Recruitment Privacy Policy

1. Introduction

Shiftbase B.V. is responsible for recruiting and onboarding new colleagues. This privacy policy explains how we collect and process personal data from job applicants and candidates during the recruitment process. Shiftbase acts as controller under the EU General Data Protection Regulation (GDPR). We are committed to processing personal data lawfully and transparently and to protecting your privacy.

2. Personal data we collect

We collect only the information necessary for recruitment and assessment. Depending on the role and the stage of the process, this may include:

• Identification and contact details: full name, postal address, email address and telephone number.
• Professional information: your résumé/CV and cover letter, details of qualifications, skills, experience and employment history.
• Compensation details: your current level of remuneration and benefit entitlements.
• Eligibility information: evidence of your right to work in the Netherlands or EU.
• Assessment data: test or assessment results, interview notes and records of reference checks.
• Technical data: records of communication with us via email or our recruitment platform and metadata such as interview scheduling information.

Providing this information is voluntary; however, if you do not supply the necessary data, Shiftbase may not be able to assess your application.

3. Purposes and legal basis for processing

We process your data for the following purposes:

1. Recruitment and selection: evaluating your qualifications, skills and experience to determine your suitability for employment. Legal basis: steps prior to entering into a contract (Article 6(1)(b) GDPR).
2. Compliance with legal obligations: verifying your right to work, carrying out background checks where required and complying with applicable labour, tax and regulatory laws. Legal basis: Article 6(1)(c) GDPR.
3. Legitimate interests: maintaining a talent pool, improving our recruitment processes and defending against legal claims. We balance our interests against your rights.
4. Consent: if we wish to retain your application for future opportunities beyond the standard retention period, we will ask for your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not make recruitment decisions based solely on automated processing or profiling.

4. Retention period

We keep your personal data only for as long as necessary for the purposes described above and to comply with legal requirements.

With your consent, Shiftbase may retain your data for up to one year after the recruitment process ends so that we can contact you about future opportunities.

If you are hired, your data becomes part of your personnel file and will be kept in accordance with employment-record retention requirements.

5. Data sharing and international transfers

Your application will be accessible only to our internal recruitment team and managers involved in the selection process. We may share certain personal data with service providers (e.g., recruitment software providers or assessment agencies) who act as processors and process the data on our behalf under confidentiality agreements. We may also share data with reference providers or regulators if required by law.

Some service providers may be located outside the European Economic Area (EEA). Where personal data is transferred to a country without an adequate level of protection, Shiftbase ensures appropriate safeguards such as the EU Standard Contractual Clauses.

6. Security measures

Shiftbase takes technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include secure IT systems, controlled access to applicant data, encryption of data transmissions and restricted storage. Our recruitment platform follows industry-standard security practices, and we train our staff on privacy and confidentiality obligations.

7. Your rights

Under the GDPR and the Dutch GDPR Implementation Act, you have several rights regarding your personal data:

• Right to be informed: you have the right to know how we process your personal data.
• Right of access: you may request confirmation of whether we process your data and receive a copy. We must respond within one month.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten): you can request deletion of your data when it is no longer necessary or if you withdraw consent.
• Right to restrict processing: you may ask us to limit processing while we investigate your concerns.
• Right to data portability: you can request a copy of the data you provided to us in a structured, commonly used format.
• Right to object: you can object to processing based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
• No automated decision-making: we do not make decisions that have significant effects on candidates solely by automated means.

8. Exercising your rights and contact details

If you wish to exercise any of your rights, ask questions about this policy, or lodge a complaint, please contact us:

Data controller: Shiftbase B.V.
Postal address: Groeneweg 2A, 2718 AA Zoetermeer
Email: lfeitsma@shiftbase.com

We may ask you to verify your identity before processing your request. We will reply within one month and inform you of any extension if your request is complex.

If you are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via their website. You also have the right to seek judicial remedy if you believe your rights have been infringed.

9. Updates to this policy

Shiftbase may update this policy to reflect changes in law, technological developments or our recruitment processes. We will post the updated policy on our website and, where appropriate, notify you of significant changes. Please review this policy periodically to stay informed.