Privacy policy for employees, family members and emergency contacts

Exterus considers your privacy important and takes care that the personal data we receive are processed carefully and confidentially in accordance with the General Data Protection Regulation (GDPR). In this privacy policy we explain how and why we use and process your personal data.

Who is this policy for?

This privacy policy is relevant to people who are or were:

  • employees of Exterus B.V. and payroll employees of Exterus Payrolling B.V. collectively referred to as ‘employees’;

  • family members of employees;

  • emergency contacts of employees.

 There is a separate privacy policy for customers, suppliers, job applicants and users of Exterus websites. This can be found on exterus.nl.

What is personal data?

Personal data is all data that is related to a natural person. This means information that can directly or indirectly identify a person, such as name, address, telephone number and social security number.

Who is responsible for your personal data?

The party responsible for the processing of your personal data is Exterus B.V. or Exterus Payrolling B.V. (jointly referred to as 'Exterus'), both located at Princess Alexialaan 80, The Hague. The party responsible for your personal data is the Exterus company with which you or your family member/acquaintance has an employment contract.

What personal data do we process?

For employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

  • financial data, e.g. bank account numbers;

  • identification data, e.g. date of birth, passport copies, state issued identification number (BSN);

  • employment data, e.g. employment conditions, recruitment, internal job changes, termination of employment, assessments, pay slips;

  • leave and absence data (duration and dates);

  • residence permit, work permit;

  • details of the job application process, e.g. C.V., cover letter;

  • other personal data, e.g. marital status, photos, education.

In exceptional circumstances, special categories of personal data ('sensitive personal data') of employees may be processed, including:

  • medical data in the event of an accident at work;

  • dietary requirements for events.

For family members and/or emergency contacts of employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address.

For what purposes do we process your personal data?

Employees

Exterus processes the personal data of employees in order to carry out its obligations in relation to an employment contract, for example personnel and salary administration.

In other cases, personal data is processed on the basis of legitimate interest, for example the use of emergency contacts and for internal and external communication.

Exterus also processes personal data in order to comply with certain legal obligations, e.g. withholding and payment of income tax.

Family members and emergency contacts

The personal data of family members and emergency contacts can be used in emergency situations on the basis of legitimate interest, e.g. in the event of an accident at work.

How long do we keep your personal data?

Employees

A retention period of 7 years applies to personal data that are required for tax purposes.

A retention period of 5 years after the calendar year in which the employment ended applies to the wage tax statement and a copy of the proof of identity.

For other categories of data, such as appraisal reports and performance interviews, employment contracts, certificates, correspondence about recruitment, internal job changes and termination of employment there is a retention period of 5 years after the calendar year in which the employment ended.

Retention periods may be longer in exceptional cases, e.g. a legal obligation or in the event of a lawsuit.

Family members and emergency contacts

A retention period of 5 years after the calendar year in which the employment ended applies to the personal data of family members and emergency contacts.

How do we collect your personal data?

Employees

The personal data of employees are provided by the employee.

Family members and emergency contacts

Personal data of family members and emergency contacts of employees are provided by the employee.

Does Exterus share your personal data with third parties?

Exterus may only share your information with third parties for the purposes described above. These other parties can be:

  • other entities that are part of the Exterus organisation;

  • government bodies, e.g. tax authorities, the UWV (provider of employee insurance schemes), occupational health and safety service and the IND (the immigration authority);

  • parties to whom Exterus is obliged to provide data in connection with the performance of the employment contract, e.g. insurers and pension funds;

  • parties that perform work on behalf of Exterus, e.g. IT service providers, lawyers and accountants.

If payroll employees work for a customer of Exterus Payrolling B.V, Exterus sometimes has to share personal data about these employees with the customer, e.g. hours worked and salary.

Where Exterus shares personal data with third parties in countries outside the European Economic Area (EEA), we always take the necessary measures to protect this data, including contractual agreements.

How is your personal data protected?

Exterus protects all personal data it processes against unauthorised and unlawful access, alteration, disclosure, use and destruction. To achieve this, we have taken appropriate technical and organisational measures to guarantee a security level appropriate to the risk taking into account current best practice. Where Exterus uses services from third parties, Exterus will establish agreements on adequate security measures for personal data in a data processing agreement or contract.

Your privacy rights

You have the right at all times to see what personal data Exterus holds on you. If you make use of this right, we request that you specify which personal data you would like to receive. In the event that such data is incorrect or incomplete, you have the right to correct the data.

You also have the right to:

  • request the deletion of your personal data;

  • request (temporarily) limiting the processing of your data;

  • object to the processing of your personal data.

Any such request will be met unless there are legitimate grounds for the processing.

You can also receive a summary of your personal data in order to transfer it to another service provider.

If you wish to exercise your rights, you can contact us at any time using the contact details below.

Contact details

If you have questions about the collection and processing of your personal data or wish to make use your rights, you can contact:

Exterus B.V./Exterus Payrolling B.V.

t.a.v. Privacy Officer

Prinses Alexialaan 80

2496 XA Den Haag

E-mail: info@exterus.nl

If you are not satisfied with the response from Exterus, you can complain to the Dutch regulator, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ  DEN HAAG (https://www.autoriteitpersoonsgegevens.nl/nl).

Changes to this privacy notice

Exterus may need to change this privacy notice from time to time. This privacy notice was last updated on 1 February 2022.