Skip to content
Master Hub
Menu

Privacy Policy

1. Who is responsible

For questions about your data, write to appeal@masterhub.nl.

2. What data, why and on what legal basis

  • Account (email, name, phone, city): signing in and using the platform. Basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Orders, offers, messages, reviews and the order address (postcode, street, house number, contact phone): connecting customers and contractors. Contact details are shown only after a contractor is chosen. Basis: performance of a contract.
  • Photos and videos you upload with an order, photos in messages, in a portfolio and as a profile picture: to show the job or the work. Before storing photos we remove all metadata (EXIF), including geotags and camera data. From MP4 and MOV videos we remove the metadata, including geotags. WebM videos and documents (PDF, Word, Excel) are stored as they are, so check them before uploading. Do not upload images in which other people, number plates or other people's addresses can be recognised without consent. Basis: performance of a contract.
  • Contractor profile (name or trade name, type, categories, work area, phone, Dutch address and, if the contractor has provided them, KvK number and documents): showing and checking the profile. Basis: performance of a contract; for the check also legitimate interest (Art. 6(1)(f) GDPR): protecting customers from incorrect profiles.
  • Security (a shortened, hashed connection code, ipHash, instead of the IP address; an action log; a log of viewed contact details): preventing fraud, spam and abuse. Basis: legitimate interest.
  • Reports and moderation (reports, decisions, warnings for sharing contact details): handling reports, taking and explaining decisions. Basis: legal obligation (Art. 6(1)(c) GDPR, Arts. 16 and 17 DSA) and legitimate interest.
  • Service emails about sign-in, orders, offers and decisions. Basis: performance of a contract.

We do not collect BSN, passport scans or date of birth. Data marked as required in a form is needed to perform the contract; without it you cannot use that feature. There is no legal obligation to provide data. The platform is only for people aged 18 and over.

2a. Automated decisions

One decision is taken automatically: temporarily suspending an account for repeated attempts to share contact details before a contractor is chosen (3 days the third time, 10 days the sixth time; see the terms). It is necessary to perform the contract: without it we cannot ensure that contact details are revealed only to the chosen party (Art. 22(2)(a) GDPR). You can express your point of view and appeal by email; a person then reviews the decision again. We take no other decisions based solely on automated processing that have legal effects or similarly significantly affect you (Art. 22 GDPR): a moderator decides on hiding content, rejecting a profile and an indefinite block. The order of contractors is calculated automatically as described in the rules.

3. Retention

  • Account: until deleted, then anonymised.
  • Orders and offers: up to 24 months after closing or expiry. After that we delete the description, photos and videos, offers, phone number and address; only a short summary (category, place, month, outcome) stays with the review. Reviews: as long as the profile they relate to exists. When you delete your account, the author is anonymised ("Deleted user"), the order's phone number and address are erased, and orders not yet closed and without a chosen contractor are deleted.
  • Visibility of contact details to the chosen party: up to 30 days after the order is closed.
  • Messages and their attachments: 24 months after the order is closed or expires.
  • Phone numbers and order address: 24 months after the order is closed.
  • Photos and videos of an order: as long as the order is kept, at most 24 months after closing; when the order is deleted, within a day. Portfolio and profile picture: until you delete them or delete your account.
  • Contractor documents: while the profile is active; 30 days after deletion, rejection, replacement or expiry.
  • Contact view log, ipHash, email log: 12 months. ipHash is pseudonymised but remains personal data. Raw IP addresses may briefly appear in technical logs of our hosting and security providers.
  • Action log: 24 months; moderation decisions and reports: 36 months.
  • In-app notifications: 180 days.
  • Database backups: 7 days.

4. Who receives data

  • Other users: orders (without contact details), contractor profiles, reviews, customer profiles and the photos or videos of orders are visible to everyone, also without signing in. An offer is seen only by the customer and the contractor themselves, a conversation and its attachments only by its participants. Phone number and address are seen only by the chosen party, up to 30 days after the order is closed.

  • We share your data with processors: companies that process it on our behalf under a data processing agreement (Art. 28 GDPR). Cloudflare also uses some of this data for its own purposes as an independent controller; see the point on Cloudflare.

    • Vercel Inc. (USA) — website hosting and storage of uploaded files. Receives all requests to the website (IP address, browser data, page addresses) and the photos, videos and documents you upload. Server functions and files are located in Frankfurt (Germany). Public pages and files are delivered through Vercel's global network. Vercel's main processing facilities are in the USA, so data may also be processed in the USA and in other countries where Vercel and its subprocessors operate. Agreement: Vercel DPA.
    • Neon (Databricks, Inc., USA) — database. Stores data on accounts, jobs, proposals, messages, reviews and profiles. The database is located in Frankfurt (Germany). Some of Databricks' subprocessors are located in the USA. Agreement: Neon terms and data processing.
    • Resend (Plus Five Five, Inc., USA) — sending emails. Processes the data on our behalf. Receives your email address and the content of the website's emails: sign-in links, notifications, moderation decisions. Emails are sent from the EU (Ireland), but Resend stores them in the USA: emails and sending logs are kept for 30 days. Agreement: Resend DPA. Sub-processors: Resend's list.
    • Cloudflare, Inc. (USA) — protecting forms against bots (Turnstile). Your browser sends Cloudflare your IP address and technical browser data; our server sends only a one-time verification token. When protecting our forms, Cloudflare acts as our processor. Agreement: Cloudflare DPA. Cloudflare also uses the same data as an independent controller to improve bot detection, based on its legitimate interest. Cloudflare is responsible for that processing: Turnstile Privacy Addendum.
    • ImprovMX Incorporated (USA) — forwarding emails sent to appeal@masterhub.nl to our mailbox. Receives the sender and recipient email addresses, the subject, the message body and attachments, and the IP address and name of the server the message came from. The message is stored only until it is delivered and is then deleted; the delivery log (without the message body) is kept for 7 days. Messages are received in France and may pass through servers in the USA when forwarded. Agreement: ImprovMX DPA.

    We chose the EU: server functions, file storage and the database are in Frankfurt (Germany), and email is sent from the EU region. However, Resend stores emails and sending logs in the USA. Public pages and files are delivered through Vercel's global network (CDN) from the location nearest to you, and some technical processing (such as request routing and logs) may take place outside the EU.

    Vercel, Databricks (Neon), Resend and Cloudflare are US companies, and your data may be processed in the USA. These transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR): these companies are certified under it. Where the certification does not apply, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) apply; they form part of our agreements with these companies. For Resend, the transfer is based both on the Data Privacy Framework and on the European Commission's standard contractual clauses included in the agreement with Resend; these clauses apply regardless of the certification status. For ImprovMX (USA), the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the agreement with ImprovMX. You can request a copy of these clauses at appeal@masterhub.nl.

  • PDOK: the public address service receives only the postcode and house number to complete the address.

  • Browser notification services (only if you have turned on notifications on a device yourself): Google (Chrome, Android), Apple (Safari on iPhone and iPad), Mozilla (Firefox) or Microsoft (Edge), depending on your browser. They receive your device’s subscription address and an encrypted notification; they cannot read its content. You turn notifications off in the notification settings; the subscription address is then deleted.

  • Map of the work area (OpenFreeMap). On a professional's profile we show a map of the area where they work. Your browser loads this map directly from OpenFreeMap (Hyperknot Software Kft., Hungary). OpenFreeMap may use Cloudflare (USA) to deliver the map. To send you the map, they receive your IP address, your browser and device type, the address of our website (not the page you are on), the time of the request and which part of the map is shown. We do not share any data from your account, and the map does not use cookies.
    Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in showing where a professional works without passing on account data. You can ask us for our assessment of this interest and object at any time via the contact details in section 1.
    According to OpenFreeMap, its access logs do not contain IP addresses; error logs may contain your IP address and are deleted after 7 days; during a security incident IP addresses may be logged for up to 30 days. For transfers to the USA, Cloudflare relies on the EU-U.S. Data Privacy Framework. More information: https://openfreemap.org/privacy/ and https://www.cloudflare.com/privacypolicy/.
    Map data © OpenStreetMap contributors, available under the Open Database License (https://www.openstreetmap.org/copyright).

  • Authorities: only where the law requires it, for example when we suspect a criminal offence threatening life or safety (Art. 18 DSA) or on the order of a competent authority.

5. Your rights

You have the right of access and to a copy, rectification, erasure, restriction, data portability (your data in a common machine-readable format) and to object to processing based on legitimate interest.

  • Correct your data in settings.
  • Delete your account in settings.
  • Other requests: email appeal@masterhub.nl from your account's email address (see the contact page). There is no automatic export at the moment: we prepare a copy by hand. We reply without undue delay and within one month at the latest; for complex or numerous requests this can be extended by two months, which we tell you within the first month. If we doubt that the request comes from you, we ask for confirmation.

6. Complaints

You can complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Cookies

We use only strictly necessary cookies. The list is on the cookies page.

8. Language versions

If language versions differ, the Dutch version prevails.

Version 1.0 of 30 Oct 2026

Previous versions

There are no previous versions.