Privacy statement

• for what purpose these personal data may be processed;
• what exactly that processing entails; and
• which resources may be used.

Processor: the organization that processes personal data for the controller. To achieve this processing, a processing agreement is drawn up.

Processing agreement: an agreement in which the controller (Partner) and the processor (we as Refugee Work) make agreements about the processing of personal data.

Anonymisation: the irreversible removal or replacement of personal data so that the individual can no longer be identified.

What personal data does Refugee Work process?

Refugee Work collects and processes data that have been voluntarily provided to us via registration on our platform. We treat all data confidentially and only use it for the purposes described in this statement.

Personal data of job seekers

As a platform that connects refugees with the labour market, we process the following personal data of job seekers:

• First name and last name
• E-mail address
• Telephone number
• Address
• Residence status
• Dutch and English language level
• Desired professional sector
• Education history
• Work experience
• Skills
• Personal description (about me)
• Motivation answers submitted as part of job applications (free-text responses to vacancy-specific questions)

Personal data of employers (werkgevers / organisation contacts)

We process the following data of employer contact persons who use the platform:

• Contact person's first name and last name
• Contact person's e-mail address
• Organization telephone number
• Organization name (as registered with KvK)
• Organization logo
• Office locations and address(es)
• Organization description

Data processed through job applications

When a job seeker applies for a vacancy through our platform, we process the motivation answers they provide. These answers are linked to the specific vacancy and may be shared with the employer who posted the vacancy, for the purpose of assessing the application. When an application is made to a vacancy, the profile of the job seeker is immediately shared with the employer of that vacancy. This initial access includes residence status, Dutch and English language levels, education history, work experience, skills, the personal description (about me), and the motivation answers. Only after the employer has accepted the application, the contact details of the job seeker (telephone number and e-mail address) are shared with the employer. We process this data to collect information about the candidates who are in our database and to facilitate the matching between job seekers and vacancies. This information is necessary for the core activity of Refugee Work: bringing refugees and the labour market closer together.

Why and how do we process your personal data?

We comply with the law when processing personal data, ensuring it is done in a proper, careful, and transparent manner. We process your data based on specific legal grounds defined in the GDPR. Our core activity of matching job seekers with vacancies is processed on the basis of our legitimate interest in facilitating these connections. Where we process data for other purposes, such as sending newsletters or placing non-essential cookies, we do so on the basis of your explicit consent. The personal data belongs to data subjects and partners, and we only use it for the purposes we have mentioned above. If we want to use the data more broadly, we will request permission from the person in question and/or provide a legal basis for this.

Your rights as a data subject

As a data subject, you have the following rights under the GDPR:

Right of access and modification

Job seekers and employer contacts who register with us can request, view, change or delete their data at any time by logging into their personal online account.

Right to withdraw an application (AVG art. 17)

A job seeker can withdraw a submitted application at any time, regardless of the application's status. After withdrawal:

• The motivation text previously shared with the employer is no longer available to the employer.
• Any temporary employer-facing link to the applicant's profile for that application stops working.
• The platform retains a record that the application existed for accountability purposes, but it is no longer treated as an active application.

Right to restrict processing — account deactivation (AVG art. 18)

A job seeker or employer contact can set their account to inactive (pause it) without permanently deleting it. While inactive:

• The job seeker's profile is not visible to employers.
• Applications are hidden from employer-facing views.
• No personal data is deleted; the account and its data are retained and can be reactivated at any time.

Right to erasure — account deletion (AVG art. 17)

A job seeker or employer contact can permanently delete their account. This can be done in their personal online account settings. Deleting an account removes all identifiable information from the platform:

• Job seekers: name, e-mail, telephone number, address, education history, work history, and all profile information. All applications, contact information, and profile data are removed from public and protected views.
• Employer contacts: name, e-mail, and telephone number. Organisation vacancies are not affected.

Account deletion is permanent and cannot be undone.

Data retention and automatic processing

We take the principle of storage limitation (AVG art. 5(1)(e)) seriously and have implemented automated processes to ensure personal data is not kept longer than necessary:

Automatic purge of never-activated accounts

User accounts that were created but never activated (e.g. abandoned registrations or never- redeemed invitations) are automatically deleted after a defined retention period of 14 days. This applies equally to self-service signups and invitation based registrations. No notification is sent to the purged user.

Automatic anonymisation of inactive users (AVG art. 5(1)(e) and art. 25)

Activated user accounts that have been inactive for a defined retention period, 2 years, are automatically and irreversibly anonymised. This means all personal data — name, e-mail, telephone number, address, free-text descriptions, education, work experience, and skills — is permanently removed or replaced. After anonymisation, the individual can no longer be

identified. The record itself is preserved (not hard-deleted) so that referential links from existing applications remain valid, but no personal data remains exposed in any interface.

Retention of job application data (AVG art. 5(1)(e) and art. 9)

Job application data — in particular free-text motivation answers that may inadvertently reveal special-category data — is automatically cleared or anonymised once an application reaches a terminal state (e.g. rejected or closed) and a defined retention term has elapsed. Applications that have already been cleared through a withdrawal are not reprocessed.

Retention periods

The specific retention periods are configured by the platform operator and reviewed periodically. We apply the principle of data minimisation: personal data is only retained for as long as it is necessary for the purpose for which it was collected.

Sharing data with third parties

To keep our platform running safely and efficiently, we use trusted third-party service providers. These include cloud hosting providers, email service providers, and address validation services. These operational third parties only process personal data on our behalf.

Cookies and third-party embeds

Our website uses cookies. We distinguish between:

• Strictly necessary cookies (e.g. login session, language preference, security): these are always active and are exempt from consent. They are disclosed in our cookie statement.
• Non-essential cookies and third-party embeds (e.g. Google Maps): these are only loaded after the visitor has given prior consent, in accordance with the AVG and the Dutch Telecommunicatiewet (ePrivacy).

When you first visit our website, a cookie banner is shown. You can accept all, reject all non-essential cookies, or choose per category. Rejecting is as easy as accepting — no pre-ticked boxes or dark patterns are used. Your choice is remembered across pages and sessions. You can review and change or withdraw your cookie preferences at any time via the

Cookie-settings link in the footer.

Data security and data migration

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, or unlawful processing, in accordance with AVG art. 32. This includes secure handling of data during any migration between platforms, where:

• Only data with a continuing purpose is migrated (data minimisation, AVG art. 5(1)(c)).
• Data accuracy is verified during migration (AVG art. 5(1)(d)).
• Transfer and storage are secured end-to-end.
• Data subjects are informed when their data is moved to a new platform (AVG art. 13/14).
• Any party acting as a processor during migration is bound by a written processing agreement (AVG art. 28).

Contact

If you have questions about this privacy statement, your rights, or how we handle your

personal data, you can contact us at info@refugeework.nl.