.workflex.com/privacy-policy. The career site also has its own cookie information and cookie controls.
Please consult that notice before submitting an application. If you send an application to us directly, we use it to handle your application and provide the applicable recruitment privacy information. For recruitment enquiries and data requests, you can contact people@getworkflex.com or use https://careers.workflex.com/data-privacy. You may also contact our Data Protection Officer. This website notice does not introduce a separate retention period or a separate authorisation to record or transcribe interviews.
Some of the providers described in this notice may process data outside the European Economic Area (EEA), including through support access or onward processing in the United States. The country in which a provider has its registered office does not by itself determine where all processing takes place.
Where a transfer is covered by a valid European Commission adequacy decision under Article 45 GDPR, we rely on that decision within its scope. For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the European Commission dated 10 July 2023. This apply to an organisation whose active EU–US Data Privacy Framework certification covers the relevant entity and processing. Certification information is available at https://www.dataprivacyframework.gov/.
In addition, we have entered into Standard Contractual Clauses with the respective providers that comply with the European Commission’s requirements and establish contractual obligations to protect your data. This dual safeguard ensures comprehensive protection of your data: the DPF provides the primary level of protection, while the Standard Contractual Clauses provide an additional safeguard. If changes to the DPF occur, the Standard Contractual Clauses serve as a reliable fallback. In this way, we ensure that your data remains adequately protected at all times, even in the event of political or legal changes.
For each service provider, we inform you whether it is certified under the DPF and whether Standard Contractual Clauses are in place.
Where no applicable adequacy decision exists, transfers require appropriate safeguards under Article 46 GDPR, such as the European Commission’s Standard Contractual Clauses, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de., an assessment of the circumstances of the transfer and any necessary supplementary measures.
You can request a copy of the relevant safeguards or further information by contacting hello@getworkflex.com; information may be redacted where necessary to protect the rights of others.
In order to provide and continuously improve our services, we are using the services of the following third-party providers which may also process personal data. These third-party providers have been selected diligently and in line with the requirements of the GDPR. For processors, we enter into agreements under Article 28 GDPR. Providers acting for their own purposes have separate responsibilities; the relevant roles are identified below.
Provider details: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We use Google Analytics to understand how the website is used, which pages and resources are useful and where navigation or performance can be improved. With consent, it processes online identifiers, page and interaction events, referral information, time of access, browser and device information and approximate location derived from technical connection data. For more Information about Analytics and Tracking see section 9 of this policy.
The legal basis is Article 6(1)(a) GDPR and, for storage or access on your device, Article 11.7a Telecommunicatiewet. Pseudonymous analytics information remains personal data where it can be linked to a person. For Google Analytics 4, Google states that individual IP addresses are not logged or stored and that IP data from EU traffic is used to derive approximate location and then discarded. This does not make all analytics data anonymous.
Google processes analytics data on our behalf under the applicable data processing terms; any additional use for advertising or Google’s own purposes requires a separate assessment and transparent disclosure.
Cookie lifetimes are stated in the Cookie Policy.
Google’s privacy information: https://business.safety.google/privacy/.
Processing terms: https://business.safety.google/adsprocessorterms/.
The following data is collected and processed:
IP address transiently processed to derive approximate location; pseudonymous device and user identifiers; usage data
Click path
Browser information
Device information
JavaScript support
Pages visited
Referrer URL
Downloads
Location information
Conversion events configured for this website, such as a demo request
Widget interactions
Date and time of visit
If you do not want Google Analytics to collect and process the aforementioned data, you can refuse your consent or withdraw it at any time with effect for the future. You may withdraw consent through our cookie controls; the optional browser add-on at https://tools.google.com/dlpage/gaoptout is an additional control, not a substitute for our consent mechanism.
Google Analytics is not activated without the required consent.
The data will be stored for as long as it is necessary for the purpose of the processing. The data will be deleted as soon as it is no longer needed for the processing purposes.
As part of the processing, the data may be transferred to the following recipients besides Google Ireland Limited:
Google LLC,
Data may be transferred to Google LLC in the USA. Article 45 GDPR applies where the transfer falls within Google LLC’s active EU–US DPF certification; otherwise an effective Article 46 GDPR safeguard is required, as explained in section 14. The applicable Google terms and transfer safeguards are available at https://business.safety.google/adsprocessorterms/.
Provider details: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
With your consent, Google Ads uses identifiers and information about advertisements clicked, pages visited, timing, browser or device details and defined website actions to measure whether an advertisement led to a relevant action, such as a demonstration request. The Service is so-called conversion tracking, i.e., we can detect what happened after you clicked on our advertisements. Cookies are placed for this purpose, but they are only valid for a limited time.The purpose is to assess and improve advertising effectiveness. For more Information about this processing see section 9 of this policy.
The legal basis is Article 6(1)(a) GDPR and Article 11.7a Telecommunicatiewet for device storage or access.
Data may be transferred to Google LLC in the USA. Article 45 GDPR applies where the transfer falls within Google LLC’s active EU–US DPF certification; otherwise an effective Article 46 GDPR safeguard is required, as explained in section 14. The security of the transmission is ensured by so-called standard contractual clauses, which guarantee that the processing of personal data is subject to a security level that corresponds to that of the GDPR. The applicable Google terms and transfer safeguards are available at https://business.safety.google/adsprocessorterms/.
Google’s role depends on the applicable advertising service and its terms; where it determines its own purposes, it acts as a controller for that processing.
Further information: https://business.safety.google/privacy/ and https://business.safety.google/adsservices/.
Cookie lifetimes and the configured conversion-data retention period are in the Cookie Policy.
Any remarketing, enhanced conversions, customer-list matching or cross-device features require specific information and an appropriate legal basis before activation; they are not authorised merely by this description of conversion measurement.
The following data is collected and processed:
Cookie-ID,
Visited Pages,
IP Addresses,
Duration of visit,
Usage data,
Content user is interested in,
Clicked Ads,
Web requests,
Cookie information,
Referrer URL,
Browser language,
Browser type.
If you do not want Google Ads to collect and process the aforementioned data, you can refuse your consent or withdraw it at any time with effect for the future.
As part of the processing, the data may be transferred to the following recipients besides Google Ireland Limited:
Google LLC
Intercom provides a website messaging channel and processes your enquiry and contact information together with technical connection data, such as IP address, page visited, browser details, time and chat identifiers. The purpose is to answer enquiries and provide support. Intercom processes customer personal data under its data processing agreement; any independent processing under its own terms must be separately identified.
Provider Details: Intercom R&D Unlimited Company, Ireland; Stephen Court, 18-21 Saint Stephens Green, Dublin 2, Ireland.
If the chat function of our website is activated, additional personal data will be processed. Processed data categories: technical connection data of the server access (IP address, date, time, requested page, browser information), data about your inquiry or contact information like name and e-mail address.
The optional integration is activated with prior consent under Article 6(1)(a) GDPR and, where applicable, Article 11.7a Telecommunicatiewet. Processing is necessary to answer a submitted request is based on Article 6(1)(b) or (f) GDPR as explained in section 10. Any optional behavioural analytics or marketing functionality requires separate consent and disclosure. You may contact us by email instead.
Provider information: https://www.intercom.com/legal/privacy.
Data processing agreement: https://www.intercom.com/legal/data-processing-agreement.
The services below are activated only after the relevant consent. You can refuse or withdraw consent at any time using “Cookie settings”. Our legal basis is Article 6(1)(a) GDPR and, for storage or access on your device, Article 11.7a Telecommunicatiewet where applicable. Cookie and local-storage lifetimes are listed in the linked Cookie Details; these are separate from retention of data on provider servers.
We use Dreamdata.io ApS, Denmark, for business-to-business marketing attribution and company identification.
Dreamdata processes visitor identifiers, visited URLs, page titles, referrers, timestamps, IP addresses and browser/device information to analyse which marketing channels lead to website visits and enquiries. The identifier is pseudonymous, even though it is named dd_anonymous_id. Dreamdata processes this information on our behalf under a data processing agreement.
The dd_anonymous_id identifier is stored in a first-party cookie and browser local storage. The cookie lifetime is one year and may renew on a subsequent visit; local storage has no automatic browser expiry. It can link visits over time.
Dreamdata documents EU hosting
Further information: https://dreamdata.io/legal.
When you refuse or withdraw consent, we do not load Dreamdata tracking, including its cookieless variant, or transmit page-view events to Dreamdata.
We use Microsoft Advertising Universal Event Tracking (UET), involving Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, United States, to measure advertising conversions and attribute visits and actions to advertisements.
It processes page URLs, referrers, event and conversion information, IP addresses, browser/device information and identifiers such as _uetsid and _uetvid. Microsoft also processes data for its own advertising purposes under its Privacy Statement. This service is separate from Microsoft Clarity.
UET is blocked without the relevant consent, including cookieless advertising pings. Cookie and local-storage details are in Cookie Details.
Transfers to the United States follow section 14, using an applicable adequacy decision only where the recipient and processing are covered, or appropriate Article 46 safeguards.
Further information: https://privacy.microsoft.com/privacystatement.
We use Fullstory to analyse website use and usability through session replay. Provider: Fullstory, Inc., United States. The processing involves page views, navigation, clicks, scrolling, browser/device information, IP addresses and pseudonymous identifiers. Relevant technologies include fs_uid, fs_lua and related local-storage entries.
This processing takes place only after the relevant consent described above.
Transfers to the United States follow section 14, using an applicable adequacy decision only where the recipient and processing are covered, or appropriate Article 46 safeguards
Further information: https://www.fullstory.com/legal/privacy-policy/
When you interact with our social media pages, we process the profile information visible to us, comments, messages and interaction information to communicate, respond to enquiries and present our business. Our basis is Article 6(1)(f) GDPR and our legitimate interest in public communication and responding to visitors. Where processing concerns a contract with you personally, Article 6(1)(b) GDPR may apply. Optional advertising or tracking remains subject to the separate consent requirements described above.
The platform operator also processes personal data for its own purposes under its privacy notice, including personalisation, profiling and advertising, and may process data outside the EEA. Following a normal link to a social network is different from activating an embedded plug-in or tracking pixel on our website. The latter requires the relevant consent where applicable.
Please also note that requests for access and the exercise of data subject rights are most effectively addressed directly to the providers. Only the providers have access to the respective user data and can take the relevant action and provide information directly. If you nevertheless require assistance, you may contact us.
A social network that enables users to share photos and videos, comment on and like posts, send messages, and follow profiles and pages;
Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland;
Website: https://www.instagram.com.
Privacy policy: https://privacycenter.instagram.com/policy/.
LinkedIn is a social network, for business networking and employer branding. We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of visitor data used to generate “Page Insights” (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with and the actions they take. Details of the devices used are also collected, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job function, country, industry, seniority, company size and employment status.
We have entered into a specific agreement with LinkedIn Ireland (the “Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which specifies, in particular, the security measures LinkedIn must implement and under which LinkedIn has agreed to facilitate the exercise of data subject rights (i.e. users can, for example, submit requests for access or erasure directly to LinkedIn).
LinkedIn provides the agreed information, security measures and mechanisms for exercising rights for that processing.
LinkedIn’s wider platform processing is described at https://www.linkedin.com/legal/privacy-policy. You may exercise your rights concerning jointly controlled processing against either controller, including us.
Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland;
Website: https://www.linkedin.com;
Privacy policy: https://www.linkedin.com/legal/privacy-policy.
Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Cookies are small text files that are stored on your computer and contain readable data. A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies that are stored for longer than a single session.
Our website uses cookies and comparable technologies, including local storage, pixels and scripts that store or access information on your device. Article 11.7a Telecommunicatiewet governs that storage or access whether or not the information is personal data. Where personal data is processed, a separate GDPR legal basis is also required.
Strictly necessary technologies are used without consent only where their sole purpose is carrying out a communication or they are strictly necessary to provide an information-society service you expressly request. Dutch law also provides a limited exception for qualifying analytical technologies with no or only minor privacy impact. We do not apply that exception to the Google Analytics, advertising or session-replay activities described in this notice; those require consent under our website configuration.
For optional analytics, advertising and embedded features, we request your freely given, specific, informed and unambiguous consent before loading the relevant tool or storing or accessing device information. You can accept, reject or select optional categories without losing access to the public website. Choices are not preselected. Refusal and withdrawal are as easy as acceptance.
You can reopen “Cookie settings” (https://www.workflex.com/en-uk/cookie-policy) at any time through the persistent website link to change or withdraw your choices. Withdrawal stops future optional processing; it does not affect the lawfulness of earlier processing. Browser controls can additionally delete or block cookies but do not replace our consent and withdrawal controls.
Consent management provider:
CookieFirstDigital Data Solutions B.V. (CookieFirst)
Plantage Middenlaan 42a
1018DH, Amsterdam
Netherlands
CookieFirst stores your preference in the cookiefirst-consent cookie, listed with a one-year lifetime, and in local storage. The inventory also lists cookiefirst-id in local storage. Local storage is persistent until cleared. Server-side evidence of consent is retained for 90 days; it is separate from browser storage. We record the choice, timestamp, consent identifier and notice version needed to demonstrate consent and respect withdrawal.
We process consent status, time, notice version and a consent or device identifier to remember and demonstrate your choices. Recording evidence of consent is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; necessary operation of the preference-management function is based on Article 6(1)(f) GDPR. The settings cookie and evidence record have different purposes and may have different retention periods.
Cookie Details: https://www.workflex.com/en-uk/cookie-policy
Before you choose, this information identifies each provider and technology, its purpose, the data involved, its duration and relevant recipients or transfers. Session technologies generally expire at the end of the session; persistent technologies expire after their specified lifetime. There is no blanket two-year retention period for all cookies or device identifiers.
Information on legal bases under data protection law: Whether we process personal data using cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, as explained above in this section and in the context of the respective services and procedures.
Storage period: The following types of cookies are distinguished according to their storage period:
Temporary cookies (also known as session cookies): Temporary cookies are erased, at the latest, once a user has left an online service and closed the relevant browser or mobile application on their device.
Persistent cookies: Persistent cookies remain stored even after the device has been shut down. For example, they can be used to save the user’s login status and display preferred content directly when the user returns to a website. User data collected through cookies may also be used for audience measurement. Unless we provide users with explicit information about the type and storage period of cookies (e.g. when obtaining consent), users should assume that the cookies are persistent and may be stored for up to two years.
General information on withdrawal of consent and objection (opt-out): Users may withdraw the consent they have given at any time and may also object to processing in accordance with statutory requirements, including through the privacy settings in their browser.
Categories of data processed: Metadata, communication data and process data (e.g. IP addresses, time information, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Legal bases: Legitimate interests (Article 6(1)(f) GDPR); consent (Article 6(1)(a) GDPR).
We use a consent management solution to obtain users’ consent to the use of cookies or to the procedures and providers specified in that solution. This procedure is used to obtain, record, manage and withdraw consent, in particular in relation to cookies and comparable technologies used to store, read and process information on users’ devices. As part of this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers identified in the consent management procedure. Users can also manage and withdraw their consent. Consent declarations are stored to avoid having to request consent again and to provide evidence of consent in accordance with statutory requirements. They are stored on the server and/or in a cookie (known as an opt-in cookie) or by means of comparable technologies, so that consent can be associated with a specific user or their device. Unless specific information about consent management service providers is provided, the following general information applies: Consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information about the scope of consent (e.g. the relevant categories of cookies and/or service providers) and information about the browser, system and device used.
Optional analytics and advertising are based on consent. Refusal or withdrawal does not cause us to switch those activities to legitimate interests. Processing strictly necessary for website delivery and consent management follows the separate purposes and legal bases described in this notice.
Service providers may also use cookies and tracking technologies as part of its services. These technologies help service providers gather usage data and improve its services. For more information about the cookies and tracking technologies used by service providers, please refer to their Cookie Policy.
Please note that our interactions with service providers do not constitute an endorsement of their services, and we are not responsible for their data processing practices. We recommend reviewing their policies before using our website.
You can adjust the settings of your browser so that you are alerted each time a cookie is placed on your computer. This assures a transparent use of cookies. You can also use your browser settings to delete cookies and prevent the placement of new cookies. Please note that this may result in difficulties displaying our website and some functions may no longer be available for technical reasons.
For further Information on tracking etc. see section 9 of this policy.
We retain personal data only for as long as necessary for the specific purpose and any applicable legal obligation. When a purpose ends, we erase or irreversibly anonymise the data unless a distinct, documented legal basis requires limited further retention. Withdrawal of consent does not erase data that must lawfully be retained for a separate purpose, such as a statutory accounting record; such data is restricted to that purpose.
Routine website access and error logs: up to 90 days from collection. Information needed to investigate a specific security incident or establish, exercise or defend a specific claim may be isolated and kept for the necessary period, with restricted access and periodic review.
Contact, demo, resource-request and chat records: for the handling of the request and relevant follow-up, then 90 days. Records that become part of a contract are governed by the contract and statutory rules below.
Business contact and contract records: for the relationship and afterwards only to meet applicable legal duties or manage specifically relevant claims. Retention for claims is limited to the relevant records and the applicable limitation period, taking account of the type of claim and any interruption or suspension; it is not a general permission to keep all correspondence indefinitely.
Dutch accounting and tax records: generally seven years for the records subject to the statutory accounting obligation (under Article 52 AWR); ten years applies to particular categories, such as real-estate VAT records and records covered by the relevant One Stop Shop VAT rules. The statutory starting point depends on the record and when it ceases to be current. These periods do not automatically apply to all website visitor data.
Newsletter subscriptions and active marketing profiles: while the subscription or lawful marketing relationship remains active, subject to periodic relevance review, and until withdrawal or objection. Limited evidence of permission and compliance with electronic marketing rules is retained for five years after the last relevant message, with restricted access, for accountability and the establishment or defence of claims under Article 6(1)(f) GDPR. A minimal suppression record is kept for as long as needed to prevent renewed marketing contrary to your choice, with periodic necessity review.
Analytics, advertising and session-replay data: the tool-specific periods in sections 9 and 15. Cookie or local-storage expiry is separate from server-side retention. Aggregated reports are kept longer only if they are genuinely anonymous or a separate lawful and disclosed retention basis applies.
Consent-management evidence: Preference cookies and other device storage have the individual lifetimes listed in the Cookie Details in our Cookie Policy (https://www.workflex.com/en-uk/cookie-policy) and section 17.
Recruitment retention is explained in the separate notice linked in section 13 and on the own career website.
Where the same record serves several purposes, access and use are limited to the purpose that still justifies retaining it. We do not automatically select the longest period for all copies or purposes, and there is no universal rule that a retention period begins at the end of the calendar year. Backup copies are removed through the scheduled backup cycle within 90 days; they are access-restricted and not used for ordinary business processing. Where a backup is restored, relevant erasure restrictions are reapplied.
Personal data is accessible to authorised WorkFlex personnel who need it for the stated purpose (need-to-know-priciple). External recipients may include the website, hosting, communication, consent, analytics and other providers identified in this notice; banks and payment providers where relevant; professional advisers; and public authorities where disclosure is legally required. Any group-company access must have a defined purpose and appropriate safeguards; group membership alone does not justify access.
Where a provider acts on our instructions, we engage it under Article 28 GDPR and require appropriate confidentiality, security and subprocessing safeguards. Where a recipient acts as a separate controller or we jointly determine processing, the applicable allocation of responsibilities is described for that service. The recipient’s own notice does not relieve us of responsibility for our collection or disclosure. International disclosures, including remote access, are subject to section 14.
As a data subject, you have various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:
Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing.
We then stop processing for direct marketing; no explanation is required. For other processing based on legitimate interests, we stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or need the data for legal claims. You can object by contacting us using section 23.
Right to withdraw consent: You have the right to withdraw any consent you have given at any time, without affecting the lawfulness of processing based on consent before withdrawal. Use “Cookie settings”, the newsletter unsubscribe link, or the contact details below, as applicable.
Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to obtain access to that data, together with further information and a copy of the data, in accordance with statutory requirements.
Right to rectification: In accordance with statutory requirements, you have the right to request that incomplete data concerning you be completed or that inaccurate data concerning you be rectified.
Right to erasure and restriction of processing: Subject to statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, that the processing of the data be restricted in accordance with statutory requirements.
Right to data portability: In accordance with statutory requirements, you have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. In particular, you may lodge the complaint with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.
WorkFlex is established in Netherlands, and operates cross-border within the EU, under the EU's "one-stop-shop" mechanism our lead supervisory authority for cross-border processing within the EU is the Dutch Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl). For processing strictly local to another EU Member State, the local authority may instead be competent. For processing that falls outside EU GDPR scope, the relevant non-EU authority applies.
To exercise your rights, contact hello@getworkflex.com or our data protection officer. We respond without undue delay and normally within one month. If a permitted extension of up to two further months is necessary because of complexity or the number of requests, we explain the reasons within the first month. We request additional identity information only where reasonably necessary and proportionate. Requests are normally free of charge.
We are supported by our data protection officer in fulfilling our obligations under data protection law. The contact details of our data protection officer are:
ASURE Legal Privacy
Arzu Sandi
E-Mail: info@asurelegal.com
You may contact our external Data Protection Officer confidentially about the processing of your personal data and the exercise of your rights. Please identify WorkFlex International B.V. in your enquiry so that it can be allocated correctly.
We may update this Privacy Notice from time to time to reflect changes in our processing, our services, applicable law, or guidance from supervisory authorities. The current version is always available on our website. Any changes will be posted on this page, and the version date will be updated accordingly.
For questions about this notice or your personal data, contact hello@getworkflex.com.
Information about our security and compliance measures is available at https://trust.workflex.com/.
This supplements the information in this notice and does not replace it.
