IKONS Privacy Policy

1. Introduction

2. Controller

• Email: privacy@ikonsfreelance.io
• Postal address: Frankrijklei 5, 2000 Antwerp
• VAT number: BE0783.643.303

3. Which personal data we collect

• Account details: name, email address, phone number, password (encrypted).
• Profile details: company name, trade name, professional profile, skills, experience, preferences, selected categories and regions, keywords, profile photo and other matching information.
• CV and profile data: CV text, CV documents, profile and CV extractions, portfolio information and website or profile links that you provide.
• Business details: VAT number, company address, Chamber of Commerce number, bank details (IBAN, BIC).
• Usage data: information about how you use our website and application, login times, browser type, IP address, job interactions, application actions, matching and recommendation logs and security signals.
• Application and AI output data: generated Custom Applications, fit analyses, CV optimisations, motivation letters, rate context, fit-verdict data and application materials provided or edited by you.
• Communication: information you provide when you contact us, chat messages with Matti / AI Coach, support requests and support history.
• Vacancy data: data about assignments and vacancies that we receive, collect or extract from third-party sources to display, structure and match vacancies.

4. Purposes of data processing

• Creating and managing your user account.
• Providing and personalising our services.
• Generating Custom Applications, including fit analyses, CV optimisations and motivation letters.
• Carrying out profile and CV extraction and converting provided information into structured profile and matching data.
• Recommending, ranking and matching assignments based on profile data, preferences, job interactions, vacancy extraction data, match scores, hard exclusions and other matching signals.
• Processing vacancies with automated and AI-assisted systems to convert source data into structured vacancy display and matching data.
• Supporting users through Matti / AI Coach, product help, navigation help, matching and profile context and support handoff.
• Facilitating invoicing, credit management and time registration where applicable.
• Processing payments, credits and subscriptions where applicable.
• Improving our services and user experience.
• Preventing and investigating fraud, misuse, security incidents and technical failures.
• Complying with legal obligations.
• Providing customer service and support.
• Sending service messages and updates about our services.
• Sending job-matching notifications by email based on your profile.
• Sending marketing communications (only with your explicit consent).

5. Legal bases for data processing

• Performance of a contract: processing is necessary for the performance of the agreement you entered into with us when using our services.
• Paid and generated services: processing for Custom Application, credit use, payment, delivery of digital content, profile and CV extraction and core platform features is necessary for the performance of the contract (Article 6.1.b GDPR).
• Job matching, recommendations and functional notifications: ranking and recommending assignments and sending matching assignments by email based on your profile is necessary for the performance of the contract (Article 6.1.b GDPR) and is not based on consent.
• Legal obligation: processing is necessary to comply with legal obligations that apply to us, such as tax retention obligations.
• Legitimate interest: processing is necessary for our legitimate interests, such as security, fraud prevention, debugging, quality control and improving our services, insofar as your rights and freedoms do not override those interests.
• Consent: you have given consent to process your personal data for one or more specific purposes, such as marketing communications, analytics cookies or optional data you voluntarily provide where it is not necessary for the requested service.

6. Retention periods

• Account details: while you have an active account and up to 2 years after closing your account.
• Job-matching notifications: profile and matching data are retained while your account is active and up to 2 years after closing your account, unless a shorter retention period follows from your profile settings or a valid deletion request.
• Generated applications, fit analyses, CV optimisations and motivation letters: while your account is active and up to 2 years after closing your account, unless you request deletion earlier or longer retention is necessary for dispute handling.
• CV documents, profile and CV extraction data and website or profile links: as long as needed for the requested profile, matching or application feature and no later than 2 years after closing your account, subject to legal obligations or valid deletion requests.
• Matti / AI Coach and support history: up to 2 years after the last contact, unless longer retention is needed for security, dispute handling or legal obligations.
• Job matching, recommendation and extraction logs: as long as needed for operation, security, quality control and service improvement, generally up to 2 years after creation or closing your account.
• Invoice and financial data: at least 7 years after the end of the financial year in which the data was created (statutory tax retention obligation).
• Communication: up to 2 years after the last contact.
• Usage data: up to 26 months (analytics data).

7. Sharing your data

• AI model and automation providers: parties that help us with AI-assisted generation, profile and CV extraction, vacancy extraction, matching support and Matti / AI Coach.
• Service providers: third parties that provide services on our behalf, such as hosting and database providers, payment processors, analytics providers, support tools and security or monitoring services.
• Email and infrastructure service providers: parties required to send and manage functional job-matching notifications, including our own infrastructure and any email service providers.
• Professional advisers: such as accountants, legal advisers or auditors, when necessary.
• Government authorities: when we are legally required to do so.

8. Processing table and register

• Purpose: job matching, recommendations and functional job-matching notifications based on the profile created by the User and matching behaviour.
• Purpose: AI-assisted Custom Application, including fit analysis, CV optimisations and motivation letter based on profile, CV, vacancy, rate and fit-verdict data.
• Purpose: AI-assisted or automated vacancy extraction for vacancy display, filtering and matching.
• Purpose: Matti / AI Coach for product questions, navigation, matching and profile context and support handoff.
• Legal basis: performance of a contract (Article 6.1.b GDPR) for core features and paid/generated services; consent where required for optional data, analytics or marketing; legitimate interest for security and service improvement; legal obligation where needed.
• Categories of personal data: account details, email address, profile details, preferences, professional information, CV and profile text, documents, links, application materials, chat and support messages, job interactions and matching parameters.
• Retention period: while the account is active and generally up to 2 years after account closure, unless a shorter period applies because of profile settings or a valid deletion request, or a longer statutory retention obligation applies.
• Recipients: IKONS, authorised staff and processors required for hosting, database management, AI processing, application management, functional email delivery, payment, analytics, support and security.
• Human review and correction: where automated processing affects recommendations or profile/matching data, the User can request correction and, where required, human review or explanation.

9. International data transfers

10. Cookies and similar technologies

• Essential cookies: necessary for our services to function.
• Analytics cookies: help us understand how users use our services. These cookies are only placed with your consent.
• Functional cookies: allow us to provide certain functionalities, such as remembering preferences.
• Marketing cookies: used for marketing purposes and only placed with your explicit consent.

11. Security of your data

• Encryption of sensitive data.
• Access controls and authentication procedures.
• Regular security reviews and updates.
• Staff trained in data protection.
• Incident management and notification procedures.

12. Your privacy rights

• Right of access: you have the right to receive a copy of the personal data we hold about you.
• Right to rectification: you have the right to have inaccurate data corrected or incomplete data completed.
• Right to erasure: you have the right to have your personal data deleted in certain circumstances.
• Right to restriction: you have the right to temporarily restrict the processing of your personal data.
• Right to data portability: you have the right to receive your data in a structured, commonly used and machine-readable format.
• Right to object: you have the right to object to the processing of your personal data in certain circumstances.
• Right not to be subject to automated decision-making: you have the right not to be subject to decisions based solely on automated processing.
• Right to human review or correction: where automated or AI-assisted processing affects your profile, matching data, recommendations or generated application output, you can ask us for correction, explanation or human review where required.

13. Data incidents

14. Data protection impact assessment

15. Changes to this privacy policy

16. Complaints and supervisory authority

• For the Netherlands: Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).
• For Belgium: Data Protection Authority (www.gegevensbeschermingsautoriteit.be).