1. Our Role
The role of MKX Technologies differs depending on the processing activity.
MKX Technologies as Data Controller
We act as the data controller for personal data that we process for our own purposes, including:
account registration and authentication; subscription management and billing; support and customer service; security and fraud prevention; platform administration; and compliance with legal obligations.
MKX Technologies as Data Processor
When an entrepreneur processes personal data relating to their own customers, leads, or other business contacts through myWorkMate, the entrepreneur generally determines the purposes of that processing. In such cases, the entrepreneur will generally act as the data controller, while MKX Technologies processes the data on their behalf as a data processor.
This distinction is legally important and should also be reflected in the Data Processing Agreement (DPA). The GDPR requires processing by a processor to be governed by a contract that addresses matters including the purpose and duration of processing, categories of personal data, security measures, subprocessors, and audit obligations.
2. What Data May Be Processed?
Depending on how myWorkMate is used, the following categories of data may be processed:
contact and account information; customer and lead information; communication data; quotations and invoices; appointments and calendar information; contract information; payment and transaction references; product and service information; files and documents; WhatsApp and email communications; technical and security logs; AI prompts, instructions, and generated outputs.
3. Purposes and Legal Bases
Personal data is processed only for specific and legitimate purposes.
Depending on the processing activity, the applicable legal basis may include the performance of a contract, compliance with a legal obligation, legitimate interests, or consent.
The Dutch Data Protection Authority recommends that the applicable legal bases for processing activities are clearly identified in the Privacy Policy.
4. Data Minimisation
We aim to process only the personal data that is necessary for the relevant purpose.
When AI services are used, we aim, where possible, to provide only the context and data that are relevant and reasonably necessary for the requested processing.
5. Subprocessors
To provide the myWorkMate platform and its services, we use external service providers for purposes such as:
hosting and infrastructure; AI processing; payment processing; communications; authentication; calendar integrations; email; and other technical services.
Where these parties process personal data on our behalf, appropriate contractual arrangements are put in place.
We may maintain a separate Subprocessors page containing information about relevant third-party service providers involved in processing personal data. This provides greater transparency regarding the technology and service providers that support the myWorkMate platform.
6. International Data Transfers
Where personal data is processed or transferred outside the European Economic Area (EEA), appropriate transfer mechanisms are used where required under the GDPR.
Depending on the circumstances, these safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses (SCCs), or another legally recognised transfer mechanism.
Additional safeguards may be implemented where required based on the nature of the processing and the destination of the data.
7. Data Retention
Personal data is not retained for longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or is otherwise legally justified.
Specific retention periods are stated in our Privacy Policy where reasonably possible.
Different retention periods may apply to different categories of information depending on the purpose of processing and applicable legal requirements.
8. Security
myWorkMate implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure, or other unlawful processing.
These measures may include encrypted connections, access controls, separation between company environments, logging, monitoring, and other technical and organisational safeguards.
For security reasons, detailed information regarding our security architecture, infrastructure, and internal security controls is not publicly disclosed where doing so could compromise the security of the platform.
9. Rights of Data Subjects
Depending on the circumstances, individuals may have rights under the GDPR, including the right to:
- access their personal data;
- rectify inaccurate personal data;
- request erasure of personal data;
- request restriction of processing;
- receive certain personal data in a portable format;
- object to certain processing activities;
- withdraw consent where processing is based on consent.
These rights are subject to the conditions and limitations provided by applicable law.
Where myWorkMate acts solely as a data processor, a data subject request should generally be submitted to the relevant entrepreneur or organisation acting as the data controller. Where appropriate and required, myWorkMate will assist the relevant data controller in responding to such requests.
10. Personal Data Breaches
myWorkMate maintains procedures for assessing and responding to security incidents involving personal data.
Where myWorkMate acts as a data processor and becomes aware of a relevant personal data breach, we will inform the relevant data controller in accordance with applicable legal and contractual requirements.
The data controller remains responsible for determining whether notification to a supervisory authority and/or affected data subjects is required, unless applicable law provides otherwise.
11. Data Processing Agreement
Where MKX Technologies processes personal data on behalf of a customer as a data processor, the required arrangements are set out in a Data Processing Agreement (DPA).
The DPA addresses matters including:
- documented processing instructions;
- confidentiality;
- technical and organisational security measures;
- the engagement of subprocessors;
- international data transfers;
- assistance with data subject rights;
- personal data breaches;
- deletion or return of personal data;
- information and audit rights.
These arrangements are intended to meet the requirements applicable to processor agreements under Article 28 of the GDPR.
12. Supervisory Authority
Data subjects have the right to lodge a complaint with a competent data protection supervisory authority.
In the Netherlands, the competent supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Where another supervisory authority is competent under applicable data protection law, a data subject may also have the right to submit a complaint to that authority.
Questions about GDPR or data protection?
For questions regarding privacy, data protection, the GDPR, or the processing of personal data within myWorkMate, please contact:
privacy@myworkmate.nl© 2026 MKX Technologies — myWorkMate. All rights reserved.