Privacy Statement

This is the Privacy Statement for users of our Hiring Desk service and our other solutions to align the supply and demand of a contingent workforce. The Hiring Desk is an online hiring platform where independent professionals and suppliers of professionals can meet. The Hiring Desk is provided by Staffing Management Services B.V. and its affiliated entity, Staffing MS Broker B.V., (hereinafter referred to as “Staffing MS”). We can tailor the Hiring Desk to specific clients’ demands. If you use such a client-specific Hiring Desk, this Privacy Statement will also apply to you.

We process your personal data when you use the Hiring Desk, when you visit one of our websites, including www.inhuurdesk.nl, www.staffingms.com and the client-specific websites (hereinafter referred to as the “Websites”), and when you contact us. We may also process your personal data when a supplier you work with enters your personal data in the Hiring Desk.

Carefully handling your personal data is important to us and we like to be clear about this to all Hiring Desk users and other persons whose personal data we process (hereinafter referred to as “Data Subjects”). In this Privacy Statement, we will explain how we handle your personal data.

Who are the controllers?

The controller is the party that determines how and why personal data are processed. The controller determines the purpose of and the means for the data processing. Under the General Data Protection Regulation (GDPR), most obligations rest with the controller and it is also the first point of contact for you as the Data Subject.

Staffing Management Services B.V., with its registered office at Oostmaaslaan 71, 3063 AN in Rotterdam, is the principal controller regarding the processing operations referred to in this Privacy Statement. You can reach us by telephone on +31 (0)10 760 09 00 and by email via support@staffingms.com. Staffing Management Services B.V. and Staffing MS Broker B.V. are classified as the joint controllers. We have made mutual arrangements about the division of our responsibilities. If you have any questions about personal data processing or if you want to invoke your rights or file a complaint, please contact the principal controller.

If you are a professional whose personal data are provided to us by a supplier, that supplier is classified as an independent controller. In that case, the supplier determines the purpose and the means, and is the first point of contact for you if you want to exercise your rights under the GDPR. The supplier may have its own privacy statement and its own terms and conditions. We advise you to read them.

What personal data do we process?

What personal data we process depends on the services you are using and the capacity in which you are using those services.

Visitors to our Websites, readers of our mailings

1. Data you disclose to us. If you visit our Websites, you may disclose personal data to us, e.g. because you send us an email with a query or request. In that context, we may process your name, email address, or other contact details.

2. Personal data generated by our Website or via emails. When you visit the Websites, certain data will be processed and generated, e.g. your IP address, browser data, surfing behaviour, the date and time of your visit and how you navigate our Websites. If you open a newsletter or commercial email from us, we may record when you opened it and which segments you clicked on. To do so, we process your email address, IP address, time of receipt, time of opening and clicking behaviour.

Independent professionals who use the Hiring Desk

1. Sign up. When you sign up as an independent professional with the Hiring Desk, we will in any event ask you to disclose the following personal data: Chamber of Commerce number, company name, the segments you would like to sign up for, as well as your name, date of birth, email address, username, telephone number and bank account number. Based on your Chamber of Commerce number, we will also add your Dutch VAT number to your profile. We will then create a unique profile number for you. Without these personal data, we cannot complete your registration.

2. Once you have signed up, we will ask to you complete your profile and disclose data that allow us to introduce you to clients or to respond to requests. You can then choose to disclose the following data: birth name, first name by which you are known, sex, type of ID and ID details, address, postcode, town/city, country, date of birth, country of birth, nationality, civil status, name of your partner, and a link to your own website or LinkedIn profile. You can also disclose the following data and documents in order to respond to a request:

1. • Financial. Invoice address (postcode, house number) and town/city, contact to be included on the invoice, email address for invoices, telephone number for invoices, Dutch VAT number, withholding tax number, name and position of authorised signatory, country profile for the VAT regime, bank account number (BIC and IBAN), G account, account name.
   • Availability and rate. When you are available, your hourly rate, how many hours per week you are available, and for which jobs.
   • References. Under ‘References’, you can upload documents such as your CV, a copy of your ID (where required for screening or verification), Chamber of Commerce extract, a certificate of good conduct (VOG) or information about a pre-employment screening (PES). You can also add more information about your professional background such as your current position, your level of education and number of years of experience. You can also provide additional information about your training, work experience, IT and language skills and competencies.

When you create and use your profile, you are not obliged to enter the above personal data into your profile. Some requests may however require you to supplement your personal data or documents. If you do not disclose such data, you may not be hired for a certain assignments.

3. Requests and assignments. On the Hiring Desk, you can respond to requests submitted by clients. Your profile contains a list of the requests you have responded to as well as their status. This list contains a request number as well as details about the request. If you have responded to a request and it results in an assignment, that assignment will also be included in your profile. In addition, we will clearly show your hourly time sheets and invoices on the Hiring Desk, stating the number of hours you worked on an assignment, your hourly rate and the invoiced amounts. In some cases, a client may carry out a pre-employment screening (PES) or have one carried out. The PES results will then be saved to your list of requests and assignments.

4. Logging. We log your access to and use of the Hiring Desk. You can view the log within your profile. The log will show when you logged in (date and time), as well as your operating system and browser.

Where required by law, we may check your identity by means of a valid identity document. We may also call in the assistance of an external service provider to check your identity document on our behalf. This will be done digitally. The service provider processes the personal data on your passport, your photo and your email address. We will receive the outcome of that check and the date on which it was carried out. If you do not want your identity document to be checked digitally, you can opt to come by our office for the ID check. We will record when your ID was checked and information about the identity document that was checked, such as the type of document, country of issue, number and term of validity. If you are a national of a country outside the European Economic Area (EEA) or Switzerland or if you have Croatian nationality, we may ask you for a work permit. In that case, we may store a copy of your passport and a copy of the permit concerned.

Clients who use the Hiring Desk

Clients may have their requests published on the Hiring Desk. We process personal data of the contacts of our clients. If you are the contact for a client, we may process the following personal data: data about the organisation where you work as well as your role, your email address, telephone number, mobile telephone number, password, profile number, data about the creation of your client account and its status, and data about the contact you have had with us.

Suppliers who use  the Hiring Desk

Suppliers are organisations who provide professionals they work with through  the Hiring Desk to the organisations affiliated with us in their role as client. If you are the contact for a supplier, we will ask you to create a profile via the Hiring Desk. We will then ask you to disclose the following personal data: name, sex, email address, telephone number, mobile telephone number, password and username. We will also ask you to disclose data about the organisation where you work, such as its name, Chamber of Commerce number, Dutch VAT number and the names of the authorised signatory/signatories. We will also process a profile number and data about the creation of your supplier account and its status.

Professionals who are signed up by a supplier or another third party

If you did not sign yourself up to the Hiring Desk, but were signed up by a supplier who put your personal data in our system, we may process those personal data in line with this Privacy Statement. We may process your personal data for the purposes specified in this Privacy Statement under ‘Services’ and ‘Compliance and security’. The supplier will only disclose your personal data if you have consented to such disclosure. We have a legitimate interest in the further processing of your personal data, i.e. to be able to provide our customary services, to comply with agreements with and assignments from suppliers and clients, and to be able to meet the applicable market quality standards. We also have a legitimate interest in ensuring that the supplier who works with us can fulfil its obligations to you and in ensuring that you can be used for the selected assignment. We always weigh up our interests and your privacy interests as a Data Subject. If you want more information on this weighing up of interests, please contact us via the contact details stated in this Privacy Statement.

If you were signed up by a supplier, you will not yet have your own account with your own password. The supplier provides your personal data to us. If you are deployed for an assignment at a client, you will be given an employee profile where you will be able to find information about your deployment at a client.

A supplier is an independent controller of your personal data that it processes. The supplier manages the profiles of the professionals it includes on the Hiring Desk and determines which requests it responds to. If you want to know more about how the supplier handles your personal data and which of your personal data it discloses to us, we advise you to read the supplier’s privacy statement or to ask the supplier for information. We are neither responsible nor liable for the personal data that the supplier processes. This Privacy Statement solely covers the further processing of personal data by us.

For what purposes do we process personal data?

Our core activity is to mediate in the hiring of external professionals and contract management. The Hiring Desk facilitates simple matchmaking between professionals and clients. In that context we process your personal data for the following purposes:

Administration

• Registration of the independent professional, the supplier and the client.
• Creation of the Hiring Desk account.
• Account management, dealing with queries and requests from the professionals, clients and suppliers.
• Verification of the account, check on its completeness.

Service provision

• Presenting professionals to clients, making professionals available.
• Finding the best match between the client’s request and the most suitable professional.
• Concluding agreements with professionals, suppliers or clients for the client’s request.
• Contract management, financial handling of contracts, cost and expense calculation.
• Providing services to professionals, clients and suppliers as agreed.
• Supporting professionals, clients and suppliers in meeting their administrative obligations and implementing agreements.
• Contract maintenance, answering queries and requests.
• Providing supplementary services, improving services. We may process personal data relating to requests and assignments you have been deployed on in order to analyse and gain a clearer view of the independent professionals market as a whole. We can then better tailor our services to supply (independent professionals) and demand (clients).
• Providing information about the services of Staffing MS and its partners and relevant development in the market.
• Marketing and promotion of our services and measuring their effectiveness.

Compliance and security

• Internal audit and security. Preventing, detecting and investigating infringements of our security system.
• Compliance with laws and regulations; preventing, detecting and investigating fraud and illegal activity.
• Handling claims and complaints.
• Compliance with court rulings and orders, implementing requests from public authorities.
• Compliance with tax obligations resting with us or our suppliers/clients, limiting liability.
• Enforcing our terms of use and the terms of agreements.
• Protecting our activities, our rights, security and property.

On what grounds do we process personal data?

 We process personal data only if there is a legal basis for doing so.

• Performance of the agreement.We conclude agreements with professionals, suppliers and clients on the basis of which we process personal data. These agreements relate to the services we provide. It is also conceivable that we request personal data from you before concluding an agreement to enable us to form the agreement.
• In certain situations, we may ask for your consent prior to the data processing. For example, we ask for your consent before sending you certain news reports. After giving your consent, you may revoke it at any time, following which we will refrain from any further processing of your personal data for the purposes covered by the consent.
• Legal obligation. In some cases we are required by law to process certain personal data. For example, pursuant to the Foreign Nationals Employment Act (Wet arbeid vreemdelingen) or tax obligations. A legal obligation may also mean that we are required to share certain personal data with clients, supervisory authorities or other third parties for further processing.
• Legitimate interest. We may process personal data because we have a legitimate interest in doing so, or because the organisation to which we disclose your personal data has a legitimate interest. For example, to prevent tax liability or reduce the risk of such liability, or to prevent and investigate fraud. We also have a legitimate interest in further processing personal data of professionals who are signed up to the Hiring Desk with their consent in order to be able to provide our services and to give professionals the opportunity to respond to requests and to deploy them on assignments. We always weigh up our interests and those of the Data Subjects. If you want more information on this please contact us via the contact details stated in this Privacy Statement.

Profiling

If you are a professional, we may analyse the personal data you have disclosed which relate to your professional background and prepare profiles based on those data. That helps us to ascertain which assignments and which clients would best suit your knowledge and experience. We prepare profiles using the data you have filled in and one of our staff members will check the result. Added to that, we may use special software to match the text in your profile and CV with an assignment.

We will not take fully automated decisions (without human intervention) that significantly impact you as a professional on the basis of the profiles prepared by us and the outcomes of the matching software.

Direct marketing

We offer you the option to subscribe to our newsletters and to other direct-marketing communications from us or from other entities within our group. If you have consented to this, we may also send you messages about initiatives taken by our associate partners. You can easily unsubscribe from our communications at any time by using the unsubscribe link in the emails or by updating your preferences in your profile environment.

We use conventional tracking techniques that provide information on the reach and effectiveness of our direct marketing communications. This enables us to improve our service provision and to focus our information and communications on the relevant target groups.

Cookies

We use cookies and similar technologies on our Websites and in our apps. We place functional cookies to enable us to display the Websites and to make it easy for you to use the Hiring Desk and the facilities provided on it. In this regard, we process your IP address, information about your operating system and browser, the date and time of your visit and the duration of your visit.

Who can access your personal data?

Our staff members can access your personal data on a need-to-know basis. This also means that people working for the entities affiliated to us can access your personal data to the extent necessary to provide our services.

In certain situations, we may share personal data with third parties. We will do so only if this is necessary to provide our services and if it is in keeping with the purposes described in this Privacy Statement.

• From within our group, we may share personal data with affiliated entities, whether or not they qualify as joint controllers. We may also share personal data with legal successors (including envisaged legal successors) as well as with potential and new group entities and/or their shareholders if they intend to work with us or continue to provide our services.
• We may pass on personal data to entities with whom you enter into an agreement that is related to your deployment on an assignment and that results from your use of the Hiring Desk.
• We may share professionals’ personal data with our clients and with any supplier who has registered the professional on the Hiring Desk. These parties can be classified as independent controllers.
• We may share personal data with service providers we work with who qualify as independent controllers, such as financial service providers, legal advisers, consultants, auditors and credit and security providers. We always decide in advance which personal data need to be disclosed to such parties to enable them to provide their services. If necessary, we make additional arrangements about the division of responsibilities.
• We use service providers for aspects such as managing the Hiring Desk and for hosting. We use systems such as the Vendor Management Systems, provided by Nétive VSM B.V., and Salesforce.com Inc. We also use service providers to check your identity document on our behalf, and we use software solutions for the automated processing of CVs and to match CVs with assignments. Where such service providers process personal data on our behalf as processors, we set out the arrangements in a processing agreement.
• We only share personal data with supervisory authorities, tax authorities and investigative bodies if and to the extent that we are obliged to do so by law.

Will your personal data be safe?

We have taken appropriate technical and organisational security measures in order to protect the personal data we process against loss or unlawful use. For example, we secure our systems and applications in accordance with the information security standards currently in force. In addition, we have made arrangements with our service providers and obliged them to take adequate security measures.

Will your personal data be processed outside the EEA?

In principle, we process your personal data within the European Economic Area (EEA). We use servers that are in Europe and our group companies are established in the EEA. Because we may use the services of processors who have their main establishment outside the EEA, it cannot be ruled out that we may share personal data with organisations outside the EEA, either directly or indirectly. Where this is the case, we will take appropriate measures to legitimise such processing, including entering into a transfer agreement on the basis of standard contractual clauses (SCCs) approved by the European Commission. If required, we will take additional measures to ensure an adequate level of protection. If you want to know more about the transfer of personal data and how this is legitimised, contact us using the contact details provided in this Privacy Statement.

How long do we retain your personal data for?

We retain personal data only for as long as this is necessary for the purposes described in this Privacy Statement.  If you are a professional who no longer wishes to use the Hiring Desk, you can choose to anonymise your profile. All traceable information will then be removed from the fields on your profile. If you have been deployed on an assignment, we will not be able to fully anonymise your profile and we will in any event retain the personal data that are relevant to the assignment.

We also apply the following retention periods:

• We retain the personal data on your profile for one year, unless you use your profile actively and respond to requests. If you are not active during that year and do not respond to requests, we may delete your personal data, unless you state that you want to keep your profile for longer.
• We retain business agreements and any correspondence about them for seven years after the contractual relationship has ended unless there are still disputes or proceedings pending in that regard.
• We retain personal data relating to the verification of your identity for five years after our business relationship has ended.
• We retain registration data for the newsletters until you have unsubscribed from them, up to a maximum of two years after our business relationship ends.
• We retain complaints, correspondence about disputes and reports on incidents for seven years after they have been fully dealt with.
• We retain documents on payrolling as well as salary records for seven years.

What are your rights regarding your personal data?

Under privacy legislation, you have a number of rights in relation to your personal data and their processing. You can invoke your rights by contacting us using the contact details provided in this Privacy Statement. We will assess your request and handle it within one month. If we need more time to comply with your request, we will let you know within one month that we will need another two months. We may ask you additional questions after you have submitted your request in order to establish your identity. Alternatively, we may ask you to specify your request.

Access to personal data

You have the right to hear from us about whether we are going to process your personal data and, if so, to be granted access to those personal data and to obtain additional information about the processing of your personal data. If you are a supplier or a professional, you can access your personal data clearly and easily by logging in to the Hiring Desk. If you want a more complete overview or more information about the data processing, you can submit a request for access to us.

Right to rectification

You are entitled to the rectification of incorrect or incomplete data. You may also supplement your personal data. If you have access to the Hiring Desk as a professional, you can supplement or alter your personal data in it.

Right to be forgotten

In certain circumstances, you are entitled to the deletion of your data. At your request, we will remove your personal data if processing is no longer necessary. If you have access to the Hiring Desk as a professional, you can delete your personal data in it.

Right to restriction of processing

In some instances, you are entitled to restrict the processing of your personal data, for example if you are of the opinion that your personal data are not correct. If we grant your request for a restriction, we will not be allowed to process your personal data for as long as that restriction applies.

Right to data portability

You have the right to receive the personal data you have disclosed to us in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller, where the processing is based on your consent or an agreement.

Right to object

You have the right to object to the processing of personal data based on Staffing MS’s legitimate interests. Staffing MS will then no longer process the personal data unless we can demonstrate that there are grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of a legal claim.

Where personal data is processed for direct marketing purposes, you can unsubscribe in any communication.

Contact and complaints

If you have any questions or requests in relation to our processing of your personal data, you can telephone us on +31 (0)10 760 09 00 or send an email to support@staffingms.com. If you would like to file a complaint, please send an email to klacht@staffingms.com. We will be happy to help you find a solution. If you are still not satisfied, then you can always contact the Dutch Data Protection Authority.

Amendments

Events evolve rapidly, which can sometimes lead to changes in your personal data which we ask of you and process. Laws and regulations can also change. Consequently, we may amend this Privacy Statement from time to time. The amended Privacy Statement will be published on our Website, stating the date when the amended version becomes effective. If there are substantial or material changes that could considerably affect one or more Data Subjects, we will also endeavour to inform the Data Subjects in question about that directly.

This Privacy Statement was most recently amended on 12 May 2021.