1. Klipspringer Terms and Conditions
2. Klipspringer Candidate privacy and CV retention Policy
3. Klipspringer Personal Data Breach Response Procedure

Business our Terms & Conditions

To all our business our Terms & Conditions (Algemene voorwaarden) apply. Our Terms & Conditions are registered / deposited at The Chamber of Commerce.

Please see TERMS & CONDITIONS / ALGEMENE VOORWAARDEN

Candidate Privacy and CV Retention Policy

Klipspringer Sourcing Agency BV — Netherlands

Policy owner: Management, Klipspringer Sourcing Agency BV
Effective date: 1 January 2025

1. Purpose and scope

Klipspringer Sourcing Agency BV is a recruitment agency specialising in permanent placements. We process personal data belonging to candidates and prospective candidates to identify suitable employment opportunities, assess professional suitability, introduce candidates to clients and administer recruitment and placement services.

This policy explains how we collect, use, share, store and delete candidate CVs and related recruitment records in accordance with the General Data Protection Regulation (GDPR) and the Dutch General Data Protection Regulation Implementation Act (Uitvoeringswet AVG).

2. Personal data we process

Depending on the recruitment process, we may process:

• Name and contact details.
• CV, employment history and professional qualifications.
• Relevant skills, experience and career preferences.
• Salary expectations, availability and notice period.
• Interview notes and candidate communications.
• Candidate consent records, client introductions and placement outcomes.

We do not routinely request special-category personal data, such as health information, religious beliefs or political opinions. We will only process such information where a specific lawful condition permits it and the processing is necessary.

3. Lawful basis for processing

Klipspringer Sourcing Agency BV identifies and documents an appropriate lawful basis for each processing purpose.

Depending on the circumstances, these may include:

• Pre-contractual steps: processing necessary to take steps requested by a candidate before entering into an employment-related arrangement.
• Legitimate interests: processing necessary for legitimate recruitment or business interests, where those interests are not overridden by the candidate’s rights and freedoms.
• Consent: retaining a candidate’s CV for future vacancies where consent is the chosen lawful basis.

We provide candidates with clear privacy information explaining the purposes of processing, the applicable legal basis, retention periods, recipients and their rights.

Consent for future vacancies is separate from participation in a specific recruitment process. Refusing future-retention consent will not, by itself, prevent a candidate from being considered for a vacancy for which their information can lawfully be processed.

4. CV collection and client introductions

Candidates may submit their CV directly or be identified through professional networking platforms, referrals or other lawful recruitment sources.

Where information is obtained from a source other than the candidate, we provide the privacy information required by applicable GDPR rules.

Before introducing a candidate to a prospective employer, we verify that the proposed disclosure is within the stated recruitment purpose, is supported by an appropriate lawful basis and is consistent with the information given to the candidate.

As a standard operating procedure, we obtain the candidate’s agreement to the specific client introduction before sending an identifiable CV to that client.

CVs are disclosed only to relevant clients and authorised recipients. We do not sell candidate CVs or circulate them indiscriminately.

5. Retention and deletion

Klipspringer Sourcing Agency BV retains identifiable candidate data only for as long as necessary for the relevant purpose.

1. Active vacancy

CVs and related application information are retained while the recruitment process remains active. Following the conclusion of the process, unsuccessful candidates’ vacancy-specific CVs and application records are deleted or anonymised within four weeks, unless a documented and lawful reason requires a different period.

1. Future recruitment opportunities

Where future-candidate retention is based on consent, the CV may be retained for up to 12 months from the date consent is obtained. Before the period expires, we will request renewed consent if further retention is required. If consent is not renewed, the CV will be deleted or anonymised unless another lawful basis justifies retention.

1. Successful permanent placements

After a successful placement, we remove the candidate’s CV from the active recruitment pool when it is no longer needed for that purpose.

Placement agreements, client correspondence, invoices and other necessary business records may be retained separately for the period justified by applicable contractual, tax, accounting or legal requirements, or for establishing, exercising or defending legal claims.

We do not automatically retain the entire CV or all interview notes for the same period as financial records.

1. Deletion requests

We assess requests for erasure promptly. Where the data is no longer necessary and no lawful exception applies, we erase it. If specific information must be retained for a valid legal obligation or legal claim, we restrict its use to that purpose where appropriate.

1. Routine review

We periodically review stored CVs and recruitment records, delete expired records and maintain a documented retention schedule.

6. Data security and confidentiality

Candidate information is accessible only to personnel who require it for their authorised duties.

We apply appropriate technical and organisational safeguards, including:

• Access controls and secure authentication.
• Secure storage and transmission of CVs.
• Confidentiality obligations for employees and contractors.
• Procedures for handling suspected personal-data breaches.

We maintain procedures for assessing and reporting personal-data breaches in accordance with applicable GDPR requirements.

7. Candidate rights

Subject to applicable law, candidates may exercise their rights to:

• Access their personal data.
• Correct inaccurate or incomplete information.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Request data portability where the legal conditions apply.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Requests may be submitted to contact@klipspringer.nl We will verify the request where necessary and respond within the applicable legal timeframe.

8. External service providers and international transfers

Klipspringer Sourcing Agency BV uses recruitment systems (Trello.com) and other service providers only where appropriate safeguards are in place. Where a provider processes personal data on our behalf.

Where personal data is transferred outside the European Economic Area, we ensure that the transfer complies with applicable GDPR requirements.

9. Responsibilities

Management of Klipspringer Sourcing Agency BV is responsible for ensuring that this policy is implemented and reviewed. Recruitment consultants must follow the approved retention schedule, document client introductions and avoid unnecessary collection or disclosure of personal data.

All staff must report suspected unauthorised access, disclosure, loss or misuse of candidate information promptly.

10. Policy review

This policy will be reviewed at least annually and whenever material changes occur in applicable law, recruitment practices, systems or business operations.

Company details

Legal entity: Klipspringer Sourcing Agency BV
Registered business address: Turfmarkt 8 brd – 2011 CA Haarlem The Netherlands
KvK registration number: 85740861
Privacy contact email: contact@klipspringer.nl
Website: www.klipspringer.nl

Personal Data Breach Response Procedure

Klipspringer Sourcing Agency BV

Legal entity: Klipspringer Sourcing Agency BV
Registered business address: Turfmarkt 8 brd – 2011 CA Haarlem The Netherlands
KvK registration number: 85740861
Privacy contact email: contact@klipspringer.nl
Website: www.klipspringer.nl

1. Purpose

Klipspringer Sourcing Agency BV is committed to protecting the confidentiality, integrity and availability of personal data processed during recruitment and permanent-placement activities.

This procedure establishes the steps to follow when a suspected or actual personal-data breach occurs, including the unauthorised disclosure, loss, alteration, destruction or access to candidate CVs, contact details, recruitment records, client information or employee data.

The procedure is designed to support compliance with the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

2. What constitutes a personal-data breach?

A personal-data breach may include, but is not limited to:

• Sending a candidate’s CV to the wrong employer or recipient.
• Disclosing candidate information without appropriate authorisation.
• Losing a laptop, mobile phone, USB drive or document containing personal data.
• Unauthorised access to the recruitment database, email account or cloud storage.
• A phishing attack, ransomware incident or compromised employee account.
• Accidentally publishing candidate information online.
• Deleting or altering recruitment records without authorisation.
• A recruitment software provider reporting a security incident affecting candidate data.
• Sending an email attachment containing personal data to the wrong person.

A breach must be assessed even if the incident appears minor or no harm has yet been reported.

3. Immediate reporting

Any employee, contractor or other person acting for Klipspringer Sourcing Agency BV who suspects a personal-data breach must report it immediately to management or the designated privacy contact.

Reports must not be delayed while the individual investigates the incident or attempts to resolve it independently.

The initial report should include, where known:

• Date and time the incident occurred or was discovered.
• Description of the incident.
• Systems, devices or documents affected.
• Categories and approximate number of individuals affected.
• Types and approximate volume of personal data involved.
• Whether the information was accessed, disclosed, lost, altered or destroyed.
• Actions already taken to contain the incident.
• Any known recipients, unauthorised users or other parties involved.

If all details are not immediately available, the report must still be submitted with the information currently known.

4. Containment and immediate response

Upon receiving a report, management or the designated incident coordinator must promptly assess the situation and take reasonable steps to contain the breach.

Depending on the circumstances, these steps may include:

1. Requesting the unintended recipient to stop accessing or using the information and securely delete it, where appropriate.
2. Revoking access permissions, disabling compromised accounts or resetting credentials.
3. Isolating affected devices or systems from the network.
4. Contacting the relevant IT provider, hosting provider or recruitment software provider.
5. Preserving relevant emails, system logs and other evidence.
6. Preventing further disclosure by removing exposed files or restricting public access.
7. Documenting each containment action and the time it was taken.

Evidence must be preserved where practicable. Staff must not destroy records, alter evidence or make unsupported assurances that the incident has been fully resolved.

5. Assessment and risk evaluation

Management or the designated privacy contact must assess the incident to determine whether a personal-data breach has occurred and what risks it presents to affected individuals.

The assessment must consider:

• The nature and sensitivity of the personal data.
• The number and characteristics of affected individuals.
• Whether the information was encrypted or otherwise protected.
• Whether an unauthorised person accessed or received the data.
• Whether the data can be retrieved, deleted or secured.
• Potential consequences, including identity fraud, financial loss, discrimination, reputational damage or unwanted contact.
• The likelihood and severity of harm to affected individuals.
• Measures already taken to reduce the risks.

Recruitment records may reveal sensitive information about a person’s employment history, salary, career plans or personal circumstances. The risk assessment must consider the actual information involved rather than assuming that a CV disclosure is harmless.

The outcome, reasoning and supporting evidence must be recorded.

6. Notification to the Dutch Data Protection Authority

Where a personal-data breach is likely to result in a risk to the rights and freedoms of natural persons, Klipspringer Sourcing Agency BV must notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

If notification occurs after the 72-hour period, the reasons for the delay must be documented and provided as required.

Management must ensure that the notification includes, as far as the information is available:

• The nature of the breach.
• The categories and approximate number of affected individuals.
• The categories and approximate number of affected records.
• The contact details of the privacy contact or other appropriate contact point.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

Where all information cannot be provided at once, further information may be submitted in phases without undue further delay.

A breach that is unlikely to result in a risk to individuals does not require notification to the supervisory authority. However, the breach and the reasons for the decision not to notify must still be documented.

The designated privacy contact must use the official reporting channel provided by the Autoriteit Persoonsgegevens.

7. Notification to affected individuals

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, Klipspringer Sourcing Agency BV must communicate the breach to those individuals without undue delay, subject to the exceptions in GDPR Article 34.

The communication must use clear and understandable language and explain:

• What happened.
• The types of personal data affected.
• The likely consequences.
• The steps taken to address the incident.
• Practical actions individuals can take to protect themselves, where relevant.
• How to contact Klipspringer Sourcing Agency BV for further information.

Management must document the decision to notify or not notify affected individuals, including the reasoning and relevant risk assessment.

8. Client and service-provider coordination

Where the incident involves a client, recruitment platform, cloud provider or other service provider, management must establish the parties’ respective roles and responsibilities under the applicable contracts and data-protection arrangements.

If Klipspringer Sourcing Agency BV acts as a data processor for a client, it must notify the relevant controller without undue delay after becoming aware of a personal-data breach.

Where a service provider processes candidate data on behalf of Klipspringer Sourcing Agency BV, the provider must be required to report relevant breaches promptly in accordance with the applicable data-processing agreement.

Contractual reporting requirements must be followed alongside applicable statutory deadlines.

9. Remediation and recovery

Following containment, management must coordinate appropriate remedial action to reduce the likelihood of recurrence.

Actions may include:

• Correcting access permissions and security configurations.
• Recovering or securely deleting exposed data where possible.
• Resetting credentials and strengthening authentication.
• Reviewing email handling and CV-sharing procedures.
• Providing additional staff training.
• Updating supplier requirements or contractual safeguards.
• Improving backup, monitoring and incident-detection arrangements.

Where necessary, management must assign responsibility and deadlines for each corrective action.

10. Incident register and documentation

Klipspringer Sourcing Agency BV must maintain a confidential personal-data breach register.

Each incident record must include:

• Unique incident reference.
• Date and time reported and discovered.
• Incident description and affected systems.
• Categories and approximate volume of data and individuals affected.
• Containment measures and investigation findings.
• Risk assessment and its rationale.
• Decision on supervisory-authority notification.
• Decision on notification to affected individuals.
• Copies or references to notifications sent.
• Corrective actions, responsible persons and completion dates.
• Final outcome and lessons learned.

All personal-data breaches must be documented, including incidents for which notification to the supervisory authority is not required.

Incident records must be stored securely, with access limited to authorised personnel, and retained for an appropriate documented period.

11. Responsibilities

All staff and contractors: Report suspected incidents immediately, preserve evidence and follow instructions from management.

Management or designated incident coordinator: Coordinate containment, risk assessment, documentation, regulatory reporting and corrective action.

IT and service providers: Support technical investigation, evidence preservation, containment and recovery.

External privacy or legal adviser: Provide specialist assistance where the incident is complex, involves high risks or requires legal interpretation. Strauswolfs B.V.

Delegating technical work does not remove the company’s responsibility to comply with its applicable legal obligations.

12. Review and testing

This procedure must be reviewed at least annually and after any significant personal-data breach or material change to the company’s recruitment systems or processing activities.

Klipspringer Sourcing Agency BV should periodically test its incident-response arrangements to confirm that staff know how to report incidents and that management can meet applicable notification deadlines.

Emergency contact details

Incident reporting contact: contact@klipspringer.nl
Internal reporting emailcontact@klipspringer.nl
Telephone: +31634277454

Regulatory reference: GDPR Articles 4(12), 32, 33 and 34.

Official Dutch regulator: Autoriteit Persoonsgegevens — https://autoriteitpersoonsgegevens.nl/

No rights can be derived from klipspringer.nl and its content

Klipspringer is WAADI registered. WAADI is legislation aimed at preventing illegal staffing practices and reducing worker exploitation.

WAADI Registration in Commercial Register of The Netherlands Chamber of Commerce

• Klipspringer is registered at Dutch Chamber of Commerce: KVK Amsterdam nr: 85740861–

• These Terms of Use govern use of this website www.klipspringer.nl (“Site”), (“Klipspringer, Klipspringer.nl” or “we”, “us”) with the primary purpose of providing interested persons with access to general information and material about the recruitment and executive search services offered by Klipspringer and its consultants. In certain countries, this Site may also allow you to view job listings and to apply for those jobs through a portal. Use of this Site and the available information and content shall be governed these Terms of Use,
including any updates or revisions made in accordance with the provisions explained below.
• All Site information is provided on an “as is” basis and to the best of our knowledge is accurate and complete as at the date of publication. However, we provide no warranties of any kind, including any implied warranties of care and skill, fitness for a
particular purpose or non-infringement of third party intellectual property rights. We make no representation or warranty about the accuracy or completeness of any information or that use of the Site will be risk or error free, uninterrupted or completely secure, or that errors or defects will be corrected. Users are advised to undertake routine checks of our Site for latest content and to take appropriate protective measures against viruses and other malicious objects.

Job Listings and Applications

• If you use the Site to view and / or apply for a job vacancy, you should be aware that all jobs are listed on behalf of third party clients of Klipspringer who have instructed us to manage a recruitment process on their behalf.
• We expressly do not make any representation or warranty about the accuracy of any information contained in a job listing.
• If you apply for a job, your application will be managed in accordance with a process which we will have agreed with the relevant client.
• Whilst we will use reasonable endeavors to remove expired job listings from the Site, we can give no guarantee that any vacancy listed on this Site remains open at any given time.
• For more detail about the information we collect from job applicants, and how that information is used and managed, please refer to our Privacy Policy.

Your use of this site

• You may only use this Site for lawful purposes when seeking employment or help with your career or when recruiting staff. You must not under any circumstances seek to undermine the security of the Site or any information submitted to or available through it. In particular, you must not seek to access, alter or delete any information to which you do not have authorized access, seek to overload the system via spamming or flooding, take any action or use any device, routine or software to crash, delay, damage or otherwise interfere with the operation of this Site or attempt to decipher, disassemble or modify any of the software, coding or information comprised in the Site.
• You are solely responsible for any information submitted by you to this Site and should ensure details supplied are true, accurate, up-to-date and not misleading or likely to mislead or deceive. Nor should you supply information that is discriminatory, obscene, offensive, defamatory or otherwise illegal, unlawful or in breach of any applicable legislation, regulations, guidelines or codes of practice or the copyright, trade mark or other intellectual property rights of any person in any jurisdiction. You are also responsible for ensuring that all information, data and files are free of viruses or other routines or engines that may damage or interfere with any system or data prior to being submitted to this site. We reserve the right to remove any information supplied by you from the website at our sole discretion, at any time and for any reason without being required to give any explanation.

Limitation of Liability

• Klipspringer shall not be liable for and hereby excludes liability for any loss, damage or injury (including any special, exemplary, indirect, incidental, consequential damages, costs or associated legal fees) that may be suffered as a result of access to or use of the Site or content to the fullest extent permitted by law. Our sole and exclusive liability for any reason shall be to discontinue access to or use of the Site or relevant content.

Intellectual Property

• Unless otherwise stated, all content on the Site (including artwork, graphics, photographs, images, screen shots, text, downloadable files, video clips, trademarks, logos, product names, slogans, and compilations of the foregoing) (collectively, “Content”) is owned or controlled by Klipspringer and its licensors and may be protected by Dutch and international copyright, trade mark and other intellectual property laws. Users are expected to respect these laws and limit the download and use of Content for personal, non-commercial purposes only in accordance with these Terms of Use. Users must not be copy, modify, reproduce or use Content for any other purpose without our prior written consent.

Links

• The Site provides links to a number of websites, including, Klipspringer is not responsible and does not accept liability for anything outside klipspringer.nl. Any links to other websites or content are provided for convenience only. We do not endorse or take responsibility for third party sites or content and shall not be liable for any damage or injury suffered from use or access of the same.

Currency of Content

• Klipspringer updates the information on this Site regularly and we reserve the right to delete, modify or supplement content at any time. Users are advised to undertake routine checks of the Site for the latest content. We may also revise and update these Terms of Use from time to time. Any revisions will be effective when we publish an updated version of these Terms of Use on our website. Access or use of the Site following updates to the Terms of Use constitutes acceptance of those updated terms. Users who do not accept these Terms of Use should not access or use the Site.
• We may, at our sole discretion and at any time, discontinue, restrict or prevent use of the Site, with or without notice. OBI will have no liability to users if access to the Site is discontinued.

Applicable law

• These Terms of Use shall be governed by and construed in accordance with the laws of The Netherlands. By using this Site, you agree to submit any dispute arising from use of the matters covered by these Terms of Use to the exclusive jurisdiction of the courts of The Netherlands.

Privacy Policy

• These Terms of Use apply to your use of the Site. For guidance about the ways in which we collect and use your personal information through the Site, please refer to the Privacy Policy.

General Provisions

• These Terms of Use constitute the entire agreement between you and Klipspringer regarding the use of the Site. They are a legally binding agreement which are accepted by you as a condition of use of the Site. They operate to the fullest extent permissible by law, provided that any provision that is unlawful, void, or unenforceable, shall be severed, but without affecting the validity and enforceability of any remaining provisions. Any failure by Klipspringer to act with respect to any breach shall not constitute a waiver of Klipspringer ‘s right to act with respect to future or similar breaches.

Privacy Policy

Klipspringer Sourcing Agency BV

Website: www.klipspringernet.nl
Registered company: Klipspringer Sourcing Agency BV
KvK registration number: 85740861 — Amsterdam, Netherlands
Effective date: 1 January 2025

1. Introduction

Klipspringer Sourcing Agency BV (“Klipspringer”, “we”, “us” or “our”) is committed to protecting personal data and processing it lawfully, fairly, transparently and securely.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data through our website, recruitment activities, permanent-placement services, executive search services and communications with candidates, clients, business contacts and website visitors.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the applicable Dutch data-protection legislation, including the Uitvoeringswet AVG.

By using our website, you do not automatically consent to every form of personal-data processing. We process personal data only where an appropriate lawful basis applies.

You are not generally required to provide personal data. However, if you choose not to provide information necessary for a particular recruitment or business service, we may be unable to provide that service.

2. Personal data we collect

The personal data we collect depends on your relationship with Klipspringer and how you use our services.

2.1 Candidates and job applicants

We may collect:

• Name and contact details, including email address and telephone number.
• CVs, employment history, qualifications, skills and professional experience.
• Career objectives, preferred positions, location preferences and availability.
• Salary expectations, notice periods and other job-related information.
• Interview notes, candidate communications and recruitment assessments.
• Information about applications, client introductions and placement outcomes.
• Information reasonably necessary to administer recruitment and permanent-placement services.

We seek to collect only information relevant and necessary for the recruitment purpose.

2.2 Clients and business contacts

We may collect names, professional contact details, job titles, company information, communications, contractual information and other data necessary to manage client relationships and provide recruitment services.

2.3 Website visitors

When you visit our website, we may process technical information such as IP address, browser type, device information, website usage data and cookie identifiers, subject to applicable law and your cookie preferences.

2.4 Newsletters and surveys

If you subscribe to a newsletter or participate in a survey, we may collect your name, email address, job title, company name, country of residence, preferences and responses, as applicable.

2.5 Special-category personal data

We do not routinely seek special-category personal data, such as health information, racial or ethnic origin, religious beliefs or political opinions.

If such information is genuinely necessary for a lawful purpose, we will process it only where an applicable GDPR Article 9 condition and any other relevant legal requirements are satisfied.

Where equality or diversity monitoring is undertaken, we will use anonymised or aggregated information wherever practicable. Data will not be described as anonymous unless individuals can no longer be identified by means reasonably likely to be used.

3. How we collect personal data

We may obtain personal data:

• Directly from candidates, clients and other individuals.
• Through CV submissions, job applications, interviews and professional communications.
• From publicly available professional profiles, recruitment platforms and referrals, where lawful.
• From clients or authorised recruitment partners involved in a recruitment assignment.
• Through our website, newsletter subscriptions, surveys and cookies.
• From service providers supporting our recruitment and business operations.

Where we obtain personal data indirectly, we will provide the privacy information required by GDPR Articles 13 or 14, subject to applicable exceptions.

Where information about referees or other third parties is provided to us, we expect the person supplying it to do so lawfully. We will provide relevant privacy information to those individuals where required.

4. Purposes and lawful bases for processing

We process personal data only for specified purposes and where an appropriate lawful basis under GDPR Article 6 applies.

Purpose	Possible lawful basis
Managing a specific job application and taking requested pre-contractual steps	GDPR Article 6(1)(b), where applicable
Searching for and assessing candidates for relevant vacancies	Legitimate interests under Article 6(1)(f), where appropriate and following a balancing assessment, or another applicable basis
Introducing candidates to prospective employers	An appropriate lawful basis determined for the specific recruitment activity
Retaining CVs for future vacancies	Consent where chosen as the lawful basis, or another demonstrably applicable basis
Managing client contracts, invoicing and business records	Contractual necessity, legal obligation or legitimate interests, as applicable
Sending newsletters and direct marketing	Consent or another lawful basis permitted by applicable law, including electronic-marketing requirements
Operating, securing and improving our website	Legitimate interests or another applicable basis; consent where required for cookies or similar technologies
Meeting legal obligations and establishing, exercising or defending legal claims	Legal obligation or legitimate interests, as applicable

We will not rely on consent where another basis is more appropriate. Where consent is relied upon, it must be freely given, specific, informed and unambiguous, and may be withdrawn at any time.

Where we rely on legitimate interests, we assess whether our interests are overridden by the rights and freedoms of the individuals concerned.

5. Recruitment, CV handling and client introductions

5.1 Specific vacancies

We use candidate information to assess suitability for relevant roles and provide recruitment services.

Where a candidate applies for a specific vacancy, we may share relevant information with the employer responsible for that vacancy, where the disclosure is covered by our lawful basis and privacy information.

As a standard recruitment practice, we seek the candidate’s agreement to a specific client introduction before sending an identifiable CV to that client.

5.2 Future opportunities

We may retain candidate information for future recruitment opportunities where an appropriate lawful basis exists.

Where consent is the chosen basis, candidates will be asked separately whether they wish their CV to be retained for future vacancies. They may decline or withdraw consent without being automatically excluded from consideration for a specific vacancy that can lawfully be processed.

5.3 Candidate confidentiality

We disclose CVs only to relevant authorised recipients for legitimate recruitment purposes. We do not sell CVs or distribute candidate information indiscriminately.

Candidates should inform us if their contact details, qualifications or other relevant information change.

6. Sharing personal data

We may share personal data with:

• Prospective employers and clients involved in relevant recruitment assignments.
• Recruitment partners and other entities supporting our search and placement services.
• IT, hosting, recruitment software, email and other service providers.
• Professional advisers, insurers and auditors where necessary.
• Public authorities, regulators, law-enforcement bodies or courts where legally required or authorised.

We share only the information reasonably necessary for the relevant purpose and apply appropriate contractual, confidentiality and security safeguards.

Where a service provider processes personal data on our behalf, we put in place a data-processing agreement where required by GDPR Article 28.

Where we act as a processor for a client, we process personal data in accordance with the client’s documented instructions and our contractual obligations.

7. International data transfers

Personal data may be processed or accessed in countries outside the European Economic Area (EEA) where our business arrangements or service providers require it.

Where a transfer is subject to GDPR Chapter V, we ensure that an applicable transfer mechanism is in place. This may include an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, and supplementary measures where necessary.

Information about the relevant safeguards may be requested using the contact details in this policy, subject to applicable law.

8. Data retention and deletion

We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of legal obligations, contractual requirements and legitimate business needs.

Our proposed standard retention schedule is:

Specific vacancy applications: CVs and unsuccessful application records will ordinarily be deleted or anonymised within four weeks after the recruitment process ends, unless a documented lawful reason justifies further retention.

Future recruitment opportunities: Where consent is the chosen lawful basis, CVs may be retained for up to 12 months from the date consent is obtained. We will seek renewed consent before further retention where necessary. If consent is withdrawn, or is not renewed, we will delete the information unless another lawful basis justifies retention.

Successful placements: CVs will be removed from the active recruitment pool when no longer needed for that purpose. Necessary placement agreements, client correspondence, invoices and other business records may be retained separately for applicable legal, accounting, contractual or claims-related purposes.

Client and business records: These will be retained according to a documented schedule reflecting the applicable legal obligations and the purposes for which they are required.

Website and marketing data: These will be retained according to their purpose, applicable legal requirements and, where relevant, cookie or marketing preferences.

These periods are internal policy targets, not universal statutory GDPR deadlines. We will review them against our actual business processes and applicable Dutch retention requirements.

When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of appropriately.

9. Data security

We implement appropriate technical and organisational measures to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure and unauthorised access.

Measures may include:

• Access controls and appropriate authentication.
• Secure storage and transmission of CVs.
• Confidentiality obligations for personnel and contractors.
• Security requirements for recruitment systems and service providers.
• Appropriate backup, recovery and access-management arrangements.
• Staff awareness and incident-reporting procedures.

No online system can be guaranteed to be completely secure. However, we will take reasonable and appropriate measures to protect the information entrusted to us.

10. Personal-data breach response

A personal-data breach includes a security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Examples include sending a candidate’s CV to the wrong recipient, losing a device containing recruitment records, unauthorised access to a recruitment database, or a compromised email account.

Klipspringer maintains an internal procedure for handling suspected and actual personal-data breaches.

10.1 Internal reporting

All employees, contractors and relevant service providers must report suspected or actual breaches immediately to management or the designated privacy contact. Reporting must not be delayed until the incident is fully investigated.

10.2 Containment and investigation

Management or the designated incident coordinator will promptly investigate the incident, contain the breach, preserve relevant evidence, identify the data and individuals affected, and assess the likelihood and severity of harm.

10.3 Notification to the supervisory authority

Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where required information is not immediately available, we may provide information in phases. Any delay beyond the applicable deadline will be explained as required.

Where notification is not required, we will document the breach and the reasons for our decision.

10.4 Notification to affected individuals

Where a breach is likely to result in a high risk to individuals’ rights and freedoms, we will inform the affected individuals without undue delay, unless a GDPR Article 34 exception applies.

The communication will describe the incident, likely consequences, measures taken and practical steps individuals can take to protect themselves, as appropriate.

10.5 Client and processor coordination

Where a breach involves personal data processed for a client, we will notify the relevant controller without undue delay where required by our role and applicable law.

Relevant service providers must notify us promptly of breaches affecting personal data they process on our behalf, in accordance with applicable legal and contractual requirements.

10.6 Incident records and corrective action

We maintain an internal breach register documenting incidents, investigations, risk assessments, notification decisions, actions taken and lessons learned.

We review incidents and implement appropriate corrective measures to reduce the risk of recurrence.

11. Cookies and website analytics

Our website may use cookies and similar technologies to support website functionality, security, analytics and user preferences.

The types of cookies actually used, their purposes, providers and retention periods must be reflected in our cookie information.

Where prior consent is required under applicable Dutch and EU law, non-essential cookies and similar technologies will not be activated before the required consent is obtained. Users must be able to manage their preferences and withdraw consent where applicable.

We may use third-party analytics services, such as Google Analytics, only where configured and used in accordance with applicable data-protection and cookie requirements.

Users can also manage cookies through their browser settings. Blocking certain cookies may affect website functionality.

12. Newsletters and marketing communications

Where we send newsletters or marketing communications, we will comply with applicable privacy and electronic-marketing requirements.

Where consent is required, we will obtain it before sending the relevant communications. Where another permitted basis applies, we will comply with the relevant legal conditions.

Recipients may unsubscribe using the instructions provided in the communication. We will honour applicable objections and withdrawal requests.

We will not use candidate information for unrelated marketing purposes without an appropriate lawful basis and any additional permission required by law.

13. Your privacy rights

Subject to applicable legal conditions, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Request data portability where the GDPR conditions are satisfied.
• Lodge a complaint with the competent supervisory authority.

To exercise your rights, contact us using the details in Section 15.

We may request reasonable information to verify your identity where necessary. We will respond within the applicable legal timeframe. Requests are generally handled free of charge, except where the law permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

Certain rights may be subject to legal exceptions.

14. Complaints and third-party websites

If you have a concern about how we handle your personal data, please contact us first so that we can investigate and respond.

You may also lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl/

This policy applies to personal data processed by Klipspringer through its website and recruitment and business services. External websites linked from our website may have their own privacy policies, for which their operators are responsible.

15. Contact details

For questions about this Privacy Policy, requests concerning personal data, or privacy complaints, contact:

Klipspringer Sourcing Agency BV
KvK registration number: 85740861
Registered jurisdiction: Amsterdam, Netherlands
Website: https://www.klipspringernet.nl
Registered business address: Turfmarkt 8 3rd 2011 CA Haarlem
Privacy contact email: contact@klipspringer.nl

We will review this policy periodically and update it when our processing activities, systems or legal obligations change.

Coming soon:

THE CODE OF CONDUCT FOR RECRUITMENT & SELECTION. The NVP Recruitment Code (hereinafter referred to as. ‘the code’) contains the basic rules that, …

What Are Cookies

As is common practice with almost all professional websites this site uses cookies, which are tiny files that are downloaded to your computer, to improve your experience. This page describes what information they gather, how we use it and why we sometimes need to store these cookies. We will also share how you can prevent these cookies from being stored however this may downgrade or ‘break’ certain elements of the sites functionality. For more general information on cookies see the Wikipedia article on HTTP Cookies.

How We Use Cookies

We use cookies for a variety of reasons detailed below. Unfortunately in most cases there are no industry standard options for disabling cookies without completely disabling the functionality and features they add to this site. It is recommended that you leave on all cookies if you are not sure whether you need them or not in case they are used to provide a service that you use.

Disabling Cookies

You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit. Disabling cookies will usually result in also disabling certain functionality and features of the this site. Therefore it is recommended that you do not disable cookies.

The Cookies We Set

Account related cookies

If you create an account with us then we will use cookies for the management of the signup process and general administration. These cookies will usually be deleted when you log out however in some cases they may remain afterwards to remember your site preferences when logged out.

Email newsletters related cookies

This site offers newsletter or email subscription services and cookies may be used to remember if you are already registered and whether to show certain notifications which might only be valid to subscribed/unsubscribed users.

Forms related cookies

When you submit data to through a form such as those found on contact pages or comment forms cookies may be set to remember your user details for future correspondence.

Site preferences cookies

In order to provide you with a great experience on this site we provide the functionality to set your preferences for how this site runs when you use it. In order to remember your preferences we need to set cookies so that this information can be called whenever you interact with a page is affected by your preferences.

Third Party Cookies

In some special cases we also use cookies provided by trusted third parties. The following section details which third party cookies you might encounter through this site.

This site uses Google Analytics which is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content. For more information on Google Analytics cookies, see the official Google Analytics page. From time to time we test new features and make subtle changes to the way that the site is delivered. When we are still testing new features these cookies may be used to ensure that you receive a consistent experience whilst on the site whilst ensuring we understand which optimisations our users appreciate the most.

More Information

Hopefully that has clarified things for you and as was previously mentioned if there is something that you aren’t sure whether you need or not it’s usually safer to leave cookies enabled in case it does interact with one of the features you use on our site. However if you are still looking for more information then you can contact us