← Back to home

Privacy Policy

Last updated: April 2026

This policy covers both visitors to our website and individuals whose data is processed through the OnboardZero platform. It is written to comply with the EU General Data Protection Regulation (GDPR / AVG) and the Dutch Uitvoeringswet AVG (UAVG).

1. Who We Are

OnboardZero is operated by [YOUR COMPANY NAME] B.V., registered at the Dutch Chamber of Commerce (KVK) under number [YOUR KVK NUMBER], with registered address at [YOUR COMPANY ADDRESS], the Netherlands.

We provide a digital onboarding platform that allows HR teams to collect and manage contractor and employee data in compliance with Dutch employment and tax law. For privacy questions, contact us at privacy@onboardzero.com.

We have not appointed a formal Data Protection Officer (DPO) as OnboardZero does not meet the thresholds for mandatory DPO appointment under GDPR Article 37. The privacy contact above serves as your point of contact for all data-related enquiries.

2. Our Two Roles Under GDPR

OnboardZero operates in two distinct capacities depending on context:

Data Controller— for our own platform users

When an HR manager signs up, logs in, or manages their account, OnboardZero determines the purpose and means of processing that person's data. We are the controller and this policy applies directly.

Data Processor— for employee and contractor data

When an HR team uses our platform to onboard contractors or employees, the employing company is the data controller. OnboardZero acts only on their instructions. The employer is responsible for providing a valid legal basis for processing their workers' personal data. Our Data Processing Agreement (DPA) governs this relationship — read the DPA here.

3. What Personal Data We Collect

A. HR platform users (account holders / data controllers):

  • Full name and work email address
  • Company name and VAT / KVK number
  • Billing information — processed and stored exclusively by Stripe; OnboardZero never stores card numbers
  • IP address, login timestamps, and usage logs (security and rate limiting)
  • Browser type and device information (error monitoring via Sentry)

B. Contractors and employees (onboarding data subjects):

  • Full name, date of birth, nationality, and gender
  • Home address and contact details (phone, personal email)
  • Emergency contact name and phone number
  • BSN (Burgerservicenummer / citizen service number) — encrypted at rest using AES-256-GCM
  • IBAN bank account number — encrypted at rest using AES-256-GCM
  • Employment start date, job title, and department
  • Wet DBA risk classification — an automated score (0–8) and risk level (low / medium / high) generated from answers to our questionnaire (see section 7)
  • Any additional fields configured by the employing company

We do not collect special categories of data (Art. 9 GDPR) such as health, racial or ethnic origin, religious beliefs, or biometric data, unless explicitly required by an employer and with a documented lawful basis.

4. Legal Basis for Processing

We process each type of data on a specific legal basis:

Data typeLegal basisArticle
HR user account dataPerformance of a contractArt. 6(1)(b)
Billing informationPerformance of a contractArt. 6(1)(b)
Security logs / IP addressesLegitimate interests (fraud prevention, platform security)Art. 6(1)(f)
Onboarding data (name, address, etc.)Performance of a contract (employment / engagement)Art. 6(1)(b)
BSN (citizen service number)Legal obligation — Dutch tax and payroll law (Wet LB 1964, Art. 28); UAVG Art. 46Art. 6(1)(c)
IBAN bank account numberPerformance of a contract (salary payment)Art. 6(1)(b)
Wet DBA risk scoreLegitimate interests (legal compliance assessment)Art. 6(1)(f)
Cookies (functional)Legitimate interests / strictly necessaryArt. 6(1)(f)
Marketing communicationsConsentArt. 6(1)(a)

Note on BSN: The BSN is a restricted identifier under Dutch law (UAVG Art. 46). OnboardZero processes it only when required by the employing company for Dutch payroll or tax administration. It is stored encrypted and never shared outside the payroll / tax processing chain.

5. How We Store and Protect Your Data

All personal data is stored on servers located within the European Union. Our primary database runs on Supabase (PostgreSQL), hosted on AWS eu-west-1 (Ireland).

  • Encryption in transit: All connections use TLS 1.2 or higher (HTTPS). Plain HTTP is redirected automatically.
  • Encryption at rest: BSN and IBAN fields are encrypted using AES-256-GCM with a unique nonce per record before being written to the database.
  • Access control:Row-Level Security (RLS) is enforced at the database layer — employees can only access their own data; HR managers can only access their own company's data.
  • Rate limiting: All API endpoints are rate limited to prevent brute-force and credential-stuffing attacks.
  • Audit trail: Submission timestamps and action logs are retained for security investigations.

6. Sub-processors and International Data Transfers

We share personal data only with the sub-processors listed below, each bound by a data processing agreement and Standard Contractual Clauses (SCCs) where data is transferred outside the EEA.

Sub-processorPurposeData locationTransfer basis
Supabase Inc. (USA)Database & authenticationEU — AWS eu-west-1EU SCCs
Stripe Inc. (USA)Payment processing (billing only)EUEU SCCs
Resend Inc. (USA)Transactional emailEU — AWS eu-west-1EU SCCs
Sentry (Functional Software, USA)Error monitoring — no PII loggedEUEU SCCs
Upstash Inc. (USA)Rate limiting — IP addresses onlyEU regionEU SCCs
Personio GmbH (Germany)HR system sync — optional, customer-configuredEUIntra-EU — no transfer

Standard Contractual Clauses (SCCs) are EU Commission-approved contractual mechanisms that require non-EU processors to provide GDPR-equivalent protections. We do not sell personal data to any third party.

7. Automated Processing — Wet DBA Risk Assessment

OnboardZero includes a Wet DBA compliance checker that helps HR teams assess whether a contractor engagement qualifies as independent self-employment (ZZP) under Dutch law (Wet deregulering beoordeling arbeidsrelaties).

When a contractor completes the Wet DBA questionnaire, the platform automatically computes a risk score (0–8) and assigns a risk classification (low / medium / high). This is a form of automated processing under GDPR Article 22.

What you should know about this score:

  • What it measures: The score reflects answers to structured questions about the nature of the working relationship: supervision, substitution rights, equipment ownership, and economic dependence. It mirrors the criteria the Dutch tax authority (Belastingdienst) uses to assess bogus self-employment.
  • How it works: Each answer contributes a weighted point. The total determines the risk band. No external data sources are consulted; the score is derived solely from the answers provided.
  • Its significance:A high-risk classification may influence the HR team's decision to engage or continue the engagement. It is an advisory tool and does not constitute a legal determination.
  • Your rights (Art. 22): You have the right to request human review of the score, to contest the outcome, and to provide additional context. Contact the HR team that invited you, or email privacy@onboardzero.com.

8. How Long We Keep Your Data

Data typeRetention period
HR user account dataDuration of subscription + 30 days after cancellation
Employee / contractor onboarding dataDuration of HR team's subscription + 30 days
Billing records7 years (Dutch fiscal law — Bewaarplicht)
Security and access logs90 days
Error monitoring data (Sentry)30 days
Anonymised audit recordsIndefinite — no personal identifiers retained

When the retention period expires, personal data is permanently and irreversibly deleted or anonymised. Personal identifiers are removed; non-identifiable statistical records may be kept for compliance and audit purposes.

9. Cookies and Local Storage

OnboardZero uses only strictly necessary and functional cookies. We do not use advertising, analytics, or tracking cookies.

NameTypePurposeExpires
sb-*Strictly necessaryAuthentication session (set by Supabase). Required to keep you logged in.Session / 1 hour
oz_cookie_consentFunctionalStores your cookie consent preference in localStorage. Prevents the banner from reappearing on subsequent visits.Persistent

Strictly necessary cookies do not require prior consent under the Dutch Telecommunicatiewet (Tw Art. 11.7a). You can clear all cookies and localStorage data at any time via your browser settings; this will log you out of the platform.

10. Your Rights Under GDPR

As a data subject, you have the following rights. We respond to all requests within one month (extendable by two further months for complex requests, with prior notice).

Right of access (Art. 15)

Request a copy of all personal data we hold about you, including the categories processed, the purposes, and who it has been shared with.

Right to rectification (Art. 16)

Ask us to correct inaccurate or complete incomplete personal data without undue delay.

Right to erasure (Art. 17)

Request deletion of your personal data. We may retain a non-identifiable anonymised audit record as required by law.

Right to restriction (Art. 18)

Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.

Right to portability (Art. 20)

Receive your data in a structured, machine-readable format (JSON or CSV) so you can transfer it to another service.

Right to object (Art. 21)

Object to processing based on legitimate interests or for direct marketing at any time. We must stop unless we can demonstrate compelling legitimate grounds.

Right regarding automated decisions (Art. 22)

Request human review of the Wet DBA risk score, contest the outcome, and provide your own context. The score must not be the sole basis for a consequential decision.

Right to withdraw consent

Where processing is based on consent (e.g. marketing emails), withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any right, email privacy@onboardzero.com with your name, email address, and a description of your request. We may ask for proof of identity before processing sensitive requests.

11. Data Breaches

Despite our security measures, no system can guarantee absolute protection. In the event of a personal data breach:

  • We will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals (GDPR Art. 33).
  • If the breach is likely to result in a high risk to affected individuals (e.g. exposure of BSN or IBAN data), we will notify those individuals directly without undue delay (GDPR Art. 34).
  • Where OnboardZero acts as a data processor, we will notify the affected HR team (the data controller) without undue delay so they can meet their own reporting obligations to the AP.
  • All breaches are documented internally, including the facts, effects, and remedial actions taken, in accordance with Art. 33(5).

To report a suspected security issue, email security@onboardzero.com.

12. Complaints

If you believe we have not handled your personal data correctly, please contact us first at privacy@onboardzero.com — we aim to resolve all concerns within 30 days.

You also have the right to lodge a complaint directly with the Dutch supervisory authority at any time:

Autoriteit Persoonsgegevens (AP)

Website: autoriteitpersoonsgegevens.nl

Postal address: Hoge Nieuwstraat 8, 2514 EL Den Haag, the Netherlands

13. Data Processing Agreement (for HR Teams)

If your company uses OnboardZero to process personal data on behalf of your employees or contractors, a Data Processing Agreement (verwerkersovereenkomst) governs our obligations as your processor under GDPR Article 28. This agreement specifies the subject matter, duration, nature, and purpose of the processing, the type of personal data involved, and the rights and obligations of both parties.

Read and download the OnboardZero DPA →

14. Changes to This Policy

We review and update this Privacy Policy periodically. The date at the top of this page reflects the most recent revision. For material changes— such as new categories of data collected, new sub-processors, or changes to data subject rights — we will notify registered HR users by email at least 14 days before the change takes effect.

Continued use of the platform after a change constitutes acceptance of the updated policy.