Privacy statement by M Restart BV and M Restart Secondment & Solutions BV
Under the General Data Protection Regulation (GDPR), M Restart BV and M Restart Secondment & Solutions BV (hereinafter referred to as “M Restart”), with its registered office at Van Vollenhovenstraat 29 in Rotterdam, is responsible for processing personal data, as set out in this privacy statement.
2. Contact details
M Restart, Van Vollenhovenstraat 29, 3016 BG, Rotterdam, the Netherlands, +31 (0)10 7141800, firstname.lastname@example.org.
3. Personal data that we process
M Restart has been supplied with personal data of people who wish to be considered for employment at M Restart or who enter/wish to enter into a contract with M Restart as a self-employed worker without employees. M Restart processes personal data in three situations:
- People who are registered as an applicant with M Restart
- People who work at M Restart (in employment or as a self-employed worker without employees)
- People who no longer work at M Restart
The nature of the personal data that are collected depends on the relationship a person has with M Restart. The data concerned may be:
|Applicants||People who work at M Restart||People who carry out work for
M Restart (self-employed workers without employees)
|People who no longer work at
|First name and surname||First name and surname||First name and surname||First name and surname|
|Date of birth||Date of birth||Date of birth||Date of birth|
|Place of birth||Place of birth||Place of birth||Place of birth|
|Address details||Address details||Address details||Address details|
|Telephone number||Telephone number||Telephone number||Telephone number|
|Email address||Email address||Email address||Email address|
|Certificates and diplomas||Certificates and diplomas||Certificates and diplomas||Certificates and diplomas|
|Bank account number||Bank account number||Bank account number|
|Salary details||Data from the proof of identity||Copy of the proof of identity (applicable in the case of employees)|
|Copy of the proof of identity (not applicable for self-employed workers without employees)||Citizen service number (BSN)||Citizen service number (BSN)|
|Citizen service number (BSN)||Medical examination data (only applicable for offshore jobs)|
|Medical examination data (only applicable for offshore jobs)|
4. The legal basis and purpose that form the grounds for our processing of personal data
- Personal data of self-employed workers without employees are processed by M Restart within the scope of Article 6, paragraph 1b of the General Data Protection Regulation (GDPR): “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
- In the case of employees the legal basis is Article 6, paragraph 1c: “processing is necessary for compliance with a legal obligation to which the controller is subject”.
- In the case of applicants who do not enter into an agreement/employment contract with M Restart, the applicant’s data will only be processed (filed) if the applicant (data subject), under Article 6, paragraph 1a of the GDPR, has granted specific consent for this.
M Restart processes personal data for the following purposes:
- to carry out recruitment and selection processes, in which people are involved as an applicant;
- to establish a person’s identity;
- to keep personnel records;
- to draw up the employment contract;
- for occupational health services (sickness absence prevention and rehabilitation measures);
- to assess medical suitability for the performance of an offshore job and/or job as a seafarer;
- to enrol employees for education and training courses;
- to register employees under a pension system;
- to provide data to the Employee Insurance Agency (UWV) in connection with sickness and occupational rehabilitation;
- social insurance schemes;
- employee insurance schemes.
5. Automated decision-making
M Restart does not take decisions on the basis of automated processing, which can have significant consequences for people. This concerns decisions that are taken by computer programmes or computer systems without human intervention, for example by an employee of M Restart.
6. How long we keep personal data
M Restart does not keep personal data for any longer than is strictly necessary. The following basic arrangements apply:
- A retention obligation applies under tax law to some data in the personnel file. This means that Tax and Customs Administration requires M Restart to keep those data for a period of seven years following the termination of the employee’s employment.
- No statutory retention periods apply to any other data in the personnel file. The following guideline applies to these data: a retention period of two years following the termination of the employee’s employment.
- Data of applicants who ultimately do not enter into an agreement/employment contract with M Restart are deleted within four weeks of closing the recruitment process. An exception to this applies if the applicant has consented to his/her personal data being kept. In that case M Restart keeps the data for a period not exceeding two years, after which they are deleted from the systems.
7. Sharing personal data with third parties
M Restart shares personal data with various external parties, in order, amongst other things, to comply with a number of statutory obligations. Name, gender, date of birth and place of birth are shared with the occupational health services provider (also data concerning health), the pension fund, the accountant (for payroll records), and the insurance company. In addition, Tax and Customs Administration and the Employee Insurance Agency (UWV) receive salary details and the Citizen Service Number (BSN).
M Restart continues to be responsible for all this processing and has what is known as a “Processor’s Agreement” with private parties. Under this agreement M Restart guarantees that external parties likewise handle personal data correctly and in compliance with the GDPR. In any case, personal data are not shared with a body outside the EU.
9. Inspection, alteration or deletion of data
You are entitled to inspect, rectify or delete your personal data. Moreover, you are entitled to lodge an objection to your personal data being processed by M Restart, and you are entitled to data portability. This means that you can submit a request to us for the personal data concerning you that we have in our possession to be sent in a computer file to you or another organisation you have designated.
You can send a request for inspection, rectification, deletion, or transfer of your personal data, a request for the withdrawal of your consent or an objection to the processing of your personal data to email@example.com.
To ensure that you are the person who submitted the request for inspection, we request you to send a copy of your proof of identity with the request. In any such copy use black ink to make your passport photograph, MRZ (machine readable zone, the section with numbers at the bottom of the passport), passport number and Citizen Service Number (BSN) unreadable. This is to protect your privacy. We’ll reply to your request as soon as possible, but in any case within four weeks.
10. How we protect personal data
M Restart takes the protection of your data seriously and takes appropriate measures to combat misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration. If you have the impression that your data are not properly protected or if there are indications of misuse, please contact Ms. C. Wagemakers, via firstname.lastname@example.org.
11. What to do in the case of complaints?
M Restart would also like to point out, in connection with the processing of your personal data, that you have the option of submitting a complaint to the national supervisory authority, the Dutch Data Protection Authority (Dutch DPA). You can do so using the following link: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons.