1. Who we are
Groos Personeelsdiensten B.V. is the controller: we determine why and how the personal data in this statement is used. We are an employment agency in The Hague and work with job seekers, temporary workers and clients.
We do not have a data protection officer, because we are not required to have one. Our team is the point of contact for all questions about privacy.
2. Who this statement applies to
This statement applies to everyone whose data we use, through the website or through email, phone and WhatsApp. These are job seekers, temporary workers, contact persons at clients and other people who contact us.
The Dutch version addresses job seekers informally and everyone else formally. In English we simply use you throughout.
3. When you apply for a vacancy
If you apply through our website, we ask for your name, phone number, email address and place of residence. We also ask whether you are allowed to work in the Netherlands.
You can choose to send more, such as your CV, a message and the date on which you can start. If the vacancy requires a driving licence, we also ask whether you have a category B licence.
Through the website we never ask for:
- your citizen service number (BSN);
- a copy of your identity document;
- your date of birth or nationality;
- a photo of yourself;
- information about your health.
We use your data to review your application and to contact you. We do that by phone, WhatsApp or email.
We may do so because you apply yourself and we look together at whether an employment contract can follow. In law this is called a step prior to entering into a contract (Article 6(1)(b) GDPR).
Once your application has been completed, we keep your data for another four weeks. This allows us to answer any questions about your application (legitimate interest, Article 6(1)(f) GDPR).
Completed means that you are working through us, that we have rejected you or that you have withdrawn your application. If we hear nothing from you for twelve weeks, we also complete your application.
After those four weeks we delete your data and your CV automatically. If you start working through us, the article "When you start working through us" explains which data we then keep.
Would you like us to contact you about other work as well? You can tick a separate box when you apply.
With that box ticked, we keep your data until one year after your application has been completed. We only do this with your consent (Article 6(1)(a) GDPR), and you can withdraw it at any time.
4. When you register without a vacancy
If you register through the Register page, we ask for the same data as for an application. You can also tell us what kind of work you are looking for.
We use that data to find suitable work for you and to contact you about it. We only do this with your consent, which you give with the box in the form (Article 6(1)(a) GDPR).
We keep your registration for as long as you are looking for work through us, and never longer than one year.
If there has been no contact for twelve weeks, we close your registration. Four weeks later we delete your data automatically.
No longer want to be registered? Send an email to info@groospersoneeldiensten.nl or call us, and we will delete your data.
Are you under sixteen? Then you need permission from your parent or guardian to register.
5. When you start working through us
If you start working through us, we need more data from you. We ask for it in a personal meeting and never through the website.
We then check your original identity document and make a copy of it, because the law requires this. We also need your citizen service number (BSN) for your wages and tax.
If you do not join us after all, we destroy the copy of your identity document within four weeks. If you do join us, we keep your personnel data for as long as the law requires; for tax purposes that is seven years.
We use this data for your employment contract, your wages and our legal obligations (Article 6(1)(b) and (c) GDPR). For payroll we work with TODO name of payroll provider.
We only give the client where you work the data that is necessary. Examples are your name, your working hours and your certificates.
6. When you request staff or work with us
If you request staff, we use your name, phone number and email address and the details of your company. We use them to handle your request, prepare a quote and carry out the collaboration.
We do this to enter into and perform an agreement with your company, and because we want to maintain business contact with you. The legal bases are Article 6(1)(b) and (f) GDPR.
We keep your request until two years after the last change. We keep quotes, agreements and invoices for seven years, because tax law requires this.
7. When you send us a message
If you send a message through the contact form, we use your name, your email address or phone number and your message. We only use them to answer your question (legitimate interest, Article 6(1)(f) GDPR).
We keep the message until six months after we have dealt with it. Messages that we recognise as spam are deleted after thirty days.
If you contact us through WhatsApp, WhatsApp also uses your data, in line with its own privacy statement. For that reason, do not send a copy of your identity document or other sensitive data through WhatsApp.
8. Confirmations and notifications by email
After you submit a form you receive a confirmation by email, and our team receives a notification. We send these emails through Resend, from servers in the European Union.
We never send a CV as an attachment. We only open a CV in our secure admin environment.
For every email sent, we keep a short delivery record for ninety days. It does not contain what the email said, and your email address only in an unrecognisable form.
9. Our website: security, statistics and cookies
Our website is hosted by Vercel. On every visit Vercel processes technical data such as your IP address, in order to deliver and secure the website.
When you submit a form, we use Vercel BotID to check whether the request comes from a person. BotID assesses technical characteristics of your browser for this, and we only use them for this check.
Every form also contains an invisible check field, and we look at how quickly it was filled in. We do this to prevent abuse and spam (legitimate interest, Article 6(1)(f) GDPR).
To prevent abuse, our hosting provider Vercel limits the number of form submissions and login attempts per IP address; the IP address is processed briefly for this purpose.
We measure the use of the website with Vercel Web Analytics. It works without cookies, and we cannot use it to recognise you on a later visit.
We also count how many forms are submitted, without names or other personal data. You can read which cookies we do use in our cookie statement.
10. Who we share data with
We never sell personal data. We only share it when that is necessary for our work or when the law requires it.
- Clients receive the data they need when we propose someone for work. We only pass on a CV after we have discussed this with the job seeker first.
- Government bodies such as the Dutch Tax Administration (Belastingdienst), the UWV and the Netherlands Labour Authority receive data when the law requires us to provide it.
- Suppliers that process data on our behalf, the processors, are listed below.
These processors work on our behalf:
- Supabase: database and storage of CVs, on servers in Frankfurt;
- Vercel: hosting of the website, security of forms and statistics;
- Resend: sending email;
- STRATO: domain name and mailboxes, in Germany;
- Sinka B.V. (trading as SKUU; TODO confirm legal name, 00 §7 item 6): development and technical management of the website;
- TODO name of payroll provider: payroll administration for temporary workers.
We have a data processing agreement with every processor. It states that they only use the data for us and keep it secure.
11. Data outside the European Union
We store data within the European Union as much as possible. Our database and the CVs are stored with Supabase on servers in Frankfurt.
Supabase, Vercel and Resend are American companies. As a result, data may sometimes still be processed in the United States, for example during technical support.
Such transfers are covered by the arrangements in their data processing agreements. These are the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
12. How long we keep data
We do not keep data for longer than necessary. Deletion happens automatically, including for CVs.
Retention periods| Data | How long we keep it |
|---|
| Application for a vacancy | Four weeks after the application has been completed |
| Application with consent for other work | One year after the application has been completed |
| Registration without a vacancy | As long as you are looking for work and never longer than one year; closed after twelve weeks without contact and deleted four weeks later |
| CV that does not belong to a submitted application | 24 hours |
| Staff request | Two years after the last change |
| Message through the contact form | Six months after it has been dealt with; spam thirty days |
| Email delivery record | Ninety days |
| Log of the admin environment | Two years |
| Copy of identity document if you do not join us | At most four weeks |
| Personnel and payroll records | As long as the law requires; for tax purposes seven years |
| Complaint | One year after it has been dealt with |
Deleted data may remain in a backup of the database for another seven days. After that it is gone from there as well.
13. Security
We protect data with appropriate technical and organisational measures. Only our own staff can access the admin environment, with a password and a code from an app on their phone.
CVs are kept in protected storage and can only be opened through a link that is valid for a short time. We record when a CV has been viewed.
If something does go wrong with personal data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours when the law requires it. If this puts you at high risk, we also tell you ourselves.
14. No automated decisions
We do not make decisions about people that are taken by a computer alone. A member of our team personally reviews every application and registration.
We do not use artificial intelligence to select or assess applications. If we ever start doing so, we will update this statement first.
15. Your rights
Everyone whose data we use has these rights:
- access to the data we hold about you;
- correction of data that is incorrect;
- deletion of your data;
- restriction of the use of your data;
- objection to the use of your data;
- receiving your data in a common file format, to pass it on to someone else;
- withdrawing your consent, where we use data on the basis of consent.
Send a request to info@groospersoneeldiensten.nl or by post to our address. We respond within one month, and for a complex request we let you know within that month if we need more time.
We check that the request really comes from you through the phone number or email address we already have for you. We never ask for a copy of your identity document for this.
Sometimes we are not allowed to delete data, because the law requires us to keep it. In that case we explain which data it concerns and why.
If you withdraw your consent, we stop that use. What we did with your data before that remains lawful.
16. A complaint about privacy
If you are not satisfied with how we handle your data, please let us know first. You can do so under our complaints procedure.
You can also always lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can do this through autoriteitpersoonsgegevens.nl.
17. Changes to this statement
We update this statement when our way of working or the law changes. The version number and date of the current version are shown at the top of this page.
With every application and registration we record which version applied at that moment. This way we can always show what we told you.