Privacy notice

In short

• A CV is personal data. We treat it that way.
• We use your data to match professionals and projects. We do not sell it, rent it or pass it to advertisers. Ever.
• Your profile is never public. Your CV reaches a client only with your consent — per project, per field, to one named recipient.
• We keep data for 12 months after your last activity, and warn you 30 days before it lapses.
• Delete your account and your CV is deleted at once.
• You can see, export, hide and delete your data yourself, in your private environment.
• A person makes every decision about you. Nothing is rejected or ranked automatically.

1. Who is responsible

The controller is YRproject B.V., the Netherlands. Chamber of Commerce (KvK) 97813974. Contact for privacy: Dirk Baaijen, dbaaijen@yrproject.nl, +31 6 12 28 94 83.

2. What we collect, why, and on what legal basis

Professionals

We ask you not to put special categories of data in your CV — such as a national ID number, a photo, date of birth, health, religion or union membership. We do not need them.

Clients and requesters

Visitors and tool users

We set no advertising or tracking cookies. A session cookie is set only when you log in.

How we count visits — without cookies

We want to know which pages are read and whether the tools are used. We do that ourselves, on our own server, and we keep totals only.

• What is counted. Per day: how often each kind of page was viewed (for example “a project page” — never which address, never a link with a personal code in it), how many visitors there were, whether they used a phone, tablet or computer, the country and the approximate city their network is registered in, the organisation whose network they used (see below), the kind of site they came from (LinkedIn, a search engine, a messaging app, “other” — never the address of that site), and how often a function was used (the calculator moved, a question asked, a registration completed). Each of these is a fixed name with a number next to it. There is no list of visits and no record per person.
• No cookies, no identifiers. We place no cookie for this, store nothing in your browser and do not fingerprint your device. A small script of our own tells our own server that a page was opened; it sends the kind of page, the host name of the referring site and, if present, a campaign label from a short fixed list.
• How a visitor is counted once a day. Your IP address, a coarse browser family, the device type and your language setting are combined in memory with a random key that exists for one day only, and turned into a code that cannot be turned back. The code is kept until the day (UTC) ends, only to avoid counting you twice. Then the key and all codes of that day are deleted, so the codes can never be recalculated or linked to another day. Only the number remains. Your full IP address is never stored by this system.
• Country, city and network. When a page is opened, your IP address is used in memory to look up three things in a public list that we keep on our own server: the country, the city (approximate, as registered for the network — for home and mobile connections often the provider’s hub rather than your town), and the organisation the network is registered to — usually an internet provider, sometimes a company or institution with its own network. The address is then discarded. We store daily totals only: per country, per city and per organisation (cities and organisations for 13 months). For 30 days we also keep daily totals per shortened network block: the address with its last part removed, so that it points to a block of at least 256 addresses and not to a connection. This tells us, for example, that a visit came from Norway or from the network of a university; it does not tell us who you are. The look-up list comes from DB-IP (db-ip.com); nothing is sent to them.
• Global Privacy Control and Do Not Track. If your browser sends either signal, your page view is added to the day’s total, but no code is made for you at all, and of the look-up above only the country is counted — no city, no organisation and no network block.
• Automated traffic. Requests from declared robots are counted separately, from the web server’s own log, in which addresses are already shortened and referrers, cookies and one-time codes are removed. That log is kept 30 days.
• No profiles, no third parties. No analytics company, advertising network or social plug-in is involved. The totals are visible to YRproject staff only and are never shown on this site.
• Legal basis and retention. Legitimate interest: running and improving the site with the least intrusive measurement we could build. Daily totals are kept for 25 months (to compare a month with the same month a year earlier) and then deleted; totals per city and per organisation after 13 months, totals per shortened network block after 30 days.

3. Who sees your data

• YRproject staff. Every CV download is logged.
• A client — only after you say yes. A release is per project, per field (name, e-mail, phone, CV) and to one named e-mail address. Each release is recorded, and you can see the list in your private environment. Clients never browse profiles.
• Processors that run parts of our service under a processing agreement:

Your CV and the text extracted from it are never sent to an AI provider. Where AI helps to shortlist for a posting, it sees pseudonymised structured fields only (discipline, sectors, level, certificates, rate, availability, regions, country) under a temporary alias — no name, no contact details, no CV. A person decides.

If we add a processor — for example for accounting or for credit checks on client organisations — we name it here first.

• Nobody else. We do not sell personal data. We share it with authorities only when the law requires it.

Where a processor is outside the European Economic Area, we use the safeguards the GDPR requires and name them in the table above.

4. How long we keep it

5. When you delete your account

1. At once: your profile becomes invisible and cannot be proposed. Your CV file is deleted. You are logged out everywhere.
2. For 12 more months: remaining personal details are kept, locked, so that we can answer questions and handle disputes.
3. Then: they are erased for good.
4. What remains: match and rate history without your name or contact details. This is pseudonymised, not anonymous — in a small market, context could in theory point to a person, so we keep protecting it as personal data. Proof of your consent is kept as a keyed hash, so that we can show consent existed without keeping your identity.

Hiding your profile is different from deleting: we stop proposing you, but keep the account so you can return or delete it later.

6. Your rights

You can, free of charge:

• See and export everything we hold — "Download everything" in your private environment.
• Correct your details — in your private environment, or ask us.
• Delete your account — yourself, effective at once as described above.
• Withdraw consent — per purpose. Withdrawing the required "mediation" consent means we stop proposing you.
• Restrict or object to processing based on legitimate interest.
• Take your data elsewhere — the export is a machine-readable file.
• Not be subject to automated decisions. We make none. Where AI helps — for example reading a client's posting text — it proposes and a person decides. No professional is rejected, ranked or scored automatically.

We answer within one month. If you are unhappy with how we handle your data, tell us first; you may also complain to the Dutch Data Protection Authority, autoriteitpersoonsgegevens.nl.

7. How we protect it

• CVs are stored outside the public web folder, with restricted access. They are never reachable by a public link.
• Staff download CVs only when logged in; every download is logged.
• Passwords are stored as hashes. Links we e-mail you are random, single-use and stored only as hashes.
• Log-in and registration are rate-limited; repeated failures lock the account for 30 minutes.
• Back-ups are encrypted.
• If a breach puts you at risk, we tell you and the authority without delay.

8. Changes

We date and version this notice. If a change affects what you consented to, we ask you again.

Version 1.0 — 22 September 2026. This is the version in force.

Result links you share

Shareable result links from Margin Check and Crew Forecast contain only the numbers or settings of that result (for example a rate, hours, a project type). They never contain your name, e-mail address, the text you typed, or anything about your device. Questions you ask in Ask the North Sea do not become public pages; only our own curated questions have public pages.

Open Rate Index

The Open Rate Index takes rates anonymously. For each rate we store: the rate converted to euros per hour, the choices you made in the form (discipline, seniority, setting, region, hour or day rate, and the experience range if you gave one), the date, and whether it was sent from the logged-in account of a verified professional — as yes or no, not which account. To stop one connection from counting twice for the same selection we also store a one-way hash made from a coarse network range and the browser family; the hash cannot be turned back into an address and is deleted after 90 days. We do not store a name, an e-mail address, an IP address or any free text with a rate. Right after you submit, your own rate is kept for ten minutes in a cookie limited to the index pages and then only in your browser's session storage, so the page can show where your rate sits; it is never part of a link. Published bands show the middle half of submitted rates and the median, rounded to €5, and only once enough independent rates are in.