Privacy statement

The controller is Cruitor B.V., trading as Cruitor, established at Duinkerkenstraat 40, 9723 BT Groningen.

For questions about privacy or to exercise your rights, please contact us via the contact form at www.cruitor.com/en/contact.

This statement applies to professionals and candidates, to contact persons at clients and other business contacts, to professionals in a development programme, and to visitors to our website.

a. Professionals and candidates: name, contact details, place of residence, LinkedIn profile or other public professional profiles, CV and portfolio (if you share them), work experience, education, skills, preferences (such as role, salary expectations, availability and region), notes from conversations, results of subject-matter assessments, and references (only with your consent).

b. Professionals in a development programme: appointments, development goals and brief session notes.

c. Contact persons at clients: name, job title, organisation, business contact details, correspondence and arrangements, and invoicing details.

d. Website visitors: technical data needed to display and secure the website, such as IP address, browser type and time of visit.

e. Forms: the data you enter, such as name, email address, phone number, organisation, your question and, if you choose, your CV.

We do not ask for special categories of personal data (such as health, religion or ethnic origin), your citizen service number (BSN) or a copy of your ID. Please do not share such data unsolicited.

a. Introductory meetings and job search support: to get to know you, assess you on substance and look for suitable roles. Legal basis: performance of our arrangements with you or steps taken at your request (Article 6(1)(b) GDPR) and our legitimate interest in providing careful services (Article 6(1)(f) GDPR).

b. Introduction to a client: only with your explicit consent for each introduction (Article 6(1)(a) GDPR).

c. Actively approaching professionals: we sometimes find you through public professional profiles, such as LinkedIn. Legal basis: our legitimate interest in bringing suitable roles to the attention of professionals. We tell you who we are and where we obtained your details no later than at our first contact, and within one month. You can always object.

d. Talent pool: to contact you later about suitable roles. Legal basis: your consent.

e. Development programme: to carry out the programme your employer has commissioned from us. Legal basis: our legitimate interest in performing that assignment; development goals are shared with your employer only with your consent.

f. Clients and business contacts: to enter into and perform assignments, maintain contact and invoice. Legal basis: performance of a contract and our legitimate interest. We keep invoicing data because of a legal obligation (Article 6(1)(c) GDPR).

g. Website and forms: to operate and secure the website and to answer your question. Legal basis: our legitimate interest, or steps taken at your request.

h. Compliance with the law and establishing or defending legal claims, for example in a dispute about an introduction. Legal basis: legal obligation or legitimate interest.

We may use AI applications for support, for example to draft texts, summarise information, search for profiles or prepare conversations.

We do not take decisions about you based solely on automated processing within the meaning of Article 22 GDPR. A person always reviews the outcome and takes the decision.

We only use AI applications that are subject to appropriate security and data protection arrangements. Suppliers may not use your data to train their models.

a. Clients: only with your explicit consent for each introduction. A client is itself responsible for what it subsequently does with your data.

b. External specialists: subject-matter experts who help us with an assessment or a development programme. They work on our instructions, are bound by confidentiality and process your data only for that purpose, under a data processing agreement or comparable arrangements.

c. IT suppliers: for example for hosting, email, calendar and video calls, candidate management and AI applications. We enter into data processing agreements with them.

d. Advisers and authorities: for example our accountant, or a government authority where we are legally required to provide data.

We never sell your data.

Some suppliers may process data outside the European Economic Area (EEA). We only allow this where appropriate safeguards are in place, such as an adequacy decision of the European Commission or standard contractual clauses approved by the European Commission, with supplementary measures where necessary. On request, we will tell you which safeguards we use.

a. Introductory meeting or procedure without placement: up to four weeks after completion, unless you consent to the talent pool.

b. Talent pool: a maximum of twelve months after your consent. After that, we ask for your consent again or delete your data.

c. Records of an introduction (who, to which client, when): up to twelve months after the introduction, so that we can honour our arrangements with clients; longer only if a dispute is ongoing.

d. Placed professionals: as long as necessary for the guarantee and any development programme, and a maximum of twelve months thereafter.

e. Session notes from a development programme: no later than three months after the programme ends.

f. Clients and business contacts: for the duration of the business relationship and a maximum of twelve months thereafter. We keep invoices and accounting records for seven years, as required by Dutch tax law.

g. Technical website data: no longer than necessary for security and troubleshooting.

h. Messages via forms or email: as long as necessary to handle your question, then in accordance with the period for the category you belong to.

We take appropriate technical and organisational measures to protect your data against loss and unlawful use, such as encrypted connections, restricting access to those who need the data, and confidentiality arrangements.

We distinguish three kinds of cookies. Necessary cookies are always active: they make the website work and remember your cookie choice (for up to 13 months). Analytics cookies (anonymous statistics to improve the site) and marketing cookies (ads and personalised content) are only placed if you consent to them in the cookie notice.

You can change or withdraw your choice at any time via 'Cookie settings' at the bottom of every page. Until you consent, no analytics or marketing tools are loaded.

Fonts are served by our own website. As a result, no data is sent to an external font service when the website loads.

If we use analytics or marketing tools from third parties (such as Google or Meta), we name them in this statement, including any transfer outside the EEA.

You have the right to access your data, to have it corrected or erased, to restrict its processing, to object to processing based on legitimate interest, and to data portability. If you have given consent, you can withdraw it at any time; this does not affect processing that has already taken place.

You can submit a request via the contact form at www.cruitor.com/en/contact. We respond within one month. To prevent misuse, we may ask you to verify your identity.

If you have a complaint about how we handle your data, please contact us first via the contact form at www.cruitor.com/en/contact. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

We may amend this privacy statement, for example if our services or the law change. The date at the top shows when the statement was last amended. We will inform data subjects of material changes where reasonably possible.