Privacy and cookie statement

Our privacy and cookie statement in brief

When processing personal data, we comply with applicable data protection laws. This means that we:

Clearly define our purposes before processing your personal data, through this privacy and cookie statement.
Store as little personal data as possible and only process personal data necessary for our purposes.
Explicitly request consent for the processing of your personal data, where consent is required.
Implement appropriate security measures to protect your personal data. We also impose these obligations on parties that process personal data on our behalf.
Respect your rights, such as the right to access, correct or delete your personal data processed by us.

Purposes of data processing

In this privacy and cookie statement, we explain what we do with the information we obtain about you. By using our services or visiting our website www.ictrecht.nl/en and www.werkenbijictrecht.nl collect various types of personal data about you. Below, we explain what personal data we collect, why we process them, and how long they are retained. If you have any questions or would like to know exactly what data we hold about you, please contact us using the contact details provided at the bottom of this privacy and cookie statement.

Providing our services

For this purpose, we process the following personal data:

Name
(Business) telephone number
(Business) email address
Organisation name (optional)
Payment details
Invoicing details
Any content of correspondence or documentation

We process these personal data on the basis of our legitimate interest to perform the agreement with your organisation and to maintain the resulting relationship. The personal data are retained for up to two years after the end of the agreement. In the event that we do not enter into an agreement, we retain these personal data for up to two years after the end of the quotation process. Some personal data are retained longer if we are legally obliged to do so (for example, due to the fiscal retention period of seven years).

ICTRecht Academy

We provide (in-house) training courses, (in-house) educational programmes, and webinars through the ICTRecht Academy. You can register for these programmes, training courses and webinars via our website.

For this purpose, we process the following personal data:

Name
Organisation name (optional)
(Business) telephone number (optional
(Business) email address
(Business) address
Invoicing details
Payment details
Job title and background of participant
BAR number
Purchase order number or reference
Training progress
Postal address for course materials
IP address
Test results
Test location
Any content of correspondence
Any dietary requirements and/or allergies

We process this information for the performance of the agreement with you, including sending training materials and practical information, issuing a certificate of participation, invoicing, and arranging on-site catering. For the processing of allergies and dietary requirements, i.e. special categories of personal data, we request your explicit consent.

Where your employer purchases an (in-house) programme or training course from us, we process your personal data on the basis of our legitimate interest to perform the agreement with your employer.

We typically provide training courses at a training venue. In addition, for our training courses, we use an online learning environment. To provide you with access to this environment, we create an account for you using an email address and a password of your choice. This account and access to the online learning environment are retained for six months in the case of an individual training course, eighteen months in the case of a one-year programme and twelve months in the case of a programme shorter than one year. These periods are calculated from the start date of the programme or the training date of an individual training course, respectively.

Name and address details, the final grade, the assessment and evidence of active participation are retained during the programme and for up to two years thereafter. An electronic copy of the certificate or proof of participation is retained for five years. Some personal data are retained longer if we are legally obliged to do so (for example, due to the fiscal retention period of seven years).

For the purpose of examination and certification of CCLTE-accredited programmes, name and address details, the email address, the achieved result, and the assessment are shared with CCLTE. For more information on how CCLTE processes your personal data, please refer to CCLTE’s privacy statement.

In addition, ICTRecht offers serious games aimed at increasing players’ awareness of topics such as privacy, security, and AI. Where personal data are processed when using these serious games, a specific privacy statement is provided within the game. This explains how ICTRecht handles your personal data.

During the programme or training course, ICTRecht provides you with two months of free access to our professional AI environment. This gives you access to custom GPTs developed by ICTRecht, enriched with our own content and expertise.

To provide you with access, we process your email address solely for this purpose and based on your consent. Participation in this offer is entirely voluntary. You decide whether to use the account. ICTRecht has no access to your use of the AI Pro Pack, the questions you ask, or the answers you receive.

AI Pro Pack
We offer organisations the opportunity to use our AI Pro Pack: a professional AI environment with specialised AI assistants for legal and compliance matters.

For this purpose, we process the following personal data:
Name
(Business) telephone number
(Business) email address
Organisation name
Anonymised user data (such as the number of conversations)
Payment details
Invoicing details
Any content of correspondence

We process these personal data on the basis of our legitimate interest to perform the agreement with your organisation and to provide, maintain, and further develop the AI Pro Pack.

The personal data will be retained for up to two years after termination of the subscription. In the event no agreement is concluded, we will retain these personal data for up to two years after the end of the quotation process. Some personal data are retained longer if we are legally obliged to do so (for example, due to the fiscal retention period of seven years).

IAPP

We are an official training partner of the International Association of Privacy Professionals (IAPP). Through the IAPP, you can obtain certain internationally recognised certifications. In order to attend the official IAPP training (such as CIPP/E or CIPM) and gain access to the IAPP portal with relevant training materials, including a voucher for the IAPP examination, we share your personal data with the IAPP.

This concerns your:

Name
(Business) email address
The certification you wish to obtain and the date on which you attend the training

We process these personal data on the basis of our legitimate interest to perform the agreement with your employer. If you have registered for an IAPP training as an individual, we share this personal data because it is necessary for the performance of the agreement we have concluded with you. The IAPP processes your personal data for its own purposes and is independently responsible for the use of your personal data. Please refer to the IAPP’s privacy statement for further information.

We retain your personal data for up to one year after completion of the training. Some personal data are retained longer if we are legally obliged to do so (for example, due to the fiscal retention period of seven years).

Newsletter

You can subscribe to our newsletter via our website. In this newsletter, we inform you monthly by email about information, news, and developments in the field of ICT and law and keep you informed about ICTRecht’s products, services, and offers.

For this purpose, we process your email address. We use your email address on the basis of your consent. You can unsubscribe from the newsletter at any time. Each newsletter contains an unsubscribe link. When you unsubscribe, we will delete your email address.

In addition, to optimise and improve our newsletter, we analyse its use. In doing so, we process data about whether the email was opened, click behaviour on the newsletter, delivery status, unsubscriptions, spam reports and information about the email programme used. This processing takes place on the basis of our legitimate interest to improve our communications.

Anonymisation

We may anonymise personal data obtained through the use of our website. This means that the personal data we originally collected are altered in such a way that the data subject can no longer be identified from them. The data are therefore no longer considered personal data, meaning there are no privacy risks associated with it.

We have a legitimate interest in anonymising data. These anonymised data enable us to carry out statistical analysis and improve our website.

Contact

We offer various ways for you to contact us, including by telephone, email, or via the contact form.

For this purpose, we process the following personal data:

Name
(Business) email address
(Business) telephone number
Organisation name
Any information you enter as the content of a message

We use these personal data to handle your contact request carefully (performance of the agreement). We retain this information for as long as necessary to manage the contact or for up to two years after our last interaction with you, because we want to ensure that we have handled your enquiry properly.

Applying for a job with us

If you have responded to one of our vacancies or submitted an unsolicited application, we process your personal data in order to assess your application.

For this purpose, we process the following personal data:

Name
Email address
Telephone number
Curriculum vitae
Cover letter
BrainsFirst results
Academic transcripts (optional)
References (optional)
Any additional information you include in your application

We process your application data in preparation for potentially concluding an employment contract. If you are not offered a position following the application process, we retain your application data for no longer than six weeks after the end of the procedure. This allows us to contact you if the previously chosen candidate turns out to be unsuitable after all. If we are unable to offer you a position at that time, we may, with your consent, retain your application data for up to two years. Before the end of this period, we will ask for your consent again to retain your application data for another two years. You can withdraw your consent at any time in the system or by sending us an email. If you join our organisation, your application data will be included in your personnel file.

Part of the application procedure is an assessment by BrainsFirst. This is an online assessment that measures your cognitive functions. Completing this assessment is necessary to ensure that the applicant fits the profile we are looking for. We process this information on the basis of our legitimate interest. With your consent, BrainsFirst may also process your results for its own purposes. Please consult BrainsFirst's privacy statement for more information.

In addition, a social media and internet screening is part of the procedure. We process this personal data on the basis of our legitimate interest to ensure that our reputation is safeguarded when hiring new personnel. Information found may be used for further assessment during the application process. We search for your name on Google and r any public profiles on social media. We will not ask you to grant access to private social media pages or to connect with us. Our findings will always be discussed with you. Candidates are not rejected solely on the basis of this screening. If you object to the screening, you can indicate this by email at the time of your application.

Talent pool

We maintain a talent pool. A talent pool is a group of candidates of interest for future internal or external vacancies. We add new candidates to our talent pool following a telephone conversation and only with your consent. We also maintain regular contact with candidates in our talent pool (by telephone or email).

For this purpose, we process the following personal data:

Name
City of residence
Email address
Telephone number
Curriculum vitae
Work experience
Your preferences and interests for future positions
Any additional information you provide

We process these personal data on the basis of your consent. You may withdraw from the talent pool at any time. We retain your personal data for a maximum of two years. Before the end of this period, we will request your consent again to retain your personal data for an additional two years.

ICTRecht Samen

We have established a network for self-employed professionals, called ICTRecht Samen. Through this network, we connect additional expertise to our organisation and expand our capabilities to support clients more broadly and specifically.

For this purpose, we process the following personal data:

Name
City of residence
Email address
Telephone number
Curriculum vitae
LinkedIn profile (public)
Any additional information you provide

Following registration for the network, we process the personal data in preparation for concluding a framework agreement. If no framework agreement has been concluded within six months, or if the framework agreement is terminated by either party, we will delete the personal data.

Customer satisfaction surveys

To assess and improve the quality of our services, we conduct customer satisfaction surveys. We may invite clients and/or website visitors to complete a questionnaire and subsequently engage in a conversation.

For this purpose, we process the following personal data:

Name
Job title
Organisation name
Email address
The input on the questionnaire

We process these personal data on the basis of our legitimate interest to improve our services. In addition, with your consent, we may record the conversation on video. This recording is used solely for research purposes and is retained for a maximum of sixty days. If you wish to withdraw your consent, please contact us using the contact details provided at the bottom of this privacy and cookie statement.

Testimonials

On our website, we present various testimonials from our employees and collaborations with our clients. In this way, we try to give you a complete picture of our services and what it is like to work for us. We process personal data on the basis of consent from the reviewers. This consent can be withdrawn at any time by contacting us using the contact details provided at the bottom of this privacy and cookie statement.

For this purpose, we process the following data:

Name of the reviewer
Name of the organisation where the reviewer is employed
Any photographs provided by the organisation or reviewer
Any personal data included in the content of the testimonial

We require these personal data to assess and publish the testimonial on our website. We retain the personal data for up to five years after the testimonial is published or until you have withdrawn your consent.

When do we share your personal data with third parties?

We only share your personal data with third parties when this is permitted under current legislation. We may provide your personal data to third parties because:

we have engaged them to process certain personal data;
it is necessary for the performance of the agreement with you;
you have given your consent;
we have a legitimate interest in doing so;
we are legally required to do so (for example, where requested by the police in the context of a suspected crime).

In this table, you will find an overview of the parties that process personal data on our or your behalf.

International transfers of personal data

Some of our suppliers are located outside the European Economic Area (EEA). When sharing your personal data with these parties, we implement appropriate safeguards to protect your privacy.

You can set your web browser to only accept cookies with your consent. For more information, please consult your browser's manual. Be aware that disabling cookies will affect the functionality of this and many other websites that you visit.The European Commission has adopted adequacy decisions for 15 countries. On the basis of an adequacy decision, personal data can be safely transferred from the EEA to companies in these countries without additional safeguards being required.When we share personal data with companies in other countries without an adequacy decision (or with US organisations not participating in the EU-US Data Privacy Framework), we take additional protective measures in the form of so-called appropriate safeguards. This means that we take extra action to protect your personal data. We use, among other things, standard contractual clauses (SCCs).

Where we transfer your personal data to parties outside the EEA on the basis of SCCs, you have the following rights:

to request information about the transfer, including a copy of the SCCs;
to contact both us and the receiving party for further information;
to submit complaints to the receiving party, the Dutch Data Protection Authority, a competent court in the EEA, or an independent dispute resolution body;
to claim compensation in the event of a breach of the SCCs.

These rights are in addition to your general data protection rights under the GDPR. This privacy and cookie statement applies solely to ICTRecht’s services and not to other websites accessible via our website.

Security

We take appropriate security measures to limit misuse of and unauthorised access to your personal data. We ensure that only the necessary persons have access to your personal data, that access to your personal data is restricted and that our security measures are regularly reviewed.

We take the following security measures, among others:

logical access controls on our laptops and systems, using passwords;
physical access control measures, including access badges and camera surveillance at our office premises;
encryption of digital files;
organisational measures for access security;
securing network connections using Transport Layer Security (TLS) technology;
purpose-based access restrictions.

We work digitally as much as possible: physical documents are securely destroyed and digital documents are properly protected.

reCAPTCHA

We use the reCAPTCHA service from Google to protect our website against spam and abuse. For the proper functioning of Google reCAPTCHA, a website visitor’s IP address, mouse movements, and possibly other data are collected. This information is transmitted to and processed by Google. By analysing this information, Google can determine whether we are dealing with a real website visitor or a robot. For more information, please refer to Google’s privacy statement.

Social media buttons

On our website, we use social media buttons that redirect you to the various social media platforms. The buttons function through pieces of code that originate from the social media platforms. If you would like to know how these platforms process your personal data, please refer to their privacy statements:

Data subject rights

You have the following rights:

Right of access: you have the right to access the personal data we process about you.
Right to rectification: you have the right to correct or supplement the personal data we process about you if it is inaccurate or incomplete.
Right to withdraw consent: you may withdraw your consent at any time with ease.
Right to object: you have the right to object to the processing of your personal data.
Right to erasure: you can request us to delete your personal data.
Right to data portability: if technically possible, you have the right to have the personal data we process about you transferred to a third party.
Right to restriction of processing: in certain circumstances, you can request to restrict the processing of your personal data (whether temporarily or not), meaning that we process less data about you.

If you wish to exercise any of these rights, we may ask you to verify your identity. We request this information to ensure that you are the correct person to whom the personal data belongs.

We will respond to your request within one month. This period may be extended by two months for reasons related to the specific privacy rights or the complexity of the request. If we extend this period, we will inform you within the first month.

If you wish to exercise any of your rights, you can do so by contacting us using the contact details provided at the bottom of this privacy and cookie statement.

Filing a complaint

If you have any questions or wish to file a complaint about the use of your personal data, you may contact us using the contact details provided at the bottom of this privacy and cookie statement. We handle every question and complaint internally and communicate further with you. If you believe that we have not addressed your concerns appropriately, you may contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) to file a complaint.

Changes to this privacy and cookie statement

ICTRecht reserves the right to amend this privacy and cookie statement. Any changes will be published on our website. We recommend that you review this privacy and cookie statement regularly to remain informed of any updates.

Contact

ICTRecht B.V.
Jollemanhof 12
1019 GW Amsterdam

Telephone number: +31 (0)20 663 1941
E-mail: privacy@ictrecht.nl

Chamber of Commerce number: 72602651