1. Who is responsible for your data
Controller of personal data:
the CrewPoint operator
Questions about personal data: support@crewpoint.work.
When an organisation or team uses information obtained through the platform for its own purposes, it is independently responsible for that processing.
2. What data we process
- Account: name, email, password hash, language, selected role, version of the accepted terms, email confirmation marks, notification settings, the time you completed the first steps after sign-up (for accounts created before these steps existed, the time of sign-up). For Google sign-in: the Google account identifier, name and email. For platform staff with two-step protection enabled: an encrypted key and recovery codes.
- Profile: name, headline, portrait or the statue chosen instead of it, country and city, base location, languages and proficiency, specialities, description, travel zone, certificates, own gear, rate (an amount per day or per hour, or “on request”) and a note on it, if you have given them, availability marks and the contacts you have added. Published only at your decision.
- Specialities: up to 8 specialities, each with its years of experience if you have entered them; the first one is the main one. Shown in the published profile.
- Base location: a place from the GeoNames list that you have chosen; a city typed in by hand is matched against this list when you save. The place is stored with its coordinates — the coordinates of the town, not of an address. The coordinates are used only for the radius search: from them the platform calculates the distance to the place chosen in the search. Neither the coordinates nor the distance are passed on to other users or shown, in the profile or in search. The profile shows the name of the place and the country.
- Travel zone: the countries you are ready to work in, or “Across Europe” or “Worldwide”, and your travel radius if you have set one. Shown in the published profile.
- Certificates: the type of certificate, who issued it, the month it is valid until and, if you wish, a scan — see the section “Certificates and scans” for details.
- Teams and organisations: name, description, contacts, members and their consent to be shown on the page, portfolio images. For a team, also the specialities, the number of people in it, the languages, the countries it is ready to work in, or “Across Europe” or “Worldwide”, and the rate (an amount per day or per hour, or “on request”) and a note on it, if they have been given; all of this is shown on the published team page. For an organisation, also the address, if it has been given; it is shown on the published organisation page.
- Projects and responses: projects and vacancies, responses with a message, project invitations and the answers to them, availability calendar.
- Figures: information the platform calculates from invitations: the number of projects via CrewPoint, the reply time to invitations, “Worked with you” and “Recent work”, as well as the jobs you have hidden from your page. See the section “Figures and recent work” for details.
- Communication: personal messages, list of blocked contacts, support requests, reports, notifications.
- Technical data: session cookie, security action log (who changed what and when), IP address for rate limiting, error reports.
If a profile, a team or organisation page or a project was saved before this version, the city entered in it was matched against the GeoNames list when the platform was updated: if a place with that name was found in the same country, that place was added with its coordinates and the city name as entered was kept; if not, the city remained as text without a place.
3. Portfolio and photos
Portfolio images may be shown in a published specialist profile or on a team or organisation page. The owner can hide an item, manage the photos and check the public view.
Photos and their thumbnails are kept until the author deletes them or deletes their account, unless limited retention is required by law.
4. Certificates and scans
You can list certificates in your profile: a type from the list or your own name for “Other”, who issued the certificate and the month it is valid until. If you wish, you can attach a scan to a certificate: a PDF, JPEG or PNG file of up to 10 MB; at most 40 files are kept per person.
Apart from you, scans can be opened only by the owners of an organisation whose invitation you accepted: from the acceptance until 30 days after the last day of that work, as long as the invitation has not been cancelled. A scan is downloaded as a file, so the platform cannot withdraw a copy the organisation has already saved.
A scan is never shown in the published profile or in search: only the type of certificate, who issued it and the month it is valid until are visible there.
5. Figures and recent work
The platform calculates figures from invitations and shows them on a specialist’s published page, and the number of projects and the reply time also in search:
- Projects via CrewPoint: the number of different projects for which you accepted an invitation and whose last working day has passed. Shown from the first such project onwards.
- Reply time to invitations: the median time from an invitation being sent to your answer — acceptance or refusal — over the answers of the last 180 days. Shown only when there are at least three such answers.
- “Worked with you”: the mark is seen only by the owners of an organisation whose invitation you accepted, once the first day of that work has passed. In that organisation’s search, people can be filtered by this mark, and it affects the order in which they are shown.
- “Recent work”: up to six finished jobs via CrewPoint — the project’s title and photo, the organisation, the speciality you were invited for and the month of the last working day. You can hide each of them from your page: others then no longer see it, and the number of projects does not change.
A team’s page likewise shows the number of the team’s projects via CrewPoint.
6. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Registration, sign-in, account protection | Performance of a contract (Art. 6(1)(b)); abuse prevention — legitimate interest (Art. 6(1)(f)) |
| Public profile, catalogue, team and organisation pages | Performance of a contract, based on your choice to publish |
| Radius search from the base location | Performance of a contract, based on your choice to publish |
| Figures and “Recent work” on the public page, the “Worked with you” mark for an organisation that has worked with you | Legitimate interest (Art. 6(1)(f)): trust between organisations and specialists. You can hide any work from your page or object to the processing through support. |
| Certificate scans for an organisation whose invitation you accepted | Performance of a contract, based on your choice to attach a scan |
| Projects, vacancies, responses, personal messages and availability calendar | Performance of a contract |
| Service emails and notifications | Performance of a contract |
| Support, reports and moderation | Performance of a contract; legal obligations of an online platform |
| Error monitoring, security and backups | Legitimate interest in the reliable and secure operation of the platform |
We don't send marketing emails. The platform does not make automated decisions that have legal effects for you.
7. Who receives data
Other users see only what is needed to work together: a published profile and team and organisation pages in the catalogue, and the name and portrait from a published profile also on the home page for guests; a response, with the responder's page and message, goes to the organisation it is addressed to; personal messages go to the other person in the conversation.
A project invitation is seen by the owners of the organisation that sent it and by the person invited (if a team is invited, by its owners): the days and times, the terms, the offer, the message, the answer, the reason for declining if one was given, and the reason for cancelling participation. As long as the invitation is accepted, the owners of the organisation see all the contacts you have filled in, including those hidden in your profile, and you see the organisation's contacts, the venue address and the on-site contact. If a team is invited, the organisation sees all the team's contacts instead of yours.
Certificate scans go only to the owners of an organisation whose invitation you accepted, for the period stated in the section “Certificates and scans”. The “Worked with you” mark is seen only by the owners of an organisation that has worked with you. The coordinates of the base location are not passed on to other users.
On a team page a member is shown only if they have turned on “Show me on the team page” and their profile is published. The owner’s name in the line saying who receives the team’s invitation is likewise shown only with the owner’s consent. The number of people in the team and the number of people free per day are shown as numbers, without names.
We use processors that act on our instructions under data processing agreements:
| Service | Purpose | Where data is processed |
|---|---|---|
| The operator's hosting provider | Platform servers, database, backups | Data centres in the EU |
| Resend | Delivery of service emails: email verification, account recovery, notifications | US; transfers under the EU-US Data Privacy Framework or standard contractual clauses |
| Google Connected | Sign in with Google: we receive your name, email and account ID | EU and US (Google Ireland Limited); transfers under the Data Privacy Framework |
| Sentry | Application error reports without passwords, tokens or cookies | Storage region chosen by the operator; if stored in the US, transfers under the Data Privacy Framework or standard contractual clauses |
Data may be disclosed to public authorities where required by law.
8. Retention periods
| Data | Period |
|---|---|
| Account, profile, organisations | While the account exists; after the account is deleted — deletion or anonymisation, except for the data below |
| Certificate scans | Until you remove the scan or the certificate itself and save the profile. A scan that no profile refers to is deleted by the daily clean-up once more than 24 hours have passed since the upload. When the account is deleted, all scans are deleted. |
| Sign-in session | 7 days or until you sign out |
| Email verification and password reset links | 24 hours and 30 minutes respectively |
| Support requests and moderation decisions | 2 years after the support request is closed |
| Security log and error reports | Up to 2 years and up to 90 days respectively |
| Backups | According to the backup rotation schedule, after which the copies are deleted |
9. Your rights
- access your data and obtain a copy of it;
- have inaccurate data rectified;
- have your data erased where there is no obligation to keep it;
- restrict processing or object to processing based on legitimate interest;
- receive your data in a machine-readable format (portability);
- withdraw consent where processing is based on it.
You can export your data and delete your account yourself in your account settings. Send other requests to support@crewpoint.work; we respond within one month.
You can lodge a complaint with the Dutch supervisory authority — Autoriteit Persoonsgegevens — or with the supervisory authority in your country of residence, for example in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données.
10. Data protection
Passwords are stored only as a strong hash. The session cookie is not accessible to page scripts and is not sent to other sites. Access to personal data and messages is checked on the server by role, and important actions are logged. The connection to the platform is protected by HTTPS.
11. Cookie
The platform only uses strictly necessary cookies. For details, see our cookie policy.
12. Changes to this policy
Current version privacy-2026-11-02 of 2 November 2026. We notify you of material changes in advance by email or in the interface.
Previous versions of the policy: privacy-2026-11-01, privacy-2026-10-19, privacy-2026-10-15