Privacy Policy

1. Introduction

EenvoudigHR B.V., trading as WorkVine, takes the protection of personal data seriously. This Privacy Policy explains what personal data we collect, how we use and protect it, and what rights you have.

2. Who is responsible for your personal data?

EenvoudigHR B.V., trading as WorkVine, is based at IJsbaanpad 84e, 1076 CW Amsterdam, the Netherlands. Our role depends on the processing activity.

When WorkVine determines why and how personal data is processed, for example for our own contracts, administration and billing, we act as the data controller.

When a customer uses WorkVine to process personal data for which that customer is the controller, WorkVine acts as the data processor. We process that data on the customer's instructions, under the arrangements set out in the data processing agreement. The customer remains responsible for the purpose and legal basis of that processing.

3. Personal data we process

Depending on the processing activity and the platform features in use, we may process the personal data listed below. When we process data on a customer's behalf, the roles described in section 2 apply.

• Name and contact details
• IP address, browser data and device information
• Login and account details
• HR data, such as hours worked, leave, and documents

4. Purposes of data processing

The purposes for which personal data is processed as part of our services are listed below. When processing data on a customer's behalf, we follow that customer's instructions and the data processing agreement. This list does not give WorkVine independent permission to use customer data for other purposes.

• Providing access to and use of the WorkVine platform (SaaS)
• Customer service and support
• Legal obligations and compliance (such as GDPR and WvP)
• Security, statistics, and product improvement

5. Legal bases

For processing activities where WorkVine is the controller, the applicable legal basis depends on the purpose and circumstances. The legal bases we may rely on are listed below. When we process personal data on a customer's behalf, that customer is responsible for establishing a valid legal basis.

• Performance of a contract
• Legal obligations
• Legitimate interests, such as improving the product or preventing misuse. When relying on legitimate interests, we carefully balance those interests against your privacy rights and interests.
• Consent, for example, for marketing newsletters

6. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected, unless a statutory retention period applies. Examples include:

• Account and login data: two years after the contract ends
• Payroll and tax data: seven years (statutory tax retention period)
• Job application data: up to four weeks (or one year with consent)

7. Sharing personal data with third parties

We only share personal data with:

• Hosting and infrastructure providers, including Google Cloud environments configured by WorkVine in Europe.
• Public authorities when required by law
• Partners such as Nmbrs for payroll processing, where activated

We put the required data processing arrangements in place with parties that process personal data on our behalf. When we act as a processor for a customer and engage a sub-processor, the arrangements in our data processing agreement with that customer apply.

8. Data security

We use appropriate technical and organizational measures to protect personal data against loss, unauthorized access, and misuse. These measures include encryption, access controls, and logging.

9. Your data protection rights

You have the right to:

• Access your personal data
• Have your personal data corrected or erased
• Request restriction of, or object to, processing
• Data portability
• Withdraw your consent
• Lodge a complaint with the Dutch Data Protection Authority

Send requests to privacy@workvine.nl. We will respond within 30 days.

Does your request concern personal data processed through WorkVine by your employer or another organization? We recommend contacting that organization as the data controller. WorkVine supports the organization in handling your request under the data processing agreement. You can also contact us using the address above.

10. Cookies and tracking

When you visit our website, a cookie banner allows you to choose which cookies you accept. We use:

• Functional cookies: required for the website to work properly (always active)
• Analytics cookies: used to measure website use anonymously with Google Analytics 4 (only with your consent)
• Marketing cookies: for example, LinkedIn or remarketing pixels (only with your consent)

Your consent preferences are stored in a functional cookie for up to 12 months. You can change them at any time through the cookie banner. Click here to reopen it.

11. Where is personal data processed?

For customer and employee data within the WorkVine platform, we use European hosting and an EU-only processing chain. Application data is processed and maintained in European Google Cloud environments configured by WorkVine. Further arrangements on sub-processors and data transfers are set out in the data processing agreement.

We use Google Analytics 4 to analyze website usage, but only after you have given consent. Google uses regional infrastructure to collect measurement data. This does not mean that all subsequent processing takes place exclusively within the European Economic Area (EEA). Google may also process data outside the EEA.

Google describes its processing and international data transfer arrangements in the Google Ads Data Processing Terms.

12. Data Protection Officer

WorkVine is not required to appoint a Data Protection Officer (DPO). We have designated an internal privacy contact to oversee GDPR compliance.

13. Changes

We may update this Privacy Policy from time to time. The latest version will always be available on our website. We will notify you proactively of material changes.

14. Contact

If you have questions or wish to exercise your rights, contact us at:

• Email: privacy@workvine.nl