Privacy Policy

Last updated: 1 August 2026

1. Introduction

Blackbear B.V. (“Blackbear”, “we”) operates a platform that brings together Clients (organisations with a project) and Contractors (independent specialists). Blackbear acts as intermediary, handles the financial settlement in its own name and is not a party to the performance of the project itself. In this Privacy Policy we explain which personal data we process, why, and what rights you have. It applies to everyone who uses our Platform and our Website (together: the “Services”).

Capitalised terms, such as Client, Contractor, Project, SOW, Milestone, Workspace and User, have the same meaning as in the Blackbear contract documents applicable to you.

2. Who we are and how to reach us

Blackbear B.V. is established at NDSM-Straat 23, 1033 NA Amsterdam, and registered in the trade register under number 72489669.

You can reach us via [email protected] or +31 (0)85 060 08 75. We have appointed a Privacy Manager as the point of contact for questions and complaints about personal data; this is not a data protection officer within the meaning of the GDPR. Our Privacy Manager is Stefan Hoogenboom, who can be reached via [email protected].

3. Our role under the GDPR

We are the controller for the platform data, that is to say the data we process to make the Platform work, such as accounts, profiles, matching, the financial settlement and security.

For the content submitted or exchanged within a Project, such as documents uploaded by the Client and Deliverables submitted by the Contractor, the Client is the controller. Blackbear processes that content on behalf of the Client as processor. Our Data Processing Agreement applies to this. It forms part of the Terms and Conditions for Clients, so that the Client accepts it without a separate signature being required. The Contractor’s position in relation to this content is governed by the Terms and Conditions for Contractors.

4. Which data we process

Depending on your role, we process:

  • Contact and profile data: name, email address, telephone number, job title, organisation, and for Contractors also a profile photo, professional links and skills.

  • Account and usage data: login credentials, your Workspace and rights, and data about your use of the Platform, including technical data such as your IP address.

  • Project and transaction data: the Initiatives, SOWs and Projects in which you are involved, approved Milestones, logged hours, expense claims, and invoicing and payment data.

  • Tax and verification data of Contractors: VAT number, Chamber of Commerce registration, IBAN, and the data we process on the basis of our statutory obligations (see section 5).

  • Data of website visitors: we automatically record your IP address, browser data and the pages visited.

If you submit personal data of others, for example of colleagues in a Project, you are yourself the controller for this (see section 3).

If you respond to a vacancy for a position at Blackbear itself, so not to a Project via the Platform, we process the data you provide with your application. If you take part in user research, we process the data you provide in that context; participation is voluntary and we do not make recordings without your prior consent.

We do not process special categories of personal data, such as data concerning health or biometric data.

5. Purposes and legal bases

We process your personal data solely on a valid legal basis under the GDPR:

  • Performance of a contract: creating and managing your account, bringing Clients and Contractors together, the AI-supported scoping, generating agreements and invoices, the financial settlement and communication via the Platform.

  • Legal obligation: reporting to the Dutch Tax and Customs Administration on the basis of the DAC7 Directive, and retaining financial and contractual data for tax and administrative purposes. For the DAC7 reporting, we verify the identity of Contractors and process, among other things, the citizen service number or another tax identification number.

  • Legitimate interest: the security and improvement of the Platform, the prevention of fraud, and bringing our services to the attention of existing Clients and Contractors. You can object to this (see section 8).

  • Consent: marketing to persons who are not yet a Client or Contractor, user research, and non-necessary cookies. You can withdraw your consent at any time.

We do not take decisions that significantly affect you, based solely on automated processing.

6. Use of AI

We use AI to help Clients convert an Initiative into a structured SOW. The outcome remains a draft until the Client confirms it. The scoping can also be done without AI, with a Blackbear employee; the choice is up to the Client. We do not use AI to select, assess or track Contractors.

The technical processing takes place via an external AI service provider that is established outside the European Economic Area. The safeguards set out in section 7 apply to that transfer. The data supplied are not retained by that service provider and not used to train its AI models. If the Client submits personal data of others in its input, it remains the controller for this (see section 3).

7. Recipients and transfers

We share personal data only when necessary, with the following categories of recipients: service providers we engage to provide the Platform (including hosting, contract handling, email, analytics, AI support and customer support), banks and payment service providers for the payouts, providers of login services, government authorities where the law requires it, and our professional advisers. In the event of a merger or acquisition, data may be transferred to the party involved.

Some of these service providers process data outside the European Economic Area. For that transfer we apply appropriate safeguards, namely the EU-US Data Privacy Framework and standard contractual clauses approved by the European Commission. An up-to-date overview of our sub-processors is available on request via our Privacy Manager.

We do not sell your personal data and do not share it with third parties for their own marketing purposes.

8. Retention and your rights

We do not retain your personal data longer than necessary for the purposes set out in section 5. We retain financial, contractual and tax data for at least seven years on the basis of our statutory retention obligations; other data no longer than necessary, after which we delete it or render it untraceable.

You can delete your account yourself at any time. Deletion is final. If you have never received a payout, we delete your data in full. If you have received payments, we delete your identifying profile data but retain your payment and tax data for as long as our statutory retention obligation applies; during that period those data remain traceable to you. For a User of a Client, the name remains visible with the Projects in which the User was involved.

You have the right to access, rectification, erasure, restriction and portability of your personal data, and the right to object to processing based on a legitimate interest or to direct marketing. Where we rely on your consent, you can withdraw it. You can exercise these rights via our Privacy Manager. We may ask you to confirm your identity and respond within the statutory period of one month. If your request concerns the content of a Project, the Client or the Contractor is the controller for this and we refer you to them.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Security

We take appropriate technical and organisational measures to protect your personal data, including access management, encryption and confidentiality by everyone who processes data on our behalf. If you suspect misuse or a security problem, please contact our Privacy Manager.

10. Other information

Our Services are aimed at business use within the European Economic Area and not at persons under the age of 16. Our Website and our Platform may contain links to third-party websites; we are not responsible for their privacy practices. We have procedures to detect personal data breaches and, where required, to report them to the supervisory authority and to you.

11. Changes

We may adjust this Privacy Policy from time to time. The current version is always available on our Website. In the case of far-reaching changes, we inform you, for example by email or via a notification on the Platform.


COOKIE POLICY

This Cookie policy belongs to the Privacy Policy and explains which cookies we use on our Website (blackbear.global) and in our Platform, and how you manage your preferences.

12. Cookies and your choice

Cookies are small files placed on your device during a visit. We also use similar techniques, such as local storage; where we write “cookies”, we also mean those techniques. We distinguish four types:

  • Necessary cookies make the Website and the Platform work and secure them. You cannot disable these.

  • Functional cookies support preferences, such as your language choice.

  • Analytical cookies help us understand and improve usage.

  • Advertising cookies measure and tailor advertisements.

We place necessary cookies without consent, on the basis of our legitimate interest in a functioning and secure environment. We place all other cookies only after you have given consent for this via our cookie banner; until that moment they are blocked. The cookie banner runs on the Website and in the Platform. You can adjust or withdraw your choice at any time via the banner, and delete cookies via your browser settings.

Some of these cookies are placed by third parties, who may process data outside the European Economic Area. The safeguards set out in section 7 apply to this.

13. Which cookies we place

On our website


Necessary

These cookies are needed to make the Website work. We do not ask for consent for these.

BLACKBEAR-WEBSITE-SESSION
Provider: Blackbear
Purpose: keeps the website session active
Retention period: 10 hours

XSRF-TOKEN
Provider: Blackbear
Purpose: protection against forged requests
Retention period: 10 hours

__cf_bm
Provider: Cloudflare
Purpose: bot and abuse detection
Retention period: 1 hour

cookietest
Provider: Blackbear
Purpose: checks whether your browser accepts cookies
Retention period: session


Functional

These cookies remember your preferences and support features from third parties.

lidc
Provider: LinkedIn
Purpose: supports the operation of LinkedIn features
Retention period: 1 day

li_gc
Provider: LinkedIn
Purpose: remembers your cookie preference at LinkedIn
Retention period: 6 months


Analytical

These cookies let us measure how the Website is used.

ga and ga*
Provider: Google Analytics
Purpose: website statistics and visitor numbers
Retention period: 13 months

hstc, hubspotutk, hssrc, __hssc
Provider: HubSpot
Purpose: recognises visitors and measures website visits
Retention period: session up to 6 months

ph_phc_…_posthog
Provider: PostHog
Purpose: analyses the use of the Website
Retention period: 1 year


Advertising

These cookies let us measure and target our advertisements.

gclau
Provider: Google
Purpose: measures the effectiveness of advertisements
Retention period: 3 months

bcookie
Provider: LinkedIn
Purpose: advertising targeting via LinkedIn
Retention period: 1 year

_fbp
Provider: Meta
Purpose: advertising targeting via Meta (Facebook)
Retention period: 3 months


In our platform


Necessary

Session cookie
Provider: Blackbear
Purpose: keeps your logged-in session active
Retention period: duration of the session

XSRF-TOKEN
Provider: Blackbear
Purpose: protection against forged requests
Retention period: 10 hours

remember-me
Provider: Blackbear
Purpose: keeps you logged in
Retention period: until you log out

__cf_bm
Provider: Cloudflare
Purpose: bot and abuse detection
Retention period: 1 hour


Functional

bb_locale
Provider: Blackbear
Purpose: remembers your language preference
Retention period: local storage

sow_*
Provider: Blackbear
Purpose: temporarily stores your work on a SOW
Retention period: session and local storage


Analytical (after consent)

ph_phc_…_posthog
Provider: PostHog
Purpose: product analytics and debugging
Retention period: 1 year


We use the analytical cookie in the Platform for product analytics and screen recordings for debugging, whereby completed form fields are masked. If you use the chat function in the Platform, HubSpot may place the HubSpot cookies mentioned above.


14. Changes to this Cookie policy

We may adjust this Cookie policy when the cookies we use change. The current version is always available on our Website and in our Platform.