A ready-to-use GDPR-compliant privacy statement for your internal team for Dutch nonprofits. Covers applicants, current employees (including volunteers and interns), and former employees. Adapt the placeholders, get legal review, and publish before hiring your first team member.
How to use this:
- Step 1: Adapt the placeholders. Replace every
[placeholder]with your organization's details. Remove any sections that do not apply (for example, remove the camera surveillance section if you have no office cameras). Add sections for any processing activities not covered here. - Step 2: Get legal review. Have a lawyer or privacy specialist review the final version before you publish it. The template follows Dutch law and GDPR requirements, but your specific situation may need additions or changes.
- Step 3: Publish and keep it current. Publish the statement where every team member can always find it (for example, on your own Slite). Review it at least once a year and after any significant change to your data processing.
Last modified on [date]
We consider it important to handle your personal data with care. When processing personal data, we comply with the relevant laws and regulations, such as the General Data Protection Regulation. We explain in detail which data we collect from you and how we handle it. We recommend that you read this privacy statement carefully. Check it regularly so that you are aware of any changes, since we may revise it at any time.
Scope
This privacy statement applies to the processing of personal data of our employees (including volunteers and interns) and former employees.
Employees
Personal data
If you are employed by us, we may process the following personal data about you:
- Basic personal data: name, address, date of birth, gender, phone number, email address, BSN number, copy of passport, nationality, marital status, photograph
- Position data: employee number, start and end dates, contract length, part-time percentage, role, cover letter, CV, assessment answers
- Financial data: salary, pension, IBAN, fees, payroll deductions, taxes and premiums
- Performance data: interview reports, evaluations, assessments
- Development data: training, courses, assessments, internship reports
- IT-related data: devices on loan, business email address, token, access rights and logging
- Leave data: vacation leave accrual and take-up of special leave
- Absence and reintegration data
- Correspondence, including emails
- Other personal data you provide to us
Special or sensitive personal data
We also process special or sensitive personal data. We are required to register your BSN number and sometimes process information about your health, such as data on absenteeism, reintegration, or maternity leave. We process this data only when necessary to comply with laws and regulations.
Purpose and legal basis
We process your personal data for the following purposes:
- Executing the employment contract (agreement)
- Managing and assessing performance (legitimate interest)
- Career guidance, payroll processing, training and development (legitimate interest)
- Complying with legal obligations in case of disability (legal obligation)
- Complying with legal administrative obligations (legal obligation)
- Keeping data after rejection for a future application (consent)
- Processing data for proper information management and organizational security (legitimate interest)
- Maintaining an internal and external overview of team members, with photo and contact details (legitimate interest)
- Using images and other personal data on social media and other communications (consent)
- Using personal data for statistical analysis (legitimate interest)
Retention period
We are required to retain your name and address details, date of birth, nationality, marital status, copy of ID, and data relating to tax and contribution obligations for 5 years after the end of employment.
We retain information about your position and terms of employment, including your employment contract, payroll records, correspondence, performance information, training records, and reintegration file for up to 2 years after the end of your employment, unless there is a legal dispute.
Sometimes we are required to keep certain data for 7 years in connection with the general legal obligation to keep records. Other data we keep only for as long as you are employed by us.
Access
Others only access your data on a need-to-know basis. Your employee file is kept digitally, with access limited to your supervisor and HR staff.
External recipients
We sometimes share personal data with external parties, such as the Tax Office (Belastingdienst) and UWV. In case of occupational disability, we share your data with our occupational health and safety service (arbodienst) and company doctor. We also share data with, for example, the supplier of our mobile telephony or the organization where you take a course.
Legitimate interest
As an employer, it is necessary to process certain personal data for proper and efficient operations: for example, to assess your performance or to log access to our systems. This includes managing and improving HR policies and preventing fraud or unethical behavior. We balance our organizational interests against your interests.
Consent
If we process your personal data based on your consent, you can withdraw it at any time by emailing [privacy contact email]. If we have used imagery or other personal data for print media with your consent, you can only withdraw consent for new use. Data used online, for example on social media, cannot always be deleted completely. We will do our best and take your legitimate interests into account.
Consequences of not providing data
In an employment relationship, providing certain data is often mandatory. Not providing, or incompletely providing, the requested information may have consequences for your employment relationship with us.
Former employees
Personal data
After your employment ends, we retain certain personal data. See the Employees section for which data we are required to keep and for how long. In addition, we retain:
- First and last name
- Email address, phone number, address
- Correspondence, including emails
- Other personal data you provide to us
Purpose and legal basis
We process your personal data for the following purposes:
- Keeping contact details (legitimate interest)
- Maintaining contact with former team members (legitimate interest)
Retention period
We keep your contact data no longer than necessary for our business interests, or until you request deletion.
Legitimate interest
As your former employer, we value being able to contact you for events such as a reunion or anniversary. We keep the contact information of former team members so that we can reach you personally.
Camera surveillance
We use camera surveillance to protect organizational property and the property of our employees and visitors, to secure access to our office, and to record incidents. Camera surveillance takes place at the entrance to our office. The cameras are both visibly and invisibly placed, and their presence is announced.
Remove this section if your organization does not use camera surveillance.
Automated decision-making
We do not engage in automated individual decision-making or profiling that may adversely affect you.
Your rights
You may ask us at any time to:
- Access the data we hold about you (right to access)
- Correct inaccurate or incomplete data (right to correction)
- Delete data we hold about you (right to be forgotten)
- Object to data processing
- Restrict data processing
- Transfer your data (right to data portability)
To exercise any of these rights, email your request to [privacy contact email]. We may need to verify your identity to fulfill your request. If you have a complaint about how we handle your data, please contact us first. If you are not satisfied with our response, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Sharing with external parties
We sometimes share personal data with external parties. We have entered into processing agreements with our processors. Where we share data with parties other than processors, we agree to confidentiality or enter into a data sharing agreement. We currently share data with the following parties:
- Payroll administration firm (processor)
- Payroll administration software (processor)
- Online work environment, including email (processor)
- Website hosting (processor)
- Occupational health and safety service (arbodienst) and company doctor (confidentiality)
- Tax Office (Belastingdienst)
- UWV
Transfer of personal data
We process and store your data within the European Economic Area (EEA).
Security
We have taken great care to secure your data both organizationally and technically. Our systems and communications are secured to prevent your data from reaching unauthorized parties. Others can only access your data on a need-to-know basis. Your employee file is kept digitally, with access limited to your supervisor and HR staff.