Privacy statement

Workays is a trade name (handelsnaam) of Yseasonal B.V. Workays does not have separate legal personality — Yseasonal B.V. is the data controller responsible for the processing of personal data described in this privacy statement, for all activities carried out under the Workays name.

Personal data is processed at Workays in accordance with national and European legislation and regulations on data protection, privacy and security, including the General Data Protection Regulation (GDPR). Yseasonal B.V. attaches great value to handling your personal data in accordance with the fundamental principles relating to the processing of personal data. We process your personal data in a lawful, fair and transparent manner, correctly and with due care.

We are aware that you have faith in us while processing your personal data. Therefore, we see it as our responsibility to protect your privacy. In this privacy statement we inform you how we collect and further process your personal data when you use our website and recruitment platform, why we collect it and how we use it to improve your user experience and our business activities, so that you can understand exactly how we work. Workays respects the privacy of all users of its website and ensures that the personal data you provide to us is treated with a high level of confidentiality.

This privacy statement applies to the Workays website, as well as the further services that we provide to you or your organisation generated through our website.

Yseasonal B.V., trading as Workays

Zuiderplein 4

8911 AJ Leeuwarden (The Netherlands)

https://workays.com

privacy@workays.com

KVK number: 95405003

We want you to fully understand what this privacy statement says. Sometimes we have to align with the terminology used in legislation. In this privacy statement, the terms below have the following meaning in line with and in addition to the General Data Protection Regulation (GDPR):

• GDPR: the most important European law protecting your personal data, meaning regulation (EU) 2016/679 of the European parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) which came into effect on 25 May 2018, and any future versions of this regulation;

• Workays: the trade name under which Yseasonal B.V. offers the services described in this statement. You may find our contact details above;

• Personal data: all the information we Process of You, meaning any information relating to an identified natural living person or to a natural living person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, ID number, location data, IP address or other online identifier or to one or more other factors specific to the person's identity. For the sake of clarity, personal data includes personal data that is publicly available and excludes personal data that has been irreversibly anonymized so it is no longer possible to re-identify a data subject from the information, taking into account all means likely and reasonably to be used by the Controller or anyone else to re-identify them;

• You: You, as a data subject, meaning you are either: (i) A jobseeker, (interested in) using our website, or; (ii) Acting on behalf of an employer who uses our website or with whom Workays has an agreement for the use of our other services, and/or; (iii) A website visitor, meaning that you are the natural person to whom the personal data relates that we are processing;

• Data controller: Yseasonal B.V., trading as Workays, being the entity who is responsible for processing your personal data, meaning a natural or legal person or an organisation which alone or jointly with others determines the purposes for which personal data is processed and the means by which personal data is processed;

• Processor or third party: other entities, involved in processing your personal data, meaning: (i) a natural or legal person or an organisation that processes personal data on behalf of Yseasonal B.V., whilst not being part of the legal structure of Yseasonal B.V.; or, (ii) a natural or legal person that processes personal data in the role of a separate and independent data controller, whilst not being part of the legal structure of Yseasonal B.V.;

• Processing: everything we do with your personal data, meaning any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

• Supervisor authority: your national/local data protection watchdog, whose purpose is fighting against privacy infringements, meaning any competent public body responsible for monitoring and enforcing compliance with applicable (European) privacy law including at least the entities referred to in article 51 GDPR;

• EEA: the European Economic Area, meaning the member states of the European Union, Iceland, Liechtenstein, Norway and Switzerland.

We process your personal data as you use our services, such as our recruitment platform, and/or because you provide us these data.

Below you will find an overview of the personal data we process:

• For jobseekers: First name(s), surname, residential address, town/city, postal code, gender, date of birth, curriculum vitae (such as previous employment experiences), diplomas, (personal) email address, (personal) telephone number; nationality, education information and any other information you provide to us, amongst other, in your curriculum vitae. For jobseekers placed through our traditional employment arrangements, we additionally collect: copies of your identity document (passport or ID card, front and back), bank account number (IBAN), bank verification document, and BSN (citizen service number, collected via digital signing forms).

• For employer representatives: company name, contact's surname, contact's first name(s), company address, location, postal code, (business) e-mail address, (business) telephone number.

• Other types of personal data:

• (i) Required by law: For example, transferring personal data to governmental bodies, such as the police, inspection- or tax authorities and/or to comply with bookkeeping (tax) laws and regulations applicable to legal entities; or,
• (ii) You provided consent: For example, when you choose to accept that we place cookies on your computer hardware; or,
• (iii) You voluntarily provided additional personal data: For example, when registering on our website, as a jobseeker, you can choose to create your profile with (data from) your social media profile (Facebook, LinkedIn, Google etc). This is not mandatory as you are free to decide to create your profile manually.

We do not intend to process special categories of personal data and/or sensitive personal data: It may occur that we indirectly store your personal data relating to, for example, the situation where you performed charity work or worked as a volunteer at a church, political party or trade union. But this takes place because we process your resume in order to create your profile and/or link you to a potential employer and such information will be captured as work experience. We then process that data to have a general impression of your employment history. The fact that this might happen to say something about your possible religion, political views or trade union membership is irrelevant to us. Seen in that context and for that purpose, we do not process any special categories of personal data.

When you are placed through our traditional employment (uitzenden) arrangements, we collect additional personal data to register your employment. This includes copies of your identity document (passport or ID card, front and back), your bank account number (IBAN), a bank verification document, your residential address, date of birth, and your BSN (citizen service number, collected via digital signing forms).

We process this data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing is necessary to fulfil the employment agreement between you and us.

• Legal obligation (Art. 6(1)(c) GDPR): Dutch employment law requires us to verify your identity and register your employment with the relevant authorities.

Your employment documents are shared with JEX (jex.nl), our payroll and backoffice partner, who processes employment registrations on our behalf. We have a data processing agreement in place with JEX to ensure appropriate protection of your personal data.

Your documents are stored securely with time-limited access. Your IBAN is encrypted at rest. Employment documents are automatically deleted from our servers 28 days after your placement start date, in accordance with our data minimisation obligations.

We process information, including personal data to:

• Clearly and correctly communicate with you via any contact details you provide, such as, but not limited to calls, texts, WhatsApp and email;

• Map supply and demand on the labour market;

• Provide you with the opportunity to create your own personal profile as a jobseeker and making the database with these jobseeker profiles available to employers through our recruitment platform;

• Provide employers with a platform on which they can upload open vacancies and make the database with these open vacancies available to jobseekers through our recruitment platform;

• Provide job search and recruitment services to jobseekers and employers when using our website and our recruitment platform;

• Match you, as a jobseeker, to outstanding vacancies from our clients (and possibly your next employer);

• Provide jobseekers with general information about working abroad;

• Collect anonymous statistical data for (potential) clients;

• Train our personnel and to improve the quality of our services and conversations with you. For this purpose, recordings of telephone conversations you have with us may be used. A trainer will listen to the recorded telephone conversation and discuss with our employee what is going well and what could be improved;

• Share basic profile information (first name, surname, email address, phone number, preferred language and spoken languages) with our group companies Yseasonal B.V. and Yobbers B.V. so they can offer you matching opportunities through their recruitment platforms. You can object to this sharing at any time by emailing privacy@workays.com or by deleting your account.

At Workays, we only process personal data as a data controller if one or more of the following legitimate grounds of the GDPR apply:

• You gave clear consent for the processing activity, meaning that personal data can be processed if you have given freely, specific and informed consent. Workays makes it possible for you to withdraw previously granted consent at any time. Withdrawing such previously granted consent will not affect the lawfulness of the processing activities that took place immediately prior to the moment the consent was withdrawn. Processing activities for which your consent is required include, for example:

• sending newsletters to you and provide you with updates on our services;
• use of specific (non-functional, non-analytical) cookies on the Workays website.

• Processing your personal data because you and Workays have (or could enter into) a contract, meaning that the processing is necessary for the performance of an agreement to which you are a party or for taking pre-contractual actions requested by you and which are necessary for entering into a possible agreement. Processing activities we perform based on this legitimate ground are, for example:

• Provide you with the opportunity to create your own personal profile as a jobseeker and making the database with these jobseeker profiles available to employers through our recruitment platform;
• Provide employers with a platform on which they can upload open vacancies and make the database with these open vacancies available to jobseekers through our recruitment platform;
• Processing your requests, as a jobseeker or employer, for more information about Workays' services.

In order to use the Workays services and recruitment platform, jobseekers must create an account as described on our website. Completing the process of creating an account, for which your personal data is required, is part of the agreement between you as a jobseeker and Workays. If you do not complete the process of creating an account (part of which is also uploading your resume), we cannot grant you access to our recruitment platform as a jobseeker and you will not be able to apply on the outstanding vacancies posted by employers.

• Processing your personal data is mandatory according to applicable law, meaning that the processing activity is necessary in order to comply with a legal obligation to which Workays is subject. Processing activities we perform based on this legitimate ground are, for example:

• transferring personal data to governmental bodies, such as the police, inspection- or tax authorities, as is the case when we suspect fraudulent activities or other criminal offences;
• bookkeeping (tax) laws and regulations applicable to legal entities, as well as (internal) auditing.

• Processing your personal data in the pursuance of a legitimate interest of Workays, meaning that the processing is necessary for legitimate interests pursued by Workays or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Processing activities we perform based on this legitimate ground are, for example:

• general customer relationship management, communication and information provision, such as answering your questions or requests regarding IT issues;
• IT security and preventing illegitimate access to our (IT) assets and investigating fraud and/or other (suspected) criminal offences.

Workays uses automatically generated data for statistical purposes, as well as for the protection and improvement of the work, services and the website of Workays. This information is provided to third parties provided they are processed on an aggregated level and not personally identifiable to you, the user of our website and recruitment platform.

The Workays website automatically collects certain non-directly identifiable information about the visitors of its website, including the Internet Protocol (IP) address of the computer from visitors, date and time of access to the website, the internet address of the website from which the visitor is redirected to the website of Workays, the IP address of the Internet Service Provider of the visitor, the visitor's operating system, the parts, information and pages of the website that the visitor has visited and/or viewed, as well as the material forwarded or downloaded by the visitor of the website.

We use Google Analytics on our website. This is a piece of software we deploy to collect statistics on visitor numbers, visited web pages and traffic sources and to run reports. The purpose of this is to improve the Workays website for visitors and to give us insight into how our website is performing.

These statistics are not used by Workays to create insights on the level of an individual person. We are in theory able to identify you as an individual from this dataset based on identifiers such as user-id, which we share with Google. However, Workays does not process personal data in this context to create insights for each and every person individually, as the data is available to us on an aggregated level, and that is how it creates value for us. The information that you enter and upload via our website, for example in our contact form or the content of your resume, is never processed in Google Analytics. When you visit our website, your web browser automatically shares your IP address and the URL of the webpage you visit with Google. With regard to this processing of personal data, Google is the controller within the meaning of article 4(7) GDPR. Workays has no role whatsoever in these processing activities.

You can find more information about Google's data processing activities when using our partner sites.

This technical information is used for the management of the website and for improvement of the website and services of Workays. In addition, this data can be used for historical, statistical or scientific purposes. This information may be passed on to third parties in so far as it is not personally identifiable to you.

We do not take decisions on the basis of automated processing or technologies on matters that may have (considerable) impact on people, such as the assessment whether or not to match you, as a jobseeker, to the vacancy of an employer. We are talking about decisions taken by computer programs, algorithms or IT systems, without any human (for example, one of our employees) interference.

To build your jobseeker profile, we use an automated text-analysis tool (a third-party AI service) that reads the CV you upload and extracts and structures the information it contains, such as your skills, work experience, education and certifications, together with a short factual summary. This tool is used only to read and organise the information you have provided. It does not evaluate, score, rank or shortlist you, and it does not make any decision about you or your suitability for a vacancy. Decisions about matching you to an employer are always made by our recruiters.

The tool is instructed not to extract special categories of personal data (such as health, religion, ethnicity or nationality), and the structured data it produces is added to your profile only where those fields are still empty. You can review, correct or delete this information at any time in your profile.

We will retain your personal data no longer than is strictly necessary for the purposes for which your information is collected. If you are a jobseeker and no longer wish to use our services, you can simply decide to delete your account. We will process such a request for account deletion right away, but due to our internal data recovery procedures it may occur that certain account information is still retained on back-up hardware equipment for a maximum of 4 years. After that period, your account, including all personal data contained therein, will be fully removed.

Other personal data shall be retained no longer than necessary for the purpose for which it was collected, for the exercise of legal tasks and fulfilling legal obligations or the execution of agreements (think of limitation periods), but of course, in accordance with the applicable legal retention periods.

As an example: we are legally obliged to store financial data, such as invoices, for at least 7 years, due to Dutch tax laws and regulations.

We retain contact information (for sending newsletters/mailing list information purposes) until you unsubscribe or request that we delete that information. If you decide to unsubscribe from a mailing list, we may keep certain limited information about you so that we may honour your request.

Employment documents (identity document copies, bank verification, and signed forms) collected during the placement process are automatically deleted from our servers 28 days after the placement start date. This ensures we only retain sensitive documents for as long as necessary to complete your employment registration.

Workays is a trade name of Yseasonal B.V. We process and (share) your personal data within the group to which Yseasonal B.V. belongs and then only with employees who are authorised to process this data. All our employees are subject to secrecy. The group to which Workays belongs consists of Yseasonal B.V., Yobbers B.V. and Yobbers Group B.V.

We do not sell your personal data to third parties and will only share (personal) data if needed for the execution of our agreement with you, to improve our website (where possibly your IP address is processed), to comply with a legal obligation, or in case we have a legitimate interest in doing so, which is not outweighed by your (data protection) rights.

With companies that process your data on our behalf, we enter into a data processing agreement to ensure an appropriate level of security and confidentiality of your personal data. We remain responsible for this personal data processing.

For jobseekers placed through our traditional employment arrangements, we share employment documents with JEX (jex.nl), a Dutch payroll and backoffice company that handles employment registration and contracts on our behalf. A data processing agreement is in place with JEX.

We are doing business with companies in countries outside the EEA. If we transfer personal data to third parties located outside the EEA and if no adequate level of protection is present, we continue to monitor the processing of personal data and we use legal transfer mechanisms to ensure that the personal data are sufficiently protected. We do this by using the standard data protection clauses adopted by the European Commission or other safeguards meeting the requirements of the GDPR for transfers of personal data outside the EEA.

To provide the CV analysis described above, we share the CV you upload with Anthropic, a provider of AI text-analysis services, acting as our processor under a data processing agreement. Anthropic processes this data in the United States; we rely on the standard contractual clauses adopted by the European Commission to safeguard this transfer.

We may share your personal data with third parties, such as our clients, when you, as a jobseeker, are matched to a vacancy of an employer. In that case, we share your personal data with the employer who published the vacancy. We will always inform you of the identity of the employer before we share your personal data.

The Workays website deploys cookies. Cookies are small information files that a website leaves on the hardware of the users (for example, computer or smartphone). At your first visit to our website you have been informed about these cookies and we ask your consent for posting some of them. The website uses different kinds of cookies:

• Functional cookies: These cookies are necessary for the website to function properly. These cookies are used to store certain user and preference settings, any login data, to remember your browsing session, to facilitate and optimise the use of the website. In addition, these cookies are used to detect abuse of the website. Asking your consent for functional cookies is not legally required.

• Social media cookies: Information on the website can be shared via social media. This can be done by using the social media buttons present on the website. These operate on the basis of social media cookies that are placed by the social media parties (such as Facebook). By clicking on a social media button, the website visitor will be redirected to the website of the relevant social media party. For the use of the cookies by the social media parties please refer to the information on the websites of these social media parties. This information can change regularly without any influence of Workays. Asking your consent for social media cookies is legally required.

• Analytical cookies: These cookies are used to collect information about the use of the website. For this purpose, among others, we use the software from Google Analytics. These cookies measure how many visitors come to the Workays website, at which time the website and pages are visited, from which region the user visits the website, from which website the user is redirected to the website, which pages are visited (how long and how often) and in what order and if errors have occurred. The data collected is used to optimally attune the website to the desires and needs of the website visitors. Asking your consent for analytical cookies is not legally required.

If you decide you do not want our cookies on your computer hardware anymore, you can perform this through your internet browser so that it does not save cookies anymore. In addition, you can also delete all information that was previously stored by your browser settings.

You have the right to access your personal data, to correct or to remove it. You can do this through the personal settings/environment of your account.

In addition, you have the right to withdraw your permission for the processing of your data or to object to the processing of your personal data by Workays. You also have the right to data portability. That means that you can apply that the information we have of you will be transferred in a computer file to you or another organisation, appointed by you.

To ensure that the request for data portability is done by you, we ask you to send a copy of your ID in the request. Please blacken out your photo, MRZ (machine readable zone, the strip with numbers at the bottom of your passport or ID card), passport/ID card number and social security number (BSN) in this copy of your identity document. This is to protect your privacy.

Would you like to use your right to object and/or right to use data portability, or if you have other questions/comments about the data processing, please send a specified request to privacy@workays.com.

Workays will respond to this in writing within one month of receipt of your request. We may contact you in order to adequately process your request. Depending on the complexity and the number of requests, Workays is entitled to extend this period by two additional months. You shall be informed by Workays of any such extension within one month of receipt of the request, together with the reasons for the delay. Workays only accepts to process your data protection rights after we have had the opportunity to identify you properly.

Workays can reject a request to exercise your data protection rights if:

• Your request is not clearly specified;
• Your identity cannot be established with reasonable certainty;
• The data processing involved is allowed in connection with a fraud and/or criminal investigation, a legal obligation or a legal action;
• The request follows a previous request within an unreasonable interval or if the request constitutes a misuse of your rights. An interval of 6 months or less will, in general, be considered as an unreasonable interval.

Any (partial) rejection of your request will be explained to you in writing.

We take the protection of your data seriously and take appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. Workays will ensure that only authorised personnel have access to the personal data necessary for the performance of their duties. Personnel with access to personal data are bound to maintain full confidentiality with regards to your personal data and to process it strictly in accordance with Workays' instructions, or to comply with a requirement of law.

The connection you have with the Workays website and recruitment platform is encrypted and authenticated using TLS 1.2, ECDHE_RSA with P-256, and AES_128_GCM technologies. This is to make sure the communication through our website is secured, preventing unauthorised others from intercepting the personal data and other information you provide to us. Although we use appropriate security measures, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavour to protect personal data properly, but we cannot guarantee full security of data transmitted to or by Workays.

If you feel that your personal data are not properly secured or there is evidence of abuse or a data breach, please contact us via privacy@workays.com.

What is a data breach? A data breach is a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

If you have knowledge of a data breach or a possible data breach, we kindly ask you to notify us immediately. We deal with such notifications promptly and perform further investigation, whilst taking appropriate measures necessary to prevent further harm or damage to those involved and to us. As the law requires: a data breach that can have serious consequences will be reported to the Supervisory Authority by Workays and to the person(s) whose personal data are involved in this data breach, if prescribed by law.

On our website you will find some links to other organisations outside of the Yseasonal B.V. legal structure. Although these third-party organisations are carefully selected by Workays, we take no responsibility for the handling of personal data by or on behalf of these third parties. For this, please read the privacy statement (if any) of the organisations.

In the event of the sale or transfer of our company or assets, or a part thereof, Workays reserves the right to also transfer the personal data we obtained from you. In the event of such a sale or transfer, we will undertake a reasonable effort to impose the obligation on the purchaser to process the personal data in accordance with the terms of this privacy statement. If you have any questions about the processing of your personal data after such transfer or sale, you can contact the organisation to which we have transferred your personal data.

We regularly check whether we comply with this privacy statement and update it if new laws and regulations require this or if changes occur in our business operations. If you have any questions about this privacy statement, please feel free to contact us via privacy@workays.com.

In addition, you have the right to lodge a complaint with a Supervisory Authority if you believe your data protection rights are compromised by Workays. For your convenience, we have listed the name and website information of the Supervisory Authority:

• Autoriteit Persoonsgegevens (NL)

Workays may modify this privacy statement. This privacy policy was last modified in [MONTH YEAR]. We may update this privacy statement at any time by publishing an updated version on our website. The amended privacy statement will apply from that revision date. Therefore, we encourage you to review this privacy statement periodically to be informed about how we are protecting your personal data.