When you search for or book a tradesperson through Zoofy, or join Zoofy as a tradesperson, we process personal data to provide our services. This statement describes how we process the data of consumers, affiliated tradespeople and their contact persons, and visitors to and users of the associated website, apps and services. Section 2 concerns consumers making bookings; section 3 concerns tradespeople. The other sections apply to both groups insofar as the processing concerned applies to them.
Zoofy BV (‘Zoofy’, ‘we’, ‘us’), Wibautstraat 137 H, 1097 DN Amsterdam, is the controller responsible for the processing described in this statement.
If you have any questions, comments or suggestions about this information, or wish to contact us about the processing of your personal data, you can reach us using the following details:
Zoofy BV, Wibautstraat 137 H, 1097 DN Amsterdam, email: [email protected]
Using our website may result in the processing of personal data. For data protection purposes, ‘personal data’ means any information relating to an identified or identifiable person. The IP address assigned by an internet service provider to an internet-connected device may also constitute personal data.
When you use our website, we collect information that you enter or provide yourself. During your visit, we also automatically collect certain information about your use of the site. We process personal data in accordance with the relevant data protection rules, in particular the General Data Protection Regulation (GDPR).
We retain personal data for no longer than necessary for the purpose for which we process it. A retention period of seven years generally applies to the legally required records of booked and/or invoiced jobs. This covers financial data and the associated customer, booking and job details necessary for those records. The period starts in accordance with the applicable tax rules; any different statutory retention period takes precedence. We may also retain a limited job file for up to seven years after closure for payment queries, complaints, warranty claims and legal claims. We retain only the data necessary for those purposes, on the basis of our legitimate interests and after weighing your privacy interests. In doing so, we consider the nature of the job, outstanding obligations and applicable warranty and limitation periods. We delete unnecessary data sooner. Relevant data may be needed for longer in an ongoing matter.
For other data, we determine the retention period according to its purpose and necessity. For requests and customer service conversations, we consider their completion and any outstanding follow-up questions; for customer profiles, active use, the duration of inactivity and termination; and for security and fraud prevention data, the time needed to investigate indications of problems, assess specific risks of recurrence and handle incidents. We retain reviews for as long as they remain current and relevant to quality monitoring and informing customers.
We use newsletter data until you unsubscribe or withdraw your consent, or until its use is no longer justified because of prolonged inactivity. To demonstrate consent and respect unsubscribe requests, we retain only the minimum necessary record for as long as needed for those purposes. Retaining data for administrative or evidential purposes does not provide a separate right to use it for marketing.
We periodically assess whether data is still needed and delete or anonymise it as soon as it is no longer necessary. This also applies to connected systems and processors. Data in routine backups is removed in accordance with the established overwrite cycle, remains unavailable for routine use until then, and is checked again against deletion requests if restored.
We may engage technical service providers for hosting, maintenance, development, storage, backups and administration. Only insofar as they process personal data on our behalf do they act as processors, and we document the required arrangements on instructions, confidentiality, security, any subprocessors and deletion. We limit access to what is necessary.
We process data relevant to the purposes described below. Mandatory contact, address and job details are needed to handle your request and have the job carried out. Without that data, we cannot provide the relevant service, or cannot provide it properly. You do not have to provide optional information. Do not include unnecessary personal data or sensitive information in free-text fields, photographs or attachments.
Data: name, email address, telephone number, job address, selected job, description, preferred time, request and booking times, confirmations and job status. We also process photographs, attachments and additional instructions insofar as you provide them and they are needed for the job.
Purposes: handling your request, finding a tradesperson, confirming an appointment, supporting the work and communicating with you about the job.
Legal basis: performance of our contract with you or taking steps at your request before entering into a contract. For invoicing and payment processing, we process necessary invoice and transaction data, including amounts, payment status and payment references and, insofar as actually received, bank account details. The legal basis is performance of the contract; mandatory record-keeping is based on a legal obligation. We do not ask for online banking login details.
To allow your request to be assessed, we may show limited data, such as the town or postcode, the type of job and the preferred time, to eligible tradespeople. We limit descriptions and attachments to what is necessary for that purpose. Only after acceptance do we release your name, full job address, telephone number and other necessary contact details to the tradesperson carrying out the job. Necessary data may also be provided to a tradesperson engaged for remedial work or mediation.
This is necessary to handle your request and provide our services. The tradesperson processes the data needed to carry out their own work and maintain their records under their own responsibility. Do not include unnecessary contact details in the description or attachments before acceptance.
We use your email address and the necessary job details to send you a review invitation. Our legitimate interest is to monitor and improve the quality of our services and network. You may object to these invitations.
If you post a review, we process its content and the author details indicated when posting for publication and quality monitoring. We limit the data visible to the public. Publication serves our legitimate interest in showing customers relevant experiences; you may object. For promotional reuse outside this review context in which you can be identified, we request separate consent, which you may withdraw. Posting a review or accepting our terms does not constitute general consent to such advertising use.
You can create and use a customer account through our website and the Zoofy customer app for iOS and Android, including before booking a job. We process the registration and profile data you provide, such as your email address and, where requested or entered, your name, telephone number and address details. We also process your account identifier and the data needed for the login and verification method you use.
We use this data to create your account, provide access, manage your profile and offer the account features you use. If you book using this account, we link the relevant bookings and associated status and invoice data to your account so you can view them. For the account service you request from us, we process the necessary data to perform our contract with you.
For the technical operation and security of the website and app, we process the necessary technical data, such as session, device and browser or app information and access logs. The purposes and legal bases for security are set out in section 4.b. Additional app features that use other data are explained before that processing begins; where necessary, we request separate consent.
You may ask us to correct your account data or delete your account. The retention periods and criteria in section 1.c and your rights in section 7 also apply to accounts on the website and in the customer app. Simply deleting the app from your phone does not delete your Zoofy account. Data that must necessarily be retained for administrative purposes or a legal claim is retained solely for that purpose.
For newsletters, we use your email address and the necessary subscription and consent records. We send newsletters on the basis of your consent. You can unsubscribe using the unsubscribe option in the newsletter or our privacy contact channel. Once you unsubscribe, we no longer use the data for this purpose.
We record only the data needed to register and substantiate your choice, such as its time, source and content. Not every consent record requires a full IP address to be stored as standard.
Insofar as we measure opening or clicking behaviour that can be linked to you, we provide information about this and obtain prior consent where required for the technology or processing used. Pseudonymised data remains personal data. For statistics, we use aggregated or anonymised information wherever possible. Consent to marketing is not a condition for booking a job. Necessary booking, payment and security messages serve a different purpose from advertising.
When you join, we process your business name, name, business contact and address details, Chamber of Commerce (KvK) number, VAT number, liability insurance policy number, bank account details, business activities and service area. We use this data for registration, account management, job communications, invoicing and payouts. For a tradesperson who is personally a party to the contract, the legal basis is performance of that contract, insofar as the processing is necessary for that purpose. We process data about employees or contact persons of an affiliated business on the basis of our legitimate interest in managing that business relationship, after weighing their privacy interests.
For identification during onboarding, we ask for a valid identity document. We use it to verify that the identity provided matches the person registering. Our legitimate interest is to prevent identity fraud and ensure reliable onboarding of tradespeople. We assess whether temporarily storing a copy is necessary for that purpose and whether identification can take place using less data or without storage. We retain any identity document or temporary copy received for no longer than necessary for this check and for a maximum of thirty days after receipt. We delete it sooner once the check is complete and the copy is no longer needed. After that, we retain only the minimum necessary record of the identity check, such as the check date and outcome, for as long as needed to demonstrate that the check took place.
We do not process the citizen service number (BSN) on an identity document without specific statutory authorisation and therefore mask it, including where it appears in a document code. Other data unnecessary for the check, including the photograph on a retained copy insofar as it is not lawfully needed, is also masked. Inspection for identification and retention of a copy are assessed separately.
We also request your liability insurance policy number and, where necessary, relevant insurance certificates, references and professional qualification documents to assess your application and suitability. Our interest is to maintain a reliable and suitable network of tradespeople. We limit the data to what is needed for that check and, wherever possible, retain only the outcome. For a Certificate of Conduct (VOG) or any criminal offence data, we first assess the additional legal requirements; accepting the tradesperson terms does not constitute general consent for this. Mandatory and optional fields and the consequences of not providing necessary data are explained when the data is requested.
We use relevant profile data to present your services to customers. On your public profile, we limit this to the necessary name or business details, trades, service area and relevant reviews. A profile photograph is optional; you can have it removed. We do not publish bank details, tax identifiers or screening documents on a public profile. When you manage your profile, we inform you about the visibility of individual fields.
After acceptance, we share your business name, name and telephone number with the customer concerned for contact about the job. Other data is shared only insofar as necessary for the job, invoicing or a legal obligation. The legal basis is performance of our contract with you insofar as necessary for that purpose; for data about other contact persons, we assess our legitimate interest in organising the job.
We process specialisms, service area and data about jobs offered, accepted and completed. We link relevant reviews, complaints and cancellations to your profile for quality monitoring and complaint handling. For necessary job matching, we use performance of the contract as the legal basis. For quality monitoring, fraud prevention and the protection of customers and tradespeople, we assess our legitimate interests, necessity and your privacy interests.
If scores or activity data affect the jobs offered, access to services or measures taken, we inform you about the data used, the main factors and the consequences. You can have inaccurate data corrected and request a substantive reassessment. Solely automated decisions that produce legal effects or similarly significant effects require a separate legal assessment and appropriate safeguards, including human intervention where required.
We process the information you provide through jobs, status updates and contact with Zoofy to deliver and support our services. A service area or a notification that you are on your way is not the same as your current GPS location. Any additional app analytics, technical data or precise location processing is specifically explained before that processing begins. Where consent is required, we request it separately. The general description does not constitute consent to continuous location tracking.
We process bank, invoice, transaction and payout data for administration and payment processing. We share only necessary data with the payment service provider concerned and administrative service providers. For services such as accelerated payouts, we explain any additional data processing and selection. The legal basis is performance of the contract or an applicable legal obligation; for checks and dispute handling, we assess our legitimate interests where necessary.
Section 5 on recipients and section 6 on transfers also apply to tradesperson data insofar as the services mentioned are actually used for tradespeople. This may include access by IT developers and maintenance providers. Each party’s role is determined for each processing activity, and access is limited to what is necessary.
We retain basic tax records for seven years insofar as the statutory retention obligation applies, with the applicable start date and any different statutory period. This concerns only the invoice, transaction, payout and identifying administrative data necessary for that purpose. It is not a seven-year retention period for the entire tradesperson account, all screening documents, location data or communications.
We retain the operational account for as long as necessary for the affiliation and its winding up. We then delete or anonymise data that is no longer needed. For complaints, disputes and investigations, we retain only the relevant limited file for as long as demonstrably necessary. The shorter period in section 3.a applies to an identity document or temporary copy received during onboarding: a maximum of thirty days after receipt, with earlier deletion once the check is complete and the copy is no longer needed. This period takes precedence over the general backup period in section 1.c. For other screening documents, we assess whether retention remains necessary after the check. For profile and review data, we periodically assess whether it remains current and necessary; after termination, we also assess whether public visibility remains justified. The maximum periods for individual customer service conversations, routine security logs and backups in section 1.c also apply to comparable tradesperson data, unless a specific legal obligation or demonstrable necessity for an ongoing matter requires otherwise.
We distinguish necessary messages about jobs, payments and security from advertising. Commercial messages are subject to the applicable rules for each channel and, where required, separate consent. You may unsubscribe and object to direct marketing. Accepting the tradesperson terms does not constitute general consent to marketing. For privacy questions and requests, use the contact details in section 1.a; the rights in section 7 and security provisions in section 8 also apply to you.
If you contact us, we process your contact details, the content of your message, necessary job details and any attachments to handle your question. For questions about your booking, this is necessary to provide our services. For general questions, we rely on our legitimate interest in being available and providing assistance.
Our customer service team may use AI chat. In doing so, we process the chat content and the context necessary for your question to provide an answer or refer the question to a member of staff. AI answers may be incorrect or incomplete; you can request human follow-up. Do not provide unnecessary sensitive data. Insofar as an external provider processes data on our behalf in this context, the processor arrangements and access restrictions below apply. Using chat content for a separate training purpose does not automatically fall within answering your question; a separate adequate purpose and appropriate legal basis must first be established, and you must be informed.
We use necessary booking, job performance and payment data and relevant communications, complaints and reviews to prevent abuse and fraud, investigate indications of these and take appropriate measures. This allows us to protect customers and tradespeople, limit payment risks and promote reliable payment and proper completion of jobs.
We assess indications carefully; a complaint or overdue payment does not in itself mean that fraud has occurred. For technical security, we may also process log data, such as IP address, time, page or function accessed, device/browser information, error messages and access or administrative actions. We use this data to prevent, investigate and resolve unauthorised access, abuse, malfunctions and security incidents.
We base this processing on our legitimate interests and those of customers and tradespeople in a secure and reliable platform. We assess in advance whether the processing is necessary, whether the same purpose can be achieved with less data and whether your privacy interests override those interests. Insofar as a statutory security obligation applies, we also process data to comply with it. We limit data and access to what is needed. The retention periods and criteria for determining them are set out in section 1.c.
We use certain parties that process personal data to support our services. These parties act as processors within the meaning of the GDPR and process the data only on our instructions, not for their own purposes. We use the following processors:
To send newsletters, we use MailChimp, a service provided by The Rocket Science Group, LLC, 675 Ponce de, Leon Avenue NE, Suite 5000, Atlanta, GA 30308, USA. MailChimp works with us as a data processor, is strictly bound by instructions and is contractually required to ensure adequate technical and organisational data protection measures that comply with European privacy legislation. Mailchimp EU Data Transfer Policy Mailchimp Security
To host our website, we use hosting provider Transip, Schipholweg 9B
2316 XB Leiden, Chamber of Commerce (KvK) number: 24345899 (Leiden). Transip is strictly bound by instructions and is contractually required to ensure adequate technical and organisational data protection measures. You can read more about how they handle your privacy here.
We use third-party content and services on our website. This integration technically requires the IP address to be processed so that the content can be sent to your browser. Your IP address is therefore passed on to the respective external providers. In each case, these data processing activities serve to protect our legitimate interests in optimising and economically operating our website.
The Java programming language is regularly used to integrate content. You can stop data processing through JavaScript execution by disabling it in your browser or installing a JavaScript blocker. Please note that this may limit the website’s functionality.
To display maps, we use “Google Maps” from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google is certified under the Privacy Shield agreement, which guarantees compliance with European privacy legislation.
To display videos, we use the service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”). As a subsidiary of Google, YouTube is covered by Google’s Privacy Shield certification.
Under the GDPR, you have the right to:
Ask us to correct or update your data;
Ask us to remove your data from our records or restrict its processing;
Ask us for access to all personal data we have processed about you, including a copy. At your request, we can also forward this copy to another data controller;
Withdraw your consent to the processing of your data where the processing is based on consent. This does not affect the lawfulness of processing before you withdraw your consent;
Object to our processing of your data where it is based on our legitimate interests. You may also object to the use of your data for direct marketing;
Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe that we are processing your data unlawfully.
We take the protection of your data seriously and implement appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration. Among other things, we have taken the following measures:
We have established internal rules on the use of personal computers, external hard drives, email, telephones and chat programs, etc.
Every Zoofy employee is required to protect their user ID and the actions carried out under it.
Computers are not left unattended and are protected by passwords that meet minimum complexity requirements. Passwords must not be shared with third parties.
If you nevertheless believe that your data is not properly secured, or if there are indications of misuse, please contact us at [email protected].
Last updated: 26 November 2025