Version v1.1 | Effective date 10 July 2026

WorkFlexStay Privacy & Cookie Policy

This Privacy & Cookie Policy explains how WorkFlexStay processes personal data and uses cookies when Users visit or use the WorkFlexStay platform, website, dashboard, booking tools, contract tools, payment flows, messaging system and related services.

Controller

WorkFlexStay

van Hushovenstraat 6

5913VG Venlo

The Netherlands

Email: office@workflexstay.nl

Phone: +31 6 87099914

KvK: 42067675

BTW / VAT: NL005469340B21

1. Scope

This Policy applies to Providers and Landlords, Clients and Agencies, company representatives, account users, persons who communicate with WorkFlexStay, website or Platform visitors and persons whose data appears in contracts, invoices, messages, audit logs, evidence or support requests.

The Platform is intended for B2B and professional use.

2. Role of WorkFlexStay

WorkFlexStay generally acts as data controller for personal data processed for account creation and administration, company and account verification, Platform operation, booking administration, contract generation, digital signing, payment administration, invoice support, fraud prevention, security, dispute support, legal compliance, Platform communication and customer support.

In some specific situations, another party may independently determine the purposes and means of processing data it enters into or receives through the Platform. Where WorkFlexStay processes personal data solely on documented instructions of another party and acts as a processor, a separate data processing arrangement may apply where required.

3. Personal data we collect

Depending on Platform use, WorkFlexStay may process the following categories of personal data.

Account and contact data: name, business email address, telephone number, account identifiers, language preferences and account role.
Company and verification data: company name, KvK information, VAT / BTW information, company address, representative details, verification status and business relationship information.
Booking and accommodation data: booking requests, accommodation details, dates, occupancy information, pricing, service costs, booking status, offers and acceptances.
Contract and signature data: contract details, signer information, signature records, acceptance records, contract references, document versions and audit information.
Payment and invoice data: invoice information, payment references, payment status, payout information, mandate status, failed payment status, refund status, reversal or chargeback information and limited banking information where required.
Communication and evidence data: Platform messages, support requests, complaint information, uploaded evidence, inspection records, photographs or other materials submitted by Users.
Technical and security data: IP address, timestamps, user-agent, login information, session information, security events, audit logs and cookie preferences.

4. Data we try not to collect

For the MVP / Beta version, WorkFlexStay aims to avoid unnecessary personal data about individual Occupants. Unless legally or operationally required, the Platform should not request BSN numbers, identity document copies, dates of birth, nationality, employment contracts, medical data, criminal data or unnecessary sensitive personal data.

Where possible, WorkFlexStay uses occupancy numbers instead of detailed personal information about individual Occupants. Users should not upload unnecessary personal or sensitive data about other individuals.

5. Purposes and legal bases

WorkFlexStay processes personal data only where an appropriate legal basis applies. Depending on the processing activity, the following purposes and legal bases may apply.

Account creation and Platform access: performance of a contract or steps taken at the User request before entering into a contract.
Company and representative verification: performance of a contract, legitimate interests in maintaining a trustworthy B2B Platform and, where applicable, legal obligations.
Listings, bookings and offers: performance of a contract or steps taken before entering into a contract.
Contract generation and digital signing: performance of a contract and legitimate interests in proving execution, preventing fraud and resolving disputes.
Signature and audit trails: legitimate interests in security, fraud prevention, legal evidence, enforcement and dispute handling.
Invoice and payment administration: performance of a contract, legitimate interests in payment administration and recovery, and legal obligations where applicable.
Accounting and legal records: legal obligation and legitimate interests in establishing, exercising or defending legal claims.
Platform messages and communication: performance of a contract and legitimate interests in Platform integrity, fraud prevention, dispute handling and prevention of prohibited circumvention.
Security and fraud prevention: legitimate interests in security, fraud prevention and protection of business operations and Users, and legal obligations where applicable.
Service communications: performance of a contract, legitimate interests and legal obligations where applicable.
Marketing: consent where required or another lawful basis where specifically permitted by applicable law.
Non-essential analytics and cookies: consent where required.

6. Digital signature and audit data

When a User signs, accepts or confirms legal or transactional information, WorkFlexStay may store signer name, email, User ID, company ID, IP address, UTC timestamp, user-agent, checkbox status, signature ID, contract reference, contract version, Terms version, Privacy Policy version, PDF hash, contract hash and locked snapshot details.

This information may be processed to prove execution, maintain reliable records, prevent fraud, investigate disputes, protect Platform integrity and establish, exercise or defend legal claims.

7. Payment data

Payments may be processed through payment partners including Stripe or other payment providers made available through the Platform.

Depending on the applicable payment flow, WorkFlexStay may receive and process payment status, payment references, invoice data, payout status, mandate status, failed collection information, refund status, reversal information, chargeback information and limited bank or account information where operationally required.

Where a temporary payment arrangement is used because a Provider is not yet registered, verified or technically enabled with the applicable payment provider, WorkFlexStay may process information necessary to receive, reconcile and transfer the relevant payment in accordance with the applicable booking and payment arrangement.

Full payment card details are not stored by WorkFlexStay unless expressly stated, technically required and legally permitted. Card and payment credentials may instead be processed directly by the applicable payment provider.

8. Messages and communication

Platform messages may be stored and processed to provide communication functionality, support bookings, prevent fraud, investigate abuse, handle disputes, enforce the Terms, protect Platform-introduced transactions and improve safety and security.

WorkFlexStay may use automated or manual measures to identify or restrict prohibited contact details where Platform rules apply, spam, abuse, unlawful content, fraud, security threats or deliberate attempts to avoid applicable Platform obligations. Any such processing will be carried out only where reasonably necessary for the relevant purpose.

9. Sharing personal data

WorkFlexStay may share personal data where necessary with payment service providers, hosting and infrastructure providers, email and notification providers, verification providers, accounting and invoice service providers, analytics providers where enabled and lawfully used, professional advisers, legal and compliance advisers, public authorities where legally required and other Users involved in relevant bookings, contracts, signatures, invoices, payments or disputes.

WorkFlexStay shares only data reasonably necessary for the relevant purpose. The specific providers used by WorkFlexStay may change as Platform infrastructure develops.

10. International transfers

Some service providers may process personal data outside the Netherlands or European Economic Area. Where GDPR / AVG requires safeguards for an international transfer, WorkFlexStay will use an appropriate transfer mechanism, which may include an adequacy decision, Standard Contractual Clauses or another legally recognised transfer safeguard.

11. Data retention

WorkFlexStay retains personal data only for as long as reasonably necessary for the purposes for which it was collected and processed.

Retention periods depend on factors including the duration of the User account, booking or contractual relationship, tax and accounting requirements, legal retention obligations, payment and transaction requirements, limitation periods for legal claims, active or reasonably anticipated disputes, fraud prevention, security requirements and the need to prove contract execution or acceptance.

Contract, signature, invoice, accounting and payment records may be retained for longer periods where necessary to comply with legal obligations, maintain reliable evidence or establish, exercise or defend legal claims. Where Dutch tax or accounting law requires specific records to be retained for a statutory period, WorkFlexStay will retain those records for at least the applicable required period.

Messages, technical logs, support information and cookie consent records are retained only for as long as reasonably necessary for their stated purposes, security, dispute handling or legal compliance. Data that is no longer reasonably required will be deleted, anonymised or otherwise handled in accordance with applicable law and technical capabilities.

12. Security

WorkFlexStay uses reasonable technical and organisational measures appropriate to the nature of the Platform and processing activities. Measures may include authentication controls, password hashing, access controls, audit logging, secure hosting, encrypted connections where applicable, restricted administrative access, backups, monitoring, data minimisation and account and security controls.

No online system can guarantee absolute security. Users must keep credentials secure and promptly report suspected unauthorised access.

13. Personal data breach procedure

WorkFlexStay will assess and document suspected or confirmed personal data breaches. Where required by GDPR / AVG, WorkFlexStay will notify the competent supervisory authority and, where applicable, affected individuals.

Users must report suspected unauthorised access, disclosure or security incidents without unreasonable delay.

14. User rights

Under GDPR / AVG, individuals may have rights including access, correction, deletion, restriction, objection, data portability, withdrawal of consent and complaint to a supervisory authority. Requests may be submitted to office@workflexstay.nl.

WorkFlexStay may request reasonable identity verification before acting on a request. Some information may need to be retained despite a request for deletion where necessary for contracts, invoices, accounting, tax obligations, legal claims, fraud prevention, payment records, security or other legal obligations.

Withdrawal of consent does not affect processing already lawfully carried out before withdrawal.

15. Marketing communications

Service messages necessary for accounts, bookings, contracts, signatures, invoices, payments, security or legal updates are not treated as optional marketing messages merely because they are sent by email or another communication channel.

Marketing communications are sent only where permitted by applicable law. Where required, Users may unsubscribe from marketing communications at any time.

16. Children

The Platform is intended for business and professional Users and is not intended for children. WorkFlexStay does not knowingly create Platform accounts for children.

17. Cookies and similar technologies

WorkFlexStay may use cookies and similar technologies for strictly necessary purposes, analytics, marketing and third-party technologies involved in hosting, security, payments, analytics, communication or support.

Strictly necessary purposes include login, authentication, security, account sessions, language preferences, contract signing, payment flows, cookie preferences and core Platform functionality. These technologies may be used where necessary to provide the requested service or secure the Platform.

Analytics technologies may be used to understand Platform performance, errors, navigation and service improvement. Where consent is legally required, analytics technologies will not be activated before valid consent.

Marketing or advertising technologies may be used for campaign measurement, advertising or conversion tracking. Where consent is required, these technologies will not be activated before valid consent.

18. Cookie consent and settings

Where required, WorkFlexStay asks for consent before placing or activating non-essential cookies or similar technologies. Users may be offered options to accept all, reject non-essential cookies or manage preferences.

Users may later change or withdraw consent through Cookie Settings where available. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

19. Updates to this Policy

WorkFlexStay may update this Privacy & Cookie Policy where necessary due to legal changes, Platform changes, new functionality, security requirements, changes in providers or changes in processing activities.

The current version and effective date will be published through the Platform. Material changes may be communicated by email, dashboard notification or another appropriate method.

20. Contact