Privacy Policy

1. Introduction

Work TalentPool ("we", "us") is an international Recruitment + HR platform that connects job seekers with international employers. We collect and process personal data of candidates, employers, website visitors and other individuals in the context of recruitment, remote work, outsourcing, training and workforce management.

This privacy policy applies to our website, our services and all forms through which we collect data. Where the GDPR applies, we take it into account. This policy is a draft and must still be legally reviewed.

Company details

Trade name

Work TalentPool

Legal form

Legal entity to be established (Netherlands, Suriname and/or Greece)

Country of establishment

Netherlands, Suriname and Greece

Registered address

Paramaribo, Suriname · Athens, Greece · Amsterdam, Netherlands

Email for privacy requests

privacy@worktalentpool.com

General email

hello@worktalentpool.com

Phone number

+597 8889191

Website

worktalentpool.com

Data Protection Officer

Not appointed — contact via privacy@worktalentpool.com

Supervisory authority

Dutch DPA (Autoriteit Persoonsgegevens) / Greek DPA / relevant Suriname authority

Our role

Work TalentPool may act in different roles depending on the service or recruitment process:

• Independent controller — for example when recruiting through our own website.
• Jointly with an employer — when we select candidates together with a client.
• As a processor on behalf of a client — when we perform services on instruction from an employer.

The exact role may differ per service. Contact us via privacy@worktalentpool.com to ask which organisation is responsible for your data.

2. Personal data we process

Candidates and applicants

When you apply, we may process the following data. Fields marked with * are mandatory in the form; other fields are optional.

• First and last name *
• Email address *
• Phone number *
• Place of residence *
• Country of residence
• Nationality (only if necessary)
• Preferred language
• Preferred start date *
• Full-time or part-time availability *
• Current position
• Years of experience
• Relevant experience
• Languages and proficiency levels
• LinkedIn profile
• CV
• Cover letter
• Optional profile photo
• Salary expectation
• Equipment and internet connection details
• Sales or lead generation experience *
• Application status
• Interview information
• Training and onboarding data
• Messages and correspondence
• Application source
• Job ID and job title
• UTM parameters

Identity documents and financial data

After selection, we may need documents or financial data for administration, contracting and payment. This only happens at a later stage of the process. The documents that may be requested include: a valid identity document (passport or ID card), bank details (IBAN) for payment to a euro account, and a signed employment or contractor agreement. These are retained for the duration of the contract plus the statutory tax retention period of 7 years.

• Identity documents are only collected when there is a valid necessity and legal basis.
• Non-essential information in identity documents is redacted where possible.
• Bank details are used solely for contractual administration and payment.
• Access to this data is restricted to authorised personnel.

Employers and contacts

• Company name
• Contact person name
• Business email
• Phone number
• Country
• Requested roles
• Desired number of employees
• Desired start date
• Budget range
• Content of requests and correspondence
• Contract and invoice data (if applicable)

Website and technical data

• IP address
• Browser type
• Device information
• Language preference
• Pages visited
• Date and time of visit
• Referrer
• Cookies
• Analytics data
• UTM parameters
• Server logs
• Form and error data

We distinguish between necessary cookies (which make the website function) and optional analytics or marketing cookies. Optional cookies are only placed after you have given consent, where legally required.

3. Purposes and legal bases

We process personal data for the following purposes. The legal basis per purpose must still be legally confirmed.

4. Sharing with employers

As part of our services, we may share candidate data with potential employers or clients. Below is how this works:

• Which data: candidate profile, CV, contact details and relevant background.
• With which type of employer: international companies seeking talent through us.
• At what point: only after a candidate is considered for a specific role and has consented to this.
• Legal basis: pre-contractual measures, supplemented by consent where required.
• Candidates are informed in advance and give separate consent before their data is shared with an employer.
• We do not share more data than necessary for the purpose.
• Employers have their own privacy responsibilities for further processing.

5. Service providers and recipients

We use the following categories of service providers. Specific vendors and configurations must still be completed.

6. International data transfers

Because we operate internationally, personal data may be processed or stored in various countries, including the Netherlands, other EEA countries, Suriname, the United States and possibly other countries.

• In which countries data is processed: Netherlands, Greece, Suriname, and the United States (for cloud and CRM services).
• Whether data leaves the EEA: yes, for CRM and cloud storage services with servers in the US.
• Which safeguards are applied: Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, verified per vendor.
• We do not automatically assume a vendor is GDPR-compliant. This is checked per vendor.
• Individuals can request a copy of relevant safeguards via the contact address.

7. Retention periods

We do not retain personal data longer than necessary. The periods below must still be set internally.

After the retention period expires, data is deleted or anonymised, unless a legal retention obligation applies.

8. Your privacy rights

To the extent legally applicable, you can request:

• Access to your data
• Correction of inaccurate data
• Erasure of your data
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent
• Complaint to a supervisory authority

You can submit a request via privacy@worktalentpool.com. To verify your identity securely, we only ask for the data necessary for that purpose. Some rights have exceptions. A request is handled within 30 days, in accordance with the GDPR.

9. Automation and AI

• We use CRM automations for confirmations, tags, reminders and pipeline statuses.
• These administrative automations do not mean a candidate is rejected without human intervention.
• We currently do not use AI CV screening, assessments or fully automated decision-making.
• Before AI CV screening, assessments or automatic matching are introduced, this policy will be updated.
• If automated decision-making is used later, human oversight and an objection option apply.

10. Children

The services are not intended for persons under 18 years of age. If we discover that data of a minor has been collected without a valid basis, we take appropriate measures to delete that data.

11. Security

We take appropriate security measures, including:

• Restricted access rights
• Strong authentication
• Encrypted connections (HTTPS)
• Secure storage
• Backups
• Logging and monitoring
• Data processing agreements
• Incident and data breach procedures
• Periodic access review

We do not claim specific certifications or absolute security unless demonstrable.

12. Data breaches

We have a procedure to handle data breaches. This includes:

• Internal investigation of incidents.
• Risk assessment for affected individuals.
• Where necessary: notification to the supervisory authority.
• Where necessary: informing affected individuals.
• Documentation of incidents.

13. Third-party links and services

Our website may contain links to external websites and services such as WhatsApp, LinkedIn, video calling software and social media. These third parties have their own privacy policies. Work TalentPool is not automatically responsible for the independent data processing of these parties.

14. Changes

• The date of the latest update is shown at the top of this policy.
• Material changes are communicated via the website or by email.
• The latest version is always available on the website.
• Changes do not apply retroactively and do not make earlier unlawful processing lawful.

15. Contact and complaints

The competent supervisory authority is the Dutch DPA (Autoriteit Persoonsgegevens) for processing concerning individuals in the Netherlands. For individuals in Greece, the Greek DPA is competent. For individuals in Suriname, the relevant local supervisory authority is competent. You may always lodge a complaint with the supervisory authority in your country of residence.