The data controller responsible for your personal data is:
Data Protection Officer (DPO): Charmies is in the process of appointing an external DPO as required under GDPR Article 37. In the interim, all data protection inquiries should be directed to privacy@charmies.be.
We collect the following categories of personal data when you register as a Charmie:
First name, last name, date of birth, nationality, civil status, gender, phone number, email address, home address (street, postal code, city).
Belgian national ID card number, ID card expiry date.
Legal basis: your explicit consent (GDPR Art. 9(2)(a)).
Belgian SSIN (National Register Number / NISS) for payroll and social security processing.
Legal basis: your explicit consent (GDPR Art. 9(2)(a)).
IBAN for payment of wages for completed jobs.
Legal basis: performance of contract (GDPR Art. 6(1)(b)).
This is necessary for payroll . It's only visible to you and authorized HR staff, and are not used for job matching.
Legal basis: employment administration and legal obligations (GDPR Art. 6(1)(b) and 6(1)(c)).
Height, clothing sizes (top, pants, dress, coat, skirt), shoe size, hair colour, eye colour. Used for uniform and outfit matching for jobs.
Legal basis: your explicit consent (GDPR Art. 9(2)(a)).
A photo used to identify you to clients and for job matching purposes.
Legal basis: your explicit consent (GDPR Art. 9(2)(a)).
Work experience, specialties, job preferences, language skills, work regions, availability, student status, education details, social media profiles (optional).
Job applications, job assignments, contracts, quality reports, training completions, messages sent through the platform, consent records.
| Purpose | Legal Basis |
|---|---|
| Matching you with job opportunities | Consent (Art. 6(1)(a)) + Contract (Art. 6(1)(b)) |
| Processing payroll and SSIN for social security | Explicit consent (Art. 9(2)(a)) + Legal obligation (Art. 6(1)(c)) |
| Contract administration | Contract (Art. 6(1)(b)) |
| Sharing profile with clients for job matching | Consent (Art. 6(1)(a)) |
| Quality reports and performance tracking | Legitimate interest (Art. 6(1)(f)) |
| Communication about job opportunities | Consent (Art. 6(1)(a)) |
| Identity verification (ID card, SSIN) | Explicit consent (Art. 9(2)(a)) + Legal obligation (Art. 6(1)(c)) |
| Retaining financial records for tax purposes | Legal obligation — Belgian tax law, 7-year retention (Art. 6(1)(c)) |
We share your data only with processors needed to run the platform. Charmies must keep Article 28 Data Processing Agreements in place with these processors before public launch:
EU VPS hosting for the application, database, and file storage. Production infrastructure is hosted in Germany and operated by Charmies.
Database, authentication, and storage software run on Charmies-controlled infrastructure. Supabase Inc. is not used as the production hosting processor for this self-hosted stack.
Transactional email delivery (e.g., notifications, contract emails). Only name and email address are shared.
When you are selected for a job, your name, photo, and relevant profile information may be shared with the client for that job. You consent to this at registration.
We do not sell your personal data to any third party.
Your production platform data is hosted on Charmies-controlled infrastructure in Germany, within the European Economic Area. Resend may process transactional email metadata outside the EEA; where this happens, transfers must be covered by appropriate safeguards such as Standard Contractual Clauses (SCCs) as approved by the European Commission.
| Data Category | Retention Period |
|---|---|
| Active charmie profile | While account is active |
| Anonymized records after account deletion | 7 years (Belgian tax and accounting obligation) |
| Job applications (unselected candidates) | 6 months after job date |
| Messages | 2 years (contractual dispute resolution) |
| Audit logs | 5 years |
Under GDPR, you have the following rights. We will respond within 30 days of receiving a verifiable request.
To exercise any of these rights, contact us at privacy@charmies.be. You can also exercise your rights to data access, portability, erasure, and consent withdrawal directly from your account settings at Settings → My Profile → Privacy & Data Rights.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Belgian supervisory authority:
Autorité de protection des données (APD)
Rue de la Presse 35, 1000 Brussels, Belgium
Website: www.dataprotectionauthority.be
Tel: +32 2 274 48 00
We implement technical and organizational measures to protect your data, including:
In the event of a personal data breach, we will notify the APD within 72 hours and affected individuals without undue delay, as required by GDPR Articles 33–34.
We use only strictly necessary cookies for authentication (session management). We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required for strictly necessary cookies under the Belgian ePrivacy Directive.
We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.
Questions? Contact us at privacy@charmies.be