Privacy Policy

Last updated: February 12, 2026

1. Introduction

DataToday NV ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform (the "Service").

We are the data processor for candidate data uploaded by our customers (who are the data controllers). For our own customers' account data, we act as the data controller.

2. Data We Collect

2.1 Account Data (Controller)

Name, email, phone number
Company name, industry, size
Billing information (processed by our payment provider)
Login credentials (hashed, never stored in plain text)
Usage data and activity logs

2.2 Candidate Data (Processor)

Names, contact information
CV/resume content (skills, experience, education)
Professional qualifications and certifications
AI-generated embeddings for matching (vector representations)
Match results and scores

2.3 Technical Data

IP addresses, browser type, device information
Cookies and similar tracking technologies
Service usage statistics

3. Legal Basis for Processing

Purpose	Legal Basis (GDPR Art. 6)
Providing the Service	Contract performance (Art. 6(1)(b))
Account management	Contract performance (Art. 6(1)(b))
Candidate data processing	Legitimate interest of the controller (Art. 6(1)(f)) or consent
Security and fraud prevention	Legitimate interest (Art. 6(1)(f))
Service improvement	Legitimate interest (Art. 6(1)(f))
Marketing communications	Consent (Art. 6(1)(a))
Legal obligations	Legal obligation (Art. 6(1)(c))

4. Data Retention

Data Type	Retention Period
Account data	Duration of account + 12 months
Candidate data	As configured by the data controller (default: 24 months)
CV files	As configured by the data controller (default: 24 months)
Audit logs	36 months (regulatory minimum)
Technical logs	90 days
Billing records	7 years (legal requirement)

5. Your Rights (Data Subject Rights)

Under the GDPR, you have the right to:

Access -- Request a copy of your personal data (Art. 15)
Rectification -- Request correction of inaccurate data (Art. 16)
Erasure -- Request deletion of your data ("right to be forgotten") (Art. 17)
Restrict Processing -- Request limitation of processing (Art. 18)
Data Portability -- Receive your data in a structured format (Art. 20)
Object -- Object to processing based on legitimate interest (Art. 21)
Withdraw Consent -- Withdraw consent at any time (Art. 7(3))

To exercise these rights, contact us at dpo@askbob.be. We will respond within 30 days.

6. Data Transfers

Your data is stored in the European Union (GCP europe-west1 region, Belgium). We do not transfer personal data outside the EU/EEA unless required and protected by Standard Contractual Clauses or an adequacy decision.

7. Sub-processors

We use the following sub-processors:

Sub-processor	Purpose	Location
Google Cloud Platform	Infrastructure hosting and storage	EU (Belgium)
OpenAI	AI text processing and embeddings	US (SCCs in place)
Mistral AI	AI document parsing and embeddings	EU (France)
ConvertAPI	Document format conversion	EU
SMTP email relay	Transactional email delivery	EU

8. Security Measures

We implement appropriate technical and organizational measures including:

Encryption at rest and in transit (TLS 1.2+)
Access controls and role-based permissions
Regular security assessments and penetration testing
Audit logging and monitoring
Multi-tenant data isolation
Automated backup and disaster recovery

9. Cookies

We use the following cookies:

Cookie	Purpose	Duration
session_token	Authentication (essential)	Session
refresh_token	Token refresh (essential)	7 days
preferences	UI preferences (functional)	1 year

We do not use third-party tracking or advertising cookies.

10. Data Breach Notification

In the event of a personal data breach, we will notify affected data controllers within 72 hours as required by GDPR Article 33.

11. Data Protection Officer

Our Data Protection Officer can be reached at:
Email: dpo@askbob.be
DataToday NV, Veldkant 33 A, 2550 Kontich, Belgium

12. Supervisory Authority

You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, gegevensbeschermingsautoriteit.be) or your local supervisory authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before they take effect.

14. Contact Us

Privacy / data-subject requests: dpo@askbob.be
General enquiries: hello@askbob.be
DataToday NV
Veldkant 33 A, 2550 Kontich, Belgium
Enterprise / VAT number: BE 0669.633.758