Your career data remains yours.

Who is responsible

Decato, trading as BaanReady and registered with the Dutch Chamber of Commerce under number 93600410, is the controller for the processing described in this policy. Our public correspondence address is Hooimeijerlaan 10, 2991 WS Barendrecht, the Netherlands. For privacy questions and requests, email privacy@baanready.nl.

Decato's owner is the person responsible for privacy at BaanReady. This includes assessing new processing, reviewing service providers and security measures, and handling privacy requests on time. We have not appointed a separate Data Protection Officer.

What data we process

• Account data, such as your email address, account identifier, session data and recovery requests.
• Contact data, such as your name, telephone number and city of residence.
• Career data, such as work experience, education, skills, languages, certificates and results.
• Vacancies, generated CVs, cover letters, application answers, assessments and statuses.
• Payment and subscription data, such as the selected plan, amount, currency, payment status and the customer, payment and subscription identifiers used to recognise a Mollie payment. Mollie also processes the information required for your chosen payment method.
• Technical data recorded by providers for security and operation, such as IP address, browser information, errors and usage metadata.

Why we use this data

We process account, profile, vacancy and application data to manage your account, read documents, save your fact base, analyse vacancies, generate applications and retain results in your dashboard.

For these core functions, our legal basis is performance of the contract and taking steps at your request, Article 6(1)(b) GDPR. For necessary security, fraud prevention and error investigation we rely on our legitimate interests, Article 6(1)(f) GDPR. We retain legally required administration under Article 6(1)(c) GDPR.

If you select a paid plan, BaanReady and Mollie process the data required to carry out the payment or subscription under Article 6(1)(b) GDPR. Financial administration and statutory controls are processed under Article 6(1)(c). Security and fraud prevention may rely on Article 6(1)(f).

Legal documents when creating an account

When you create an account, we ask you to read this policy and accept the User Agreement. We record the version and time of your confirmation for both documents. The privacy checkbox confirms that you have seen this explanation. It does not turn the legal bases described above into consent and is not used for marketing.

Files and your fact base

BaanReady first tries to read a PDF in your browser. If that fails, the file is sent to our secured extraction service for the duration of the request. BaanReady does not retain the original file as a separate upload in your workspace. Extracted text can be saved in your fact base.

Do not upload special category or other sensitive data that is unnecessary for an application, such as medical information, Dutch citizen service numbers, identity documents, religious beliefs or political opinions.

Files you provide

You can upload a CV or another profile file you obtained yourself. BaanReady reads only the file you select and does not connect to your account with the source. You can review, edit or delete the extracted information in your career profile.

BaanReady does not offer LinkedIn sign-in or direct import and never asks for your LinkedIn password.

How we use AI

Relevant profile text, contact details, vacancy text and instructions may be processed through the OpenAI API to extract text from files, identify missing evidence, generate application documents and run quality checks. BaanReady instructs the AI to use only facts you supplied.

Under its business terms, OpenAI does not use API input and output to train models unless Decato separately opts in. BaanReady sends each request with storage of the Responses result disabled. We do not create OpenAI files, conversations, assistants or vector stores for this processing. Under default settings, OpenAI may retain safety logs containing content for up to 30 days, and longer where legally or operationally required for security. BaanReady cannot shorten this provider retention period through its deletion button.

For match assessments, BaanReady removes protected characteristics from model input. Age, date of birth, sex, gender identity, pregnancy, race, ethnicity, nationality, religion, health, disability, sexual orientation, marital or family status, political opinions and trade union membership must not affect a match score, assessment or recommendation. A necessary work authorisation confirmation may be handled separately as a practical condition. Name and contact details are used only to address and format documents.

Service providers we use

Some providers may process data outside the European Economic Area. Where this occurs, the provider's contractual safeguards apply, such as the European Commission's Standard Contractual Clauses. We share only data needed for the relevant task.

Payments and subscriptions

When you purchase a plan, BaanReady sends you to Mollie's secured checkout. BaanReady shares your name, email address, selected plan, amount, currency and technical customer and payment references. Mollie may also process your IP address, browser and device data and information required for your chosen payment method. BaanReady does not receive a complete card number, bank account number or payment security code.

BaanReady retains payment status, amounts, plan details and Mollie identifiers to allocate credits, manage your subscription, reconcile payments and maintain administration. Mollie may screen transactions for fraud and financial compliance. Read Mollie's Privacy Statement.

You can cancel Plus online. When you fully delete your account, BaanReady first attempts to cancel an active Plus subscription with Mollie. If Mollie cannot temporarily confirm cancellation, we do not delete the account yet and show you a notice. This prevents you from losing the ability to manage an active payment.

How long we retain data

• Your account, fact base and saved applications are deleted when you delete them, delete your account or do not use BaanReady for 12 months. Use includes signing in, refreshing a secured session, updating your profile and saving or updating an application. The automated rule applies from 1 August 2026. No existing account will be automatically deleted under this rule before 1 August 2027.
• A file used only for temporary extraction is not retained by BaanReady as a separate upload after the request.
• BaanReady disables storage of Responses results at OpenAI. Under default settings, OpenAI may retain safety logs containing content for up to 30 days and longer where legally or operationally required for security.
• Technical logs at hosting and database providers are kept according to configured provider periods and only as long as needed for security and error investigation.
• Payment and tax administration is kept for seven years where required by Dutch tax law. After account deletion, we remove the direct link to your active workspace where possible. Mollie may also retain payment data for as long as its financial legal obligations require.

Security and access

Your workspace is linked to your Supabase account. Row Level Security restricts database records to the signed-in owner. API routes for stored account data verify the signed-in user before loading or changing data. Transfers use encrypted HTTPS connections.

No system is completely risk-free. Report suspected misuse or a security issue immediately to privacy@baanready.nl.

Your rights and choices

On the Privacy and data page in your workspace, you can download a JSON export, delete individual applications and delete your complete account with its profile and applications. You may also request access, rectification, erasure, restriction, portability or object to processing.

The JSON export also contains your plan, credits, subscription information and payment history. We cannot always erase payment and tax records immediately where the law requires further retention. In that case, they are no longer used for your workspace and the link to the deleted account is limited to what is necessary for statutory administration. For rights relating to data Mollie processes as an independent controller, you may also contact Mollie directly.

You can edit or delete information from a CV or profile file you uploaded in your career profile. You can export your full workspace or delete your account and data under Privacy and data.

Email your request to privacy@baanready.nl. We respond within one month. If you are dissatisfied, you may lodge a complaint with the Dutch Data Protection Authority.

Cookies and measurement

BaanReady uses necessary local storage and authentication tools to operate your session and workspace. Cloudflare Turnstile processes technical browser and connection signals to detect automated abuse of account functions. We do not place non-essential marketing cookies without a separate choice. If we add analytics or marketing measurement later, we will first update this policy and the cookie choice.

Changes to this policy

We may update this policy when features, providers, legal requirements or retention periods change. For a material change, we publish a new policy version and ask you to read and accept it before continuing to use the workspace.