Privacy statement - Brainnet Groep
As of 1 May 2021
Our vision on privacy
Brainnet helps organisations to search for, find and select external professionals, arranges the hiring processes and manages and administers Service Contracts. We refer to external professionals as being ‘experts’. We believe in a transparent labour market and in a transparent privacy policy. We consider the privacy of our experts, our own employees, people who we contact at suppliers and clients, applicants, employees hired by Brainnet, and other business relations highly important. Within Brainnet, we weigh up all of the interests and consider your right to privacy to be extremely important. This privacy statement explains how we protect your privacy and how we handle your personal data.
Who processes your personal data?
Brainnet is located in Nieuwegein, on the Marconibaan 1A (3439 MR). Brainnet and its affiliated companies, including Brainnet B.V. and Flexbrain Detachering Publieke Sector B.V. (referred to together as: “Brainnet”), process personal data. Brainnet is the controller for the personal data that are processed in accordance with this privacy statement. Brainnet has an officer for data protection. The data protection officer can be reached at the following e-mail address: avg@brainnet.nl.
What are personal data and when are they processed?
Personal data include all of the data that can be used to identify a person. Are you a self-employed professional or a sole proprietor? Then you are legally also considered to be a person and personal data will concern data that can identify you, directly or indirectly. You have already shared personal data with us when you contacted us. For instance, your name, telephone number and/or e-mail address.
Specific personal details are considered to be sensitive data, for instance data about your health, criminal record, religious or philosophical beliefs, membership of a trade union, sexual orientation or data concerning race or ethnic origin. In principle, we do not process specific personal details. We only process specific personal data if is required for the service we provide and if it we are statutorily obliged to do so, if this is done with your consent or if you ask us to do so.
‘Processing’ personal data is generally understood to mean performing any action on it, for instance, collecting, storing, using, forwarding or deleting personal data.
From whom do we process personal data?
We process personal data from people with whom we have, want to have or have had a direct or indirect relationship. For instance, this means personal data from:
- experts;
- our own employees;
- people related to the suppliers;
- people related to the clients;
- people interested in our services;
- people who are related to another company or another organisation with which we have, want to have or have had a business relationship.
How do we get your personal data?
We receive your data because you give them to us, for instance, when you enter into an agreement with us or when you use the service we provide. We can also receive your data from third parties. For instance, from suppliers or other parties that Brainnet collaborates with. We have agreed with our suppliers that when they forward your personal data they will point out this privacy statement to you.
For what purposes and on what grounds do we process personal data?
Brainnet can only perform its activities effectively if we know you well. Therefore, we ask for and process your personal data. The Brainnet organisation is comprised of several activities. Below is an explanation of the personnel data we process for each activity, the purpose for which we process it and on what legal grounds.
Recruitment
We search for suitable experts to carry out temporary activities for our clients. Brainnet comes into contact with these experts in various ways. In the first place by them applying directly to Brainnet. The expert will then be given access to a portal that contains the Service Contracts for the Brainnet clients. Secondly, an expert can be recommended to us via a Brainnet supplier. In both cases, Brainnet will process the expert’s personal data. We process this personal data for our recruitment and selection activities and to be able to establish where the expert can be deployed.
These personal data must be processed to be able to contact the expert, to investigate whether the expert can be deployed for a client’s Service Contract, to be able to enter into a Service Contract with (the supplier of) this expert, but also to enter into a Service Contract with a client regarding the employability of the expert. This processing is mainly necessary for the execution of a contract the expert is part of, or to be able to contact the expert at their request prior to entering into this contract. Furthermore, Brainnet has a justified interest in processing the personal data of the expert, because it makes it possible to select the appropriate expert for the Service Contract.
The personal data of the expert that we process for our recruitment activities, include name and address details, date and place of birth, e-mail address, telephone number, curriculum vitae (CV), education details (including the highest level diploma) and other details that can be of interest when assessing the suitability of the expert for a certain job, for instance references and attestations. If you wish to access our portal, we will also process your IP address. We ask your permission to record this IP address.
In some cases, Brainnet can use artificial intelligence during their recruitment activities. Artificial intelligence is used more and more in the flex branch to form the perfect match between a candidate and client. Brainnet can use artificial intelligence to speed up the recruitment process and to make it more fair and more objective. Brainnet wants to continue to innovate and can, by carefully using artificial intelligence, respond even better to the wishes and needs of their clients and candidates. In this context, Brainnet handles the interests of those involved very carefully.
The software Brainnet uses in its recruitment and selection process can use fully anonymised historical data to predict which candidate will be most suitable for a vacancy. This software uses a specific form of profiling. The software is programmed in such a way that it only processes the minimum required data from candidates. From a precision standpoint the outcomes of the software are tested and assessed by Brainnet's recruiters at all times to ensure that these outcomes are fair. The software won't replace the work of the recruiters, but rather supports them in this work. The emotional intelligence of a recruiter is and remains essential in the selection process of Brainnet. The recruiters will therefore continuously check whether they agree with the selection made by the software. There will be no solely automated decision-making.
For Brainnet, the use of artificial intelligence is in a number of cases necessary to reach an agreement with the most suitable candidate at the request of both the client and the candidate. Therefore, Brainnet has a legitimate interest in using this form of selecting candidates. Candidates who are selected or rejected after using this software (and the subsequent human assessment by Brainnet recruiters) will be notified by Brainnet. They can request additional information from Brainnet about the software, the algorithms used, the profile and the segments into which they are classified, as well as the personal results of this process. Candidates may also request Brainnet to rectify or delete their data and they have the right to object to the use of the software.
Pre-employment screening
Brainnet regularly performs pre-employment screenings for its clients. Screening is always a customised activity and depends on the requirements set by the client. We only perform a pre-employment screening for our clients after establishing that the client has a justified reason for performing this screening, which is more important than the expert’s (privacy) rights. If this is the case, we process the expert’s personal data to be able to assess the expert’s suitability and integrity with respect to a specific position. The specific nature of the position can mean that (strict) pre-employment screening is required. For certain positions, for instance those in the financial sector, screening is even a statutory requirement.
When performing a pre-employment screening, we always process the name and the address details of the expert we screen. We also process, among other data, the date and place of birth, e-mail address, telephone number, recent curriculum vitae (CV), educational details and other details that could be of interest within the framework of assessing the expert’s suitability.
Dependent on the degree of pre-employment screening, we also process information from (ex-) employers and/or clients, details about the expert’s labour history (e.g. data related to suspension and dismissal), a Verklaring Omtrent het Gedrag (‘VOG’ - certificate of good conduct) or a Verklaring van Geen Bezwaar (‘VGB’ - declaration of no objection) and an overview of the secondary functions performed.
Contract management
When Brainnet enters into a Service Contract with (a supplier of) an expert or a client, the expert’s personal data must be processed. These personal data are necessary for the execution of a contract the expert is part of or to be able to contact the expert at their request prior to entering into this contract. We are also legally obliged to establish the identity of an expert when he or she is employed on a Service Contract. Brainnet also has certain obligations arising from the Wet Ketenaansprakelijkheid (Dutch Sequential Liability Act). Based on these statutory obligations, we must also include certain (financial and fiscal) data of an expert in our records.
The expert’s personal data that we process within the framework of contract management include the name and address data, nationality, gender and a BSN (citizen service number) and/or ID number.
Purchase records/invoices
Brainnet suppliers can send us an invoice related to the expert’s activities. We send invoices to our client. The timesheets for these invoices include personal data, namely the expert’s name and the name and contact data of the client’s manager. These personal data must be processed to execute the Service Contract and to be able to pay the invoices relating to that contract.
Clients/suppliers
If a supplier or a client wants to purchase a service from us, Brainnet requires personal data from one or more of the contacts at the organisation. These personal data are needed to enter into, for instance, a Service Contract or hiring contract with this organisation or to contact this organisation about current business. If you are one of our suppliers or clients, of course we want to provide you with a good service. This is another purpose of processing your personal data while pursuing Brainnet's legitimate interests. For instance, we use your name and (business) address data to maintain contact with you. We can also use these data to check, for instance, whether you are allowed to represent your organisation. If this is the case, we also have a legitimate interest in processing these personal data.
Employees
We process the personal data of our own employees who work for Brainnet under an employment contract or a service contract. This data processing is necessary for the performance of the employment contract or service contract that we have entered into with our employees, such as the administration of salary and other employment terms. We also process data from our employees to pursue Brainnet's legitimate interests, such as the performance of business processes and internal management, travel and expense reporting, reports and access to systems and facilities, training, compensation and other management purposes in the interest of the Brainnet company. Finally, we process our own employees’ personal data in order to comply with our legal obligations as an employer, including tax and social security regulations and labour law provisions.
In this respect, we process the following personal data of our employees: name and address, date and place of birth, sex, private e-mail address, IP addresses, telephone number, BSN and/or ID number, relatives’ contact details, educational background and diploma details, references and testimonials, salary data, job description, and driver’s license data.
Applicants
We process personal data from applicants for positions at Brainnet. The personal data that you share with us, including name and address details, date and place of birth, e-mail address, telephone number, curriculum vitae (CV), educational details (including the highest level diploma) and other details that can be of interest within the framework of assessing the suitability for a certain job, for instance references and attestations. We handle these personal data with great care. Brainnet has a justified interest in processing the personal data of its applicants, as that makes it possible to select the appropriate person for the job.
Workers hired by Brainnet
When Brainnet hires workers, it enters into a Service Contract with (a supplier of) an expert. To do so, Brainnet must process the expert’s personal data, in order to execute the contract. The expert’s personal data that we process to enter into the Service Contract include your name and address data, nationality, gender and a BSN (citizen service number) and/or ID number.
Newsletters, magazines and other messages
We regularly send our clients, suppliers, experts and other business relations newsletters containing substantive and professional items and interviews, magazines and/or other messages dealing with the latest developments in the sector. In this context, we process personal data of our clients, suppliers and experts to pursue Brainnet's legitimate interests in maintaining close contact with its contracting parties. To be able to send our newsletter to the relevant people, we use the name and e-mail address of these people. We use your name and address details to send our magazine. We send a newsletter, magazine or other message to people who have given us permission to do so. You can also unsubscribe to these publications/messages.
What are the consequences of a refusal to provide personal data?
In principle, there are no general legal or contractual obligations that require you to provide Brainnet with your personal data. Besides, providing your personal data is in principle not a prerequisite for Brainnet to enter into an agreement with you. However, if you choose not to share your personal data with Brainnet and/or if you provide incomplete personal data to Brainnet, Brainnet has the right to refrain from entering into an agreement with you. In this case, Brainnet is also entitled to terminate the agreement already entered into with you in part or in full, provided that the personal data in question are required for administrative purposes and/or in order to meet the legal requirements Brainnet is bound to.
How do we deal with your personal data?
Brainnet and its affiliated companies have an SNA certificate (NEN 4400-1) and Brainnet is also ISO 9001/14001/27001 certified. We have taken appropriate technical and organisational measures to protect your personal data and to avoid abuse. We ensure that our systems and the portal that we use have the maximum protection. Our systems are continually updated. We also frequently ask for advice related to the security of our systems from reputable market parties. We do this to protect your personal data as well as possible.
We resolve and record data leaks. If required, we also report them to the inspector and to the parties involved. Within Brainnet, your personal data can only be used by employees who must have access to them to perform their job.
How long do we keep your personal data?
Your personal data are securely kept and no longer than necessary for the purpose for which they have been processed, unless we have received your permission to keep them for a longer period. We operate a storage policy which states how long we can keep data. The personal data that we have processed within the framework of a Service Contract with a client are kept for five (5) years after the termination of the contract, unless we have reason to keep them longer. We store our own employees’ personal data processed by us for up to five (5) years after the termination of the employment contract or service contract. For fiscal data, we employ the legal storage term of seven (7) years. Data that we have received from you for a selection process for a Service Contract for which you have not been selected are kept for up to six (6) months after the end of the selection procedure. Data related to applying for internal positions at Brainnet are kept for a maximum of four (4) weeks after the end of the application procedure, unless you have given us permission to keep your data longer, for instance, because a suitable position for you could possibly arise at a later date.
Do we share your personal data with others?
In principle, Brainnet processes your personal data for its own business purposes. Brainnet will only share your personal data with third parties insofar as this is stated in this privacy statement.
First and foremost, Brainnet only shares your personal data with third parties if we have the statutory obligation to do so, because we have to implement an agreement with you or because we employ another service provider. For instance, inspectors and the Tax Authority can request data from us based on the legislation. Furthermore, a judge can request us to provide data. If you, for instance, commit a fraud, we can report you.
Sometimes, based on an agreement, we are obliged to share your data with another party or organisation. For instance, Brainnet shares an expert’s personal data with clients that are interested in employing the expert for a Service Contract. Brainnet also sends monthly key figure reports to its clients.
We also provide your personal data to other parties that we need to work with to provide our service. For instance, Brainnet can share experts’ personal data with the AMP Group that, on behalf of Brainnet, checks the identity details of the experts who are employed on a Service Contract.
Moreover, Brainnet uses various processing organisations. We have entered into contracts with these organisations that ensure that they guarantee that they will handle your personal data with as much care as Brainnet. In addition, these organisations guarantee that they will adhere to the existing privacy legislation.
If you wish, we can also provide your personal data to other clients or companies.
Do we transfer your personal data to a third country or international organisation?
We do not pass on personal data to a third country or international organisation, aside from the exception explicitly stated in this section of this privacy statement.
Brainnet shares some personal data of its own employees with companies of the Brainnet group based in Europe and the U.S. This refers in particular to the following data of its own employees: business e-mail addresses, IP addresses, sex, year of birth, year of employment, job description, and the salary data of its own employees. No adequacy decision applies to the information shared with its group company in the United States. However, Brainnet has implemented other safeguards in order to share this data with its group company in the U.S., namely by applying the standard data protection provisions for data controllers approved by the European Commission. A copy of these standard data protection provisions for data controllers may be requested via avg@brainnet.nl.
Aside from the aforementioned exception for Brainnet's own employees, Brainnet does not share other personal data with third parties or international organisations located outside the European Economic Area. However, Brainnet shares anonymised meta data for analytics purposes with Brainnet group companies located in Europe and the U.S. All references to personal data in this meta data have been completely removed, so that these meta data cannot be traced back to a natural person.
What rules apply when processing personal data?
As of 25 May 2018, Brainnet is bound to the General Data Protection Regulation (Algemene Verordening Gegevensbescherming - AVG) with respect to processing personal data in the Netherlands.
View or amend your personal data?
Do you want to know what personal data we have recorded about you? You can request from us an overview of the personal data we have processed. Do you think that your personal data have been incorrectly or incompletely processed or do you think that they should not have been processed? If so, you can request Brainnet to change, supplement, restrict or delete the data. You are also entitled to object to your personal data being processed and you are entitled to data transfer. In addition, you are entitled to withdraw any previous permission you have given, if this was why your personal data was processed. Consent withdrawal will not affect the legality of processing, subject to the consent before it has been withdrawn. If you send us such a request, we will as soon as possible, but in any case within four (4) weeks of receiving your request, explain to you the actions we have taken.
Questions or complaints?
For questions or complaints about how Brainnet processes personal data, please contact the data protection officer. You can send an e-mail to avg@brainnet.nl or send your written request to:
Brainnet B.V.
attn. Data Protection Officer
Request to inspect personal data
Postbus 549
3430 AM Nieuwegein
Complaints inspector
The Competent Personal Data Authority (Autoriteit Persoonsgegevens) monitors whether Brainnet adheres to the AVG. If you are of the opinion that Brainnet does not adhere to the applicable privacy legislation, you are entitled to file a complaint with the Personal Data Authority.
About this privacy statement
The regulations related to privacy legislation regularly change. Therefore, our privacy policy is never totally complete. We keep our policy up to date. As a result, Brainnet can change this privacy statement from time to time. If these changes are also important for you, we will point this out to you or notify you of the changes in a clear way. The most up-to-date version of our privacy statement can always be found on www.flexbrain.nl/en/privacy-statement. This privacy statement was last changed on 1 May 2021.