Anonymity & privacy
Anonymity is more than a promise. It is in how it is built.
Can an employer see what one driver answers? No. The dashboard shows only what a group answered together. Conversations with Joy stay closed to the employer: confidential, but not anonymous.
- 7
- drivers per team, at least
- 5
- answers before a score appears
- 10
- writers before a theme appears
These limits apply to every employer and never go lower, not even with a new agreement. They may go higher.
How it works
Where the name comes off
Questionnaire
- Driver signs up themselves, with a number they give us
- Invitation a personal link in WhatsApp
- Name off when it is handed in
- Answer with team, day and language, without a name
- From 5 answers, in a team of 7 or more
- Group figures per team, depot and company
Joy
- Driver writes to Joy in WhatsApp
- Conversation and memory confidential, not anonymous: it is tied to the driver's number
- Closed the dashboard cannot reach it
- Only a report that the driver reads and approves first
Which data goes in, and from whom
What the employer supplies
Per driver the name, team, date of birth, language, whether they are employed and whether they use a company phone; no phone number. The date of birth recognises a driver who signs up. We keep it as an unreadable code: the employer can enter the date but cannot read it back.
The phone number
The driver gives it, never the employer, and the employer does not see it. After leaving or FORGET ME we keep it only as an unreadable code, with the conversations with Joy or with a STOP.
Who delivers the messages: WhatsApp
The link and the conversations run over Meta's WhatsApp Cloud API. Meta sees the number and the text and by its own account keeps messages for up to thirty days.
Who reads the text: a language model
Joy is a language model from Mistral AI, a French company, that we call through Mistral's European address, and that model reads what a driver writes to her, to answer. A model reads open answers only after we have taken out phone numbers, email addresses, number plates and capitalised names from the driver list and the dashboard.
What we promise
And where it stops
-
The employer never sees an individual answer.
- How it is built
- The dashboard may not read individual answers in the database, only group figures. A score appears only from 5 answers, in a team of at least 7 drivers.
- Where the limit is
- In a small group a result can sometimes point to someone; that is why we never show how many people answered. The technology does not stop anyone putting someone on the list who does not work there, or signing up in a driver's name; the terms forbid it.
How the dashboard gets its figures
How it works
The dashboard has a database role of its own, which may not read individual answers. You see the response as a word (good, moderate or low), from 25 drivers as a ten-point band. A team starts with at least 7 drivers. If it later drops below 7 working drivers, the dashboard shows nothing for that team.
-
An answer is kept without a name.
- How it is built
- When it is handed in, the name comes off the invitation. The answer itself is stored with only the team, the day and the language.
- Where the limit is
- Nameless does not always mean unrecognisable: what someone writes in their own words can itself point to that person. That is why the employer never reads open answers.
How the name comes off an answer
How it works
When it is handed in, we take the name off the personal invitation, in the same database step that stores the answers. An unused invitation loses the name the night after the link expires. Only if a driver says yes does Joy keep that driver's own figures, for the driver and never for the employer.
What this does not prevent
Those of us who manage the database can technically reach the answers, and the system does not record that. An employer cannot ask us to link an answer to a driver; that is what we agreed.
-
Taking part is voluntary, and the employer does not see who takes part.
- How it is built
- Per team the employer sees one word about sign-ups: too few drivers, not yet enough, or enough. Not who, and not who sent STOP. A team that has just been put together, or is only just big enough, gets no word, so that "enough" never means "everyone".
- Where the limit is
- Someone who keeps making different teams, with a lot of patience, can sometimes still work it out. We see that, and then we take it up with the employer. Not trying to find out who takes part, and penalising nobody: that is an agreement in the terms. The two founders see per team how many drivers signed up and answered, even when that is fewer than 5. They also see per month what they chose, and for measurements that are over the scores with the number of answers. There are no names with it. That is to guide the pilot, and they share it with nobody.
Signing up, stopping and what the employer notices of it
How it works
A driver signs up themselves, with a number they give us. The employer does not see the number, the language chosen, a yes to Joy or a STOP. Anyone who does not sign up themselves gets nothing from us. If a driver is penalised anyway, they report it to us through Joy.
-
Conversations with Joy stay closed to the employer.
- How it is built
- The dashboard cannot reach conversations, what Joy remembers or the scores a driver let her keep: not as text, not as a summary.
- Where the limit is
- WorkerJoy knows which number someone writes from, and while they are signed up, who they are. Those of us who manage the database can technically reach it, and the system does not record that. On a company phone the conversation is also on the device; that the employer does not read it there is an agreement in the terms.
When we open a conversation
How it works
In two cases we open a conversation through our review system, and whoever opens it is recorded; a driver can ask who that was. Otherwise only to send it to a driver who asks what we keep. Joy is not an emergency service: in acute danger a driver calls 112 themselves. If a driver tells Joy there is danger, she says in that same answer that they should call 112; we bring nobody in. If we look into a dashboard for support, that is recorded.
Safety
If a conversation is about someone's safety, Joy marks it and says so straight away. Nobody reads it unless the driver later says yes to her one-time question whether someone at WorkerJoy may read it back. Nobody takes action because of it: we call nobody and send no help. The mark sends the conversation nowhere, not to the employer and not to the company doctor.
A driver who asks us to look
If a driver thinks Joy answered wrongly, they ask Joy to mark the conversation; only after a YES to her fixed question does she mark it and do we read it back, with the two weeks before, and nothing else. Until someone opens it, the driver can withdraw it.
What this does not prevent
Those of us who manage the servers, and our hosting Brainpod, can technically reach it too. On a company phone the conversation is also in WhatsApp, which we cannot reach.
-
A report arrives only if the driver wants it to.
- How it is built
- The driver reads the text first. Only after a yes does it appear in the dashboard the next day, in Dutch, without a name, team or conversation.
- Where the limit is
- From the content an employer can sometimes guess who a report comes from. Joy says so before the driver says yes.
Who sees a report, and for how long
How it works
Without the driver's yes nothing goes to the employer. Only an administrator or HR analyst sees a report. The employer does not see who made it, from which conversation or in which language.
If a driver is penalised for what they said or did not say, they can report it to us through Joy, not to the employer. We keep it for at most a year, without the conversation or the number. Of our own accord we tell the employer nothing about it; only if the driver wants us to, or if the law or a court requires it.
What this does not prevent
What the driver puts in the report can itself point to that driver. We refuse an email address or phone number; instead of a name Joy writes a role, but that is a rule for the language model and can go wrong.
-
The employer never reads open answers.
- How it is built
- A language model reads the text only when at least 10 drivers in one team wrote in a closed measurement, and then turns it into themes. Nobody reads the rest, and we erase it the night after the measurement closed.
- Where the limit is
- In a small group a theme can point to someone. We take names and numbers out before a language model reads the text; that does not always succeed.
Themes and the erasing
How it works
A theme does not say how many people wrote about it, and never takes over eight words in a row from an answer; a shorter phrase can still be recognisable. Above the question it says that no medical information belongs in it. If an answer seems to be about your own health, we do not keep it and no language model reads it; we do not always recognise that.
-
A driver stops or erases themselves, from WhatsApp.
- How it is built
- STOP: no more questionnaires. JOY OFF: conversations and memory erased. FORGET ME: everything Joy knows, and the number, erased.
- Where the limit is
- A report that was already passed on stays until its own term. Meta itself keeps messages for up to thirty days.
What each message does exactly
How it works
- STOP
- No more questionnaires, and Joy no longer writes of her own accord. Writing to Joy yourself still works.
- JOY OFF
- Confirmed with YES: conversations and what Joy knows erased, and she reads nothing until a new yes. The questions keep coming.
- FORGET ME
- Confirmed with YES: conversations, marked ones too, what Joy knows and the number erased, and no more questions.
Each command works in the driver's own language. The others, such as choosing another language, are on the page about Joy. To This is Joy
What this does not prevent
FORGET ME does not remove the number from our contact book at Meta, and from backups only after at most thirty days. Conversations on an earlier number run out on their own term.
-
The answers stay in the EU.
- How it is built
- Questionnaire answers stay in the EU. The language model is from Mistral AI, a French company, and we call it through Mistral's European address; it reads what a driver writes without a phone number or the employer's name.
- Where the limit is
- Meta sees number and text, and what goes through WhatsApp can leave the EU. All traffic to our site runs through Bunny; whether that stays in the EU has not yet been established.
Meta, the language model and who else looks in
How it works
A conversation with Joy goes to the language model as it is, a name a driver types included. Without a language model in the EU, we do not switch on Joy or the open answers.
What is written here also holds if an employer asks us otherwise. Only a court or the law can require something else of us.
Retention
How long we keep things
| What | How long |
|---|---|
| What a driver writes in their own words | 14 days |
| Messages with Joy | 30 days; that there was a conversation, 6 months |
| A report the driver asked Joy to pass on | at most 12 months |
| Answers to the questionnaire | 24 months; team scores as long as you are a customer |
| Phone number and date of birth (as a code) | until the night after leaving |
| Your data after the pilot | erased 30 days after the last day |
Tasks that run every night keep these periods; after the pilot, we erase the data according to a fixed procedure.
All periods and exceptions
-
14 days Open answers, word for word
Without a theme we erase it the night after the measurement closed; with a theme after at most 14 days.
-
6 months Conversations with Joy
Messages stay thirty days; for up to six months after that only that there was a conversation, and a number or address the driver gave for the company doctor. What Joy remembers goes two years after it was last added to (a name alone: until one of the three commands), or sooner with START OVER, JOY OFF or FORGET ME. Figures she was allowed to remember, eight weeks.
-
6 months after the request Conversations with a complaint about them
Until six months after the request, with the messages in it while the request stands.
-
12 months after the mark Conversations marked for somebody's safety, after a yes
Without a yes the mark goes after four weeks. After a yes to a read-back, twelve months from the mark.
-
12 months Reports a driver asks to have passed on
A report to the employer or to us stays for at most twelve months after the yes, cut loose from conversation and number.
-
24 months Answers to the questionnaire
Stored without a name and deleted after 24 months; team scores and action cards we keep as long as you are a customer.
Besides that: that an invitation went to a team, 24 months; a sign-in link with the IP address, thirty days.
If you stop
What happens to the data
For the measurement you are the controller and we are the processor: if you do not carry on, we erase the data 30 days after the last day of the pilot. The conversations with Joy and what she remembers fall outside that. Those belong to the driver, and we are responsible for them ourselves.
What exactly is erased, and what remains
Erased after 30 days, sooner if you ask
30 days after the last day of the pilot, according to a fixed procedure, we delete the roster, the answers, scores, reports and the action board, unless you ask to switch, and we confirm the deletion to you by email; backups keep them for at most thirty days. Until then you can save the monthly reports as PDFs. Erasing sooner takes one email from someone who may sign on your behalf.
When you switch
Then the individual answers can go too, without name or number but with team, measurement and day: directly, and only to a provider that uses them as your processor and promises us in writing that you never see them individually, with limits and periods at least as strict as ours.
What is the driver's stays the driver's
Conversations with Joy run out on their own terms; a driver can erase them with FORGET ME.
What remains after that, such as the access log until it expires after 24 months, is set out in article 11 of the terms.
For your privacy officer and lawyer
The documents, on request
You request the data processing agreement and the other documents from us, even before you request a pilot.
You can always ask, pilot or not: email welkom@workerjoy.nl or call +31 6 24 58 90 22.
-
Data processing agreement (draft)
-
Explanation for the driver In the driver's own language (8 languages); the first message after scanning the poster links to it. See the explanation
-
Privacy statement Read the privacy statement
Updated on 6 November 2026
Who is responsible, what this website keeps and what you request
We do not measure your visit with cookies from Google, Microsoft or anyone else. On /info, /joy, the questionnaire and the dashboard we count, ourselves and without a cookie, how often something is opened: only numbers per week or month, with no name, IP address or time of day. A form sets a security cookie and a session cookie. Brainpod, our hosting, keeps your IP address in a log, by its own account for at most thirty days; Bunny can keep a log too, for how long we do not know yet. On most pages your browser requests our typeface from Fontstand B.V.; your IP address then stays in an Amazon log in the US for up to a day.
What you fill in on the forms reaches us as an email at welkom@workerjoy.nl, so that we can contact you; after the introduction, a third form asks for the details for the pilot agreement. We keep the email until twelve months after the last contact; if a pilot follows, as long as its records. Signing goes through Youtrust in France, which keeps the proof for ten years.
For the measurement the employer is the controller and WorkerJoy the processor; for Joy, signing up in WhatsApp and this website, WorkerJoy (Pricbord B.V.) is itself responsible. Questions about privacy: privacy@workerjoy.nl. A complaint can go to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.