This Privacy Statement This Privacy Statement informs you, as a data subject, about the reasons why and the way in which Validata Group BV and Validata Group Sweden AB (‘Validata’) handles your personal data. This statement applies to all processing of personal data in the context of a screening performed by Validata.
2. Legal framework
Validata is specialised in screening individuals by means of a digital screening process. We process your personal data in order to perform aAs an organization based in the Netherlands, the processing of personal data within Validata is subject to the General Data Protection Regulation (‘GDPR’). Validata only processes personal data in the context of a screening in its office located in the Netherlands. This means that, the Dutch ‘Act Implementing the GDPR’ must be taken into account. With regard to its screenings services involving Member States other than the Netherlands, like Sweden, Validata also considers the implementation laws of those Member States, like the Swedish ‘Law 2018: 218 with Additional Provisions of the GDPR’.
3. Is Validata process personal data?
Validata is specialised in screening individuals by means of a digital screening process. We process your personal data in order to perform a screening of relevant data at the request of a client. ‘Relevant’ means that only data is checked that is in relation to the position or the reason why you enter into or intending to enter into an agreement.
4. Is Validata the data controller for the personal data?
Validata is the independent data controller in the context of the processing of personal data within the meaning of the GDPR. Our contact details are:
Data Controller Data Controller
Validata Group BV Validata Group Sweden AB
Apollolaan 151 Vasagatan 28
1077 AR Amsterdam, The Netherlands 111 20 Stockholm, Sweden
+31 (0) 20 535 6898 +46 (0) 84413840
Chamber of Commerce no. 34346504 Organization number: 559338-7706
Validata has a Data Protection Officer (‘DPO’) who is registered with the Dutch Data Protection Authority. The DPO can be contacted via firstname.lastname@example.org.
5. On what legal basis does Validata process personal data?
Our client has a legitimate interest (as defined in Article 6, paragraph 1, point (f) GDPR) to have your integrity assessed and therefore determines whether, and if so, to what extent, certain parts of your personal data need to be screened. The components of the screening have been determined by the client based on its policies, taking into consideration the applicable requirements set out in the GDPR. These include the requirements of proportionality and subsidiarity, meaning that the screening should only verify data that relate to the risks associated with the (planned) employment in a specific job or with the rental or sale of a home. Our client uses the online application of Validata to initiate your screening.
6. What personal data does Validata process?
For each screening, Validata processes the following personal data, which we receive from you or from our client:
- Data concerning your name and address, gender, email address and telephone number.
In addition, depending on the client’s screening policy and the resulting components of the screening, the following personal data and/or documents may be processed:
- Curriculum Vitae (CV)
- Date of birth
- Identity document
- Data concerning your salary
- Personal identity number or coordination number
- Driving licence
- Criminal Record
- Data concerning your educational background
- Data concerning your work experience
- Data of referees
- Data from sector and/or professional registers
- Data concerning your financial situation; including data from the register of persons under guardianship, data from the insolvency register, the ratio of your personal financial liabilities to your earnings or assets, and your credit rating
- Data from social media and/or public sources
- Data from international terrorist watchlists, politically exposed persons (PEP) lists and sanctions lists, and
- Data relating to additional documents that are gathered, verified or checked at the request of our client, such as a payslip, confidentiality statement, employer’s statement, disciplinary law statement and/or a code of conduct.
7. From whom does Validata receive personal data?
In order to perform specific components of a screening or to verify data, Validata receives personal data from the following parties:
- our client(s)
- data suppliers in the context of performing a screening
- relevant educational institutions
- employers and/or other persons submitted by you as referees.
8. With whom does Validata share personal data?
In order to perform specific components of a screening or to verify data, Validata shares the necessary personal data with the following parties:
- data suppliers
- relevant educational institutions
- employers and/or other persons submitted by you as referees
- our client
9. With which data suppliers are personal data shared?
Validata has concluded agreements with its data suppliers that set out arrangements to ensure a correct and secure processing of your personal data. Validata’s data suppliers are:
- Mitek Systems
10. Are special categories of personal data processed?
In some cases, Validata processes special categories of personal data. This depends on which components are included in the screening. The components of the screening have been determined by the client based on its policies, taking into consideration the potential risks associated with a specific job, a membership, specific work activities, or with the rental or sale of a home. Prior to the screening, you will be informed about the (special categories of) personal data that need to be processed.
11. Is submitting to the screening mandatory?
You have the right not to be screened. Chances are though, that this limits your chances to enter upon a new agreement or position that requires a screening. If you object to (all or parts of) the screening or have any questions, please contact the client. After all, the client has determined the composition of the screening in its policy.
12. Is my data secure?
Validata has taken appropriate technical and organisational measures to protect personal data against loss or any form of unlawful processing.
13. How long will my data be stored?
Validata stores your personal data for a period of 90 days after your screening has been completed. The identity document and the driving license will be kept for two weeks after the screening has been completed and will then be removed.
14. Will my personal data be transferred to other countries within or outside of the EEA?
Validata processes your personal data within the European Economic Area (EEA). Under certain circumstances, (all or parts of) your personal data may be transferred to a ‘third country’ outside of the EEA. This is the case, for example, if you are based in third country outside of the EEA, or if the client, a data supplier, or another party with whom we share your personal data, is based in such a third country.
Under the GDPR, an adequate level of protection must be ensured when transferring personal data within the EEA. The transfer of personal data to a third country outside of the EEA is permitted, provided that an adequate level of data protection or appropriate safeguards are ensured. In the absence of this, the transfer of personal data is permitted if the transfer is necessary for the performance of a contract concluded in your interest as a data subject between Validata and the client (Article 49, paragraph 1, point (c) GDPR).
15. Please be advised of your (privacy) rights:
- Right of access: To access the personal data gathered on you by Validata, please login via your personal account at Validata.
- Right to rectification: To request changes or additions to the personal data gathered on you, please send an email to Validata.
- Right to erasure (‘right to be forgotten’): You can request Validata to erase your personal data from Validata’s systems; for example, if Validata no longer needs the personal data in the context of the business activities agreed with the client.
- Right to restriction of processing: You can request Validata to (temporarily) stop processing your personal data.
- Right to object: You can object to the processing of your personal data.
- Right to lodge a complaint: If you have a complaint about our services, you can lodge a complaint with Validata to our department Support via email@example.com.
Please also be advised that you can lodge a complaint with the Dutch Data Protection Authority and/or the Swedish Data Protection Authority (www.IMY.se) about how Validata handles your personal data.
If you have any queries concerning the above matters, please contact our department Support via firstname.lastname@example.org.
16. Version Privacy Statement
This Privacy Statement may change from time to time. On our website you always find the most recent version.