# Privacy Policy — SkillMix

> Plain-language summary of the SkillMix privacy policy. The authoritative, binding version is the page at https://skillmix.nl/privacy. This markdown mirror exists for LLM context and is not the legal document.

---

## Controller

- **Legal entity:** SkillMix BV (Belgian BV).
- **Address:** Abel Janssenslaan 10, 2845 Niel, Belgium.
- **VAT:** BE1029020540.
- **Privacy contact:** info@skillmix.eu.
- **Regulation:** GDPR (Regulation (EU) 2016/679) and Belgian implementing law.

---

## Data we collect

- **Contact form submissions** — name, email, company, message content.
- **Job applications** — CV file, written motivation, contact details, optional links.
- **Booking submissions** — calendar booking metadata via Reclaim.ai.
- **Authentication & client portal data** — email and credentials for clients with portal access.
- **Standard server / analytics data** — IP address (truncated where possible), user agent, referrer, page paths, language preference, geo-region (country level for language detection).
- **Cookies** — strictly necessary cookies always on; non-essential analytics cookies only after explicit consent via the cookie banner.

---

## Why we process it (purposes & legal bases)

- **Responding to inquiries** — legitimate interest / pre-contract step.
- **Evaluating applications** — pre-contract step / consent for retention beyond the immediate decision.
- **Operating client engagements** — performance of contract.
- **Operating and improving the website** — legitimate interest, with non-essential analytics on opt-in only.
- **Compliance with legal obligations** — accounting, tax, and where applicable B2B record-keeping.

---

## Processors & sub-processors

We use vetted third-party processors under written DPAs. Current processors include:

- **Hosting / backend (Lovable Cloud / Supabase)** — hosts the site, the database, and edge functions. EU region.
- **Slack** — internal routing of contact-form inquiries and job applications to the team.
- **Reclaim.ai** — exploration call booking.
- **Email infrastructure** — transactional and notification email delivery.
- **Analytics** — opt-in only, after consent via the banner.

A current sub-processor list is available on request.

---

## Retention

- **Contact data:** kept for the duration of the engagement and a reasonable period thereafter for legitimate business and legal reasons (typically up to 7 years for accounting where applicable).
- **Job application uploads (CV, motivation):** retained for up to 365 days unless the candidate requests earlier deletion.
- **Server / analytics data:** standard retention windows; aggregated where possible.
- **Authentication data:** retained while the account is active.

---

## Your rights under GDPR

You can at any time:

- Access the personal data we hold about you.
- Request rectification of inaccurate data.
- Request erasure ("right to be forgotten").
- Request restriction of processing.
- Request portability of the data you provided.
- Object to processing based on legitimate interest.
- Withdraw consent for any processing based on consent (e.g. analytics cookies).
- Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit).

To exercise any right, email **info@skillmix.eu**. We respond within the GDPR statutory timeframe.

---

## International transfers

We host EU-first. Where a sub-processor processes data outside the EEA, transfers rely on standard contractual clauses or adequacy decisions, and processing is limited to what is strictly necessary for the service.

---

## Cookies

A consent banner is shown on first visit. Strictly necessary cookies (session, language preference, cookie-consent state) are always on. Non-essential cookies (analytics, marketing pixels) are only set after explicit opt-in. You can change or withdraw your choice at any time via the cookie controls on the site.

---

## Updates

This summary is updated alongside the authoritative policy. Material changes are reflected on the live page first; the markdown mirror is updated shortly after.

For the full, binding text see https://skillmix.nl/privacy.