Privacy Statement Sky People

SkyPeople B.V. processes personal data from customers, clients, suppliers, freelancers, specialists, applicants, visitors to our website, and users of our internal and external systems, including the customer and relationship management system Skybox. In this statement, we explain which data we process, why, on what basis, with whom we share it, how long we keep it, and what rights you have.

1. Controller

The controller is:

For privacy questions and requests, you can contact us via b.sterrenberg@sky-people.nl. You can also use info@sky-people.nl.

2. What personal data we process

Depending on your relationship with us, we process:

• Contact and identification details: name, function, organization, address, phone number, email address and other contact details.
• Data about our collaboration: orders, projects, quotes, agreements, invoices, hours, rates, schedules, correspondence, and project documentation.
• Data on freelancers, specialists and applicants: CV, work experience, education, skills, availability, certificates, security and access documentation, and data for planning and contracting. Identity verification takes place only insofar as it is permitted or required.
• Financial and administrative data: invoice and payment data, VAT data and data required for our administration.
• Website and communication data: data that you provide through forms or email, and technical data that is necessary to provide and secure our website.
• Skybox account details: name, email address, role, login credentials, and settings of employees and other users who have access to Skybox.
• Skybox relationship and communication data: contact details of relationships, WhatsApp phone numbers, content of WhatsApp messages, message metadata (such as time, direction and status), business WhatsApp account and phone number IDs, and technical receipt data from the connection.
• Authorization and connection data: business account and phone number IDs, authorization data, and Meta access tokens that are required to connect the business WhatsApp account to Skybox. The access tokens are stored encrypted. We do not store Facebook or WhatsApp passwords for this purpose.

3. Purposes

We process personal data for:

• the entering into, execution and settlement of agreements and projects;
• relationship management, including maintaining correspondence and keeping a record of contact history;
• recruitment, selection and matching of freelancers, specialists and candidates;
• planning, invoicing, debtor management and financial administration;
• the provision, management, security and improvement of our website and systems, including Skybox;
• the sending, receiving and recording of business WhatsApp communications with contacts via our authorized business link;
• compliance with legal obligations;
• dealing with questions, requests and complaints.

4. Basics

We process data based on:

• Execution of an agreement when the processing is necessary for an agreement in which you are a party, or to take measures at your request before such an agreement is concluded.
• Legitimate interest in business relationship management and correspondence with contact persons from organizations, internal administration and the security of our systems. We balance your interests in this and, if necessary, take additional safeguards.
• Legal obligation when we need to retain or provide data on the basis of laws and regulations, for example in the tax area.
• Permission when we specifically ask you for permission to do so. You can withdraw permission at any time; that will not affect processing that has already taken place lawfully.

5. Recipients

We share personal data only when necessary. This can include:

• employees and contracted specialists involved in a project or relationship;
• suppliers and business service providers, including our hosting partner TransIP for a virtual server in Amsterdam (Netherlands) and FIKS Online for maintenance and support of Skybox;
• platform and communication services, including WhatsApp and other services of Meta, to the extent necessary for our business WhatsApp connection and messaging;
• accountants, bookkeepers, debt collection agencies, legal advisors and insurers;
• government agencies or other parties when we are legally obliged to do so.

With parties that process personal data on our behalf, we enter into a processing agreement where required. FIKS Online provides maintenance and support and may have access to the server and to messages in Skybox in that context. Furthermore, WhatsApp and Meta’s own applicable terms and privacy statements apply to the processing by WhatsApp and Meta.

6. Transfer outside the EEA

Our own server is located in the Netherlands. However, some providers, including platform services like WhatsApp, may also process data outside the European Economic Area. If this is the case, we will ensure that there is an appropriate legal basis and appropriate safeguards, such as the standard contractual clauses of the European Commission or an adequacy decision. If you want to know which safeguards apply for a specific processing, you can contact us using the information in section 1.

7. Retention periods in general

We do not store personal data longer than necessary for the purposes for which they were collected, unless a legal retention obligation applies. In doing so, we apply, among other things:

• contact and quote requests: up to two years after the last contact, unless an ongoing project, a legal obligation, or an ongoing dispute or complaint procedure warrants a longer retention period;
• data of applicants and non-selected candidates: up to four weeks after the completion of the procedure, or a maximum of one year with your consent;
• financial and tax data: the statutory retention period of seven years;
• Other project and dossier data: for as long as necessary for the execution, settlement, accountability or defense of a right, after which we delete or anonymize them.

These deadlines do not automatically apply to all WhatsApp messages. Section 8 applies to WhatsApp data.

8. Retention periods for WhatsApp data in Skybox

• WhatsApp correspondence: up to two years after the last contact. If specific correspondence is needed longer for an ongoing assignment or a legal obligation, we will only retain the necessary data for that purpose for as long as that need exists.
• Technical reception data from the WhatsApp connection: up to thirty days. Message content that is stored as business correspondence falls under the term mentioned above.
• Meta access tokens: as long as the business connection is active and necessary. Upon termination of the connection, we will delete the associated access tokens.
• Backups: up to thirty days. Deleted data may still be present in a protected backup during this period. In the event of recovery, we will reapply previously performed deletions.

Requests for removal are handled by Sky People. Where necessary, FIKS Online performs the technical removal on our behalf. You can submit a request using the contact details in section 1.

9. Cookies and similar techniques

Our website may use functional, analytical, and marketing cookies or similar techniques. Functional cookies are necessary to ensure the website functions properly. For cookies that require consent, they may only be placed with your consent. You can refuse or withdraw consent via the available cookie settings. The techniques and settings used may vary from website to website. You can also manage cookies through your browser settings.

10. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, and unauthorized access. Access to Skybox and to the underlying server is restricted to individuals who require that access for their work or for support. Meta access tokens for the WhatsApp connection are stored encrypted. However, we cannot guarantee absolute security.

11. Automated decision-making

Sky People does not make decisions based solely on automated processing that have legal effects on individuals or significantly affect them in a similar manner.

12. Your rights and data deletion

Depending on the situation, you are entitled to:

• access to the personal data that we process about you;
• correction or addition of incorrect or incomplete data;
• the removal of data when the GDPR provides for the right to deletion;
• processing limitation;
• objection to processing on the basis of a legitimate interest;
• the portability of the data you have provided to us, insofar as we process it automatically based on consent or an agreement;
• the withdrawal of consent, insofar as the processing is based on consent.

You can submit a request via b.sterrenberg@sky-people.nl of info@sky-people.nl. Please include your name, contact details, and as precisely as possible the information regarding your request. We generally do not require a copy of your ID or passwords or passkeys. If we cannot reasonably determine your identity, we may request additional information.

We normally respond within one month. If your request is complex or if we receive many requests at the same time, we can extend that deadline by up to two months. If we extend the deadline, we will let you know within the first month and explain why.

Please note: removal from Skybox does not automatically remove data from the WhatsApp app on your or someone else’s phone, from the systems of other participants in a conversation, or from copies that platforms like Meta themselves keep under their own terms. A request also includes data that service providers process on our behalf. Removing data from Skybox does not in itself terminate your WhatsApp Business account or the use of WhatsApp on your phone.

13. Complaints

If you have a complaint about the way we handle your personal data, we would be happy to hear from you using the contact details in section 1. You also have the right to file a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.

14. Changes

We may modify this privacy statement. The current version is available on our website. This version is dated September 29, 2026.