Privacy statement

The Witteveen+Bos group (hereinafter Witteveen+Bos) respects your privacy. Through this Privacy Statement we inform you on Witteveen+Bos’ use of your personal data and your privacy rights. The term ‘personal data’ means any information relating to an identified or identifiable natural person. If you have any questions about how we handle your personal data, please feel free to contact us. Our contact information is provided below:

Witteveen+Bos
Leeuwenbrug 8
7411 TJ Deventer

Postal address:
Postbus 233
7400 AE Deventer

E-mail address: privacyofficer@witteveenbos.com
Telephone number: +31 570 69 79 11

1. Personal data that we process

Witteveen+Bos processes or may process your personal data if you use our services, are employed by one of our suppliers, visit our websites, apply for a job with us or provide us with your personal data in any other way. What personal data these are exactly is elaborated on below, per category of data subject.

Which entity of Witteveen+Bos qualifies as the data controller within the meaning of the Dutch General Data Protection Regulation (or where relevant the UK General Data Protection Regulation and the UK Data Protection Act 2018 or other applicable law) depends on the relationship you have with us. If you have specific questions about this, please contact us.

1.1 Customers

We process the following (categories of) personal data of (contact persons of) our customers:

  • Name and address information (surname, first name(s), initials, title, gender, address, postcode, town) as provided by the customer.
  • Other (contact) data (telephone number, e-mail address and similar information required for communication) as provided by the customer.
  • Personal data as provided by the customer in correspondence and/or during telephone contact.
  • Data for calculating and recording fees and expenses, making payments and collecting claims, including the bank account number as provided by the customer.
  • Other customer information of which processing is required- or necessary to comply with applicable legislation and/or regulations.

 

1.2 Suppliers

We process the following (categories of) personal data of persons from whom we purchase products or services or who are employed by these suppliers (hereinafter: ‘suppliers’):

  • Name and address data (surname, first name, initials, title, gender, address, postcode, town) as provided by the supplier.
  • Other contact data (telephone number, e-mail address and similar data required for communication) as provided by the supplier.
  • Data for the purpose of placing orders, purchasing services; calculating and recording fees and expenses, and making payments and collecting claims, including the bank account number as provided by the supplier.
  • Other data from suppliers the processing of which is required or necessary to comply with applicable legislation and/or regulations, including in the context of compliance.

 

1.3 Applicants

We may process the following (categories of) personal data of applicants:

  • Name and address data (surname, first name(s), initials, title, gender, address, postcode, town), as provided by the applicant.
  • Other contact data (telephone number, e-mail address and similar data required for communication) as provided by the applicant.
  • Nationality, date of birth as provided by the applicant.
  • Availability, curriculum vitae and employment history, educational history (copies of diplomas, certificates, testimonials), motivation letter as provided by the applicant.
  • References as provided by the applicant or reference, information concerning the position applied for, notes of job interviews including written communication during the applicant and where relevant: assessment results.
  • If a personal account is created for you with us, in addition to the personal information you provide for its creation and the personal data you make available to us via your personal account, your user name will also be processed.

 

1.4 Third parties

We may process the following (categories of) personal information of third parties (such as website visitors and consultants with whom we have contact):

  • Name and address information (surname, first name(s), initials, title, gender, address, postcode, town), so far as disclosed to us.
  • Other contact information (telephone number, e-mail address and similar data required for communication), so far as disclosed to us.
  • Data related to a visit to our websites including the IP address used; for more information on this subject, we refer to our Cookie Policy.
  • Data relating to electronic messages from- or to third parties and information necessary to maintain contact with these third parties.
  • Other third party information obtained from public sources or provided to us in the context of dispute resolution.

 

1.5 Newsletters and events

When you receive our newsletter or read it online or receive an invitation to an event, we process the following (categories of) personal data:

  • Your e-mail address, name, job title and company name, as provided by you.
  • Where relevant and if provided by you: your dietary requirements, information on (wheelchair) accessibility and/or restrictions.
  • Your IP address.
  • Footage taken at Witteveen+Bos events.


When you unsubscribe from the newsletter, your personal data will be destroyed.

2. Basis and purpose for processing your personal data

We process your personal data on the basis of one or more of the following legal grounds:

  1. When this is necessary for the execution of an agreement to which you are a party or for carrying out pre contractual activities at your request.
  2. When this is necessary to fulfil a legal obligation.
  3. When this is necessary for the protection of our legitimate interests or the interests of a third party.
  4. After your consent.

When we process your personal data on the basis of your consent, we will ask you for consent separately. You may withdraw your consent at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data before the withdrawal.

We use the above personal data for the purposes set out below, indicating for each purpose on the basis of which basis mentioned above (1 to 4) we do so. Where processing is based on the ‘legitimate interest’ , this interest is briefly explained.

Purposes with related bases:

  • To provide the requested services and products (1, 2 and 3: to be able to offer and improve our products and services).
  • For our records, including calculating or recording fees or payments, income and expenses, payment and collection of debts (including using a collection agency or bailiff) (1, 2 and 3: the importance of keeping accurate records).
  • To be able to deal with any complaints and disputes about our products and services (1, 2 and 3: to defend rights, to maintain and improve existing relationships through proper complaint handling and to improve the quality of our services and products).
  • To maintain contact with you (e.g. in the context of campus recruitment) and to communicate with you, e.g. by sending you newsletters and personal invitations to events; (1, 2, 3: the importance of bringing our products, services and events to the attention of existing customers, 4).
  • To place orders or purchase services (1, 2 and 3: the importance of being able to keep proper records).
  • To enable you to access our websites, to improve the websites, to display the websites in your chosen language and for the purposes of security and tracking of user statistics of our websites (3: the importance of being able to offer safe and optimised websites to you).
  • For processing your application (1, 2, 3: our legitimate interest in assessing your suitability for the vacant position and d: consent if you wish to remain in the portfolio for a longer period, see: ‘How long do we retain your personal data?’).
  • For auditing and other internal control purposes (1, 2 and 3: the importance of being able to keep proper records).
  • For compliance with our legal- and/or regulatory obligations (2, 3: the importance to fulfil these obligations).

 

2.1 To whom do we provide your personal data?

We do not provide your personal data to third parties (‘recipients’ in the sense of the privacy legislation), unless this is necessary for the proper execution of the purposes described in this Privacy Statement, when this is legally required or after you have given your consent. The third parties to whom the personal data are shared, are obliged to treat your personal data confidentially. If these parties are regarded as ‘(sub) processors’ within the meaning of the privacy legislation, we will ensure that a processing agreement is concluded with them, which meets the requirements set out in the GDPR. Third parties engaged by us who offer services as independent processors are themselves responsible for the (further) processing of your personal data in accordance with the applicable privacy legislation. Examples are accountants and lawyers. We may share your personal data:

  • Within Witteveen+Bos group.
  • With suppliers (e.g. software suppliers, bailiffs, courier services, translation agencies, accountants, assessment agencies, etc.).
  • With legal successor(s) in the event that Witteveen+Bos is acquired by or merges with another company, for instance as a result of bankruptcy, and also with third parties involved in such a proposed or actual business transaction.
  • With courts and government agencies.
  • With other parties if:
    • It is required by law. Or
    • After your consent. Or
    • When this is necessary to protect the rights and property of Witteveen+Bos and/or to prevent fraud. Or
    • This is necessary to protect Witteveen+Bos against misuse, abuse or unauthorised use of its products and services.
    • This is necessary to protect the personal safety and/or property of our employees, users of our services and products or the public.


In order to provide services, we may transfer personal data to a recipient in a country outside the European Economic Area that offers a lower level of protection of personal data than that provided by European legislation. In such a case, we will ensure that such a transfer of personal data is in accordance with the applicable legislation and regulations, for example, by concluding a model contract drawn up and approved for that purpose by the European Commission, and will check whether additional measures are necessary to guarantee an adequate level of protection of your personal data. Please do not hesitate to contact us if you would like to receive further information on the existing appropriate or suitable safeguards for the transfer of your personal data outside the European Economic Area or if you would like to receive a copy

2.2 How long do we keep your personal data?

We will not retain your personal data in an identifiable form longer than is necessary to fulfil the purposes set out in this Privacy Statement. More specifically, we apply the following retention periods:

  • Personal data which must be recorded pursuant to Article 52 of the State Taxes Act (AWR) will be kept for seven years (calculated from the end of the year in which the data in question lost their actual relevance for the purposes of (tax) operations) in connection with the tax retention obligation imposed on Witteveen+Bos pursuant to Article 52(4) of the AWR.
  • The personal data you provide us for your application will be kept for four weeks after the end of the application process. When you give us permission, we will retain your personal data for up to one year after the last correspondence with you regarding your application. Applicants can permanently delete the data in their personal account at any moment . If you apply for a job in Belgium, this retention period is three years after the last correspondence with you about your application. When you enter our service, your personal data will become part of your personnel file.
  • If you have spoken with us at a company day, business course or other event and have provided us with your personal data in that context, we will store these data, when you have given us permission to do so, for a maximum of three years.
  • If you receive our newsletters or other commercial communications from Witteveen+Bos, your personal data shall be kept for as long as you wish to receive such information from Witteveen+Bos. If you no longer wish to receive newsletters and the like from Witteveen+Bos, you may unsubscribe at any time by contacting us at communications@witteveenbos.com or by using the ‘unsubscribe from these mailings’ option in every Witteveen+Bos newsletter.


The specific retention periods mentioned above can be extended if legal retention obligations apply/become applicable. We may retain the personal data for a longer period if this is necessary in order to protect our legitimate interests, such as the settlement of incidents and/or legal disputes. For more information on cookie retention periods, please refer to our Cookie Policy.

2.3 Security

Witteveen+Bos takes the protection of your personal data very serious and has implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against loss, destruction, damage, modification or disclosure. If you have any questions about the security of your personal data, or if you suspect or have any evidence of misuse, please contact our Privacy Officer at privacyofficer@witteveenbos.com.

2.4 Your privacy rights

You have the following rights with respect to Witteveen+Bos’ processing of your personal data:

  • The right to request whether we are processing personal data relating to you and, if so, to access your personal data and certain information concerning the processing of your personal data.
  • The right to rectification of your personal data if they are incorrect or incomplete.
  • The right to have your personal data erased (‘right to oblivion’).
  • The right to object to the processing of your personal data or to restrict the processing of your personal data.
  • The right to withdraw consent to the processing of your personal data, if the processing is based on your consent.
  • The right to receive or transfer your personal data to a third party designated by you in a structured, commonly used and machine-readable form (‘right to data portability’).


We do not make use of automated decision-making. To exercise your rights, please contact us using the contact data at the top of this Privacy Statement.

To prevent us from providing information to the wrong person, we may ask for additional information to verify your identity. In principle, we will inform you within one month after receipt of your request whether we can comply with your request. This period may be extended by two months in specific cases, such as a complex request. We will inform you of such an extension no later than one month after receipt of your request. Pursuant to privacy laws, we may refuse your request under certain circumstances. If this is the case, we will explain why. You can find more information about your privacy rights on the website of the Dutch Data Protection Authority.

2.5 Complaints

If you have a complaint about Witteveen+Bos’ processing of your personal data, we shall try to resolve it together with you. If this does not lead to the desired result, you have the right to submit a complaint to the competent regulator. In the Netherlands this is the Data Protection Authority. If you live or work in another country of the European Union, you can file a complaint with the regulator in that country.

2.6 Amendments

This Privacy Statement was last updated on 25 April 2022. Witteveen+Bos reserves the right to amend this Privacy Statement. The most recent version of this Privacy Statement will always be posted on our websites (for example www.witteveenbos.com). In case of substantial amendments, which may significantly affect one or more data subjects, we will strive to inform these data subjects directly.