Privacy policy for employees of Exterus’ customers, their family members and fiscal partners

Exterus considers your privacy important and takes care that the personal data we receive are processed carefully and confidentially in accordance with the General Data Protection Regulation (GDPR). In this privacy policy we explain how and why we process your personal data.

Who is this policy for?

This privacy policy is relevant to people who are or were:

  • employees of Exterus B.V.’s customers (‘employees’);

  • family members and fiscal partners of these employees;

There is a separate privacy policy for customers, suppliers, job applicants and users of Exterus websites. This can be found on exterus.nl.

What is personal data?

Personal data is all data that is related to a natural person. This means information that can directly or indirectly identify a person, such as name, address, telephone number and social security number.

Who is responsible for your personal data?

The party responsible for the processing of your personal data is Exterus B.V. ('Exterus'), located at Princess Alexialaan 80, The Hague.

What personal data do we process?

Immigration services

For employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

  • financial data, e.g. bank account numbers;

  • identification data, e.g. date of birth, nationality, state issued identification number (BSN), immigration service number (V-nummer);

  • copy documents, e.g. passport, birth certificate, marriage certificate, visas, diplomas, residency documents, C.V., employment contract, tenancy agreement;

  • duration, nature and reason for residence.

For family members of employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

  • identification data, e.g. date of birth, nationality, state issued identification number (BSN), immigration service number (V-nummer);

  • copy documents, e.g. passport, birth certificate, marriage certificate, visas, diplomas, residency documents.

Tax services

For employees and their fiscal partners, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

  • financial data, e.g. bank account numbers;

  • identification data, e.g. date of birth, nationality, state issued identification number (BSN);

  • employment data, e.g. salary, company information, VAT number, shareholder relationship and all other financially relevant information including tax data.

For foreign employees, the personal data we process can also  include:

  • residency permit, employment contract, C.V., diplomas, proof of previous residence.

Personnel and payroll services

For employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

  • financial data, e.g. bank account numbers;

  • identification data, e.g. date of birth, nationality, state issued identification number (BSN);

  • copy documents, e.g. passport;

  • employment data e.g. employer, function, type of contract, contract duration, employment terms and conditions, recruitment, internal job changes, termination of employment, training;

  • leave and absence data (duration and dates).

For partners of employees, the personal data we process can include:

  • contact details, e.g. name, address, telephone number, e-mail address;

For what purposes do we process your personal data?

Exterus processes the personal data of employees, their family members and fiscal partners as part of its contractual obligations to provide e.g. tax, immigration, personnel or payroll services.

Exterus also processes personal data in order to comply with certain legal obligations, e.g. withholding and payment of income tax.

How long do we keep your personal data?

A retention period of 7 years applies to personal data that are required for tax purposes.

A retention period of 5 years after the calendar year in which the employment ended applies to the wage tax statement and a copy of the proof of identity.

A retention period of 5 years after the end of the sponsorship applies to documents relevant to recognised sponsorship.

For other categories of data, there is a retention period of 5 years after the calendar year in which the employment ended.

Retention periods may be longer in exceptional cases, e.g. a legal obligation or in the event of a lawsuit.

How do we collect your personal data?

Employees

The personal data of employees are provided by the employee or by their employer.

Family members and fiscal partners

Personal data of family members fiscal partners of an employee are provided by the employee or by their employer.

Does Exterus share your personal data with third parties?

Exterus may only share your information with third parties for the purposes described above. These other parties can be:

  • other entities that are part of the Exterus organisation;

  • government bodies, e.g. tax authorities, the UWV (provider of employee insurance schemes), occupational health and safety service and the IND (the immigration authority);

  • parties to whom Exterus is obliged to provide data in connection with personnel and payroll services, e.g. insurers and pension funds;

  • parties that perform work on behalf of Exterus, e.g. IT service providers, lawyers and accountants.

Where Exterus shares personal data with third parties in countries outside the European Economic Area (EEA), we always take the necessary measures to protect this data, including contractual agreements.

How is your personal data protected?

Exterus protects all personal data it processes against unauthorised and unlawful access, alteration, disclosure, use and destruction. To achieve this, we have taken appropriate technical and organisational measures to guarantee a security level appropriate to the risk taking into account current best practice. Where Exterus uses services from third parties, Exterus will establish agreements on adequate security measures for personal data in a data processing agreement or contract.

Your privacy rights

You have the right at all times to see what personal data Exterus holds on you. If you make use of this right, we request that you specify which personal data you would like to receive. In the event that such data is incorrect or incomplete, you have the right to correct the data.

You also have the right to:

  • request the deletion of your personal data;

  • request (temporarily) limiting the processing of your data;

  • object to the processing of your personal data.

Any such request will be met unless there are legitimate grounds for the processing.

You can also receive a summary of your personal data in order to transfer it to another service provider.

If you wish to exercise your rights, you can contact us at any time using the contact details below.

Contact details

If you have questions about the collection and processing of your personal data or wish to make use your rights, you can contact:

Exterus B.V.

t.a.v. Privacy Officer

Prinses Alexialaan 80

2496 XA Den Haag

E-mail: info@exterus.nl

If you are not satisfied with the response from Exterus, you can complain to the Dutch regulator, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ  DEN HAAG (https://www.autoriteitpersoonsgegevens.nl/nl).

Changes to this privacy notice

Exterus may need to change this privacy notice from time to time. This privacy notice was last updated on 1 February 2022.