Privacy Notice
This notice explains how personal data is handled in the Connect-it-all business platform. A workspace may provide an additional notice with its own purposes, legal grounds and exact retention periods. Read both notices before providing personal data.
Release status: blocked. This notice cannot serve as the final GDPR Article 13/14 notice until the platform operator's registered legal name, registration/KBO number, postal address, monitored privacy contact, DPO assessment/contact, the identity of each workspace controller and the signed allocation of roles are supplied and approved. The repository readiness check deliberately fails while those facts are missing. No fictitious details may be substituted.
1. Who is responsible?
The signed customer agreement and the facts of each processing activity determine who is controller, joint controller or processor. The organization that invited you will often determine why workspace data is used, but that role must be confirmed in the workspace notice rather than assumed. Its full legal identity and privacy contact must appear in the invitation, employment information or workspace notice.
Depending on that agreement and activity, the Connect-it-all platform operator may act as processor, controller or another legally defined party. No role allocation should be inferred from this draft. The approved final notice must name the platform's legal entity and contact details and explain the allocation for each purpose.
If an invitation does not identify the organization or explain why unusually sensitive documents are required, ask its administrator before submitting the registration.
2. Personal data and sources
- Identity and contact data: name, email, telephone, address, date of birth and gender.
- Account and security data: role, tenant, login events, verification status, device and audit data.
- Registration data: invitation, approval status, rejection reason, transport information and quick PIN.
- Identity or driving-licence documents when required by the controller or provided as an optional document.
- Workforce data such as attendance, planning, assignments and related records.
- Business data in CRM, contracts, documents, inventory, invoices, payments, point of sale and customer support.
- Mailbox, message and OAuth connection data when a user enables a Google, Microsoft or other integration.
- Email campaign delivery, opening and link-click events when a controller enables campaign tracking.
- Technical logs, error data, IP-derived security information and performance measurements on specifically allowlisted public pages.
Data comes from you, the inviting organization and its authorized users, connected devices and services, and events produced when the platform is used. The platform should not be used for special-category or criminal-conviction data unless the controller has explicitly configured a lawful, necessary and adequately protected process.
3. Purposes and legal grounds
- Creating, reviewing and administering an account or workspace access request: steps before or performance of a contract, or the controller’s documented legitimate interest.
- Performing workforce and business workflows: the controller’s contract, legal obligation, public task or documented legitimate interest, depending on the relationship.
- Invoicing, accounting and compliance: applicable legal obligations and performance of contracts.
- Authentication, fraud prevention, security, audit and reliability: legitimate interests in protecting users and the platform, and applicable security obligations.
- User-requested integrations: performance of the requested service.
- Optional processing based on consent: only after a specific choice, with the ability to withdraw as easily as consent was given.
The inviting organization must identify the ground that applies to its use. A privacy acknowledgement proves that information was provided; it is not consent and does not replace a valid legal ground.
Email opening and click tracking may be enabled only when the controller has recorded a valid legal basis for the specific recipients, completed any required legitimate-interest and ePrivacy assessment, supplied the required notice, and can prove and honour objections or withdrawal. Enabling a feature toggle alone is never sufficient evidence.
4. Required and optional information
First name, last name, verified email, password and quick PIN are the default required registration fields. Gender, date of birth, mobile number, address and transport information are optional and may be left blank. A document is required only when the invitation explicitly marks it as required. Any broader requirement needs an explicit field policy, a documented lawful and necessary purpose and matching notice.
5. Recipients, processors and integrations
Data is available only to authorized users of the relevant workspace and to service providers needed to operate selected features. These may include hosting and storage providers, transactional email providers, monitoring and security suppliers, payment providers and integrations enabled by an authorized user, such as Google, Microsoft, Stripe, Worldline, Exact Online or Ponto. Integration providers process data under their own notices when acting as separate controllers.
Data may also be disclosed to professional advisers or public authorities when legally required. Connect-it-all does not sell personal data. The controller can provide the current workspace-specific processor and integration list.
6. International transfers
Where a selected supplier or integration processes data outside the European Economic Area, the responsible controller must use an adequacy decision or another lawful safeguard, such as the European Commission’s Standard Contractual Clauses, and assess supplementary measures where required. Contact the controller for the destinations, safeguard used and a copy of the relevant protection.
7. Retention and deletion
Personal data is kept only for the shortest period needed for the stated purpose. The workspace controller sets and documents exact periods. The criteria are the lifetime of a pending request or active account, the customer relationship, statutory accounting or employment duties, limitation periods, and a short security period needed to investigate abuse and incidents.
Expired verification secrets and abandoned uploads are removed under technical cleanup schedules. At the end of a service relationship, workspace data is returned or deleted after the agreed export and recovery window, except where law requires longer storage. Backups are isolated from ordinary use and expire on their controlled rotation. Contact the workspace controller for the exact schedule applying to a record.
8. Your rights
Depending on the processing, you may request access, correction, deletion, restriction, data portability or object to processing. You may object at any time to direct marketing. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects, except where the law permits it with safeguards.
Send workspace requests to the organization that invited you. Include the workspace and account email but never send a password, PIN or access token. The responsible parties must cooperate according to their signed role allocation. Signed-in users can use the privacy centre for their own requests and core account-data export. Identity is verified proportionately before data is released. Requests are handled without undue delay and normally within one month.
You may complain to your local supervisory authority. In Belgium this is the Data Protection Authority / Gegevensbeschermingsautoriteit.
9. Cookies, local storage and performance data
The platform uses security mechanisms and storage needed for login, tenant isolation, fraud prevention, language selection and continuity of the requested service. Authentication cookies are not used for advertising. Private API responses are excluded from service-worker caches.
Vercel Speed Insights is disabled by default. A deployment may enable cookie-free performance measurement only on the home, login, privacy, terms and accessibility pages. Query strings are removed before transmission. Private, registration, password-reset, public-document and capability-token routes are rejected. No non-essential cookie or comparable tracking may be introduced without prior information and, where required, consent.
10. Automated decisions, security and children
Connect-it-all does not make the registration approval decision: an authorized workspace administrator reviews it. If a controller configures automation with legal or similarly significant effects, it must provide separate information about the logic, consequences and human-review safeguards.
Measures include tenant and role authorization, encryption in transit, protected authentication cookies, rate limiting, audit logging, restricted caching and controlled backups. No internet service can be guaranteed risk-free; suspected misuse should be reported immediately.
The platform is not directed to children. An organization inviting a minor must establish its lawful basis and provide an age-appropriate notice before collecting data.
11. Changes and contact
Material changes are announced through the service or the responsible organization before they take effect where required. Earlier versions remain identifiable by their version and effective date.
The platform operator's legal identity, postal address, monitored privacy contact and DPO decision are still pending in the accountability record. A personal Gmail address is not a substitute for those mandatory details. For workspace processing, use the verified privacy contact supplied by the identified organization that invited you; do not submit sensitive documents if it has not supplied one.