Plain-language summary of the SkillMix privacy policy. The authoritative, binding version is the page at https://skillmix.nl/privacy. This markdown mirror exists for LLM context and is not the legal document.
Controller
Legal entity: SkillMix BV (Belgian BV).
Address: Abel Janssenslaan 10, 2845 Niel, Belgium.
Booking submissions — calendar booking metadata via Reclaim.ai.
Authentication & client portal data — email and credentials for clients with portal access.
Standard server / analytics data — IP address (truncated where possible), user agent, referrer, page paths, language preference, geo-region (country level for language detection).
Cookies — strictly necessary cookies always on; non-essential analytics cookies only after explicit consent via the cookie banner.
Why we process it (purposes & legal bases)
Responding to inquiries — legitimate interest / pre-contract step.
Evaluating applications — pre-contract step / consent for retention beyond the immediate decision.
Operating client engagements — performance of contract.
Operating and improving the website — legitimate interest, with non-essential analytics on opt-in only.
Compliance with legal obligations — accounting, tax, and where applicable B2B record-keeping.
Processors & sub-processors
We use vetted third-party processors under written DPAs. Current processors include:
Hosting / backend (Lovable Cloud / Supabase) — hosts the site, the database, and edge functions. EU region.
Slack — internal routing of contact-form inquiries and job applications to the team.
Reclaim.ai — exploration call booking.
Email infrastructure — transactional and notification email delivery.
Analytics — opt-in only, after consent via the banner.
A current sub-processor list is available on request.
Retention
Contact data: kept for the duration of the engagement and a reasonable period thereafter for legitimate business and legal reasons (typically up to 7 years for accounting where applicable).
Job application uploads (CV, motivation): retained for up to 365 days unless the candidate requests earlier deletion.
Server / analytics data: standard retention windows; aggregated where possible.
Authentication data: retained while the account is active.
Your rights under GDPR
You can at any time:
Access the personal data we hold about you.
Request rectification of inaccurate data.
Request erasure ("right to be forgotten").
Request restriction of processing.
Request portability of the data you provided.
Object to processing based on legitimate interest.
Withdraw consent for any processing based on consent (e.g. analytics cookies).
Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).
To exercise any right, email info@skillmix.eu. We respond within the GDPR statutory timeframe.
International transfers
We host EU-first. Where a sub-processor processes data outside the EEA, transfers rely on standard contractual clauses or adequacy decisions, and processing is limited to what is strictly necessary for the service.
Cookies
A consent banner is shown on first visit. Strictly necessary cookies (session, language preference, cookie-consent state) are always on. Non-essential cookies (analytics, marketing pixels) are only set after explicit opt-in. You can change or withdraw your choice at any time via the cookie controls on the site.
Updates
This summary is updated alongside the authoritative policy. Material changes are reflected on the live page first; the markdown mirror is updated shortly after.