Version 2026 — Last updated: 7 July 2026
Privacy Policy — Website
This Privacy Policy is offered by:
Ivy Consulting BV, trading as Ivy Relations (hereafter “IVY”, “we” and “us”)
Brasschaatselei 9, 2950 Kapellen, Belgium
Enterprise number 0727.541.867
hermes@ivyrelations.com | +32 3 446 00 86
1. Introduction
IVY provides discreet, personalised matchmaking services and, in doing so, processes personal data that is often sensitive and highly personal.
For full transparency about how our service works: IVY’s matchmaking services are commissioned and paid for by IVY’s clients (“Clients”). For a specific Client, IVY creates a dedicated application website through which interested persons (“Applicants”) can apply to be considered for an introduction to that Client. As an Applicant, you do not enter into a service agreement with IVY and you do not purchase any service. Your participation is entirely voluntary and free of charge, and you may end it at any time. Your personal data is processed in order to assess and, with your agreement, realise an introduction to the Client concerned.
This Privacy Policy (“Policy”) explains how we collect, use, store, share and protect the personal data of Applicants in that context. It is an information document within the meaning of Article 13 of the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”). It does not in itself create contractual obligations for the Applicant; any confidentiality commitments expected of Applicants are set out in a separate Participation Declaration.
IVY complies with the GDPR and with applicable Belgian privacy legislation.
2. When this Policy applies
This Policy applies whenever IVY acts as a data controller in relation to Applicants, meaning that IVY determines the purposes and means of the processing of their personal data. “Applicant” means any natural person who applies, through a dedicated application website created by IVY for a specific Client, to be considered for an introduction to that Client. This Policy also applies when you submit an enquiry to IVY or subscribe to IVY’s newsletter via the Website, whether or not you subsequently apply.
IVY’s services are exclusively intended for adults. Participation is only possible for persons who are at least 18 years of age and have full legal capacity. IVY does not knowingly process personal data of minors in the context of its matchmaking services.
3. Which personal data we process and where it comes from
Categories of personal data
Depending on your interaction with IVY, we may process the following categories of personal data:
- Identification and contact details: name, address, email address, telephone number, date of birth;
- Profile information: photographs, profile descriptions, relationship preferences, interests, personality characteristics and the profile presentation drafted for you and approved by you;
- Interview and assessment information: notes taken during intake conversations and compatibility assessments;
- Communications: correspondence between you and IVY;
- Technical data: when you use the application website, IP address, browser and device information, log data and cookies (see the Cookie Policy);
- Any other information you voluntarily provide in the course of your application or participation.
Special categories of personal data
In the context of matchmaking, you may choose to share information relating to your sexual orientation, religious or philosophical beliefs, ethnic origin or health (“special category personal data” within the meaning of Article 9 GDPR).
IVY only processes special category personal data on the basis of your explicit consent (Art. 9(2)(a) GDPR), which is requested separately. The mere fact that you provide such information does not in itself constitute consent. If you do not give this consent, you can still participate in the service; IVY will then simply not take these elements into account in the compatibility assessment.
You may withdraw this consent at any time; the special category data concerned will then be erased, unless retention is required for the establishment, exercise or defence of legal claims.
Sources of personal data
IVY collects your personal data directly from you: through the application form you submit on the application website, the intake conversation and your communications with us.
The provision of your personal data is neither a statutory nor a contractual requirement. Without certain basic information (identity, contact details, profile information), however, your application cannot, or can only partially, be taken into consideration.
4. Purposes, legal bases and retention periods
IVY processes personal data only where a lawful basis applies under the GDPR. The table below summarises, per processing activity, the purposes, the categories of data processed, the applicable legal basis and the standard retention period.
| Activity and Purpose | Data Categories | Legal Basis | Retention |
|---|
| Application and intake: receiving and reviewing your application, conducting intake conversations and communicating with you | Identification and contact details, application form content, communications, interview notes | Performance of the Participation Declaration (Art. 6(1)(b) GDPR) | Duration of participation; if no introduction takes place, max. 12 months after the decision |
| Compatibility assessment for the specific Client: assessing compatibility with the Client for whom the application website was created and drafting the profile presentation | Profile description, photographs, relationship preferences, interests, personality characteristics, approved profile presentation | Performance of the Participation Declaration (Art. 6(1)(b) GDPR); explicit consent for special category data (Art. 9(2)(a) GDPR) | Duration of participation |
| Introduction to the Client: sharing the approved profile presentation with the specific Client | Given name, brief personality description, profile picture, approved profile presentation | Performance of the Participation Declaration (Art. 6(1)(b) GDPR); no sharing without your agreement to the specific introduction | Duration of participation |
| Future introductions (optional): retaining your profile so that IVY may consider you for introductions to other Clients | Profile information and approved profile presentation | Consent (Art. 6(1)(a) GDPR) | Max. 24 months, or until consent is withdrawn |
| Operation and security of the application website: ensuring the website functions properly and securely | IP address, browser and device data, access and security logs, cookies (see Cookie Policy) | Legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR); consent for non-essential cookies (Art. 6(1)(a) GDPR) | Logs: 30–180 days; cookies: see Cookie Policy |
| Enquiries: responding to questions and requests submitted via the Website or by email | Identification and contact details, content of your enquiry | Legitimate interest in responding to enquiries addressed to IVY (Art. 6(1)(f) GDPR) | 12 months after the last contact |
| Newsletter: sending IVY’s newsletter to subscribers | Name and email address | Consent (Art. 6(1)(a) GDPR); each newsletter contains an unsubscribe link | Until you unsubscribe |
| Service improvement: evaluating and improving the quality of the matchmaking process | Aggregated or pseudonymised feedback and process information | Legitimate interest in improving services (Art. 6(1)(f) GDPR) | 24 months |
| Marketing, PR and testimonials: any use of personal data or images beyond the operation of the service | Name, photographs, testimonial content | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Legal position: establishing, exercising or defending legal claims | Data relevant to the claim concerned | Legitimate interest in defending IVY’s legal position (Art. 6(1)(f) GDPR) | Duration of the applicable limitation period |
Where IVY relies on its legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to that processing on grounds relating to your particular situation (see Section 10).
5. Compatibility assessment and profiling
Matchmaking involves a form of profiling: IVY analyses the information you provide in order to assess compatibility between you and the Client for whom the application website was created. All assessments and introduction proposals are prepared and decided by IVY’s consultants; IVY does not make decisions based solely on automated processing within the meaning of Article 22 GDPR.
6. Who receives your personal data?
IVY does not sell personal data. Personal data is shared only with the following (categories of) recipients:
Internal use
Within IVY, personal data is accessed only by authorised personnel who need it to perform their duties. Access is granted on a need-to-know basis and all staff are bound by strict confidentiality obligations.
The Client
The purpose of your application is a possible introduction to the specific Client for whom the application website was created. Only after you have approved the profile presentation and agreed to the proposed introduction may the following information be shared with the Client:
- your given name;
- a brief personality description;
- your profile picture;
- the approved profile presentation.
Your profile is not shared with any other client of IVY without a separate consent.
Clients who receive profile information are bound by confidentiality obligations towards IVY. To the extent a Client subsequently processes your data for their own purposes (for example after a successful introduction), the Client acts as a separate controller and is itself responsible for that processing. If you withdraw from the process or request erasure or rectification, IVY will communicate this to the Client who received your profile, unless this proves impossible or involves disproportionate effort; upon request, IVY will inform you of the recipients concerned.
Service providers acting as processors
IVY relies on external service providers who process personal data on IVY’s behalf and instructions, in the following categories: development and hosting of the application website; IT, hosting and email services; CRM / candidate administration software; photography or profile-presentation support, where applicable; and accounting and administrative support.
Legal obligations and legitimate disclosures
In limited circumstances, IVY may be required to disclose personal data to public authorities, regulators, courts or external legal or accounting advisers where necessary to comply with a legal obligation or to establish, exercise or defend legal claims. Such disclosures are limited to the minimum necessary.
7. International data transfers
IVY strives to store and process personal data within the European Economic Area (EEA). Some service providers (for example email, cloud or CRM providers) may nevertheless process certain data outside the EEA. Where that is the case, IVY ensures that at least one of the following safeguards is in place:
- the destination country benefits from an adequacy decision of the European Commission (including, for the United States, certification under the EU–U.S. Data Privacy Framework);
- the European Commission’s Standard Contractual Clauses have been concluded, supported by appropriate technical and organisational measures;
- another valid transfer mechanism under Chapter V GDPR applies.
You may obtain further information on the safeguards applied, or a copy thereof, by contacting hermes@ivyrelations.com.
8. How long we store your data
IVY retains personal data only for as long as necessary for the purposes described in this Policy. The retention periods per processing activity are set out in the table in Section 4. Where a dispute exists or is reasonably anticipated, the relevant data may be retained for the duration of the applicable limitation period, strictly limited to what is necessary for that purpose. After expiry of the applicable retention period, personal data is securely erased or irreversibly anonymised.
9. How IVY protects your personal data
Given the sensitive nature of the data processed, IVY applies appropriate technical and organisational measures (Art. 32 GDPR) to protect personal data against loss, misuse, unauthorised access, disclosure or destruction. These measures are aligned with the nature of the data and the risks involved, and are reviewed periodically. IVY requires its service providers to apply equivalent safeguards.
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, IVY will inform you without undue delay and will notify the Belgian Data Protection Authority where required (Art. 33–34 GDPR).
10. Your rights and how to exercise them
Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:
- Right of access: to obtain confirmation as to whether IVY processes your personal data and to receive a copy of it;
- Right to rectification: to have inaccurate or incomplete data corrected;
- Right to erasure: to request deletion of your data in the circumstances provided by law (for example where the data is no longer necessary or where you withdraw consent and no other legal basis applies);
- Right to restriction: to request that processing be restricted in certain cases;
- Right to object: to object, on grounds relating to your particular situation, to processing based on legitimate interests (website security and service improvement);
- Right to object to direct marketing: to object at any time and unconditionally to the use of your data for direct marketing;
- Right to data portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or contract and carried out by automated means;
- Right to withdraw consent: where processing is based on consent, to withdraw it at any time, as easily as it was given, without affecting the lawfulness of prior processing.
You may exercise these rights, or ask any question about this Policy, by contacting IVY at hermes@ivyrelations.com or at Brasschaatselei 9, 2950 Kapellen, Belgium. IVY may request proof of identity where necessary to verify your identity, and will respond within the statutory period of one month (extendable by two months for complex or numerous requests, in which case you will be informed).
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat / Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be, or with the supervisory authority of your habitual residence.
11. Changes to this policy
IVY may update this Policy from time to time. The most recent version, with its “Last updated” date, is available on this page and on request.
This Policy is governed by Belgian law. This choice of law does not affect the protection afforded to you by mandatory provisions of the law of your habitual residence, nor your right under Article 79 GDPR to bring proceedings before the courts of the Member State of your habitual residence.
Back