Privacy Statement – version 2022.1

2. Why does Validata process personal data?

Validata processes personal data to perform its primary business function, namely to conduct a screening on behalf of our client. The client decides to screen certain data subjects based on a certain screening profile, in line with its own internal screening policy. Personal data, relevant to trigger the screening, is requested by Validata from the client. However, to perform the screening itself, Validata decides what additional personal data is required from the candidate who is being screened.

3. Is Validata the data controller for the personal data?

Validata is the independent data controller in the context of the processing of personal data within the meaning of the GDPR. As such, Validata does not operate as data processor or joint data controller under the GDPR. Our contact details are:

Validata Group BV

Address – Apollolaan 151, 1077 AR Amsterdam

Telephone – +31 (0)20 5356898

Email – info@validatagroup.com

Chamber of Commerce no. 34346504

Validata has a Data Protection Officer (‘DPO’) who is registered with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), being the Dutch enforcer on privacy & data protection matters. The DPO can be contacted via privacy@validatagroup.com.

4. On what legal basis does Validata process personal data?

Our client has a legitimate interest (as defined in Article 6, paragraph 1, point (f) GDPR) to have your integrity assessed and therefore determines whether, and if so, to what extent, certain parts of your personal data need to be screened. The components of the screening have been determined by the client based on its screening policies, taking into consideration the applicable requirements set out in the GDPR. These include the principles of proportionality and subsidiarity, meaning that the screening should only verify data that relate to the risks associated with the (planned) employment in a specific job or with the rental or sale of a home. Our client uses the online application of Validata to initiate your screening.

5. What personal data does Validata process?

For each screening, Validata processes the following personal data, which we receive from you or from our client:

• Data concerning your name and address, gender, email address and telephone number.

In addition, depending on the client’s screening policy and the resulting components of the screening, the following personal data and/or documents may be processed:

• Curriculum Vitae (CV);
• Date of birth;
• Identity document: passport, (Dutch) identity card or Dutch document for foreigners obtained through the Dutch Immigration Services (IND);
• Processing BSN: Validata is not authorised to process your Social Security Number (SSN/BSN), so we request that you make it not processable (e.g. blacking the SSN/BSN out);
• Driving licence;
• Processing BSN: Validata is not authorised to process your Social Security Number (SSN/BSN), so we request that you make it not processable (e.g. blacking the SSN/BSN out);;
• Certificate of Good Conduct (VOG);
• Data concerning your educational background;
• Data concerning your work experience;
• Data provided by referees;
• Data from sector and/or professional (publicly available) registers;
• Data concerning your financial situation; including data from the register of persons under guardianship, data from the insolvency register, the ratio of your personal financial liabilities to your earnings or assets, and your credit rating;
• Data from declarations you have made, or from your integrity statement:
• Data concerning outside activities and/managerial positions;
• Data concerning circumstances that cast doubt on your reliability, competence or integrity;
• Data concerning convictions for a criminal or corporate offence or being treated as a suspect in an inquiry into a criminal or corporate offence;
• Data concerning legal entities: legal status, business information, financial information and/or managerial powers;
• Data from social media and/or public sources;
• Data from international terrorist watchlists, politically exposed persons (PEP) lists and sanctions lists, and;
• Data relating to additional documents that are gathered, verified or checked at the request of our client, such as a payslip, confidentiality statement, employer’s statement, disciplinary law statement (Verklaring Onderwerping Tuchtrecht (VOT)/Statement Subject to Disciplinary Law)) and/or a code of conduct.
• Data extracted and gathered from data subjects through telephone correspondence, after the data subject has given approval of the recording.

6. From whom does Validata receive personal data?

In order to perform specific components of a screening or to verify data, Validata receives personal data from the following parties:

• you;
• our client(s);
• data suppliers in the context of performing a screening;
• relevant educational institutions (within and/or outside of the Netherlands);
• relevant sector and/or professional (publicly available) registers, such as the BIG register (for healthcare professionals);
• employers and/or other persons submitted by you as referees.

7. With whom does Validata share personal data?

In order to perform specific components of a screening or to verify data, Validata shares the necessary personal data with the following parties:

• data suppliers;
• relevant educational institutions (within and/or outside of the Netherlands);
• relevant sector and/or professional (publicly available) registers, such as the BIG register (for healthcare professionals);
• employers and/or other persons submitted by you as referees;
• our client.

8. With which data suppliers are personal data shared?

In accordance with the GDPR, Validata has concluded (data processing) agreements with its data suppliers that set out arrangements to ensure a correct and secure processing of your personal data. Validata’s data suppliers are:

• DUO
• Nuffic
• Qualifícation Check
• Mitek Systems
• Company.info
• Focum
• EDR
• Dun & Bradstreet
• DataExpert
• KvK (Chamber of Commerce)
• iCOVER

9. Are special categories of personal data processed?

In some cases, Validata may process special categories of personal data. This depends on which components are included in the screening and is done in accordance with the GDPR. The components of the screening have been determined by the client based on its policies, taking into consideration the potential risks associated with a specific job, a membership, specific work activities, or with the rental or sale of a home. Prior to the screening, you will be informed about the (special categories of) personal data that need to be processed.

Validata has a licence under the Act on Private Security Firms and Detective Agencies (POB): POB licence no. 1533. Based on this licence, and provided that certain conditions are met as set out in the GDPR, Validate may process data concerning criminal convictions or treatment as a suspect in a criminal inquiry.

10. Processing identity document (ID document)

Validata processes ID documents to enable our client to meet its legal obligation to verify a person’s identity. This involves checking the authenticity of a scan of the ID document based on a number of security features. In addition, the document number is checked to establish that the document has not been reported stolen or missing. Validata is not authorised to process your Social Security  Number (BSN), so we request that you make this section of the ID Document not processable (e.g. by blacking out the BSN/SSN before uploading a scan of your ID document into our secure environment).

11. Is submitting to the screening mandatory?

You have the right not to be screened or to refuse a screening. The potential implications of the refusal to screen can produce certain outcomes, such as (but not limited to) the limitation of your chances to enter upon a new agreement or position that requires a screening. However, Validata in no way is (legally) responsible for the potential outcome of a refusal to be screened by the candidate, since Validata does not provide an opinion on this matter. Validata solely provides the client with factual findings and does not provide an opinion or advise on the recruitment decision of its client. If you object to (all or parts of) the screening or have any questions, we kindly advice you to  contact the client. After all, the client has determined the composition of the screening in its policy.

12. Which safeguards does Validata provide with regards to the security of the processing of my data?

Validata has, in accordance with ISO 9001 and 27001 certification, taken appropriate technical and organisational measures to protect personal data against loss or any form of unlawful processing. Furthermore, Validata is subject to periodical audits on security measures and has installed a full time Information Security Officer. For specific data security queries, please contact security@validatagroup.com.

13. How long will my data be stored?

Until the end of 2022, Validata is transitioning to a renewed service offered via a new screening platform. An important adjustment that has been made concerns the retention period of your personal data.

1. If your client has not yet switched to the new service, you will fall under the ‘old’ arrangement whereby Validata will keep your personal data for 5 years after your screening has been completed.
2. If your client has switched to the new service or started screening with Validata in 2022, you will fall under the ‘new’ arrangement whereby Validata stores your personal data for 90 days after your screening has been completed. Consequently, your personal data will no longer be kept available for a possible subsequent screening.

Your client knows whether you fall under the “old” or “new” arrangement. Our Support department can also inform you about this via support@validatagroup.com.

For both arrangements, the ID and driver’s license will be kept for two weeks after the screening has been completed and will then be removed.

14. Will my personal data be transferred to other countries within or outside of the EEA?

Validata processes your personal data within the European Economic Area (EEA). Under certain circumstances, (all or parts of) your personal data may be transferred to a ‘third country’ outside of the EEA. This is the case, for example, if you are based in third country outside of the EEA, or if the client, a data supplier, or another party with whom we share your personal data, is based in such a third country.

Under the GDPR, an adequate level of protection must be ensured when transferring personal data within the EEA. The transfer of personal data to a third country outside of the EEA is permitted, provided that an adequate level of data protection or appropriate safeguards are ensured. In the absence of this, the transfer of personal data is permitted if the transfer is necessary for the performance of a contract concluded in your interest as a data subject between Validata and the client (Article 49, paragraph 1, point (c) GDPR).

15. Please be advised of your (privacy) rights:

• Right of access: To access the personal data gathered on you by Validata, please login via your personal account at Validata.
• Right to rectification: To request changes or additions to the personal data gathered on you, please send an email to Validata.
• Right to erasure (‘right to be forgotten’): You can request Validata to erase your personal data from Validata’s systems; for example, if Validata no longer needs the personal data in the context of the business activities agreed with the client.
• Right to restriction of processing: You can request Validata to (temporarily) stop processing your personal data.
• Right to object: You can object to the processing of your personal data.
• Right to lodge a complaint: If you have a complaint about our services, you can lodge a complaint with Validata to our department Support via support@validatagroup.com. Should you have any complaints or questions on privacy and data protection matters, we kindly request that you contact our privacy & data protection department through privacy@validatagroup.com.

Please also be advised that you can lodge a complaint with the Dutch Data Protection Authority about how Validata handles your personal data.

If you have any queries concerning the above matters, please contact our department Support via support@validatagroup.com.

16. Version Privacy Statement

This Privacy Statement may change from time to time. On our website you always find the most recent version.