Skip to content

Privacy policy | GV connect

Last updated: 28/09/26

This Privacy Policy explains how GOOD VIBES SARL (“GOOD VIBES”, “we”, “us” or “our”) collects, uses, stores and protects personal data processed through its mobile application and related services.

GOOD VIBES is committed to processing personal data in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”), as well as applicable Luxembourg data protection laws and regulations.

1. Data Controller

The data controller responsible for the processing of personal data relating to users of the Application is:

GOOD VIBES SARL
49, boulevard Royal
L-2449 Luxembourg
good@vibes.lu

Where GOOD VIBES processes personal data on behalf of its clients, including in connection with lead-collection terminals, promotional competitions or surveys, the respective roles of GOOD VIBES and the relevant client are described in Section 8 below.

2. Personal Data We Collect

Depending on how you use the Application and our services, we may collect the following categories of personal data.

Identification and Contact Information

We may collect:

  • first and last name;
  • email address;
  • telephone number;
  • profile photograph;
  • information necessary to create and manage your account.

Assignment and Mission Information

We may process information relating to assignments or missions to which you are assigned, invited or applying, including:

  • assignments and missions;
  • dates and working hours;
  • mission locations;
  • participation status;
  • information relating to required clothing or uniforms;
  • information necessary to organise and monitor the mission.

Check-In Data and Precise Location

When the check-in functionality is used, the Application may access your precise geographical location at the time of your check-in and check-out.

This precise location data is used to verify that the check-in or check-out takes place at the location designated for the relevant mission and to validate your presence at that mission.

GOOD VIBES does not use this functionality to continuously track your location. Precise location data is collected only when required for the check-in or check-out process.

Photographs and Documents

The Application may allow the collection and storage of:

  • photographs taken during check-in or check-out;
  • photographs and documents relating to mission reports;
  • photographs collected as part of surveys or operations carried out for our clients.

Such data is used only for purposes connected with the relevant mission, verification of its completion, reporting or the relevant operation.

Audio Recordings

For certain appointments, meetings or presentations conducted using an iPad, an audio recording may be made where this functionality has been specifically enabled for the relevant operation.

Participants will be informed in advance that an audio recording is being made and about the purpose of the recording.

Where consent is the applicable legal basis, the recording will only be made after the required consent has been obtained.

Communications and Surveys

The Application may also process:

  • messages exchanged through the internal chat;
  • responses to post-mission surveys;
  • responses and information provided through other questionnaires or forms available through the Application.

Technical Data

In order to operate, secure and maintain the Application, we may process:

  • a technical device identifier required for push notifications;
  • technical information necessary for authentication and operation of the Application;
  • technical information necessary to diagnose errors and incidents.

Administrative Data

For users with administrative privileges, certain information may be stored in an encrypted secure vault, where necessary for administration, security or management of the service.

3. Purposes of Processing

We may process personal data for the following purposes:

  • creating and managing user accounts;
  • enabling users to view, accept and perform missions;
  • organising missions and managing schedules;
  • verifying attendance and check-ins/check-outs;
  • verifying the location associated with a check-in or check-out;
  • managing mission reports and supporting documentation;
  • communicating with users;
  • sending notifications relating to missions and the operation of the Application;
  • conducting and managing surveys;
  • carrying out commercial and promotional operations on behalf of our clients;
  • ensuring the security of the Application and preventing fraudulent or abusive use;
  • maintaining, troubleshooting and improving the Application;
  • complying with legal and regulatory obligations;
  • handling complaints, data subject requests and potential disputes;
  • establishing, exercising or defending legal claims.

4. Legal Bases for Processing

In accordance with Article 6 of the GDPR, GOOD VIBES processes personal data on the appropriate legal basis applicable to each processing activity.

Performance of a Contract

Where processing is necessary for the performance of an employment contract, mission agreement or other contractual relationship with the user, this may include:

  • managing assignments and missions;
  • managing working hours;
  • organising the mission;
  • processing check-ins and check-outs;
  • validating attendance;
  • communicating information necessary for the performance of the mission.

Legitimate Interests

GOOD VIBES may also process personal data where this is necessary for its legitimate interests, including:

  • maintaining the security of the Application;
  • preventing and detecting fraud, abuse or misuse;
  • ensuring the security and proper execution of missions;
  • administering and improving our services;
  • ensuring the traceability and proper operation of our activities;
  • establishing, exercising or defending legal claims.

Where GOOD VIBES relies on legitimate interests, we ensure that such interests are balanced against the rights and freedoms of the individuals concerned.

Consent

Where consent is required under applicable law, GOOD VIBES will obtain consent before carrying out the relevant processing.

This may notably apply to audio recordings of appointments, meetings or presentations.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Location Data

The check-in functionality may require access to the precise location of your device.

This data is collected at the time of check-in or check-out in order to verify that the user is physically present at the location designated for the mission.

Precise location data is not collected continuously for the purpose of tracking the user’s movements.

Use of this functionality may require location services to be enabled on your device and the relevant permission to be granted through your device’s operating system.

6. Data Retention

GOOD VIBES retains personal data for no longer than is necessary for the purposes for which it is processed, subject to applicable legal retention obligations and the need to retain certain information for the establishment, exercise or defence of legal claims.

In particular:

  • data required to manage a mission is retained for the period necessary to organise, perform, verify and administer the mission;
  • check-in and check-out data is retained for the period necessary to verify and monitor the relevant mission and thereafter in accordance with applicable legal or evidentiary requirements;
  • photographs, reports and mission documents are retained for the period necessary to process and administer the relevant operation;
  • internal chat messages are retained for the period necessary to operate the service and manage the relevant missions, subject to applicable legal requirements;
  • audio recordings are retained only for the period strictly necessary to fulfil the purpose for which they were recorded and are subsequently deleted or anonymised;
  • data collected through lead-collection terminals, promotional competitions and surveys on behalf of our clients is retained for a maximum period of 24 months, unless a longer retention period is required by law or a different period is lawfully instructed by the relevant controller;
  • technical data required for notifications and operation of the Application is retained for as long as necessary for those purposes.

Users with “New” Status

Where an individual has registered on the Application with the status “New” and has never been engaged or assigned to a mission, their personal data will be automatically deleted after the applicable retention period has expired, in accordance with GOOD VIBES’ data deletion procedures.

Data may nevertheless be retained for a longer period where required by law or where necessary for the establishment, exercise or defence of legal claims.

7. Service Providers and Recipients

GOOD VIBES may use technical service providers acting on its behalf to operate and maintain the Application.

These providers may include:

Google Firebase

GOOD VIBES uses Google Firebase for certain technical functionalities of the Application, including authentication/login, notifications and gateway functions required for the operation of the service.

Stream

Stream is used to provide the internal chat functionality and facilitate communications between users through the Application.

Airtable

Airtable may be used to store and manage certain data necessary for the operational functioning of our services.

GOOD VIBES Server Infrastructure

GOOD VIBES also operates its own server infrastructure located in Luxembourg for certain Application functions and data processing activities.

Service providers used by GOOD VIBES may only process personal data in accordance with applicable instructions, contractual arrangements and the purposes for which their services are provided, subject to any obligations directly applicable to those providers.

GOOD VIBES takes appropriate measures when selecting service providers and, where required by the GDPR, enters into appropriate data processing agreements.

Google Analytics is not used by the Application, subject to confirmation of the technical architecture actually deployed.

8. Personal Data Collected from Third Parties: Leads, Promotional Competitions and Surveys

As part of certain commercial, promotional or marketing operations organised for its clients, GOOD VIBES may provide or operate functionalities that collect personal data from participants, including through:

  • lead-collection terminals;
  • promotional competitions;
  • surveys;
  • questionnaires and forms.

In these circumstances, the client on whose behalf the personal data is collected determines the purposes and essential means of the processing and acts as the data controller, while GOOD VIBES acts, as applicable, as a data processor within the meaning of Article 28 of the GDPR.

GOOD VIBES processes such personal data in accordance with the documented instructions of the relevant client and the applicable contractual arrangements.

Personal data collected in this context is retained for a maximum period of 24 months, unless a different retention period is required by law or lawfully specified by the relevant controller.

Exercise of Data Subject Rights

Participants may exercise their rights:

  • directly with the client identified in the information notice or form provided at the time of collection; or
  • with GOOD VIBES where GOOD VIBES is identified as the relevant contact point for the operation.

Where GOOD VIBES receives a request relating to processing for which its client is the controller, GOOD VIBES will assist with or forward the request to the relevant controller in accordance with the GDPR and the applicable contractual instructions.

The identity of the controller and the specific information relating to the relevant processing will be provided to participants at the time of collection where required by the GDPR.

9. Your Rights

Subject to the conditions and limitations provided by the GDPR, you have the following rights:

  • Right of access: to obtain confirmation as to whether your personal data is being processed and to receive a copy of such data;
  • Right to rectification: to request the correction of inaccurate or incomplete personal data;
  • Right to erasure: to request the deletion of your personal data where the legal requirements for deletion are met;
  • Right to restriction of processing: to request that processing be restricted in the circumstances provided by the GDPR;
  • Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, to request its transmission to another controller;
  • Right to object: to object to certain processing activities based on legitimate interests, including on grounds relating to your particular situation;
  • Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.

These rights may be subject to limitations where GOOD VIBES is legally required to retain certain information or where another exception under the GDPR applies.

To exercise your rights, please contact GOOD VIBES at:

good@vibes.lu

Where necessary to protect personal data against unauthorised disclosure, we may request additional information to verify the identity of the person making the request.

10. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a competent supervisory authority.

In Luxembourg, the competent supervisory authority is:

Commission nationale pour la protection des données (CNPD)

You may consult the CNPD’s official website for the current procedures and information regarding the submission of a complaint.

This right is without prejudice to any other administrative or judicial remedy available to you.

11. Data Security

GOOD VIBES implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Depending on the nature of the data and the risks involved, these measures may include access controls, authentication mechanisms, encryption, secure storage and other appropriate security measures.

Access to personal data is restricted to individuals and service providers who require such access for legitimate business or operational purposes.

12. International Data Transfers

Where certain technical service providers may process personal data outside the European Economic Area (“EEA”), GOOD VIBES will ensure that such transfers are based on an appropriate mechanism recognised under the GDPR, such as an adequacy decision or appropriate safeguards provided for by the GDPR.

Further information concerning applicable international transfers and safeguards may be obtained from GOOD VIBES upon request.

13. Changes to this Privacy Policy

GOOD VIBES may update this Privacy Policy from time to time to reflect changes to its services, processing activities, applicable legislation or guidance issued by competent supervisory authorities.

The most recent version will be published on this page and will indicate its date of last update.

We recommend that users review this Privacy Policy periodically to remain informed about how their personal data is processed.

Last updated: 28/09/26