Privacy statement

Privacy statement of Staffing MS - Version 08-08-2023

About us
Staffing Management Services B.V. and its affiliated entity Staffing MS Broker B.V. (together: Staffing) are subsidiaries of HFBG Holding B.V. (together with Staffing further called: HeadFirst Group, we, our, us). HeadFirst Group offers a.o. a Hiring Desk for its clients and other services to bring together supply and demand of temporary staffing.

Our relationship with you
Your privacy is important to us. This statement explains what personal data HeadFirst Group processes, how HeadFirst Group processes it and for what purposes. Please read this privacy statement carefully.

We process your personal data when you use our services (Inhuurdesk, intermediary services and/or additional services), when you visit one of our websites and when you contact us. For example, through our websites you can contact us by e-mail, request information or chat with us. Prior to using intermediary services, we may process personal data when you enter it into our systems yourself or when your employer or client enters it. This data can be used to bid for assignments.

1. Who are the data controllers

The controller determines the purpose and means of data processing. Pursuant to the General Data Protection Regulation (AVG), most of the obligations lie with the controller and they are also the first point of contact for you as a data subject. Below is a breakdown. In almost every case HeadFirst Group qualifies as an independent data controller, with the exception of the situation that your employer has entered your data into our system and then you are never placed on an assignment through HeadFirst Group or when the contract between supplier or self-employed is entered into directly with the Client and HeadFirst Group has only played an intermediary role. In the latter case, HeadFirst Group is the processor acting on the instructions of the Client who is then designated as the processing controller.

Three variants are conceivable:

Are you self-employed? Then you have to deal with two controllers of your data (the Client and HeadFirst Group).
Are you employed by a supplier of a Client? Then you have to deal with three data controllers (your employer, HeadFirst Group and the Principal).
Do you use premium and/or excellent services? Then the insurer from whom you receive the certificate is independently responsible for the processing of its services.

The Principal as the data controller

Do you have a privacy-related question and/or request to the Principal? If so, you can contact the Principal directly for that purpose. You can do so by contacting them using the contact information found in the Principal's privacy statement.

The employer as data controller

Do you have a request to your employer? Then you can contact your employer directly. You can do this by using the contact information you can find in the privacy statement of your employer. Have you not yet completed an assignment through HeadFirst Group, no offer has been made and no start has been made with that? Then your employer can remove your data in the Platform through his or her account.

The self-employed supplier as a data controller

If you are a self-employed person whose personal data is provided to us by a supplier, that supplier is to be regarded as an independent data controller for this purpose. The supplier then determines the purpose and means, and is the first point of contact for you to exercise your rights under the AVG. The supplier may have its own privacy statement and terms and conditions. We recommend that you consult these. We are not responsible or liable for the personal data processed by the supplier. This Privacy Statement only covers the further processing of personal data by us.

You have not yet fulfilled an assignment through HeadFirst Group, no bids have been made and have not started? Then your supplier can remove your data.

The Insurer as data controller

Do you have a question and/or request to the insurer? Upon contracting, you or your employer have been informed where to find the insurer's privacy statement. Do you have a question and/or request to the insurer? Then you can contact the insurer directly for that. You can do that by contacting them using the contact information in your insurer's privacy statement.

HeadFirst group as (Joint) controller

In the context of HeadFirst Group's services.
We process personal data when services (both intermediary services and any additional services) are used. HeadFirst Group provides services from multiple entities, each 100% part of the same concern (HFBG Holding B.V.). For the services provided by Staffing, Staffing Management Services B.V. , located at Oostmaaslaan 71, 3063 AN in Rotterdam is the primary data controller for the processing operations in this Privacy Statement. You can reach us by phone at 010 - 760 0900, by e-mail at privacy@headfirst.nl.

Other entities that are part of HeadFirst Group and may process your personal data as a data controller include but are not limited to (subsidiaries and sister companies of): Associates B.V., Between Staffing B.V., Designated Professionals B.V., EXPR B.V., Fast Flex B.V., Fast Flex Sourcing B.V., HeadFirst Germany GmbH, HeadFirst IT B.V., HeadFirst Poland sp. z o.o., Jenrick Nederland B.V., Jenrick Payroll Services B.V., Myler B.V., Oyster Coast B.V., Proud ICT B.V., Proud Payroll B.V., Source Automation B.V., Source Automation BV. (Belgium), Source Automation Luxemburg SA, Source Payroll Services B.V., Sterksen B.V., StarApple B.V. and Yellow Friday B.V. Each of these entities, in addition to being part of this group, is also contractually bound to handle data responsibly, all in line with this Privacy Statement.

In connection with other activities, including customer contact, direct marketing and website visits
We also collect personal data for our own purposes (including customer contact, direct marketing, website visits, which are explained under purposes) in addition to personal data for intermediary services. Because we determine the purpose and means, we qualify as an independent data controller.

Employees of the Principal
We also process data of the Client's contact persons. With respect to this data, HeadFirst Group qualifies as a data controller.

2. Contact Center

If you have any questions or requests regarding what happens to your personal data, please contact HeadFirst Group. Unsure about which party qualifies as a data controller or where to go with your question about data processing by or through HeadFirst Group? For your privacy questions related to the services of Staffing you can reach us by phone at 010 - 760 0900 or by email at privacy@headfirst.nl. We are happy to help you find a solution. Should that still not succeed, you can turn to the Personal Data Authority (https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/gebruik-uw-privacyrechten/klacht-melden-bij-de-ap).

3. What type of personal data are processed? For what purpose and on what basis?

We process different types of personal data about you, for example, because you have created a profile and uploaded a CV. When you use the Hiring Desk, different categories of personal data are collected in the process. What data is collected is primarily determined by law and also depends on the additional service selected and the Client's requirements for flexible staffing.

We process personal data only when there is (or are) one (or more) basis(s) for doing so:

(1) Execution of the contract.
As an intermediary, we are the contractual intermediary in the hiring of flexible staff. We conclude and manage agreements with professionals, suppliers and clients on the basis of which we process personal data. In addition to the personal data from the agreements themselves, this also covers the personal data required by the contracts. Thus, it is also conceivable that we request personal data from you prior to the conclusion of an agreement so that we can establish it. Subsequently, it is also possible that surveys are sent out in order to be able to improve our services and/or (gain) insights into (the circumstances of the execution of) contracts with Clients.

(2) Consent.
We may ask you for your consent prior to data processing in certain cases. For example, we will ask you for your consent before we send you certain news items. Once you have given your consent, you may withdraw your consent at any time, after which we will not process your personal data for the purposes for which the consent was given. You can revoke your consent by clicking the unsubscribe button at the bottom of the relevant news item.

(3) Legal obligation.
As an intermediary we are obliged to process certain personal data. Examples are obligations under the Wet allocatie arbeidskrachten door een intermediair (Waadi), the Wet arbeid vreemdelingen (Wav) or tax obligations. A legal obligation may also mean that we are obliged to share certain personal data with Clients, supervisors or other third parties for processing. When we are required to do so, we share this data with the relevant party.

(4) Legitimate interest.
We may process personal data because we have a legitimate interest in doing so, or because the organization to which we provide your personal data has a legitimate interest. This is the case, for example, when we want to prevent or minimize the risk of tax liabilities, or when we want to detect and prevent fraud. We also have a legitimate interest to be able to further process personal data of professionals included in the Platform with their consent in order to be able to carry out our services and to be able to assign the professional to an assignment. We also have a legitimate interest in aggregating and anonymizing personal data to perform market analysis so that we can improve our services. We always balance our interests against those of the data subjects. If you would like to receive more information about this, please contact us using the contact details under 'Contact Center' in this Privacy Statement.

A. Visitors to our websites and/or readers of our mailings.

We use several websites (collectively, the Websites). When you visit our Websites, you may provide us with personal data, for example, because you send us an e-mail with a question or request, or because you use a chat function or a contact form on our Websites. We may process your name, e-mail address or other contact information in this context. In addition, we process other personal data insofar as you provide these with your question or request or in the chat conversation. We collect this personal data because, when applicable, we need to perform the agreement we have with you. If no agreement has yet been concluded (and the question, for example, concerns how registration with the Recruitment Desk works), these data are processed on the basis of the legitimate interest that the question can be answered adequately.

We offer you the opportunity to sign up for our newsletters and other direct marketing messages coming from us and/or other entities within our group. We may also, with your consent, send you communications about initiatives by partners with whom we work. You can easily unsubscribe from the messages we send you at any time by using the unsubscribe link in the emails or by adjusting your preferences in the area of your profile. We use common tracking techniques that provide insight into the reach and effectiveness of our direct marketing messages. If you open a newsletter or commercial e-mail from us, we can track when you opened it and which parts you clicked on. To do this, we process your e-mail address, IP address, time of receipt, time of opening and click behavior. The first purpose is to inform you about services of HeadFirst Group and its partners and relevant developments in the market. The second purpose is to conduct marketing and promotional activities of our services and measure their effectiveness. In this way we can improve our services and tailor our information and communication to relevant target groups. Newsletters and other direct marketing messages are sent pursuant to "consent," which can be revoked at any time. In addition, data collected is analyzed and processed on the basis of legitimate interest in order to measure the effectiveness of marketing and promotional activities.

B. Personal data generated by our Websites.

We use cookies and similar techniques on our Websites and within the environment of our apps. When you visit the Websites, certain data are processed and generated, such as your IP address, data about your browser, data about browsing behavior, date and time of your visit and the way you navigate through our websites. Consent is requested for preference cookies, analytical cookies and marketing cookies. Because we want to guarantee your privacy and improve the usability of the Inhuurdesk, we find it important that you know how and why we use cookies. We encourage you to consult the cookie statements on our Websites. The data are partly based on 'permission', partly on 'legitimate interest' to let the website and the 'Inhuurdesk' function.

C. Users of the hiring desk

When you register or are registered on the Hiring Desk, personal data are collected from you, divided into stages for the purpose of data minimization. A distinction is made between independent professionals and employees of suppliers.

v Independent professionals and (professionals from) suppliers using the hiring desk

Phase 1: Register as a self-employed professional
When you register as an independent professional on the Hire Desk, we ask you to enter the following personal data: Chamber of Commerce number, company name the segments you want to register for and your name, date of birth, e-mail address, username, phone number and bank account number. Based on your Chamber of Commerce number, we also add your VAT ID number to your profile. We then create a unique profile number for you. Without this personal information we cannot finalize your registration.

The purpose of this registration is the execution of the agreement and the legitimate interest of both parties (i.e. access to the Hiring Desk for you and an up-to-date file for HeadFirst Group). In addition, HeadFirst Group can verify that the account is set up correctly.

Phase 1: Register as a supplier.
If you are a contact person of a supplier we may process the following personal data from you: name, gender, data about the organization where you work, e-mail address, (mobile) phone number, password and username. We also ask you to provide information about the organization you work for, such as the name of the organization, Chamber of Commerce number, VAT number and which person or persons are authorized to sign. We further process a profile number, data about the creation of your supplier account and its status, and data about contact you have had with us. The purpose of recording this is to record with whom what contact is maintained (legitimate interest) and to be able to contract quickly and correctly when an order is awarded to a professional employed by the supplier (performance of the contract).

Phase 2: Completing your self-employed profile.
Once you have registered, we ask you to further complete your profile and provide data that will enable us to introduce you to Clients or respond to assignments. For this purpose, the following personal data may be provided: Birth name, call sign, gender, type of ID and ID card data, address, zip code, city, country, date of birth, country of birth, nationality, marital status and a link to your own website or LinkedIn profile. Furthermore, for the purpose of your response to an application, you may provide the following information and documents:

Financial. Invoice address (zip code, house number) and city, contact person for invoice, e-mail address for invoices, phone number for invoices, VAT number, payroll tax number, name and position of authorized person to sign, country profile for VAT regime, bank account number (BIC and IBAN), G account, bank account ascription.
Availability and rate. When you are available, your hourly rate, how many hours per week you are available and what positions you are available for.
Characteristics. Under 'Characteristics' you can upload certain documents such as your CV, copy of your identity document (if necessary for screening or verification), extract from the Chamber of Commerce, a VOG or information about a pre-employment screening (PES). You can also add more information about your professional background such as your current position, level of education, number of years of experience. You can also provide additional information about your education, work experience, IT and language skills and competencies.

When creating and using your profile, you are not required to provide the above personal information in your profile. However, certain applications may require you to provide personal information or documents. If you do not provide this information, it is possible that you may not be assigned to an assignment.

To the extent permitted or required by law, we may ask you for your BSN.Only when we are legally required to do so (i.e. in the run-up to an order) will we verify your identity on the basis of a valid identity document. We may also engage an external service provider to verify your identity on our behalf. This is done digitally. The service provider processes the personal data on your proof of identity, a photo of you and your e-mail address.We obtain the result of the check and the date on which the check was performed. If you do not want your proof of identity to be checked digitally, you can choose to come to our office for the identity check. We will note when the check took place and information about the identity document checked such as the type of document, country of issue, number and period of validity. If you are a national of a country outside the European Economic Area (EEA) or Switzerland or if you are a Croatian national, we may ask you for a work permit. In this case, we may store a copy of your passport and a copy of the relevant permit.

Within the environment of your profile, we process information about your assignments and agreements we have made with you in this regard. We may use unique identifiers, such as an assignment number, for this purpose. The basis is the execution of the agreement (if an assignment is awarded to you) and the legitimate interest of both parties (i.e. the ability for you to quickly apply for a portion of the assignments and an up-to-date file for HeadFirst Group. After all, HeadFirst Group will need to check data such as identity only once in case of successive assignments).

In the Inhuurdesk you can respond to requests from Clients. Within your profile you will find an overview of applications to which you have responded and their status. This includes a request number and details about the request. You can also see an overview of all applications to which you have responded. When you have responded to an application and this leads to an assignment, you can find these assignments in your profile. We will also make your timesheets and invoices visible in the Inhuurdesk. They show how many hours you have worked on an assignment, what your hourly rate is and what amounts have been declared. In some cases, a client may perform or have a pre-employment screening (PES) performed. The results of the PES are stored in your overview of requests and assignments.

We log your access and use of the Hiring Desk. You can consult the logging within your profile. Here you can see when you logged in (date, time), your operating system and browser.

Its goals are:

Being able to quickly compare available professionals so that the right person gets to the right place (legitimate interest);
To be able to provide the right match between the Client's assignment and the professional best suited to it (legitimate interest);
Being able to quickly present and make professionals available to Clients (legitimate interest);
Closing an agreement with the correct data (data quality) when an assignment arises, both towards you and the ultimate client.

If an assignment has not yet been awarded and has not been fulfilled in the past, these data are editable on the Hiring Desk. After assignment, this data can be adjusted and reused (to the extent still current) for future assignments (except for the verified identifying data).

Phase 2: Supply profile as supplier.
As a supplier, you can register an employee or a self-employed person as a professional (and as an employee or self-employed person of a supplier, you can be registered) on the Hiring Desk and through the Hiring Desk offer (or be offered) on (part of) the assignments to Clients. The personal data of the completed profiles of professionals (or you) will also be processed in accordance with this Privacy Statement. With respect to the professional, the following applies. When the supplier registers you as a professional on the Hiring Desk, we ask the supplier to fill in the following personal data (required): first and last name, gender, address and zip code, e-mail address, country of origin and nationality, (mobile) phone number, date of birth. We will process your personal data in order to facilitate your registration by the supplier and to include you in the database of the Hiring Desk.

When you are enrolled by a supplier, you do not yet have your own account with your own password. The supplier provides us with your personal data. When you are placed on an assignment with a client, you will receive an employee profile in which you can find information about the assignment. In the first place, we have a legal obligation (art. 7c paragraph 2 of the Law on allocation of labor forces by intermediaries) to identify you. We may also process your BSN. By law, this must be done prior to the nomination for mediation. It is of course possible that you have been registered on the Hiring Desk by your employer without being successfully offered assignments. It is up to your employer to remove the profile in that case, for example when you leave employment or a long-term assignment elsewhere. You can contact your employer for this. Have you left your employment in the meantime or are you dealing with a different situation, please feel free to contact us using the contact information provided under the heading Contact Center. We also have a legitimate interest in ensuring that the supplier working with us can fulfill its agreements with you and that you can be deployed on the desired assignment. We always weigh our interests against the privacy interests of you as a data subject. If you would like more information about this balancing of interests, you can contact us via the contact details under 'Contact Center' in this Privacy Statement. In addition, we have a legitimate interest in processing your personal data, which lies in being able to perform our usual services, to fulfill the agreements and orders of suppliers and clients and to comply with (quality) standards applicable in the market.

Its goals are:

Being able to quickly compare available professionals so that the right person gets to the right place (legitimate interest);
To be able to provide the right match between the Client's assignment and the professional best suited to it (legitimate interest);
Being able to quickly present and make professionals available to Clients (legitimate interest);
Closing an agreement with the correct data (data quality) when an assignment arises, both toward the supplier and toward the ultimate client.

Phase 3: Upon award of the assignment
When an assignment is awarded, the information is checked again by HeadFirst Group. If all information is complete and correct, a contract will be entered into.

Its goals are:

Establishing a clear agreement with the correct data (data quality) when a contract is awarded, both towards the supplier and/or independent contractor and towards the ultimate Client.
Performing contract management, financial processing and cost and expense calculations by HeadFirst Group.
Supporting professionals, Clients and suppliers in meeting administrative obligations, such as the delivery of agreed documents (for example, a required Statement of Payment History compliance with tax obligations or an auditor's report) and the conclusion of the agreements.
Maintaining contact, answering questions and requests.
Offering additional services and improving services. We may process personal data related to assignments on which you have been deployed in order to analyze and understand the market for independent professionals in order to better align our services with demand (Clients) and supply (independent professionals).
Complying with laws and regulations, detecting, preventing and combating fraud and illegal activities.
Handling claims and complaints.
Complying with legal judgments and orders and responding to government requests.
Complying with tax obligations imposed on us or our suppliers/clients and limiting (chain) liability.
Ensure compliance with our terms of use and agreements.
Protecting our operations, our rights, security and property.

v Clients using the Hiring Desk

When Clients, who want to place (or have placed) assignments on the Hiring Desk, register (or have registered) on the Hiring Desk, personal data of the employees of Clients (in case of approvals/additional agreements. If you are a contact person of a Client, we may process the following personal data of you: your email address, your (mobile) phone number, password, profile number and information about the contact you have had with us. In doing so, HeadFirst Group has a legitimate interest (to carefully record required information). In addition, these data serve the execution of the agreement. HeadFirst Group also has an accountability towards its own accountant and tax authorities in the sense of the administration obligation in Article 2:10 BW.

Would you like to make a request regarding your data? If so, please feel free to contact us using the contact information under item 2. Contact Center.

v As part of a pre-employment screening process

For some assignments we perform a pre-employment screening. We do this because the client asks us to, for example when it is required by law (think of the Financial Supervision Act, Wft) or because it arises from the nature of the assignment. Where necessary, we will inform you that for the assignment for which you (or the employee or self-employed person of a supplier) are eligible, a screening will be part of the selection procedure and we will explain how we or a third party engaged by us will conduct the screening.

If a Client indicates that screening is desired or required, we always verify the nature of the assignment, the manner in which the screening is to be conducted, and the legitimate interests of the Client. We balance the interests of the client against your privacy interests. Only when your privacy interests do not interfere with this will we proceed to conduct a screening.

When we conduct a screening, we process data on your suitability, reliability and integrity that are relevant to the performance of the assignment. The severity of the screening depends on the assignment, the requirements of the Principal and the requirements and obligations of the law, even if those requirements and obligations rest with the Principal. In any case, we may check the data entered by you or by the supplier as part of the screening. In addition, depending on the nature of the screening, we may process information from references, former employers/clients, antecedents, data on previous performance, suspension or dismissal, a certificate of good conduct (VOG) or a declaration of no objection (VGB) and a list of ancillary positions.

Depending on the nature of the screening, we will provide personal data from you to the Principal. We may ask you to complete a screening form provided by the Client. The information entered on the form will be processed only for the purpose of the deployment with the Client listed on the form and will be shared with that Client, unless otherwise agreed. It is also conceivable that we conduct a screening where we only pass on whether you have completed the screening with a positive result. In that case, we do not share any further data with the Principal. It depends on the assignment what we share. If you have any questions about this, please contact the contact person associated with the assignment.

4. Why are your personal data being processed (Purposes)?

In addition to the above purposes, personal data may be processed for the following purposes, as applicable:

Administration

HeadFirst Group has an accountability and administration obligation towards its own accountant and the tax authorities within the meaning of Article 2:10 of the Dutch Civil Code. This includes the performance and administration of agreements to be made and concluded, all agreements and all payment actions following agreements concluded (legal obligation). All documents relating to an agreement also form part of the mandatory administration.
HeadFirst Group is required under art. 7c Waadi to identify a (prospective) worker (legal obligation).

Services

HeadFirst Group's (core) service (finding, presenting and contracting the right matches for Clients and vice versa) starts with facilitating the Hiring Desk and making the online marketplace connected to it accessible. In doing so, HeadFirst Group facilitates that the self-employed person or supplier can create a profile. The purpose of processing this personal data is that HeadFirst Group can offer its services and that the self-employed person/supplier/Client can use them (legitimate interest).
To quickly compare, present and make available the right matches on a Client assignment (legitimate interest).
Being able to provide account management and handling of questions, requests, claims and complaints from the professionals, Clients and suppliers (legitimate interest and, as applicable, performance of the agreement).
For HeadFirst Group, data quality is important (both for its Clients and correct contracting), so part of the service is checking the account. Especially when a concrete offer is made, HeadFirst Group performs a check on completeness. The purpose is to conclude a contract with the correct data (data quality) when an assignment occurs. The performance and administration of all actions, agreements and arrangements related to the contracting is part of this (legitimate interest).
Performance of contract management, financial processing and calculation of costs and expenses by HeadFirst Group (contract performance).
Capturing and providing services by HeadFirst Group to professionals, Clients and suppliers (performance of the agreement).
Supporting professionals, Clients and suppliers in meeting administrative obligations, such as the delivery of agreed documents (for example, a required Statement of Payment History compliance with tax obligations or an auditor's report) and the conclusion of agreements (execution of an agreement)
Offering additional services and improving services. We may process personal data related to assignments on which you have been deployed in order to analyze and gain insight into the market for independent professionals in order to better align our services with demand (Clients) and supply (independent professionals) (legitimate interest and performance of an agreement, if concluded).
Protecting our operations, our rights, security and property (legitimate interest).
To fulfill the obligations to the Client, for example, by conducting a pre-employment screening (performance of the contract).

Marketing

Inform about services provided by HeadFirst Group and its partners and relevant developments in the market (consent).
Marketing and promotion of our services and measuring their effectiveness (newsletters) (consent and legitimate interest).
Collecting reviews through Ratecard.io (privacy statement available at www.ratecard.io).

Compliance and security

Complying with laws and regulations, detecting, preventing, recording and combating fraud and illegal activities (legal obligation and legitimate interest)
Complying with legal judgments and orders and responding to government requests (legitimate interest).
Compliance with tax obligations incumbent on us or our suppliers/clients and limiting (chain) liability (legitimate interest and a legal obligation, to be found in the Implementing Regulation Mandatory Use of BSN, article 1 sub b).
Internal monitoring and security. To prevent, detect and investigate possible breaches of our security (legitimate interest).

5. What makes processing operations lawful under the law?

Some of our processing operations are based on the basis that we are required to process your data by law. In addition, we actively (for example, by minimizing data collection to what is necessary in stages) limit the amount of data. We have taken appropriate technical and organizational security measures to protect the personal data we process against unwanted alteration, loss or unauthorized use. For example, we secure our systems and applications in accordance with applicable information security standards (ISO27001). We have also made agreements with our service providers and required them to implement adequate security measures.

6. Who has access to your personal data?

Our employees have access to your personal data on a need-to-know basis. This also means that employees of our affiliated entities may have access to your personal data to the extent necessary to provide our services.

We may share personal data with third parties in certain cases. We do so only when necessary for our services and the purposes described in this Privacy Statement.

We may share personal data within our group with affiliated entities, whether or not they qualify as joint controllers. In addition, we may share personal data with (intended) legal successors and potential and new group entities and/or shareholders thereof when they intend to cooperate with us or continue our services.
We may disclose personal data to entities with whom you enter into an agreement related to your engagement on an assignment and resulting from your use of the Hiring Desk.
We may share personal data of professionals with our Clients and possibly with the supplier by whom the professional is registered in the Hiring Desk. These parties qualify as independent data controllers.
We may share personal data with service providers with whom we work and who qualify as independent data controllers, such as financial service providers, legal advisors, consultants, auditors, and credit and security providers. We always consider in advance what personal data is necessary to provide to these service providers for the purposes of their services. If necessary, we make additional agreements on the division of responsibilities.
We use service providers, for example, to manage the Hiring Desk and for hosting. Among other things, we use the Vendor Management System of Netive VSMs BV and Salesforce.com Inc. We also use service providers who verify your identity on our behalf, and we use software solutions that enable automated processing of resumes and matching of resumes and assignments. To the extent these service providers process personal data on our behalf as processors, we document arrangements in a processor agreement.
Only if and to the extent we are required to do so by law do we share personal data with regulators, tax authorities and investigative agencies.

7. Do we process data outside the EEA?

No, we process your personal data in principle within the European Economic Area (EEA). We use servers located in Europe and our group companies are located within the EEA. Because we may use processors that have their principal place of business outside the EEA, it cannot be excluded that we directly or indirectly share personal data with organizations outside the EEA. To the extent this is the case, we take appropriate measures to legitimize such processing, including entering into a transfer agreement based on standard contractual clauses (SCCs) approved by the European Commission. If required, we thereby take additional measures to ensure an adequate level of protection. If you would like to know more about the transfer of personal data and how this is legitimized, please contact us using the contact details in this Privacy Statement.

8. How long do we keep your personal data?

The data on the Hire Desk.
As long as the self-employed person or supplier has a contractual relationship with HeadFirst Group, including using the Inhuurdesk, HeadFirst Group will keep the personal data. After this relationship has ended (i.e. the supplier or self-employed person has unsubscribed, deleted the profile and does not otherwise work with HeadFirst Group), HeadFirst Group can keep the personal data for up to 7 years unless longer retention is required, for example, for tax obligations or civil claims. The self-employed person and/or supplier himself can remove his profile and a profile of an employee of the supplier at any time through the Hiring Desk. The profile cannot be removed (completely) if there are only agreements with an age of between zero and seven years and/or there are ongoing and/or future agreements or bids.

HeadFirst Group further applies the following rules of thumb:

We retain business agreements and correspondence about them for a period of seven years after the end of the contractual relationship, unless they are subject to ongoing disputes or litigation.
We retain personal data with respect to the verification of your identity for seven years after the end of our business relationship.
We retain subscription data for newsletters until you have unsubscribed from them, with a maximum of two years after the end of our business relationship.
We will always consider whether the (longer) processing of the personal data is necessary. If it is not, the personal data in question will be deleted.
We retain complaints, correspondence regarding disputes and incident reports for seven years after they have been fully resolved. We retain documents with respect to payroll and payroll records for seven years.

For cookie retention periods, please refer to our Cookie Statements on the Websites.

9. What rights do you have?

Under privacy laws, you have a number of rights regarding your personal data and its processing. You can invoke your rights by contacting us using the contact details in this Privacy Statement under 'Who are the controllers'. We will review your request and comply with it within one month. If we need more time to comply with your request, we will let you know within one month that we will need another two months. We may ask you additional questions in response to your request in order to establish your identity or to ask you to specify your request.

Right of access
You have the right to hear from us whether we are processing your personal data. If so, you have the right to access that personal data and to receive additional information about the processing of your personal data. If you are a supplier or independent professional, you can access your personal data in a simple and clear manner by logging into the Platform. If you would like a more complete overview, or more information on data processing, you can send us a request for inspection.

Right of rectification
You have the right to rectification of inaccurate or incomplete personal data. You can also supplement your personal data. If you have access to the Hire Desk as an independent professional, you can supplement or change your personal data here. Do you not have access to the Leasing Desk? Then contact the party that entered your data. Does that not provide a solution? Then contact the details under no. 2 of this Privacy Statement.

Right to be forgotten
You have the right to data erasure under certain circumstances. At your request we will delete your personal data when the processing is no longer necessary. If you have access to the Hiring Desk as an (independent) professional, you can delete personal data herein.

Right to restriction
In some cases, you have the right to restrict the processing of your personal data, for example, if you believe that your personal data is inaccurate. If we honor your request for restriction, we may no longer process your personal data for the duration of the restriction.

Right to data portability
You have the right to receive the personal data you have provided to us in a structured, common and machine-readable form, and you have the right to transfer that data to another data controller, where the processing is based on your consent or on an agreement.

Right of Objection
You have the right to object to the processing of personal data based on the legitimate interests of HeadFirst Group. HeadFirst Group will then no longer process the personal data unless we can demonstrate that there are grounds for the processing which outweigh your interests, rights and freedoms or which are related to the establishment, exercise or support of a legal claim.

Staffing Management Services B.V.