Privacy Policy
At myWorkMate, we take the protection of personal data seriously. In this Privacy Policy, we explain which personal data we process, why we process it, with whom data may be shared, how long data is retained and what rights data subjects have.
This Privacy Policy applies to the website, the myWorkMate platform, our AI assistants, mobile web environment, communication channels, integrations and other services of myWorkMate.
For additional information, we refer to our GDPR & Data Protection, AI Transparency Statement, Cookie Policy and, where applicable, our Data Processing Agreement.
1. Who are we?
myWorkMate is an AI-powered platform and virtual back-office assistant for entrepreneurs and small and medium-sized businesses. myWorkMate supports companies with, among other things, customer management, leads, quotations, invoices, payments, appointments, communication, workflows and other administrative, commercial and operational processes.
myWorkMate is a product of MKX Technologies, Netherlands (Chamber of Commerce number: 88447995). Contact for privacy and data protection questions: privacy@myworkmate.nl
Our role under the GDPR
The data protection role of MKX Technologies depends on the processing activity.
MKX Technologies as data controller
MKX Technologies is the data controller when we determine the purposes and means of the processing ourselves. This applies, for example, to personal data we process for:
- account registration and authentication
- subscriptions and billing
- customer service and support
- platform administration
- security and fraud prevention
- communication with our own customers and users
- analysis and improvement of our services
- compliance with legal obligations
MKX Technologies as data processor
When an entrepreneur or organisation processes personal data of its own customers, leads, employees, suppliers or other contacts through myWorkMate, that organisation generally determines the purpose of the processing. In that case, the relevant organisation is generally the data controller and MKX Technologies acts as a data processor.
Arrangements regarding such processing are, where required, laid down in our Data Processing Agreement. This distinction is important: the GDPR requires that processing by a processor be governed by a contract.
2. What personal data do we process?
The data we process depends on the features, modules and integrations that are used.
Account and user data
We may process, among other things:
- name
- email address
- phone number
- company name
- Chamber of Commerce number
- job title and user role
- account and authentication data
- language and user preferences
Customer and lead data
Users can process personal data of their own customers and leads through myWorkMate, including:
- names
- contact details
- addresses
- company information
- communication history
- notes
- appointments
- customer and lead status
- other information linked by the user to a contact
For this data, myWorkMate generally acts as a processor on behalf of the relevant entrepreneur or organisation.
Quotations, invoices and financial data
Depending on the use of the platform, we may process data contained in:
- quotations
- invoices
- payment requests
- transactions
- subscriptions
- agreements
- financial documents
Payment data
Payments may be processed through external payment service providers, including Stripe. myWorkMate may process data such as:
- invoice details
- payment status
- transaction amounts
- currency
- Stripe identifiers and transaction references
- payment method
- information about refunds and chargebacks
myWorkMate does not store full raw payment card data when this is processed directly by the payment service provider.
Communication data
When communication features are used, we may process, among other things:
- WhatsApp messages
- emails
- messages via myWorkMate
- customer inquiries
- AI chat conversations
- attachments
- communication history
Calendar and appointment data
When calendar or appointment features are used, we may process, among other things:
- appointment date and time
- title and description
- location
- participants
- availability information
- relevant calendar information
When an external calendar is connected, data may be exchanged with the relevant calendar provider to the extent necessary for the chosen functionality.
Location data
When a user voluntarily shares a location, for example via WhatsApp or another feature within myWorkMate, coordinates or location data may be processed to, for example:
- determine an address
- record a lead or customer location
- schedule an appointment
- calculate routes or travel times
Location data is not used for unrelated purposes.
Files and documents
Users can upload or have generated files and documents, including:
- quotations
- invoices
- agreements
- images
- attachments
- other business documents
These files may contain personal data.
AI data
When AI features are used, we may process:
- prompts
- instructions
- messages
- directives
- relevant business context
- relevant customer or lead data
- AI-generated responses and results
- information about performed AI actions
Technical and usage data
We may automatically collect technical information, including:
- IP address
- browser type
- device and session data
- login data
- error messages
- security logs
- usage and activity data
This information is used, among other things, for security, error analysis, support and improvement of the platform.
3. For what purposes do we use personal data?
Depending on our role and the features used, we process personal data for, among other things:
- providing and managing the myWorkMate platform
- creating and managing accounts
- authentication and access control
- carrying out user instructions
- CRM and lead management
- creating and managing quotations and invoices
- payment processing
- managing subscriptions
- scheduling and managing appointments
- enabling communication via WhatsApp, email and other channels
- executing workflows and automations
- providing AI assistants and AI agents
- customer service and technical support
- security and fraud prevention
- error analysis and monitoring
- improving our services
- compliance with legal obligations
4. Legal bases for processing
When MKX Technologies acts as a data controller, we only process personal data when there is a valid legal basis. Depending on the processing, this may be:
Performance of a contract
When processing is necessary to perform our contract with a customer or user.
Legal obligation
When we must process or retain data to comply with legal obligations.
Legitimate interests
When processing is necessary for a legitimate business interest, for example security, fraud prevention, technical monitoring or improvement of our services, provided the interests and fundamental rights of data subjects do not override those interests.
Consent
When consent is legally required. Given consent can be withdrawn without affecting the lawfulness of the processing prior to its withdrawal.
When we act as a processor, myWorkMate processes personal data on behalf of and on the instructions of the relevant data controller. That organisation is in principle responsible for establishing the applicable legal basis.
5. WhatsApp and other communication channels
myWorkMate can integrate with Meta's WhatsApp Business services and other communication providers. When WhatsApp is used via myWorkMate, incoming and outgoing messages may be processed by the platform to, for example:
- answer customer questions
- recognise instructions
- register data
- make appointments
- prepare quotations or invoices
- execute workflows
- provide AI features
Messages may be stored when this is necessary for conversation context, business administration, support, security or other legitimate purposes. The use of WhatsApp may also be subject to Meta's terms and privacy policies.
6. Artificial intelligence
myWorkMate uses artificial intelligence to support users with administrative, commercial and operational tasks. Depending on the features used, AI may be deployed for, for example:
- understanding natural language
- interpreting instructions
- answering messages
- structuring information
- drafting communications
- preparing quotations and invoices
- supporting CRM processes
- suggesting follow-up actions
- executing or supporting workflows
For AI features, we may use specialised external technology and AI providers, including, depending on the functionality used, for example OpenAI, Anthropic and Google. When necessary to carry out an AI task, relevant context may be provided to such a provider. We aim for data minimisation: only data that is reasonably necessary for the relevant processing is provided.
Training of AI models
myWorkMate does not use customer data to independently train its own general AI models. Where external AI providers are used, we use business/API services and appropriate contractual and technical settings for data processing where possible.
We do not make an absolute commitment that data cannot under any circumstances be processed by any external service beyond what is described in this Privacy Policy and the applicable agreements. More information about the use of artificial intelligence within myWorkMate can be found in our AI Transparency Statement.
7. Integrations and external services
myWorkMate can offer integrations with external services. Depending on the features a user activates, this may include:
- payment services
- WhatsApp and communication platforms
- Google services
- Microsoft services
- Apple services
- calendar and video conferencing services
- accounting software
- AI services
- route and location services
- other business integrations
When a user activates an integration, data may be exchanged to the extent necessary to provide the relevant functionality. Some external service providers may be independent data controllers for certain processing. In that case, their own privacy policy also applies.
8. With whom do we share personal data?
We do not sell personal data. Personal data may only be shared when this is necessary and lawful.
Service providers and subprocessors
We may use external service providers for, for example:
- hosting and infrastructure
- databases and storage
- AI processing
- payment processing
- communications
- authentication
- calendar integrations
- monitoring and security
- technical support
Where these parties process personal data on behalf of MKX Technologies, we make appropriate contractual arrangements where required. We may publish a separate and current list of subprocessors with information about relevant vendors.
Recipients chosen by the user
Data may be shared with parties that a user selects or authorises, such as:
- accountants
- bookkeepers
- tax advisors
- employees
- consultants
- customers
- other business contacts
Legal obligations
We may disclose personal data when legally required to do so, on the basis of a valid legal request, or when necessary for the establishment, exercise or defence of legal rights.
9. International transfers of personal data
Some service providers used by myWorkMate may process personal data outside the Netherlands or outside the European Economic Area (EEA). When personal data is transferred outside the EEA and the GDPR requires it, we use a valid transfer mechanism. This may, for example, consist of:
- an adequacy decision of the European Commission
- Standard Contractual Clauses (SCCs)
- or another legally valid mechanism for international data transfers
Where necessary, additional technical, organisational or contractual safeguards are applied.
10. Retention periods
We do not retain personal data for longer than necessary for the purpose for which it is processed, unless a legal obligation or justified reason requires a longer retention period. Indicative retention periods may be:
Account and subscription data
During the term of the customer relationship and thereafter as long as necessary for administration, disputes or legal obligations.
Customer and company data within the platform
During the use of the account and subsequently during the applicable deletion or recovery period.
Financial administration
Insofar as it falls under fiscal retention requirements, in principle for the legally required period.
Communication data
As long as necessary for the relevant communication, business operations, support or legal obligations.
Technical and security logs
For a limited period necessary for security, error analysis and investigation.
Activity Logs
When this feature is used, according to the retention period that applies within myWorkMate for this feature.
Data from external integrations
As long as the integration is active or as long as storage is necessary for the relevant functionality. Upon disconnection, data is deleted or unlinked where technically and legally appropriate.
Backups may persist for a limited additional period before being automatically overwritten or deleted.
When myWorkMate acts as a processor, additional retention periods may follow from the instructions of the relevant customer and the Data Processing Agreement.
11. Security
myWorkMate takes appropriate technical and organisational measures to protect personal data against, among other things, loss, unauthorised access, alteration and disclosure. Depending on the relevant systems, measures may include:
- encrypted data transmission via TLS/HTTPS
- authentication and access control
- role-based access control
- separation of data between organisations
- logging and monitoring
- security audits
- restricted access to production data
- measures for incident detection and response
For security reasons, we do not publish detailed information about our security architecture where disclosure could compromise the security of the platform. No digital system can guarantee absolute security. We therefore continuously evaluate and improve our security measures.
12. Data breaches and security incidents
myWorkMate maintains procedures for assessing and responding to security incidents that may involve personal data.
When MKX Technologies acts as a data controller, we assess whether an incident must be reported to the competent supervisory authority and/or data subjects in accordance with the GDPR.
When we act as a processor, we inform the relevant data controller in accordance with applicable legal and contractual obligations when we become aware of a relevant personal data breach.
13. Rights of data subjects
Depending on the circumstances, data subjects may have the right under the GDPR to:
- access their personal data
- rectify inaccurate personal data
- erase personal data
- restrict processing
- data portability of certain personal data
- object to certain processing
- withdraw consent where processing is based on consent
- protection against certain solely automated individual decision-making
These rights are not absolute and may be subject to legal conditions and exceptions.
When MKX Technologies is the data controller
A request can be submitted via privacy@myworkmate.nl. We respond within the time limits prescribed by the GDPR. In principle, this is within one month.
When myWorkMate is a processor
When the request relates to data that an entrepreneur or organisation processes via myWorkMate about its own customers, employees or other data subjects, the request should in principle be directed to that entrepreneur or organisation. myWorkMate supports the relevant data controller where necessary and in accordance with applicable arrangements in handling such requests.
14. Automated decision-making
myWorkMate is not intended to make decisions about natural persons without appropriate human intervention that have legal effects or similarly significantly affect them, unless such processing is lawfully arranged and complies with the applicable legal requirements.
Where features are offered that make such processing possible, appropriate information, settings and protective measures are applied. More information about AI and automation can be found in our AI Transparency Statement.
16. Google API Services and Google Workspace – Limited Use
myWorkMate may use Google API Services, including Google Sign-In (OAuth 2.0) and Google Workspace APIs such as Google Calendar, to enable authentication and user-selected integrations.
We only request access to data and permissions that are necessary for the features the user activates.
The use and transfer of information received from Google API Services and Google Workspace APIs complies with the applicable Google API Services User Data Policy, including the applicable Limited Use requirements. Data obtained via Google APIs is not used for personalised advertising or sold to third parties.
For Google Workspace data, additional restrictions apply regarding transfer, human access and use for training general AI/ML models. Google requires that use be limited to appropriate, user-directed functionalities and that this handling of Workspace data be clearly disclosed.
Limited Use statement
"The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements."
17. External authentication
When users choose to log in via an external authentication provider, such as Google, Microsoft or Apple, we receive the data necessary to identify the user and enable the login, depending on the permissions granted by the user.
The external provider may also independently process personal data in accordance with its own privacy policy.
18. Minors
myWorkMate is a business service and is not intended for independent use by children. We do not knowingly collect personal data from children for the creation of an independent business myWorkMate account.
When personal data of minors is processed by a business customer via the platform, the relevant customer is responsible for a valid legal basis and compliance with applicable privacy legislation, insofar as myWorkMate acts as a processor.
19. Complaints to the supervisory authority
Data subjects have the right to lodge a complaint with a competent supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). This right is without prejudice to other administrative or judicial remedies.
20. Changes to this Privacy Policy
We may amend this Privacy Policy when our services, technology, processing activities or legal obligations change. The most recent version is made available via our website and/or the myWorkMate platform.
In the event of material changes, we may inform users, for example via email or a notification within the platform.
21. Additional privacy documents
This Privacy Policy should be read in conjunction with, where applicable:
- GDPR & Data Protection
- AI Transparency Statement
- Cookie Policy
- Data Processing Agreement (DPA)
- Subprocessors list
- Terms & Conditions
In the event of discrepancies between these documents, for processing where myWorkMate acts as a processor, the specific arrangements in the applicable Data Processing Agreement prevail insofar as permitted by law.
22. Contact
For questions about this Privacy Policy, data protection or the processing of personal data within myWorkMate:
MKX Technologies — myWorkMate – Privacy & Data Protection · Chamber of Commerce number: 88447995 · Netherlands
E-mail: privacy@myworkmate.com
Questions about your privacy?
We're happy to help. Send us an email and you'll hear back within the time limits prescribed by the GDPR.
privacy@myworkmate.com© 2026 MKX Technologies — myWorkMate. All rights reserved.