What we know about you, and why

About WorkerJoy

Who we are

WorkerJoy is a trade name of Pricbord B.V. We make a weekly questionnaire for drivers, usually short and longer once a month, a dashboard for their employer, and Joy: an AI agent drivers can talk to about their work in WhatsApp.

• Pricbord B.V., Chamber of Commerce 78178444, Vluchtoord 37, 5406 XP Uden
• E-mail: privacy@workerjoy.nl
• Phone: +31 6 24 58 90 22

We have not appointed a data protection officer. You can send questions about privacy to privacy@workerjoy.nl.

Back to contents

About WorkerJoy

Two promises, two roles

By the measurement we mean everything around the questionnaire: the list of drivers, the invitations, the answers, the figures, themes, action cards and what is going on per team in the dashboard, the reports drivers had Joy pass on to their employer, from their yes onwards, and the accounts of the people who work with the dashboard.

Privacy law has two roles. The controller decides what data is used for and answers your questions. A processor works on the controller's instructions.

For the measurement your employer is the controller and WorkerJoy the processor. By your employer we mean the company that put you on the list of drivers and that you drive for, also if you work through an agency or as a self-employed driver. Your employer decides the purpose and the legal basis; we work under the written agreements with your employer. We use that data for anything else in four cases only, and for those we are responsible ourselves: a few counts for ourselves, statistics across all pilots that are irreversibly anonymous, a copy of your scores for Joy if you want that, and what the list of drivers says about your language, whether you are employed and whose phone you use. That tells us which language Joy writes to you in if you did not choose one yourself, and whether Joy stays on your number when you leave your job. The counts and the statistics are under “What WorkerJoy counts itself”, the copy under “Letting Joy remember your answers”; on what basis is under “The legal reason”.

For your sign-up in WhatsApp WorkerJoy itself is responsible: your number, when you signed up, whether the phone is yours, your language choice, STOP and a new number. The purpose is that we can send you messages and receive yours, on the number you gave us yourself, and that we know whether Joy stays on that number when you leave your job. Your employer does not see that data and cannot change it. If your employer marks you as having left, we do erase your number, when you signed up, whether the phone is yours and your language choice the night after. A STOP stays. If the phone was yours, we keep an unreadable code of your number for two more years, with your former employer and your language, so that you can keep writing to Joy. As a processor, on behalf of your employer, we do two things: recognise you by your name and date of birth when you sign up, and send the questionnaire over that number. For Joy, for your questions about Joy and your sign-up, for our site and for our administration WorkerJoy itself is responsible.

Based on the group figures and themes we give your employer concrete actions, and we follow whether they are taken up. Your employer cannot ask us to link your answers or a report to you, or to lower the limits. That is what we agreed, and no agreement changes it: the limits never go lower, they may go higher.

Back to contents

Drivers

The questionnaire

Every week a questionnaire about your work: usually short, and once a month longer. You get the link in WhatsApp and fill in the questionnaire on our own website.

List of drivers and signing up

Your employer puts you on the list of drivers with your name, date of birth, team, language, whose phone you use and your status: employed, inactive or left. Only drivers marked as employed get the questionnaire. We get that data from your employer, not from you. We keep your date of birth as an unreadable code, which your employer can enter but cannot read back. With it we recognise you when you sign up and prevent anyone from being on the list twice.

You sign yourself up with the QR code on the poster or the link your employer shares; that way you give us your number yourself. We do not keep what you type to be found, your name and date of birth; Meta keeps it, like every WhatsApp message, for at most thirty days. We keep your number, when you signed up, whether the phone is yours and your language choice. WorkerJoy itself is responsible for that data. Your employer sees none of it, only one word per team: whether enough people signed up. If a team has exactly 7 drivers on the list who have not left, “enough” almost always means they all signed up. Your employer may not sign up in your name and may not try to find out whether you signed up; that is in our agreements with employers.

Every week

Every Wednesday you get a personal link in WhatsApp. Not filled in yet? Then on Friday you get one reminder, with a new link; Wednesday’s link then stops working. Your link works until the next questionnaire goes out.

Your answers

There is no name with your answer. Your employer never sees your single answers, only figures and themes about a group and what is going on per team, unless a court or the law obliges us to hand them over.

As soon as you send your answers, we take your name off. Your answers are then kept without a name, with only your team, the measurement, the day and the language. Your employer can never link them to you. Until the following night, we technically still can: our database then still shows which answers belong to which invitation. That night we erase those traces. After that, it can still be seen that you answered and on which day, until the night after the next questionnaire goes out, usually within a week; if you were the only one in your team to answer that day, that also points to your answers. After that night, nothing records which answers are yours, except our back-ups, for at most thirty more days. But if you are the only one in your team who answers in your language, anyone with access to the database can recognise your answers by that language. Only two people at WorkerJoy can currently access the database, and they never link your answers to you. If you let Joy remember your answers, she gets her own copy of your scores per topic, which is linked to you. What you wrote in your own words is not in it.

Before the language model (AI software that reads and writes text) reads your open answer, we take phone numbers, e-mail addresses, Dutch number plates and the names of people on the list of drivers and in the dashboard out of it, if those names are written with a capital letter. That does not always work: a name without a capital letter, or of someone on neither list, stays in. Above the open question it says never to put medical information in it, such as an illness, symptoms or medication. Text that looks like it is about someone's health we do not keep, and no language model reads it; we recognise it by its words, so not always. What we do not recognise, the language model reads too, without your name. Your employer sees no open answers, only themes, without counts. A theme is a short summary, and only appears if at least 10 people from the same team wrote about the same thing in the same measurement. The language model may not quote in it, and we block eight or more words in a row from an answer. In a small group a theme can sometimes still point to someone; that is why we never show counts. Your text is gone after fourteen days, and often sooner.

Stopping and leaving your job

After STOP you get no more questions; with START you do again. If your employer marks you as “left”, we erase your sign-up (your number, whether the phone is yours and your language choice) and the code of your date of birth the night after. Your name stays on your employer’s list marked “left”, and a STOP stays in place. If the phone was yours (as you told us, or otherwise as your employer entered it), we keep an unreadable code of your number for two more years, with your former employer and your language, so you can keep writing to Joy; with VERGEET MIJ it goes at once.

If your employer switches

If your employer moves to another provider of such a measurement, your employer can take along what it already sees or manages: what your employer put about you on the list of drivers (not your date of birth), the reports drivers had passed on, and the figures, themes and what is going on per team. The new provider can also fetch these from us directly. Your single answers can go to that new provider too, so the measurement continues there: only your answers to the questionnaire, with your team, the measurement and the day, without your name or number. They go only to the successor your employer chooses, which uses them solely as your employer’s processor, for the same measurement, and only if it promises us in writing that your employer never gets to see them individually and that limits and retention periods apply that are at least as strict as ours. We send them directly, and put the name of that provider in this statement before we send anything. Your employer never gets them. If your employer chooses no one, we erase them. If your employer does not continue after the pilot and does not ask to switch, we erase the measurement, including your answers, at the latest thirty days after the last day of the pilot. Your number, your sign-up, your own language choice, your STOP and Joy never go along. What the new provider keeps after that is in your employer’s information. In a small team, team, measurement and day together can still point to you; that is why the new provider may never let your employer see them individually.

What WorkerJoy counts itself

To guide the pilot and improve the service we count per employer how many drivers signed up, sent STOP and talked to Joy, how many teams have enough sign-ups and how many do not yet, and per measurement how many links we sent and how many were used. Those counts are exact. How many links of a measurement were used we see only once the measurement has closed, like the scores on your employer’s dashboard: while it runs, we see only how many links we sent, so even whoever looks often does not see when somebody handed in. If fewer than 5 links went out in a measurement, we do not show how many were used, not even zero. We do not store these figures: we calculate them when we look. We also see the same figures per team of your employer: per week how many drivers are on the team’s list and how many of them signed up, per measurement how many links the team got and how many were handed in and on which day — exactly, also under 5, per day and never per hour, and only once the measurement is over —, the score per topic with the number of answers, and per month how often each work topic was chosen and how it went. We show a score per team only for a measurement that is over, in which every team of your employer handed in at least 5 and has at least 7 drivers. Whoever of us also looks at your employer’s dashboard can, with those counts and the score of a depot or the company, roughly work back the few answers of a small team, and if only one driver answered, that one answer. That too stays with us. The number on the list and the sign-ups per week, and the choices per month, we keep for thirteen weeks; the rest per team we calculate when we look. For all employers together we also count per month how often the questionnaire is opened and handed in — we see a month only once it is over and every measurement in it has closed —, and per week and per language how often our explanation for drivers is read; there we show no figure under ten, and we keep those totals for two years. If only one employer takes part, the total is that employer’s figure. All these figures are seen only by whoever has the highest role in our admin screen. In addition we keep, for two years, per employer per day how many drivers are on the list and how many invitations we sent and how many failed. Only people who signed up get an invitation, so that roughly shows how many drivers signed up. Everyone with an account for our admin screen sees that. In both cases that is currently only the two founders. There is no name or phone number with them, and no team except with the figures per team; but if your employer has one team, your employer’s figure is your team’s. We give these figures to no one, not to your employer either, and we do not mention them in a conversation with your employer. To learn from all pilots together, we keep afterwards only statistics that are irreversibly anonymous; we never use your single answers, open answers or conversations with Joy for them, and we do not train an AI model on them. Why and on what basis, and how to object, is under “The legal reason”.

Back to contents

Drivers

The conversation with Joy

Joy is an AI agent: software, not a person. She says so herself. The conversation is confidential, but not anonymous: we know which number you write from and which employer you signed up with. The language model behind Joy is not given your number or your employer.

Your employer cannot see your conversations with Joy in the dashboard, and may not read them. We do not give them to your employer, not in a conflict and not after an incident, unless the law or a court requires us to. Joy only reads what you write if you agree: she asks at your first message. We do not keep what you write to her before you say JA; if you say JA, send it again. If you say nothing or NEE, Joy reads nothing. Your employer does not know whether you said JA, and you do not need your JA for the questionnaire. You can withdraw your JA with JOY UIT, confirmed with JA: we then erase your conversations with Joy and everything she remembers about you, she reads nothing you send any more, and the questionnaire simply keeps coming. If you write to her again later, she first asks again whether she may read what you write. If you want no more questionnaires either, send VERGEET MIJ or email us: we then also erase your number and set a STOP, until you sign up again with the QR code on the poster. What VERGEET MIJ erases and what stays is under “Having your data erased”.

Joy is not a care provider and not an emergency line. She answers only after a few minutes, gives no medical, legal or financial advice and can make mistakes. If she recognises danger in your message, she says she is not the right one for this and that you should call 112. If you have not said JA yet, she does not read your message, so she does not say this either. If you are in danger, do not wait for Joy but call 112 yourself straight away: Joy and WorkerJoy do not call in anybody.

Who sees your conversations

• The language model (the AI behind Joy), at Amazon Web Services (AWS) in the EU. It reads the last part of your conversation and what Joy knows about you. We do not send your number or your employer along. What the language model reads does not go to the US. AWS does not keep it and does not train on it.
• Meta (owner of WhatsApp): every message, to deliver it. Meta keeps messages in Germany, for at most thirty days. While it is being delivered, a message can be in a Meta data centre outside the EU for at most an hour; after that it is only in Germany.
• Someone at WorkerJoy: conversations you had checked, a conversation about danger that you later said could be read, or your conversations if you ask what we keep. We record who does that. Beyond that, only two people at WorkerJoy can currently access our database, and so also your messages; see “How we protect your data”.

What Joy remembers about you

After a conversation, the language model makes a short summary, so Joy still knows you next time. Joy only knows your name if you give it to her yourself: she is not given the name on your employer's list. If you later sign up with the same number at another employer that also uses WorkerJoy, Joy still knows you there; we tell you so when you sign up. Your new employer sees nothing of what Joy knows about you. Rather start over? Send OPNIEUW.

Do you work with a company phone? Then send NIEUW NUMMER as soon as you know you are leaving: that way you take Joy along to your own phone. Do not wait until you hand the phone in. As soon as your employer marks you as having left, we disconnect Joy from your number, unless we know it is your own phone: because you said so yourself or, if you said nothing, because your employer entered it that way. If we do not know, it counts as a company phone; if the phone is yours, send MIJN EIGEN TELEFOON. After the disconnection you lose what Joy knows about you, and your conversations on that number stay until their term ends. If it is your own phone, you can keep talking to Joy for two years after you leave. We cannot erase the chat with Joy on the device; your employer may not read it, but erase it yourself before you hand in a company phone.

Your health

What you tell about your health is extra sensitive. The language model reads it to answer you, and like every message it stays in your conversation with Joy for 30 days; that falls under your first JA. If you had that conversation checked, or said JA to it being read back after a mark for danger, it stays as long as that conversation. For the summary after the conversation we ask the language model to leave your health out, except what you let Joy remember; if it still ends up in it, worded differently, that belongs to that summary and so also to your first JA. Whether Joy deliberately remembers something about your health for a next conversation is a separate choice; how that works is below. Do you want her to remember everything about your health, or do you want to undo that? Tell Joy.

If you told Joy she may remember everything, she also remembers what you tell her about your health. Otherwise, when you mention something new about your health, she usually asks whether she may remember it, in a few words, such as “bruised ankle”. Only if your next message is JA, on the same day, does she remember exactly those words; if you send something else or nothing, she does not remember it. If you first said she may remember everything and later say NEE, she forgets everything she remembered from earlier conversations, not only about your health; your name, your kept answers and what you let her remember topic by topic stay. Forgetting one topic on its own is not possible: with OPNIEUW, Joy forgets everything she knows about you.

The summary is written by a language model. We ask it to leave out everything about your health that you did not let Joy remember. If a summary still literally names a topic Joy asked in that conversation whether she could remember, and you did not say JA to it, we throw that summary away and Joy keeps the previous one. Something Joy did not ask you about, or something that ends up in it worded differently, is not stopped by that check; that falls under your first JA, and disappears with OPNIEUW or VERGEET MIJ. Your employer never sees any of this, not even whether you said something about your health.

Letting Joy remember your answers

Only if you say yes does Joy remember your answers to the questionnaire: with the box on the questionnaire, or with JA to the question she asks in WhatsApp after you sign up. She then keeps your average per week and per topic, encrypted and for 8 weeks. She uses them in her answers, so the language model reads them too. Your employer never sees them. If you ask us what we keep about you, we open them to give them to you. If your average on a topic was two or lower, on a scale of 1 to 5, Joy sends you a message herself at most once every 28 days. Want to stop? Untick the box on your next questionnaire; Joy then forgets them at once. JOY UIT and VERGEET MIJ remove them too. OPNIEUW erases what she had, but after that she remembers your new answers again.

When someone at WorkerJoy reads a conversation back

Is a conversation about danger to you, about someone who could be put in danger by you, or about being unsafe at home? Then the language model marks that conversation, rather once too often than too rarely. Joy tells you straight away. A conversation here is everything you write to Joy until you send nothing for about two days; your next message starts a new conversation, which is not marked. Nothing goes to your employer or an emergency service, and we do not call anybody or contact you. Nobody will read it just because it is marked. If you write to Joy in a new conversation within four weeks, she asks once whether someone at WorkerJoy may read that conversation afterwards, to see whether Joy helped well. Only if you say JA to that does it happen; we record who does it, and we then keep the conversation with its messages for twelve months from the marking. Without a JA the mark goes after four weeks, the messages after 30 days, and the rest of the conversation after six months, like every conversation. You can withdraw your JA with JOY UIT: we then erase that conversation with your other conversations with Joy, and the questionnaire keeps coming.

Do you think Joy answered you wrongly, or was she unkind? Then ask her clearly for someone at WorkerJoy to take a look; just being angry is not yet a request. Joy then asks you, in a fixed question, whether someone at WorkerJoy may read your conversations with her from the past two weeks, and from which day. Only when you send JA to that does she mark them. Someone at WorkerJoy reads those back, and nothing else. We record who does that. Changed your mind? Tell Joy. As long as nobody has read your conversations, she withdraws your request. A mark for danger does stay, until it goes after four weeks, but nobody reads a conversation just because of it. If you said JA when asked whether that conversation may be read back, that still holds.

Passing something on

Joy can pass something on for you in three ways. You always know first what goes through, and it only goes once you confirm it: with JA, or for the company doctor by sending your phone number or e-mail address yourself.

• To the company doctor: if it is about your health, there is no danger and your employer has named a company doctor. Joy can then give you the company doctor’s details, so you can get in touch yourself. If you would rather the doctor contacted you, send Joy only the phone number or e-mail address where you can be reached, in one message; that is your yes. The company doctor gets only that number or address and the name of your employer; what you said to Joy does not go along. From then on the company doctor is responsible for that data. We keep that number or address with the conversation until the conversation is erased: usually after six months, or earlier with VERGEET MIJ.
• To your employer: something at work that could be better. Your employer gets only what is wrong and where, in Dutch, dated the day after your JA: without your name, your number, your team or your conversation with Joy. Sometimes your employer can still guess from the content who it comes from. From your JA on, your employer is responsible for that report, and passing it on can no longer be undone. You can still have it corrected or erased: tell us which report it is (see “Your rights”).
• To WorkerJoy: if your employer treats you worse because you said something or said nothing. For example because you did or did not fill in the questionnaire, sent STOP or said something to Joy. Treating you worse is, for example: worse trips, fewer hours, a warning or being left out of the group, also by your planner or manager. That is not allowed, and we want to know. Send Joy a message about what happened. She asks whether she may pass it on to us, and only when you say JA do we get it. We then only get what you told and at which employer, not your number. You get a report code; you mention it when you e-mail us about your report. Your employer hears nothing about it from us, unless you want that or the law or a court requires it of us.

If your employer treats you worse

Your employer does not see your report and does not hear from us that you reported anything, unless you want that or the law or a court requires it of us. We talk with every employer at set times about the agreement that nobody is disadvantaged, even if nobody reported anything. Do you want us to talk with your employer about your situation, or do you want to withdraw your report or have it erased? Then e-mail us at privacy@workerjoy.nl with your report code, preferably from a private e-mail address. You do not have to give your name. We only talk with your employer about your situation once you have approved the words and the moment. Note: anyone who knows your report code can ask us the same. So do not keep it on a company phone.

A report counts when we decide whether to continue with an employer. We cannot promise that it stops: whoever treats you worse can often guess who a report comes from. That is why we say nothing about your situation without you, unless the law or a court requires it of us. Is it about dismissal, your pay, threats or your driving hours? Then do not wait for us, but get free advice from the Juridisch Loket (legal aid desk), or from your union if you are a member.

Before an employer starts, we put in writing with that employer the agreement that it disadvantages nobody. It applies until twelve months after the collaboration ends, and also to you if you take part: if you ask your employer or us in writing, for example by e-mail, for your employer to keep to it, you can then demand that yourself too. If you ask us, we only give your name to your employer if you want us to.

No decisions by software

Joy is software: a language model reads your messages and writes her answers. She makes no decisions about you, and nothing Joy knows about you goes to your employer, except what you have passed on yourself or what a court or the law requires of us. Decisions made by software alone that have legal effects or a similarly significant effect on you, as Article 22 of the GDPR means them, we do not make. Software does three things by itself. Summary: from your conversation, so Joy knows you next time; only Joy uses it, and it has no consequences for your work. Mark for danger: the language model judges whether a conversation is about danger; if so, Joy tells you to call 112. Nobody reads it just because of the mark; when someone at WorkerJoy does read it is under “When someone at WorkerJoy reads a conversation back”. Message after a low score: if you let Joy keep your answers and a score was two or lower, she sends you one message herself, at most once every 28 days, with no score in it; your employer does not see it. Besides that, the language model watches for a few things in every message, so Joy can respond well: whether you tell her something about your health, or say she may remember all or none of it (see “Your health”); whether you ask for a conversation to be checked (then she marks your conversations and tells you so); whether there is something you could pass on (then she shows you a text); whether your employer’s company doctor, if there is one, could help you (then she offers the doctor); whether somebody is in danger right now; and what you want to be called. None of these judgements goes to your employer or has consequences for your work. Software never sends a report or a request to the company doctor by itself: a report goes only once you have read the text and say JA, a request to the company doctor only once you send your phone number or e-mail address yourself. With OPNIEUW you erase the summary and what Joy knows about you; after your next conversation she makes a new summary again. You stop the message after a low score by unticking the box on the questionnaire, or with STOP. You can stop all three with VERGEET MIJ; what that erases and what not is under “Having your data erased”. About groups software does something too: it makes themes from open answers, decides by a fixed rule from what drivers chose about their week what is going on per team, and makes action cards from the group figures and themes in the dashboard. Those never come from your conversations with Joy. They are about groups, although in a small group a theme can sometimes point to someone; your employer may never use them to decide about one driver. If ‘not good’ was chosen most often on what is going on in a team, a language model writes an action card about it from what the card’s readers already see: the topic and the direction, the month it began, the team’s scores that belong to it, earlier cards about it and a theme on the same topic if there is one. Besides that it gets our own list of measures and whether the card is for a team or for the whole company; never a driver’s words, a count or a name.

Back to contents

Drivers

What you can send yourself

Send the word as a separate message, with no other words, and in capitals as below. STOP, JOY UIT and VERGEET MIJ also work in small letters, so stopping always works. After JOY UIT, VERGEET MIJ and OPNIEUW we first ask whether you are sure. This is Joy has the words in your language; the Dutch words work too. In English they are JOY OFF, FORGET ME, START OVER, NEW NUMBER and LANGUAGE. Where this page says JA or NEE, send the word Joy names in her question, in the language of your conversation: in English, YES or NO. For a report, for remembering something about your health and for letting Joy keep your answers, only that word counts.

STOP

No more questionnaires, and Joy no longer starts a conversation herself. You can still write to her yourself afterwards.

START

You get the questions again. If you sent VERGEET MIJ before, first sign up again with the QR code on the poster.

JOY UIT

After a JA you take back your yes to Joy: we erase your conversations with Joy and everything she knows about you, and she reads nothing you send any more. The questionnaire and your number stay. If you write to her again later, she first asks again whether she may read what you write.

VERGEET MIJ

After a JA we erase your conversations, what Joy knows about you and your number, and you get no more questionnaires. If you want to take part again after that, sign up again with the QR code on the poster. What stays is under Erasing.

OPNIEUW

After a JA, Joy forgets what she knew about you, including your name, what she remembered about your health and your kept answers. Your conversations and the questionnaire stay, and so does what you agreed to before: if the tick box is still on, she keeps your next answers again.

NIEUW NUMMER

Send it from your old phone, and the code you get within a day from your new one. What Joy knows about you and the questionnaire come along. Your conversations on the old number do not: they stay until their term ends. You erase the chat on your old phone yourself.

TAAL

Choose your language from the list you get.

Back to contents

Employers

For whoever works with the dashboard

This part is for everyone at an employer who works with the dashboard, such as HR, planners, depot managers and team leaders. Your employer gives you access and chooses your role: Administrator, HR analyst, Depot manager or Viewer. We invite the first administrator, with the details your employer gave us. Your employer is responsible for your account; WorkerJoy processes it on your employer's instructions. If you want to see, correct or erase the data in your account, ask your employer; if you e-mail us, we help your employer with it.

• Account: name, e-mail address, language, role, which teams you see, when you last signed in and which cards on the action board you picked up. We use them to let you sign in, to decide what you may see and to show on the action board who picked up a card. We keep your name and e-mail address until your employer removes you from the dashboard, or until we erase your employer’s data after it has stopped working with WorkerJoy; the action board until that last moment (see “How long we keep things”). Under My account you choose whether we e-mail you when something is ready for you. Such an e-mail only says that something is ready, how much and where: no scores and no names of teams or people.
• Signing in works with a link by e-mail. We keep the IP address of the request until thirty days after the link is used or expires, so that in case of misuse or a taken-over account we can check afterwards from which address a sign-in link was requested.
• Log: who signed in when, and who gave or took away someone's access or role, with an internal number instead of your e-mail address. It is there so that it can be checked afterwards who gave, withdrew or used access. The dashboard and our admin screen cannot erase or change anything in it.
• Looking along and administration: sometimes someone at WorkerJoy helps your employer by looking along in your account, at most half an hour at a time and without being able to change anything. In our admin screen we also see your name, e-mail address, role and when you signed in, and at your employer's request we manage your access there: inviting you, changing your role, blocking or removing you. We record who at WorkerJoy did what, in which account and when. You do not see that in the dashboard; if you want to know, ask us.
• If your employer removes you from the dashboard, “Deleted user” will appear where your name was, for example on a card on the action board. We erase your e-mail address. We keep an unreadable code of it, so we recognise you if you are invited again later. Want that code gone too? E-mail us. If you still have access at another employer, your account stays there.
• What WorkerJoy counts itself: per day how many drivers, teams and users your employer has, and how many invitations we sent and how many of them failed; how often users signed in and how many action cards they picked up in the last thirty days; and per week how often the screens are opened. WorkerJoy itself is responsible for this, not your employer. We store no names with it and keep the figures for two years. Only people at WorkerJoy with an account for our admin screen see these figures; at present that is only the two founders. If anyone else gets such an account, we tell your employer beforehand. If your employer has one user, those figures show how that person uses the dashboard. We do this on the basis of legitimate interest: improving the product and supporting your employer. You can object by e-mail. From then on we no longer count you in your employer's sign-ins and usage; what we counted before stays, without a name.

If a driver mentions you

A driver can talk or write about you: to Joy, in an open answer or in a report through Joy. That also applies if you do not work with the dashboard yourself, for example as a planner or manager.

• To Joy: your employer cannot see that in the dashboard and may not read it. The language model does read it, including your name if it is in it. The message usually stays in the conversation for 30 days. Someone at WorkerJoy reads it if the driver asks for the conversation to be checked or to see what we keep, or if the driver says JA to it being read back after a mark for danger. Beyond that, only two people at WorkerJoy can currently access our database, and so also that message. In what Joy remembers, she writes down no names but a role, such as “the planner” or “the director”; that is a rule for the language model, and it can make mistakes. What a driver says about somebody else’s health we do not keep: the language model points it out and we take it out of the kept conversation, and if that cannot be done with certainty, we do not keep that message at all. A summary or report that still contains it is refused by a separate check. The language model does read the message once, to answer.
• In an open answer: before the language model reads it, we take out the names of people on the list of drivers and in the dashboard, if they are written with a capital letter. Another name can stay in, such as a name without a capital letter or of someone on neither list. Text that looks like it is about someone's health, yours included, we do not keep, and no language model reads it; we recognise it by its words, so not always. Your employer sees no open answers, only short themes; in a theme the language model is not allowed to quote or to mention anyone's health. After fourteen days the text is gone.
• In a report through Joy: if Joy mentions someone in it, she writes a role, not a name. That is a rule for the language model, and it can make mistakes. The driver reads the text before it is passed on. We keep a report for at most twelve months; a report about being disadvantaged only goes to WorkerJoy.

A role can also point to you, for example if there is only one director.

Want to know what is stored about you? For what belongs to the measurement, such as your account, the open answers and what is in the dashboard, your employer is responsible: ask there, and we help your employer. For what WorkerJoy itself keeps, such as what a driver said to Joy or reported to us, e-mail us; only you, or someone you authorise to do so, can ask that about you. We look at each request separately. As a rule we do not open a conversation with Joy for it; if we say no, we tell you why. You do not get from us which driver said something or a driver's literal words, and what a driver said to Joy or reported to us, we do not give to your employer. We only do so if the driver wants that, or if the law or a court obliges us.

Are you a company doctor?

We get your name, e-mail address and possibly phone number from the employer that gave us your details, so that drivers can reach you. If a driver talks to Joy about their own health and nobody is in danger, Joy can give your details to that driver in WhatsApp. If a driver asks for contact, we e-mail you that driver's number or e-mail address and the name of the employer; we do not send along what the driver said to Joy. Your details stay until your employer removes them in the dashboard, or until we erase your employer's data after it has stopped working with WorkerJoy; see “How long we keep things”.

Back to contents

Visitors

Website, pilot and contact

We show no ads, sell no data and do not measure your visit with cookies from Google, Microsoft or anyone else. On the questionnaire, the pages for drivers and the dashboard we do count ourselves, without a cookie, how often they are opened and how often a questionnaire is handed in: only as a number per week or per month, without a name, IP address or time. See “What WorkerJoy counts itself”. If we ever do measure with cookies, it will only be after your yes in a cookie notice, and we will change this statement first.

• Typeface: on the website and in the dashboard we rent a typeface from Fontstand BV in The Hague. Your browser fetches it from Fontstand on every page, through Amazon CloudFront. Amazon records your IP address, your browser, the website and the time in a log. That log is kept by Amazon in the US (Virginia) and erased within a day; Fontstand only takes the number of page views for the licence from it and keeps nothing itself. That transfer to the US falls under the EU-US Data Privacy Framework. Fontstand is responsible for that counting itself. That your browser fetches the typeface on our pages is our doing; for that we are responsible together with Fontstand, on the basis of our legitimate interest in showing the site in our own typeface. Fontstand offers no arrangement between us about this; with questions you can go to Fontstand and to us. The questionnaire, the “What is this?” page and this privacy statement fetch nothing from Fontstand; the “This is Joy” page does.
• Server log: for every page you open, our hosting records your IP address, the time, your browser and the address of the page, so that we can investigate faults and abuse. We keep that for at most thirty days. For now that is the website; once the questionnaire and the dashboard are in use, those too, and with a personal link, such as the link to your questionnaire, that link is then in it as well. That log is kept at Brainpod, our hosting. We have asked Brainpod whether it is deleted there after at most thirty days as well; we do not have the answer yet. Bunny, through which the traffic to our site passes, can also keep a log of your visit. Whether Bunny does, and for how long, we do not know yet. As soon as we know, we will put it here.
• Pilot and documents: if you request a pilot or our documents, your name, job title, company, work e-mail, possibly phone, the number of drivers and any question you ask reach us as an e-mail, only to get in touch or send the documents. After a pilot request you get a short confirmation at the e-mail address you gave, containing nothing you typed. We keep that e-mail until at most twelve months after the last contact; if a pilot follows, it belongs to that pilot’s records. To limit abuse, we count for an hour how many requests come from the same address, under a code your IP address cannot be read from. After the introductory meeting, a separate form asks for the details for the pilot agreement: the company details, the name, job title and e-mail address of whoever signs and of the contact person, possibly the contact person's phone, and the name and e-mail address of whoever will administer the dashboard. That too only reaches us as an e-mail. We sign the agreement through Youtrust in France; Youtrust records who signs, with name, e-mail address and IP address, and keeps that proof itself for ten years. We only use a quote from someone at a pilot partner if that person and the pilot partner approved, by e-mail, the literal text, the name, the job title and where it appears; approval can be withdrawn by e-mail. We only use a company’s name and logo with that company’s separate consent: a box in the form for the pilot agreement that is not ticked in advance and that can be left empty without changing anything about the pilot, or later by e-mail. Any consent can be withdrawn by e-mail; within five working days we then stop new use and take it off our website.
• Cookies and storage in your browser: only what is needed for what you do yourself. If you send a form, a security cookie against abuse, which disappears when you close your browser, and a session cookie of at most thirty days that shows your confirmation once. If you fill in the sample questionnaire, your browser keeps your answers until you send them or close the tab, so they are not lost if the page reloads. We use no other cookies or storage; that is why there is no cookie notice. Once the dashboard and the questionnaire are in use, this is added: after you sign in to the dashboard, a session cookie of at most thirty days, and on the questionnaire the same storage of your answers.
• Social media: we have a page on Facebook and on Instagram. At the bottom of the site are ordinary links to them; only when you click do you go to Meta. If you view such a page, Meta records that and we get statistics about it: totals, without names. If you follow us or respond, we do see your name. Meta and WorkerJoy are jointly responsible for those statistics. Meta arranges most of it, including your rights, but you can also come to us.

Back to contents

For everyone

Who we share data with

For a few things we call in other companies. Most of them work only for what we ask, under a data processing agreement. Fontstand also uses data for itself, and Youtrust itself keeps the proof of a signature for ten years.

Where is your data? Our database will be at Brainpod in the Netherlands. There is no database yet: the website runs without one. The language model runs in the EU. What can end up outside the EU is in the last column of the table. For drivers that is: a WhatsApp message, for at most an hour while it is being delivered; your number in Meta's contact list; e-mail between you and us, and e-mail we send to the company doctor for you; and your IP address when you open This is Joy, because of the typeface. For Bunny, through which all traffic to our site passes, drivers’ too, it has not yet been established whether any of it ends up outside the EU, nor, if it does, whether that happens as described below.

A few of these companies are American. If data leaves the EU, it goes to a company that falls under the EU-US Data Privacy Framework, or it is covered by the standard contractual clauses approved by the European Commission. You can get a copy of those clauses on request: e-mail privacy@workerjoy.nl. For the typeface, Fontstand confirmed to us in October 2026 that the transfer falls under the EU-US Data Privacy Framework; Fontstand’s own privacy statement dates from 2018 and still names the Privacy Shield.

Your employer only gets group figures, themes, what is going on per team and action cards, and what you pass on yourself; the company doctor only what you pass on. If your employer switches, data from the measurement can go to the new provider (see “If your employer switches”). We only give more, or give to anyone other than those named above, if the law or a court obliges us, for example to the government.

Back to contents

For everyone

How long we keep things

Most terms are enforced by a job that runs every night and erases what is past its term. A few things we erase by hand, such as the list of drivers and the action board after the collaboration ends, and a few are kept by another company on its own term, such as Google, Microsoft and Youtrust.

Each term starts at the moment the table names; where it names none, from when the data arises. Afterwards we erase it, or make it irreversibly anonymous. If a conversation with Joy falls under more than one row, the longest term applies. If you send VERGEET MIJ and confirm with JA, we erase at once your conversations with Joy on this number, what she remembers about you, health included, your kept answers, your JAs to Joy and your number, even where a row above is longer; what we cannot erase is under “Having your data erased”. E-mail you send us we keep as the table says. Erased data stays in backups for up to thirty days, which we use for nothing else.

Back to contents

For everyone

How we protect your data

Each employer can only access its own data. The dashboard cannot read conversations with Joy, nor drivers' phone numbers or dates of birth. That is arranged in the database itself.

Only two people at WorkerJoy can currently access our database. Your employer only reaches its own data through the dashboard, and can never get into our database directly.

If something does go wrong, we report it as the law requires. If it concerns Joy, your sign-up in WhatsApp or something else WorkerJoy itself is responsible for, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), unless it is unlikely to pose a risk to you, and to you if the risk to you is high. If it concerns the measurement, we report it to your employer within 24 hours of discovering it. Your employer then decides whether it is reported to the Autoriteit Persoonsgegevens and to you, and we help with that.

Back to contents

For everyone

The legal reason: the legal basis

The GDPR asks for a legal reason for every use of data: the legal basis. Below, per part: who is responsible, what for, which data and on what basis.

• The measurement (the list of drivers, the invitations, your answers, the figures, themes, action cards and what is going on per team in the dashboard, the reports drivers had Joy pass on to their employer, from their yes onwards, and the accounts of people who work with the dashboard). Your employer decides the purpose and the legal basis and is the controller; WorkerJoy processes the data as processor, under your employer’s written instructions. Which basis fits is for your employer to assess. We have proposed legitimate interest to your employer (Article 6(1)(f) GDPR): seeing in time where work gets heavy and doing something about it, as part of the care for healthy work the Dutch Working Conditions Act asks. Passing a report on to your employer rests on your own JA to that report (consent, Article 6(1)(a) and, if it is about health, Article 9(2)(a) GDPR). What your employer then does with the report, it does on a basis of its own, and only to solve the problem. The accounts in the dashboard have a purpose of their own: signing in, deciding who sees which teams, recording who gave access and keeping that access secure. For that too, we have proposed legitimate interest to your employer. Your employer has to justify which basis it chooses and why, and tell you in the information you get from your employer.
• Your sign-up in WhatsApp. WorkerJoy is responsible. Data: your number, when you signed up, whether the phone is yours, your language choice, STOP and a new number; what the list of drivers says about your language, whether you are employed and whose phone you use; and if you leave your job with your own phone, an unreadable code of your number for two years, with your former employer and your language. Purpose: sending you messages and receiving yours on the number you gave us yourself, knowing which language Joy writes to you in if you did not choose one yourself, and knowing whether Joy stays on your number when you leave your job. Basis: legitimate interest of WorkerJoy, because without it we cannot offer you the questionnaire and Joy. With STOP you get no more questionnaires and Joy no longer starts a conversation herself; your number does stay with us. If you also want your number gone, send VERGEET MIJ.
• The conversation with Joy. WorkerJoy is responsible. Data: what you write to Joy and what she answers, also if you tell her something about your health. Purpose: talking with you. Basis: your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR): the JA Joy asks for at your first message. That JA covers four things, and the question names all four: that the language model reads your messages to answer, also to see whether a conversation is about danger; that we keep your messages for 30 days; that after a conversation the language model makes a short summary, which Joy remembers until you have not talked to her for two years, also if you later take part with the same number at another employer; and that Joy remembers for four weeks that a conversation was about danger, to ask you once whether someone at WorkerJoy may read it back. For the summary we ask the language model to leave your health out, unless you agreed to it separately; if it still ends up in it, that falls under this JA. A separate yes is needed for: Joy remembering something about your health for longer, your kept answers, passing something on, and reading back after a mark. For the company doctor, your yes is sending Joy your phone number or e-mail address yourself. A conversation is only checked if you ask Joy for that yourself and then say JA to her fixed question. You can withdraw your first JA at any time, with JOY UIT (Article 7(3) GDPR). We then erase your conversations with Joy and everything she remembers about you, because without that JA there is no ground left to keep them (Article 17(1)(b) GDPR); the questionnaire and your number stay. VERGEET MIJ also erases your number and sets a STOP; what we then erase and what we cannot erase is under “Having your data erased”.
• What Joy remembers about you (a short summary and the name you gave her). WorkerJoy is responsible. Purpose: that Joy still knows you next time, also if you sign up with the same number at another employer that uses WorkerJoy. Basis: your first JA (above), because the summary can contain something about your health. She deliberately remembers something about your health only after your separate JA (Article 9(2)(a) GDPR). With OPNIEUW you ask us to erase what Joy knows about you; your JA stays, so after a next conversation she does make a summary again. If you want her to remember nothing about you and read nothing any more, send JOY UIT; VERGEET MIJ also erases your number (see “Having your data erased”).
• What WorkerJoy counts itself. WorkerJoy is responsible, even though the figures come from the measurement. Data: the counts listed under “What WorkerJoy counts itself” for the questionnaire and for the dashboard: the pilot figures (signing up, STOP, Joy, teams and links, per employer and per team, and per team also the scores and the work topics chosen), the daily counts per employer, the dashboard usage and the totals for all employers together. Purpose: steering a pilot in time, supporting your employer, improving the service and learning from all pilots together. Basis: legitimate interest of WorkerJoy; we have recorded why it is necessary and why your interests do not prevail. Safeguards: no name or phone number, and a team only with the pilot figures per team, with a score only for a measurement in which every team of the employer handed in at least 5 and has at least 7 drivers; for an employer with one team the employer’s figure is also the team’s; with fewer than 5 links not how many were used, and no total under ten; currently only the two founders see the figures; we give them to no one, not to your employer either. We calculate the pilot figures when we look, except per team the number on the list, the sign-ups and the work topics chosen, which we keep for thirteen weeks; the rest we keep for two years. You can object by e-mail. If you are a driver, we mark your phone number. From that moment you are no longer counted in the pilot figures, the invitations per day or the questionnaire totals, at every employer that knows that number. Per team you do stay in the scores and the work topics chosen: an answer and a choice carry no name, number or link, so we cannot take them out, and the score is the one on your employer’s dashboard. Of a measurement in which you got a link, we show no counts and no score per team, for no team of your employer, and no work topics of that month. Your employer’s dashboard does show your team’s score, once the measurement has closed, and our total per employer does not count you: whoever of us puts the two side by side can sometimes see whether you handed in. As long as you get links, the figures per team do not show which team you are in. Once you get no more links, your links are no longer counted per team while your sign-up stays until the number on the list falls, and whoever of us puts the figures from before and after side by side can see which team you are in, as after a STOP. A link you already had is counted as it was sent: a used link can no longer be linked to you, and taking it out later would show whether you had used it. What we counted and kept before stays, without a name. You are still counted in the number of drivers on your employer’s list, because that list is your employer’s. If you work with the dashboard, from then on we no longer count you in sign-ins and usage; what we counted before stays, without a name.
• Our own affairs: the pilot agreement with your company on the basis of a contract (Article 6(1)(b)); a pilot request, a request for our documents and the details of whoever signs for a company, keeps in touch or is going to manage the dashboard on the basis of our legitimate interest in agreeing and running a pilot with that company (point (f)); our bookkeeping on the basis of a legal obligation (point (c)), and the management and security of our platform, the server log and loading Fontstand’s typeface on the basis of legitimate interest. We count ourselves, without a cookie, how often our explanation for drivers is read; that is described above, under “What WorkerJoy counts itself”. We only use a quote from someone at a pilot partner, with their name and job title, if that person and the pilot partner have approved by e-mail the literal text, the name and job title and where it appears; if either of them withdraws that approval, we stop using it.

Do you have to take part? No. Signing up, filling in and writing to Joy are allowed, but not required. Not taking part must not have any consequences for your work: your employer promises us not to disadvantage anyone for it. Your employer does put you on the list of drivers; that is not your choice. Your sign-up is the yes WhatsApp asks for to send you messages, not consent in the sense of privacy law. The question whether Joy may remember your answers, which you get after signing up, is not part of that: it is a separate JA, and saying NEE changes nothing about taking part.

Back to contents

For everyone

Your rights

You may see your data, have it corrected or erased, restrict its use, object, take your data with you and withdraw a yes; what we did with your yes before you withdrew it remains valid. It costs nothing. We can erase what we keep. We cannot erase what is already with someone else, such as messages at Meta or what you had passed on to the company doctor. A report you had passed on to your employer is no longer linked to you, so VERGEET MIJ does not find it; tell us which one it is, and it can be corrected or erased. We erase a report about being disadvantaged if you e-mail us your report code. What remains after VERGEET MIJ is under “Having your data erased”.

• Joy, your sign-up in WhatsApp and what WorkerJoy does itself: e-mail privacy@workerjoy.nl.
• The measurement belongs to your employer. Through HR you can see what your employer put about you on the list of drivers, such as your name, team, language, your status and whose phone you use; ask HR for a correction too, and we help your employer with that. HR cannot read back your date of birth, because it is only kept as an unreadable code; HR can enter it again. If you e-mail us about the measurement, we tell you that your employer is responsible and how to reach them, we find out what there is about you, and within five working days we let your employer know that there is a request, what kind and which deadline applies, without your name or anything else that points to you, unless you say that is fine. Your answers to the questionnaire have no name from the moment you send them, and the night after, we erase the link with your invitation. If you ask us before that night, we search with that link and keep what we find until we have answered you; after that the link still goes. After that night, until the next questionnaire goes out, it still shows that you answered and on which day; you get that too. If after that you can give us something yourself with which your own answers can be found beyond doubt, and it does not also point to someone else's answers, we use it; otherwise we explain to you why it is not possible.
• Straight away in WhatsApp: STOP, START, OPNIEUW, TAAL, NIEUW NUMMER, JOY UIT and VERGEET MIJ. This is how you withdraw a yes: for Joy remembering your answers, untick the box on your next questionnaire; for Joy remembering everything about your health, tell Joy; for a single topic about your health, send OPNIEUW, which makes Joy forget everything she knows about you; and for your JA to Joy reading your messages or reading back a conversation about danger, send JOY UIT. A report or your details for the company doctor have already been passed on after your yes; what is still possible then is described above.

If you are a driver and e-mail us, we e-mail you back a sentence. You send it from your own number to Joy, so we know for sure the number is yours. If you no longer have that number, we check your name, date of birth and employer against the list of drivers. Only if we then still have a concrete reason to doubt, we ask for something more, and never a copy of your ID. If you e-mail us about a report about being disadvantaged, your report code is enough. You get an answer within one month, usually sooner. If your request is complicated or we get many at once, it may take two months longer; we will then tell you within that first month, with the reason.

Back to contents

For everyone

Having your data erased

Send VERGEET MIJ in WhatsApp and confirm with JA. We then erase your conversations with Joy on this number, including those at a previous employer, everything Joy knows about you and your number.

• Send VERGEET MIJ (in English: FORGET ME), or the same in your own language.
• You get asked whether you are sure.
• Send JA as your next message, within a day.

If you let Joy remember your answers, we erase her copy too. After that we set a STOP, so you get no more questionnaires. If you want to take part again later, sign up again with the QR code on the poster; START alone is then not enough. Only want to be rid of what Joy has of you, and keep the questionnaire? Then send JOY UIT (see What you can send yourself).

What remains

• Your answers to the questionnaire: VERGEET MIJ does not erase them, because they belong to your employer’s measurement. They have no name, and the night after you answer we erase the link with your invitation; from the night after the next questionnaire goes out, nothing records which answers are yours. And your place on the list of drivers, which belongs to your employer.
• A report you had already passed on to your employer: it is no longer linked to you, but if you tell us which one it is, it can still be erased. A request to the company doctor that you had already passed on: that is with the company doctor. A report about being disadvantaged stays for at most twelve months; if you e-mail us your report code, we erase it. Your STOP, as an unreadable code of your number, so that you get no more questionnaires. If you objected to what WorkerJoy counts itself, that stays too, as the same code, so that we do not start counting you again. And who at WorkerJoy opened a conversation of yours and when; we keep that for two years.
• Conversations on an earlier number: from before you sent NIEUW NUMMER, or on a number we had already disconnected from Joy, such as a company phone you handed in. They are then no longer linked to what Joy knows about you, and are removed at the end of their own term (see “How long we keep things”).
• At Meta: messages for up to thirty days, and your number in the contact list. In backups: copies, for at most thirty days.
• The chat on your phone: you erase that yourself.

Back to contents

For everyone

A complaint

Not satisfied? E-mail us: privacy@workerjoy.nl. You can always complain, even without e-mailing us first, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or to the supervisory authority in the EU country where you live or work, or where you think it went wrong.

Back to contents

For everyone

Changes and version

Version 1.0.3, 29 October 2026. What is in use now: the website, the forms for a pilot, for our documents and for the details of a pilot agreement, signing through Youtrust, and our WhatsApp number, which does not answer messages yet. We do not yet use the questionnaire (the sample questionnaire included), Joy or the dashboard with real drivers or employers. What this statement says about them describes how they will work, and we only start with them once that is how they work.

If anything changes, a new date will appear here. Before we use data we are responsible for ourselves for a new purpose, we say so: here, and to drivers also on the questionnaire or in WhatsApp. For the measurement, that decision is your employer’s, not ours.

Back to contents