Privacy Policy


Exterus considers your privacy to be paramount and ensures that the personal data we receive is treated in confidence. Exterus is responsible for careful processing of personal data in line with the General Data Protection Regulation (GDPR). This privacy statement sets out how and why we use and process your personal data.


Personal data encompasses all data that can be traced to a natural person. We are entitled to process personal data obtained from all persons with whom we are in contact, or who visit this website. We also process personal data from contacts of our clients (or potential clients), business customers, suppliers or business partners, employees and job applicants.


The parties responsible for processing your personal data are Exterus B.V. or Exterus Payrolling B.V. (hereinafter collectively: ‘Exterus’), both established at Prinses Alexialaan 80, in The Hague. The party responsible to you is the business with whom you are (actually or potentially) entering a legal relationship. The party responsible for processing personal data through the website is Exterus B.V.


Exterus may only process personal data from you if we have a statutory basis for doing so. Exterus will process your personal data for the purposes of ensuring efficient, effective business operations. In general, we will only amass and process your data for the purposes of providing our services, for recruitment purposes or where you have consented to us doing so.

In the table below you can see what personal data Exterus B.V. and Exterus Payrolling B.V. process and for what purposes.


Employees of Exterus and those third parties enlisted by Exterus to serve as data processing agents are entitled to view your data on the proviso that this is necessary for the performance of their duties. All parties are obliged to maintain confidentiality pursuant to the GDPR and/or in line with their contract with Exterus.


Exterus will not store your data any longer than is necessary for the purposes for which your data is being processed, nor longer than is statutorily permitted. Your data will be deleted upon expiry of the retention period.


Exterus is entitled to share your data with third parties insofar as this is necessary for the provision of services with due regard for the aforementioned purposes.

Furthermore, Exterus is entitled to issue personal data to a third party, such as a regulatory body or another public authority insofar as there is a statutory obligation to do so.

A processing agreement will be entered into with this third party processing your personal data on behalf of and at the request of Exterus, as a result of which this third party will be similarly required to comply with the GDPR. Third parties enlisted by Exterus who offer services that entail responsibility for processing personal data—such as a tax advisor, solicitor or accountant—will themselves be bound by an obligation of compliance with the GDPR when processing (or continuing to process) your personal data.

Sharing data with third parties whose services have been enlisted and who are situated outside of the EU will always be done in line with the GDPR.


Personal data amassed by Exterus can be forwarded to other Exterus entities forming part of the Exterus organization. Nonetheless, these entities will only be entitled to use the data for the purposes for which you have issued the data to Exterus. If you post information on the website of Exterus, then we will take this to mean that you are expressly consenting to Exterus sharing that information with other Exterus entities forming part of the Exterus organization.


Exterus protects all personal data it processes from unauthorized, unlawful access, alteration, publication, use and destruction. To this end, and taking into account the status of the technology, we have taken appropriate technical and organizational measures to guarantee a level of security tailored to the level of risk. If Exterus uses the services of third parties, then, within the framework of data protection, Exterus will set out agreements on sufficient security measures in a processing agreement. If it is obliged to do so, Exterus will report any loss, theft or misuse of your personal data to you as swiftly as possible.


Many instances of communication between you and Exterus will be done by telephone, through forms, e-mail or social media. The personal data that you provide to us in this regard will be recorded if this is necessary for the purposes of our service provision and/or maintaining the relationship


When you visit our website, we will record your IP address, general visit data and cookies. This data will be used to further improve our services. We will also record click behaviour. This data will only be stored and processed internally. It will be used for such purposes as statistical analyses of visit behaviour.

 With your consent, we use tracking cookies from Google on this website as part of the ‘Analytics’ service. We use these cookies to keep track of what pages you are visiting. This profile is not associated with your name, address, e-mail address or IP address. As far as possible, the information collected by Google is anonymized. Google can issue this information to third parties if legally obliged to do so, or to the extent that third parties require this information to process it on behalf of Google. We cannot influence this. The information is transferred to Google and stored on servers in the United States.

If you leave information on our website, we can use it to provide our services, to send you information or products and / or to contact you to, for example, inform you about our services, or to maintain the relationship, unless you indicate that you do not appreciate this (any longer) .


You are entitled at any time to see what personal data Exterus has stored on you. If you wish to assert this right, please specify what personal data you would like to receive. If the data is incorrect or incomplete, you are entitled to have the data corrected. We will notify those third parties that have received your personal data from us of any corrections, except where this is impossible or would require disproportionate effort on our part. You also have the right to:

·         have your data deleted;
·         (temporarily) limit processing of your data;
·         object to the processing of your data;
·         a summary of your personal data to take to another service provider (data portability);
unless this would clash with the restrictions set out in Article 23 of the GDPR.

 If you wish to assert your rights, you can get in touch with us at any time using the contact details below. We will respond to your request within one month.

Exterus is not legally obliged to appoint a data protection officer. Our internal privacy officer is your contact for any requests you have in relation to the above. You can direct your requests to the privacy officer using the contact details below.


Exterus is entitled to make changes to this Privacy Statement without prior notification. Changes will be published on the website. The most recent version can always be found at

Any questions on our Privacy Statement? Feel free to get in touch with us using the following contact details:


Exterus B.V./Exterus Payrolling B.V.
Attn Privacy Officer
Prinses Alexialaan 80
2496 XA The Hague
E-mail: [email protected]


Contact details from existing clients:

First name and surname, e-mail address and telephone number of the contact person.

We use this data to:
–          approach our clients correctly within our correspondence;
–          establish and maintain contact with our clients;
–          send commercial communications (only where this pertains to an existing client who has not asserted the right to opt out of such communications or where we have obtained consent to this end).

Data from our clients:

Name and address of client, invoicing details (Services rendered, pricing, VAT rates), contact details, salary details, company details, VAT number, citizen service number (BSN) and all other information relevant from a finance perspective.

We use this data to:
–          prepare invoices for our clients;
–          ensure our administration includes all data required by the Dutch tax authority (Belastingdienst);
–          communicate with the Belastingdienst;
–          be able to provide services to our clients.

Bank details of our clients:

Account number, IBAN and BIC.

We use this data to deal with and administer payments for our clients.

Data in client documentation:

Personal data provided to us by clients in their documentation, such as names, contact details, salary details, company details, citizen service number (BSN) and all other information relevant from a finance perspective (payroll administration, tax data).

We use this data to provide our Services to our clients, by means of issuing advice on cross-border employment.

Data pertaining to previous Services provided to our clients:

History of Services already rendered to the client.

We use this data to:
–          inventory what Services are being purchased by clients;
–          send commercial communications on Services of potential interest to the client, based on services previously rendered to the relevant client.

Identity details of our clients:

Copy of passport/ID card

We use this data to identify our clients where we are obliged to do so pursuant to the Money Laundering and Terrorist Financing (Prevention) Act (Wwft). Whilst doing so, we protect the citizen service number (BSN) and passport photo, and we do not retain copies of proofs of identity for longer than five years.

Contact details of potential clients through contact form on the Website:

First name and surname, company name, e-mail address, telephone number (optional) and any personal data included in the message.

We use this data to:
–          contact clients on the basis of their message;
–          send commercial communications (only where clients have consented to this).


Contact details of job applicant:

First name and surname, e-mail address and telephone number.

We use this data to establish and maintain contact with the job applicant.

Job applicant’s application data:

Details included in the applicant’s CV (such as qualifications, work experience and training) and details on any disabilities the applicant may have and which could impede performance of the role.

We use this data to assess which applicant would make a suitable candidate to come and work at Exterus. We will delete an applicant’s data after four weeks, unless we have the applicant’s consent to retain the data for a period of one year.

 Application procedure data:

Notes made during interview(s) and (where applicable) results of assessments and psychological tests.

We use this data to assess which applicant would make a suitable candidate to come and work at Exterus. We will delete an applicant’s data after four weeks, unless we have the applicant’s consent to retain the data for a period of one year.