1. Data controller
The controller of your personal data is Link2Events, whose registered office is in Sint-Niklaas (Belgium). For any question regarding this policy, you may write to [email protected]. The company number (CBE/KBO) will be specified in the final version.
2. Data Protection Officer
Link2Events is appointing a Data Protection Officer (DPO). Once appointed, they may be contacted at [email protected] for any request relating to the processing of your data or the exercise of your rights.
3. Purposes of processing
GIGZ processes your personal data for the following purposes:
- Managing the lifecycle of event-sector temporary work (registration, contracts, assignments, payroll)
- Complying with Belgian legal obligations (Dimona declarations, NSSO/RSZ, taxation)
- Identity verification (KYC) and, for clients, creditworthiness checks
- Transactional communications (confirmations, account notifications)
- Marketing communications, only with your prior consent
4. Legal bases
Each processing operation relies on a legal basis within the meaning of Article 6 GDPR:
- Performance of the contract binding you to Link2Events
- Compliance with legal obligations (Belgian labour law, Dimona, NSSO, taxation)
- Your consent (marketing communications and optional processing)
- The legitimate interest of Link2Events (platform security, fraud prevention)
5. Categories of data collected
Depending on your profile, the following categories of data may be collected:
- Identity data (surname, first name, date and place of birth, national register number / NISS)
- Contact details (address, telephone, email)
- Bank details (IBAN) for paying assignments
- Identity documents and supporting evidence (ID card, work permit)
- Tax and social data (status, withholding tax, dependants)
- Contractual data (contracts, assignments, payslips)
- For clients: company data (VAT, company number, creditworthiness)
6. Recipients and processors
Your data may be shared with the following recipients and processors, strictly to the extent necessary:
- PratoFlex (Prato Software) — temporary work management ERP and administrative declarations
- DigitalOcean — hosting of data within the European Union (Frankfurt)
- Resend — sending of transactional emails
- Didit — identity verification (KYC)
- Google (Google Maps Platform) — address entry assistance (autocomplete) during registration
- Unified Post, via PratoFlex — electronic signature of contracts
- The competent Belgian authorities (NSSO/RSZ, NEO, tax administration) under legal obligations
- A creditworthiness verification provider, for client accounts only
7. Retention periods
Your data is retained for the following periods:
- Inactive account: 5 years after the last activity (Belgian temporary work legislation)
- Contracts and assignments: 5 years after the end of the contract
- Invoices: 7 years (Belgian tax obligation)
- Identity documents: 5 years after the end of the contract, then deletion
- Login logs: 5 years (security and audit)
- Tokens and sessions: short technical lifespan (from 15 minutes to 7 days)
8. Your rights
In accordance with the GDPR, you have the following rights, which you may exercise at any time by writing to [email protected]:
- Right of access to your data (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to data portability (Art. 20)
- Right to object, in particular to marketing (Art. 21)
- Right to restriction of processing (Art. 18)
9. Complaint
If you consider that the processing of your data is not compliant, you have the right to lodge a complaint with the Data Protection Authority (DPA/GBA), Rue de la Presse 35, 1000 Brussels — [email protected] — www.dataprotectionauthority.be.
10. Data breach
In the event of a data breach likely to result in a risk to your rights and freedoms, Link2Events will notify the Data Protection Authority within 72 hours and, where the risk is high, will inform you as soon as possible.