Privacy Notice

These documents were drawn up in Dutch. This English version is a translation; in the event of any discrepancy, the Dutch text prevails.

Van Leeuwen de Witt B.V. (VLDW) processes personal data of candidates, contact persons at clients and other business contacts, and visitors to our website. This notice explains which data we use, why we use it and what rights you have.

1 Who is responsible

Van Leeuwen de Witt B.V.
Lampenistenstraat 9, 1019 TH Amsterdam, the Netherlands
Chamber of Commerce number: 77499107
VAT number: NL861026524B01
Privacy contact: nardi@vldw.nl

VLDW is responsible for processing whose purposes and means it determines. If, for a particular assignment, we act solely on a client’s behalf and instructions, that client may be the controller and VLDW the processor. If VLDW acts as a processor, we enter into a data processing agreement before that processing. If we jointly determine the purposes and means with another party, we document the joint responsibilities in accordance with Article 26 GDPR. The actual activities determine which role applies.

2 Which data we use and where it comes from

Candidates. Insofar as necessary for the recruitment services concerned, we use your name, contact details, place of residence, CV, education, work experience, skills, availability, role preferences, remuneration expectations and relevant interview notes. For a placement in employment or a self employed engagement, we may process information about the agreement, remuneration, work performed and extensions to support the engagement and calculate and settle our fees. We request only the remuneration and work information needed for the applicable fee calculation; supporting documents may be partially redacted where appropriate. For an agreed replacement arrangement, we may process necessary information about the departure date and reason for departure, including relevant performance information. We do not request medical data or a complete personnel file for that purpose.

We receive this information from you, from public professional sources such as LinkedIn, or from a client or another person involved in a specific recruitment process. We request references only after discussing this with you. Before assessments or other screening, we inform you of the purpose, nature, parties involved and data required. We process such data only where a valid legal basis exists.

We do not routinely collect your Dutch citizen service number (BSN), a copy of your identity document, health data or criminal offence data. Please do not include such information with your CV unless requested. Processing special category or criminal offence data requires an applicable legal exception in addition to a general GDPR legal basis.

If we do not obtain your data directly from you, we inform you of the source and our processing no later than our first contact with you, before any earlier disclosure to another recipient and, in any event, within one month of receiving the data, unless a statutory exception applies.

Business contacts. We process names, job titles, business contact details, correspondence and information necessary for assignments, contract management and invoicing. We process role profiles and team information only insofar as relevant and limit personal data to what is necessary.

Website and contact. When you contact us, we use the information you provide. To operate and secure the website, our hosting services may process technical data such as an IP address, request time and error messages. The website does not use cookies. Further information is provided in our separate Cookie Notice.

3 Purposes and legal bases

Approaching a professional about a specific suitable role. We rely on our legitimate interest and the client’s legitimate interest in targeted recruitment. We use relevant professional information, assess necessity and proportionality, and balance your interests and reasonable expectations against those interests. You may object.

Assessing a potential match and supporting a specific recruitment process. We rely on our legitimate interest in careful recruitment and the interests of the candidate and client in a suitable match, following a balancing assessment. If you are personally a party to a recruitment services agreement with VLDW, or ask us to take steps to enter into one, processing necessary for that purpose may be based on performance of a contract or those precontractual steps.

Introducing your profile to a specific client. We rely on your prior informed consent to that introduction. We tell you which organisation and recruitment process we intend to share your profile with.

Keeping your file available for future vacancies. We rely on your separate consent for the period stated when you give it. This is not a condition for participating in an ongoing recruitment process.

Answering questions and managing business contacts and assignments. We rely on our legitimate interest in being accessible and providing business services. If you are personally a party to an agreement, we rely on performance of that contract for the processing necessary for it.

Invoicing and maintaining tax records. We rely on necessary performance of an agreement with you, our legitimate interest in settling fees for our services and, for the data concerned, a statutory record keeping or retention obligation.

Recording our recruitment activities, checking fees due and handling disputes. We rely on our legitimate interest in retaining evidence and protecting legal claims. We retain only the data necessary for this purpose and take your privacy interests into account.

Security, investigating faults and preventing misuse. We rely on our legitimate interest in secure and reliable services, limiting data and retention periods to what is necessary for that purpose.

An agreement with a client is not, in itself, an agreement with the candidate or a contact person at that client. We therefore do not base processing of their personal data solely on that agreement.

You are generally not obliged to provide data. Without information necessary to contact you or assess your suitability, we may be unable to handle an enquiry or provide recruitment services. If certain data is required by law or contract, we explain this when requesting it. Reading this Privacy Notice does not constitute consent to processing.

4 Who we share data with

Clients. We introduce you to a specific client only after you have agreed. We share only the data relevant to that process. An introduction to one company does not automatically authorise circulation of your file throughout its group. Contractual candidate protection relating to affiliated companies, indirect engagement or a change between employment and self employed engagement does not alter this and does not itself provide a legal basis for sharing data. After receiving the data, the client is generally responsible for its own further processing and must inform you about it.

Service providers and platforms. We may use the following providers for our services:

Provider	Use
Hostnet B.V.	Email and domain management
Google Ireland Ltd.	Storage and collaboration through Google services
LinkedIn Ireland Unlimited Company	Recruitment and professional contact
Netlify Inc.	Website hosting
Anthropic PBC	AI support for work processes, where used

Not every provider receives all data. The data a provider processes depends on the service used. We put the required data processing arrangements in place with parties that process personal data solely on our behalf. Platforms may also act as independent controllers for certain activities of their own, to which their own privacy notices apply.

We may also disclose necessary data to, for example, our accountant, legal adviser or competent public authorities where a valid legal basis or legal obligation exists. We do not sell personal data.

5 Processing outside the European Economic Area

Using international providers may mean that data is stored outside the European Economic Area or accessible from outside it, including from the United States.

Such transfers take place only with an applicable legal basis for the transfer. This may be a European Commission adequacy decision, insofar as the recipient and processing are covered by it, or appropriate safeguards such as the EU Standard Contractual Clauses. Where necessary, we assess supplementary protective measures. A provider being established in Europe does not, by itself, rule out processing elsewhere.

You may contact nardi@vldw.nl for information about transfers applicable to your data and to receive a copy or explanation of the safeguards used, subject to protection of other people’s confidential information.

6 How long we keep data

A specific application or recruitment process. We delete data needed only for that process no later than four weeks after it ends. Exceptions apply only to data demonstrably still needed for a separate purpose described below or for which you have consented to future recruitment services.

Future vacancies. With your separate consent, we keep your relevant candidate file for no more than one year after the recruitment process ends. If there is no specific process, the period is no more than one year from your consent. We ask for consent again for a further period. You may withdraw consent earlier; we then stop that processing and delete data retained solely for that purpose.

No interest or no ongoing recruitment services. If you tell us you are not interested, we stop approaching you for that purpose. We delete data needed only for that approach no later than four weeks after it has been closed. This also applies when we close an approach that has received no response. Only a limited record may remain where necessary to respect your objection or serve a separate legitimate evidential purpose.

Evidence of recruitment activities and candidate protection. Where necessary, we keep a limited record of the candidate’s identity, the relevant assignment, the relevant contact or introduction date and the supporting evidence needed. The applicable protection period follows from the agreement with the client and the applicable General Terms and Conditions. Our General Terms and Conditions provide for eighteen months from the applicable reference date; if a shorter period has been agreed, we follow that shorter period for this retention purpose. The reference date may be the first demonstrable recruitment contact in connection with the relevant assignment, including before a formal introduction. Merely entering someone in a database is insufficient. Candidate protection does not itself provide a legal basis for processing, and the protection period is not a general retention period for complete CVs, assessments or interview files. We assess whether the limited evidence can be deleted earlier. After the protection period, we delete it unless it remains necessary to settle a fee that has arisen, pursue or defend a specific legal claim, or meet a legal obligation. In that case, only the necessary part is retained until that need ends.

Placements and extensions. We retain information necessary to support the engagement, determine Actual Assignment Value and settle fees for as long as those activities and their settlement continue. We then delete data that no longer serves another lawful retention purpose.

Financial records. We generally retain basic records required for tax purposes for seven years, calculated from the start of the statutory retention period applicable to those records. This does not mean that every candidate file is kept for seven years.

Business correspondence and technical data. We keep correspondence for as long as necessary to handle the enquiry, maintain the business relationship, or perform and settle an assignment. We keep technical data only as long as necessary for availability, security and investigating faults or incidents. In a specific incident, the necessary part may be retained separately until the investigation and handling of the incident are complete. We periodically review necessity and delete or anonymise data when its purpose ends, unless a statutory retention obligation applies.

7 AI and human assessment

VLDW may use AI tools to organise professional information, draft texts and support administrative work. We limit the personal data used to what is necessary for the specific purpose and assess the privacy safeguards of the selected service and settings in advance.

AI must not independently decide at VLDW whether you are approached, introduced or selected. The client makes the final appointment decision and is responsible for its own assessment and processing. A member of staff reviews the relevant information and outputs of any tools used. VLDW does not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you. You may request an explanation of an assessment and have inaccurate data corrected.

8 Your rights and contact details

Subject to the conditions of the GDPR, you have rights of access, rectification, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on a legitimate interest. For direct marketing, you do not need to give reasons for your objection, and we stop using your data for that purpose.

You may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal. A separate lawful retention purpose may justify limited retention of certain data; we explain this where necessary.

Send your request to nardi@vldw.nl, or contact us by post. We respond without undue delay and no later than one month. That period may be extended by up to two further months only where necessary because of the complexity or number of requests. We inform you of the extension and the reason within the first month.

If we have reasonable doubts about your identity, we may request additional information necessary to confirm it. We do not routinely request a complete copy of your identity document. Requests are generally free of charge. We explain any restriction or refusal by reference to the GDPR.

You have the right to complain to the Dutch Data Protection Authority, or another competent European supervisory authority. You do not have to complete a complaint procedure with VLDW first.

9 Security and incidents

VLDW takes appropriate technical and organisational measures against loss, unauthorised access, alteration and unlawful processing. Access is limited to people who need the data for their work. Measures reflect the nature and risks of the processing.

If you suspect a personal data breach or unsafe use of personal data, report it to nardi@vldw.nl. We investigate the report and notify the supervisory authority and affected individuals where required by law.

10 Changes

We update this notice when our services, systems or legal obligations change. The website states the current version and date. Where necessary, we separately inform you of material changes to processing. Updating this notice does not replace consent where consent is required.