SURF application privacy statement

Introduction

SURF B.V. (hereinafter SURF or us) processes your personal data in the context of our application procedure and is therefore the data controller for your personal data within the meaning of the General Data Protection Regulation (AVG). SURF processes your personal data for the following purposes:

Replying to emails
Contacting applicants
Assessing how suitable applicants are for a position
Create applicant account
Keep informed of suitable vacancies (optional)

These processing operations result in personal data of applicants and other interested parties being processed in SURF's systems, including Emply and Outlook, so that SURF can choose the most suitable person for each position. Assessing applicants is done on the basis of work experience, motivation and personal skills, among other things.

You can exercise a number of rights under the AVG in relation to your personal data. These rights are the right to access the personal data we process about you and to have this data corrected if it is incorrect. In addition, in some cases you have the right to have this data erased, have it transferred to another party, limit the processing of your personal data or object to it. See also paragraphs 2.10 and 2.11.

This privacy notice provides information on:

Why SURF processes personal data about you;
Why we may;
From whom we process personal data;
How we receive your personal data;
What personal data we process;
Who receives your personal data;
Transfer outside the EEA;
How long we keep your personal data;
Whether we use automated decision-making;
What rights you have;
Your right to object.

You can ask questions about this privacy statement by contacting: recruitment@surf.nl

Contact details SURF:
SURF B.V.
Moreelsepark 48
3511 EP, Utrecht
communicatie@surf.nl
+31 88 787 30 00

The contact details of our Data Protection Officer are:
Niels Huijbregts
fg@surf.nl

If you believe that SURF is not handling your personal data properly, you can submit a complaint to SURF's Data Protection Officer. SURF will always do its best to reach an acceptable solution in consultation. You also have the right to submit a complaint about SURF to the Netherlands Authority for Personal Data (Autoriteit Persoonsgegevens). More information on the Personal Data Authority and how to file complaints can be found at https://www.autoriteitpersoonsgegevens.nl.

Information on processing in the application procedurePolylang
```
placeholder do not modify
```

SURF processes your personal data if you apply for a position at SURF or wish to be kept informed of suitable vacancies at SURF. SURF is therefore obliged to process your personal data. SURF processes your personal data for various purposes.

Replying to emails

For answering questions sent to us via e-mail outside the application process and providing support, we process your e-mail address and any personal data contained in the e-mail.

Being able to contact applicants

If you apply for a vacancy at SURF or send an open application, we will process your e-mail address and telephone number to respond to your application and schedule any interviews.

Assessing how suitable applicants are for a position

Based on the information you provided in your CV and motivation letter, we assess how suitable you are for a position and whether you will be invited for (follow-up) interviews. We also view applicants' profiles on social media if this is necessary to gather the information we need to make a proper assessment.

Create applicant account

When you apply to SURF, an account is automatically created for you in our career centre where you can see all your applications.

Keep informed of suitable vacancies (optional)

If you give your consent, we will keep your data after an application for one year to keep you informed if a suitable vacancy becomes available for you.

Why may we process your personal data?

We process your personal data based on the legal bases preparing agreement, legitimate interest and consent.

To conclude a contract, we process applications based on cover letters and CVs and process contact data. We need to process this data to assess which individuals we wish to enter into an agreement with for a position and to schedule interviews to get to know applicants better. Without the provision of this data, SURF cannot conclude an agreement with an applicant.

When an applicant submits an application via the form on SURF's website, an account is automatically created in our career centre so that the applicant can see which application procedures are running. The creation of this account is based on SURF's legitimate interest in providing convenience to applicants and allowing them to easily withdraw applications.

In principle, we keep your application and contact data for up to four weeks after the application procedure is completed. If you give your consent, we will instead keep them for one year after the application process, so that we can keep you informed about suitable job opportunities. You can withdraw your consent at any time by sending an e-mail to recruitment@surf.nl.

Furthermore, you consent to us replying to your e-mail by sending us that e-mail. You may withdraw your consent at any time by sending an e-mail to the e-mail address you used to contact us.

From whom do we process personal data?

SURF processes personal data of applicants for the application process.

How do we receive personal data?

The personal data we process is obtained from the data subjects and is obtained through an external recruitment party.

What personal data do we process?

We process the following ordinary personal data to carry out the application process:

Contact details (possibly face if video calling)
Application data (CV, cover letter and notes from SURF staff)
Account details
Offer working conditions
```
.Polylang placeholder do not modify
```

We provide your data to:

Cloud and software provider Emply. (processor
```
)Polylang placeholder do not modify
```

SURF does not transfer your personal data to countries or organisations outside the European Economic Area.

Retention periods personal data

SURF does not use automated decision-making, including profiling, in the processing described in this privacy statement.

What rights do you have?

To start with, you have the right to have the personal data that SURF processes about you amended, supplemented or deleted. You can also request access to the personal data that SURF processes about you.

If it involves processing data provided by you yourself on the basis of your consent or the performance of an agreement with you (see 2.2) and the processing is automated (not on paper), you can request an overview in a structured and common form of the personal data we process about you. You also have the right to transfer this data to another party.

You can also request SURF to restrict the processing of your personal data, which will cause SURF to temporarily stop processing your data, if:

you object (see 2.11), or
you dispute the accuracy of personal data that SURF processes about you, or
you consider that the processing of data by SURF is unlawful, or
you consider that SURF no longer needs the personal data, but you need them in the context of a legal claim.

You can exercise your rights by contacting recruitment@surf.nl.

You can also delete data directly via your account.

Right of objection

You can also object to processing of your personal data if we process your data on the basis of a legitimate interest or the performance of a task of public interest (see 2.2). If SURF does not have compelling legitimate grounds to continue processing, SURF will cease processing.

You can also object if SURF uses your personal data for profiling or automated decision-making (see 2.9).

If you object, you can also submit a request to restrict the processing of your personal data during this objection.

In conclusion

This privacy statement does not apply to third-party websites to which we link on our website. SURF cannot guarantee that these third parties will handle your personal data in a reliable or secure manner. We advise you to read the privacy statement(s) of these website(s) before using them.

SURF may make changes to this privacy statement. We therefore advise you to consult this privacy statement regularly.

Please also read our cookie statement, where we explain which cookies we use on our website and for what purpose.