Privacybeleid (AVG/GDPR)

1. Introduction & Data Controller

CraftMatch (craftmatch.be) is committed to protecting the privacy and confidentiality of personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

For data processing activities carried out directly on our platform, CraftMatch operates as the Data Controller. For payment processing and financial transactions, our Merchant of Record partner Paddle.com acts as an independent data controller.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity & Profile Data: Full name, username, profile photograph, user role (Customer or Professional).
• Contact Details: Email address, telephone/mobile number, WhatsApp contact details, service address and postal code.
• Professional Credentials: Belgian Enterprise Number (KBO / CBE), VAT (BTW / TVA) status, verification documents, portfolio images, trade categories.
• Job Requests & Proposals: Job descriptions, project locations, urgency levels, budget expectations, photos attached to job requests, and in-app communications.
• Technical & Usage Data: IP address, device type, browser information, language preferences, session logs, and access timestamps.

3. Legal Bases and Purposes of Processing

We process your personal data under the following lawful bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): To facilitate job matchmaking, enable quotes, unlock contact details between matched parties, and provide customer support.
• Legal Obligation (Art. 6(1)(c) GDPR): To verify professional legal standing in Belgium (CBE/KBO checks) and comply with tax and statutory record-keeping requirements.
• Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraud, protect platform security, enhance user experience, and gather aggregate usage metrics.
• Consent (Art. 6(1)(a) GDPR): For optional marketing communications and non-essential cookies.

4. Payment Data & Paddle.com

We do not store complete payment card numbers on our servers. When you purchase tokens or digital packages on CraftMatch, your payment details are processed directly and securely by Paddle.com (Paddle Payments Ltd / Paddle.com Market Ltd). Paddle is PCI-DSS Level 1 compliant and processes your financial information in accordance with their privacy policy.

5. Third-Party Service Providers (Data Processors)

We work with trusted infrastructure partners to deliver our services:

• Supabase: Secure cloud database storage, user authentication, and file storage (hosted in EU Frankfurt region).
• Paddle.com: Merchant of Record, checkout, invoicing, and payment processing.
• Resend: Transactional email delivery (job alerts, notifications, password resets).
• Vercel: Web hosting, global CDN, and edge computing infrastructure.

6. Data Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data is retained for the active lifetime of your account. You can request deletion at any time.
• Job requests and quote history are retained for 24 months for quality assurance and dispute resolution.
• Transaction and invoice records are retained for statutory accounting periods required under Belgian tax law (up to 7-10 years).

7. Your Rights Under the GDPR

As a European Union resident, you have the following statutory rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete information.
• Right to Erasure / "To Be Forgotten" (Art. 17): Request deletion of your personal data when no legal retention requirement applies.
• Right to Restriction of Processing (Art. 18): Restrict processing under certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, please email us at support@craftmatch.be. We will respond to your request within 30 days.

8. Supervisory Authority

If you have unresolved concerns about how we handle your personal data, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit):

9. Contact Us

For any questions regarding this Privacy Policy or your data, please contact: