Privacy Policy - October 2024

This page is a translation of the original Dutch version, which is binding.

For temporary workers, seconded workers and candidates

Duuw Scale-Up People B.V. values your privacy and is committed to collecting and processing your personal data in a lawful, accurate and transparent manner and to handling it in a secure and confidential manner. In this privacy statement we explain what personal data we process from you, on what basis we process it and why we process it. It also explains your rights regarding your personal data and informs you about the security measures we take to protect your personal data.

1. Who are we and who to contact in case of questions?

Your data are processed by Duuw Scale-Up People B.V, hereinafter referred to as Duuw.

This company is responsible for the processing of your personal data and declare that as Data Controller they comply with national privacy laws, as well as the provisions of the General Data Protection Regulation as of its entry into force.

If you have additional questions and/or would like more information, you can always contact us at the email address info@duuw.nl.

2. What is personal data?

The General Data Protection Regulation defines a personal data as follows:

Any information about an identified or identifiable natural person; an identifiable natural person is considered to be one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characterizing the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

When this Privacy Policy refers to personal data, it refers to this definition from the Regulation.

Sometimes special categories of personal data are also processed. Processing special categories of personal data means:

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying an individual, or data concerning health, or data relating to an individual's sexual behavior or sexual orientation.

3. What personal data do we collect?

We collect and process various personal data from candidates and temporary / seconded employees. These include the following personal data:

1. Your application file (candidates): name, first name, gender, language for the desired communication, address, e-mail address, telephone number, mobile number, Skype address and public data such as Linkedin address, information regarding your diploma, education and work experience, as well as your Curriculum Vitae, motivation letters, photo, video, test results, language knowledge, notes and evaluations made during the job interview and information after you have taken a reference check or that you provide us with in the context of a job application procedure.
2. Payroll information (temporary and seconded employees): ID documents, bsn number, seniority, marital status, date and place of birth, family composition, number of children, salary and bank account number.
3. Employment file (temporary and seconded workers): salary and wage slips, social documents, evaluations and other legal data.

4. Why do we collect your personal data and with what legal basis do we process it?

Your personal data are always collected and processed in the context of:

1. Your employment as a temporary employee or seconded consultant for the purposes of our payroll administration and with the legal basis of executing a contract, as well as for tax and social purposes.
2. A job application process for the purpose of exchanging your data with potentially interested employers and with the legal basis being our legitimate interest and/or your express consent.
3. Offering you suitable job opportunities, as well as other relevant information about our new products and services, such as job events or newsletters. This information may be sent to you through various communication channels with the legal basis being your explicit consent.
4. Offering education and training through various communication channels with your explicit consent as the legal basis.

Photos's and video's may be collected and processed for the purpose of using them for internal communications and training, as well as for publication on pages's of Duuw on social media, with the legal basis your express consent.

A criminal record extract may also be requested if the position for which you are applying is included in the list for which it is required by law. For this we invoke a legal legal basis.

A. Your Consent

Via the Privacy Statement, which you received by email and signed when you registered online or during the job interview, you have given express consent to process the personal data under point 3A for the purpose of going through the application process and searching for a suitable vacancy. By this we mean:

• Informing or sending you vacancies via various communication channels that match your profile and interest.
• Sending you other relevant information that might interest you, such as job postings and other events or newsletters via various communication channels.
• Sending your CV (including passport photo if applicable), evaluations and test results to one or more potentially interested employers.
• Taking a reference check with previous employers.
• Using photos's and video for internal communication and training purposes, as well as for publication on pages's of Duuw on social media.

B. Your Employment Agreement and Employment

• For the preparation and execution of your employment contract with Duuw as a temporary or seconded employee, Duuw will process the data mentioned in 3B and possibly transmit it to its financialële administration.
• The data in the employment contract will be processed by Duuw.
• The data in the employment file mentioned under 3C will be processed because of legal obligations.
• These data may be transmitted to official national government agencies to comply with legal obligations, for audit reasons or in the case of audits by inspection services.

5. How long will my personal data be kept?

As a Trusted HR advisor, Duuw accompanies you throughout your career. As part of this, we will keep the personal data of candidates, temporary and seconded employees, at least 10 years after the last contact or your given consent, or in this case 10 years after the termination of the last contract. At the end of this period you will be contacted again to ask if you wish to remain in the database in order to be contacted about available positions.

Your personal data will in any case be kept in accordance with specific national legislation, as well as statutes of limitation that require us to keep your personal data for a longer period, e.g. to defend ourselves against a claim in court.

6. What rights can I exercise to ensure the protection of my personal data?

1. Right of access and inspection: You have the right to obtain knowledge of your personal data at any time, free of charge, as well as of the use we make of your personal data in accordance with the provisions in force in the sector.
2. Right of rectification, deletion and restriction: You are free to communicate or not communicate your personal data to us. In addition, you always have the right to request us to correct, supplement or delete your personal data. You may not oppose the processing of personal data necessary for our payroll administration and the data we are required by law to keep and process about you. You may also request that we restrict the processing of your personal data.
3. Right to object: You also have a right to object to the processing of your personal data for serious and legitimate reasons.
4. Right to transfer data: You have the right to obtain your personal data processed by us in structured, common and machine-readable form and/or to transfer them to other controllers and this in accordance with the provisions in force in the sector.
5. Right to withdraw consent: To the extent that the processing is based on your prior consent, you have the right to withdraw that consent.
6. Automatic decisions and profiling: The processing of your personal data does not include profiling, nor will we subject you to automated decisions.
7. Exercise your rights: You may exercise your rights by contacting our human resources administration at the email address info@duuw.nl.

8. Complaints: You have the right to file a complaint with the Dutch Personal Data Authority: PB 93374, 2509AJ DEN HAAG, telephone number 0881805250, fax number 070 8888501 and website https://autoriteitpersoonsgegevens.nl. This is without prejudice to a remedy before a civil court. Should you suffer damage as a result of the processing of your personal data, you may bring a claim for damages.

7. Who receives my personal data (transfer to third parties)?

Some of the personal data we process from you may be transferred to third parties. This includes the following data:

1. Payroll information is transmitted, on the one hand, to Duuw's secretariat for the purpose of carrying out our payroll administration and, on the other hand, to the competent public authorities within the framework of our legal obligations.
2. Transfer to Duuw providers for the granting of meal vouchers and/or eco vouchers.
3. Delegation to Duuw's cloud providers for the registration of performance and management of your vacation requests and absences as a temporary or seconded employee.
4. Delegation to Duuw's work accident insurer.
5. Transfer to the external services if you work as a temporary employee and medical examination is required.
6. Transmission of data to your health insurer so that your health record is in order.
7. Transfer to UBplus Online (Netherlands) for electronic signing of Duuw employment contracts.
8. Delegation to bailiffs, credit or banking institutions, debt mediators, etc., if there are wage transfers, wage garnishments, wage waivers, alimony.
9. Counsel if you are involved in legal proceedings.

Some third parties process personal data on behalf of our organization to perform a particular task. We conclude processing agreements with all these organizations, which act as processors, and make every effort to ensure that they would adequately secure your personal data.

Your personal data will not be sold, rented, distributed or otherwise made commercially available to third parties, except as described above or with your prior consent.

Your name, first name, gender and language for required communication will also be passed on to our customers in the event you commence work there.

When organizing events, we may pass on your personal data (such as first and last names) to external parties who are organizing the events, purely for organizational and security reasons.

Your personnel file may also be transferred to the audit office for the purpose of conducting an audit in the context of obtaining/maintaining the quality seal of the professional federation.

In rare cases, we may be required to disclose your personal data pursuant to a court order or to comply with other mandatory laws or regulations.

8. Security and confidentiality

We have developed security measures adapted on a technical and organizational level to avoid the destruction, loss, falsification, modification, access by unauthorized persons or inadvertent notification to third parties of personal data collected as well as any other unauthorized processing of these data. These measures include:

1. Technical measures

• Personal data on up-to-date servers in a secure data center
• Daily secure backups
• Use of firewalls and VPN's
• Use of anti-spam filters and up-to-date anti-virus software
• Use of access codes, usernames and passwords
• Regularly changing these codes and passwords

1. Organizational measures

• Specified individuals have access
• Procedure for incident management
• Policy to employees & collaborators
• Training to employees & collaborators
• Fidentiality clauses

In the event that your personal data under Duuw's control is nonetheless breached by an information security breach, Duuw will act immediately to identify the cause of such breach and take action through appropriate remedial measures. If necessary, Duuw will also notify the Personal Data Authority of this incident in accordance with applicable law.

This privacy policy may be amended by Duuw at any time. In the event of future changes to our privacy policy, we will post the changes in question here so that you are always aware of what personal data is collected by us.