Event Workforce
Menu
Log in Request a demo

Privacy statement

Last updated:

This statement covers two things that need to be kept apart: this website, eventworkforce.nl, and the application, app.eventworkforce.nl. For the website we are responsible ourselves. For what sits inside the application the customer is responsible, and we work on their instructions.

1. Who we are

Event Workforce is a product of The Dutch Crew B.V., registered with the Dutch Chamber of Commerce under number 90465954 and established at Hornweg 64, 1044 AN Amsterdam, the Netherlands.

If you have a question about this statement, or you want to know what data we hold about you, email info@eventworkforce.nl. You can also call +31 6 41 51 26 46. There is no form or portal in between; you simply get an answer from a person.

We have no data protection officer. Nor do we need one: that is required of public authorities and of organisations that monitor people on a large scale or process special categories of data, and we do neither. Privacy questions arrive at the same address as every other question.

2. This website

This website sets no cookies, uses no analytics and loads nothing from third parties — no fonts, no scripts, no tracking pixels. Nothing about your visit is recorded. The only data we receive through this site is the data you fill in yourself in the contact form.

3. The contact form

The form at the bottom of the home page asks for your name, your company, your email address, your phone number and your message. Your name, your email address and your message are required, because without those three we cannot write back; leave them empty and the form does not go anywhere. Your company and your phone number you can leave blank.

We use that data for one thing: answering your message. It does not go to anyone else, it does not end up on a mailing list, and we do not build a profile of you with it. The grounds for doing this are as simple as they sound: you send us a message yourself and you expect an answer to it. In the language of the law that is our legitimate interest — and where it concerns a quote or a demo, it is the steps that precede a contract.

There is one thing we record that you do not fill in yourself: the IP address the form was sent from. It stays in the server's memory for at most an hour to stop anyone abusing the form, it is never written to disk, and it is gone in any case the moment the server restarts. The form also carries a hidden spam check — a field you never get to see and the time the page loaded — and that records nothing about you.

The message is delivered to us as email by SMTP2GO, the party that sends our mail. They see the contents of that message in transit, as every mail deliverer does.

We keep the message no longer than the conversation needs. If nothing comes of it, it goes. If it becomes a quote or a customer, it goes into our customer records; what we keep there and for how long is set out under retention periods below.

4. The application

If your organisation uses Event Workforce at app.eventworkforce.nl, that organisation is the controller for the data held in it and we are the processor. That distinction is not only a legal one: the customer decides who gets into the system, what data goes in, and what it is used for. We build and run the system, and we process that data only on the customer's instructions. What we may and may not do we set down with every customer in a processing agreement.

About a crew member, the system may hold:

  • the name, including any prefix;
  • the phone number and the email address;
  • the date of birth;
  • a profile picture;
  • identity document details: the type of document, its number and the date it is valid through;
  • the crew company they are hired through, and the employee number that crew company itself uses for them;
  • the functions they are scheduled on;
  • the hours they clock, and the corrections made to those hours afterwards.

We do not get that data from you. It is entered by the organisation using the system, or by the crew company you work through — usually out of the records they already keep on you. If you are in the system without knowing how you got there, that is where the answer is, not with us.

Not everyone sees all of that. A crew company sees only its own people: whoever works for one company sees nothing of another company's crew. Within the customer's own organisation, who may see and change what is set per role, and the customer sets those roles themselves.

Every change is recorded in an audit log, with the name of the person who made it and the time they made it. If an hour is adjusted, a crew member added or a role changed, it can be seen afterwards who did it and when.

The application and the database run on one environment, at DigitalOcean in Amsterdam. We access a customer's data only where that is needed to run the system or to fix a fault.

5. What we use data for, and on what grounds

The law asks us to name, per purpose, why we are allowed to process data. This is that list, and it is the whole of it — if something is not on it, we do not do it.

Answering your message from the contact form
Our legitimate interest in replying to someone who approaches us themselves. If you ask for a quote or a demo, it is the preparation of a contract.
Protecting the form against abuse
Our legitimate interest in keeping the site working and our mailbox usable. For this we use only the IP address, and only for as long as that hour's count runs.
Providing and running the application for a customer
Performance of the contract with that customer, and of the processing agreement that goes with it. What happens to the data in the system is for the customer to decide; we carry that out and add nothing of our own.
Our customer records and invoicing
Performance of the contract, and for the invoices themselves a legal obligation: the Dutch tax retention duty.

We ask for consent nowhere, because nowhere do we do anything for which consent would be the ground. So there is no consent held here for you to withdraw either.

6. Retention periods

We keep nothing longer than we need it for. Per kind of data it comes down to this:

Messages from the contact form
As long as the conversation runs, and six months after that. If a customer comes of it, the message goes into our customer records.
The IP address of a submission
An hour at most, and only in the server's memory.
Crew data in the application
That is for the customer to decide, not us: they decide when a crew member leaves the system. After the agreement ends we delete that customer's data within 30 days, unless they ask us to do it sooner. Those 30 days are there so they can still request their own data before it is gone.
The audit log
Entries in the audit log stay for seven years, as long as the hours they belong to. They are not removed individually: a log you can take entries out of is no longer a log.
Our customer records and invoices
Seven years, because that is how long Dutch tax law requires us to keep them.

7. Who else gets the data

We bring in as few other parties as we can. At the moment there are two.

DigitalOcean
Hosting. The application and the database run on one server at DigitalOcean, in their Amsterdam data centre.
SMTP2GO
Email delivery. Mail that comes out of the system, such as a message from the contact form, is delivered by SMTP2GO. We use their European service, which handles sending in Amsterdam.

With both of them we have a processing agreement: they may do nothing with the data beyond what we instruct. Beyond that there is nothing. No analytics service, no CDN, no service collecting our error reports, no external storage. If a party is ever added, it will be listed here.

We do not sell data and we pass it to no one else. Outside these two parties, someone sees it only where the law obliges us — a demand from the police or the tax authority, for instance — and then only exactly what that obligation asks for.

8. Outside the European Union

The data sits in Europe. The server is in Amsterdam and the mail is processed in Amsterdam; we run no service at all that routinely takes data outside the European Economic Area.

What is true is that the companies behind those two services are not themselves European, and their administration and support sit partly outside the EEA. For those cases our agreement with them incorporates the European Commission's standard contractual clauses — the instrument the law points to for this — so that the data keeps the protection there that it has here.

9. How we secure the data

All traffic to the site and to the application runs over an encrypted connection; anyone watching the network does not see what you type or request. From the outside, the server is reachable only on the ports the site and the app need — the database is not one of them. Access to the system runs through a personal account, and inside the application the role on that account decides what someone may see and change.

We do not keep passwords in readable form but as a hash, so that they cannot be read back even out of the database. Backups are taken regularly, and the audit log records who changed what and when.

If something goes wrong despite that and data is lost or gets out, we report it to the Dutch Data Protection Authority where the law requires, and we inform the customer concerned — they are the controller and decide themselves who else to tell.

10. No automated decision-making

No computer here takes decisions about people. The system does not schedule of its own accord, turns nobody down, assigns no scores and builds no profiles. It shows what is there and records what a person does; who gets scheduled and who does not is decided by a planner.

11. Your rights

You have the right to know what data we hold about you and to receive a copy of it (access). If it is wrong, you may have it corrected (rectification). You may have it erased, you may have its use restricted, you may object to its use, and you may receive the data you supplied yourself in a common file format (portability).

If you were given an account through one of our customers — the festival, the company or the crew company you work for — ask them first. That organisation is responsible for your data in the system, and we may not change or delete anything in it on our own initiative. If you do not know who to ask, email us at info@eventworkforce.nl and we will point you the right way. If such a request reaches us, we pass it to the customer it concerns and help them carry it out. If what you want specifically is for your data to go, Deleting your data sets out step by step how to ask and what happens next.

If it concerns data we are responsible for ourselves — your message from the contact form, for instance — email info@eventworkforce.nl. We answer within a month, the period the law sets for it, and usually a good deal sooner. If a request is so large that a month will not do, we say so within that month and not after it. To avoid handing someone's data to the wrong person, we may ask you to show that you are who you say you are. A request costs you nothing.

12. Complaints

If you disagree with how we handle your data, tell us first at info@eventworkforce.nl. That usually settles it faster than any other route.

If we cannot resolve it together, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ The Hague, the Netherlands
autoriteitpersoonsgegevens.nl

13. Changes

The product changes, and this statement changes with it. At the top of this page is the date we last updated it; that is how you can see whether anything has changed since you read it.

If something material changes for customers or for the people in the system, we will say so rather than quietly put it here alone.