Privacy policy

The controller for data related to the Werkido.com brand is BloomPixel.studio, KVK 42015468, VAT NL005433877B58, operating the werkido.com domain.

Contact for privacy questions, data subject requests and security: info@werkido.com.

This policy covers data processed when you use the public site, your account, the service and job listing editors, messages, paid features, reviews, verification and contact forms.

• identification and account data: first and last name, e-mail, phone number, user id;
• profile and business data: company name, KVK, VAT, service categories, service area, description;
• listing content, photos, messages, support requests and reviews;
• payment and subscription data for premium plans;
• location data needed for search: city, region, service radius;
• verification data, if you verify your identity or company;
• technical and security data: logs, session identifiers, language preferences;
• with your consent: Google Analytics 4 analytics data described below.

• performance of a contract (art. 6(1)(b) GDPR): account, profile, publishing listings, messages, paid plans, requests;
• legitimate interest (art. 6(1)(f) GDPR): security, abuse prevention, moderation, product development, listing statistics from the Werkido counter, defence of legal claims;
• legal obligation (art. 6(1)(c) GDPR): taxes, accounting, obligations under the DSA;
• consent (art. 6(1)(a) GDPR): Google Analytics 4 and other features that need separate consent.

Data you submit to AI tools is processed only as far as needed for that operation.

With your consent we use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure page visits, listing views, phone number reveals, contact clicks and traffic sources.

• legal basis: consent (art. 6(1)(a) GDPR), which you can withdraw in the cookie settings;
• the Google script is loaded only after consent; without consent your browser does not contact Google Analytics;
• GA4 processes identifiers from the _ga and _ga_<ID> cookies, approximate location, device and browser information and on-page events; we never send phone numbers, e-mail addresses, names or message contents;
• Google Signals and ad personalisation are switched off; event data is kept for 14 months;
• data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework and standard contractual clauses.

Independently of GA4 we count listing views, phone number reveals and contact clicks with our own counter, so that advertisers get reliable statistics. The legal basis is legitimate interest (art. 6(1)(f) GDPR).

• the counter sets no cookies and stores no identifiers in your browser;
• we compute a salted hash (HMAC-SHA-256) of your IP address and User-Agent; the salt changes every 24 hours and is deleted after at most 48 hours;
• we never store the raw IP address or User-Agent; the hash only prevents a page refresh within 30 minutes from being counted twice and is deleted after 30 minutes;
• the database keeps only daily totals per listing, without any visitor data; bot traffic and visits by the listing’s author are not counted.

We share data with processors only as far as needed to run the platform, in particular:

• BetterAuth for user authentication.
• MongoDB as the main application database.
• Redis as cache, queue and listing-counter store for some services.
• Resend for system messages and transactional e-mails.
• Stripe for payments and subscriptions.
• Cloudflare R2 for storing files and images.
• Geoapify for geocoding and location suggestions.
• OpenAI for selected AI features, if you use the content assistance tools.
• Google Ireland Limited (Google Analytics 4), only with your consent.
• The internal messaging service for communication between users.

Some providers may process data outside the EEA. In that case we rely on transfer mechanisms required by the GDPR, such as adequacy decisions or standard contractual clauses.

• account and profile data: while the account is active and as long as needed for settlements and legal claims;
• payment data and accounting records: as long as tax law requires;
• messages, requests and security logs: as long as justified by running the service and handling disputes;
• GA4 data: 14 months; daily totals of the Werkido counter: at least 13 months;
• cookies and browser data: as described in the cookie policy.

You can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest.

You can withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.

Complaints can be sent to info@werkido.com and to a supervisory authority, including the Dutch Autoriteit Persoonsgegevens.

We use technical and organisational measures appropriate to the service: access control, authorisation, least privilege, event logging and separation of services into independent components.

We publish material changes to this policy with a new date. See also the terms and conditions and the cookie policy.