Privacy Statement

1. Who we are (verwerkingsverantwoordelijke)

The controller responsible for processing your personal data is:

• GRIP op werk B.V.
• Filosofentuin 1, 2908 XA Capelle aan den IJssel, The Netherlands
• Phone: 010 322 1100
• Email: info@grip.work
• KvK: 51840243

2. What data we process (persoonsgegevens)

Employees

• Full name and home address
• Email address
• Weekly kilometre reports (trips and distances)
• Working hours (including overtime)
• Digital signature

Client company contacts

• Company name and address
• Contact email address and phone number

3. Why we process your data (doeleinden en grondslag)

Employee data — used for payroll administration, kilometre reimbursement, work reporting and access management.

• Legal basis: performance of the employment or assignment agreement (AVG art. 6(1)(b));
• Legal basis: compliance with a legal obligation (AVG art. 6(1)(c)) for fiscal and payroll retention.

Client company data — used for service delivery, invoicing and communication.

• Legal basis: performance of the agreement with the client (AVG art. 6(1)(b)).

We do not use automated decision-making or profiling, and we do not use your data for marketing purposes.

4. How long we keep your data (bewaartermijnen)

• Financial and payroll records: 7 years (fiscal retention obligation, art. 52 AWR).
• Salary administration: 5 years after the end of the contract.
• Employment / assignment data: 2 years after termination.
• Digital signatures: up to 5 years after the end of the relationship.

After the applicable retention period, your data is deleted or anonymised.

5. Who has access (ontvangers)

• Authorised GRIP op werk administrators;
• Client companies — only the data of their own workers;
• Our IT processor, Supabase, which hosts the application on servers located within the EU (Frankfurt, Germany) under a data processing agreement (verwerkersovereenkomst, AVG art. 28);
• For workers who commute by public transport, OpenAI Ireland Ltd processes the uploaded OV-chipkaart expense file solely to automatically read its weekly total amount. This is done under a data processing agreement; data sent through the OpenAI API is not used to train any AI models and is retained for up to 30 days for abuse monitoring, after which it is deleted;
• Where applicable, our external accountant or payroll administrator.

We do not sell your data or share it with third parties outside the purposes described above. Where a processor (such as OpenAI) processes data outside the European Economic Area, this takes place under appropriate safeguards — in particular the EU Standard Contractual Clauses (AVG art. 46), supplemented where applicable by the EU–US Data Privacy Framework.

6. Cookies

This application uses only technically necessary functional cookiesrequired for authentication and session management. Under the Dutch Telecommunications Act (Telecommunicatiewet art. 11.7a) no consent is required for such cookies. We do not use tracking, advertising or analytics cookies.

7. Your rights (rechten van betrokkenen)

Under the AVG / GDPR you have the right to:

• Access (inzage, art. 15) — request a copy of your data;
• Rectification (rectificatie, art. 16) — correct inaccurate data;
• Erasure (verwijdering, art. 17) — request deletion, subject to legal retention obligations;
• Restriction (beperking, art. 18) — limit processing during a dispute;
• Data portability (dataportabiliteit, art. 20);
• Object (bezwaar, art. 21) — object to processing based on a legitimate interest.

To exercise any of these rights, contact us at info@grip.work. We respond within one month, which may be extended by a further two months for complex requests.

8. Security (beveiliging)

We apply appropriate technical and organisational measures to protect your data, including role-based access control, encrypted data transmission (HTTPS/TLS) and secure cloud storage within the EU.

9. Complaints (klachtrecht)

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Autoriteit Persoonsgegevens (AP)
• Website: autoriteitpersoonsgegevens.nl
• Phone: +31 (0)70 888 85 00
• Postal: Postbus 93374, 2509 AJ Den Haag

10. Changes to this statement

We may update this privacy statement from time to time. The latest version is always available within the application. We will communicate material changes to users.

11. Contact

Questions about this privacy statement? Contact us at info@grip.work.