Privacy Statement

In this privacy statement, we inform you about how we handle personal data. If, after reading this privacy statement, you still have questions about how we handle personal data, if you wish to exercise your rights set out in this privacy statement under the General Data Protection Regulation ("AVG"), or other laws and regulations on personal data, or if you wish to lodge a complaint about the use of your personal data, you can contact our ISO (Information Security Officer), as specified below. If you are not satisfied with the handling of your complaint or if you prefer not to submit your complaint to us, you can also submit it to the Personal Data Authority via the website authoritypersonaldata.co.uk.

We process the following personal data:

1. The data concerning (contact) persons of the companies we do business with and that you provide to us in the context of the execution of agreements concluded with us or the preparation thereof, such as a contract of assignment, secondment agreement, employment contract and the like;
2. The data you provide yourself that we use for the performance of our services, including recruitment and selection of staff, secondment, personnel administration, IT training, etc;
3. The data we collect, especially if you visit our website. This may include data that you send to us via our website, but also data that we collect automatically via the website, such as browser data, pages you visit, links you click, IP address data and the like;

We collect your personal data including:

1. If you contact us via the contact form on the website, by e-mail or by phone, we process the data you provide. This includes the contact details you provide to us (name, e-mail address, telephone number, etc.) and the reason why you are contacting us (e.g. because you want to respond to a vacancy).
2. If you visit the website, we process analytical data about (the computer of) visitors to our website, via cookies that are placed when you visit the website. More information on this can be found in our cookie statement. The data we collect about visitors to the website is only used to keep statistics on visits to the website (e.g. to see which pages are most frequently viewed). The data is stored anonymously.
3. If customers, where you have been offered or where you work or have worked, share personal information about you with us.
4. From social media, only if we have a legitimate reason to believe that you would be interested in our services.

Your personal data will be processed by Sphere IT for the following purposes:

1. Performing the contract(s) concluded with you, e.g. assignment contract, employment contract, secondment contract;
2. The performance of our services (both internal and external), including recruitment and selection of staff, secondment, IT training and the like;
3. Conducting administration as well as other internal management activities;
4. Liaising with you and responding to queries raised by you;
5. To update you on developments in the market;
6. Conducting customer satisfaction surveys;
7. Conducting marketing activities, including sending newsletters and invitations to events organised by Sphere IT;
8. Improving Sphere IT's services;
9. Complying with legal obligations, such as record-keeping and retention obligations;
10. Handling any disputes with you regarding the performance of the agreement/assignment.

The legal grounds for the aforementioned purposes of processing are as follows:

• The performance of the contract concluded with you, e.g. the assignment contract and/or employment contract and/or taking pre-contractual measures at your request;
• The representation of the legitimate interests of Sphere IT or a third party;
• Complying with legal obligations, such as record-keeping and retention obligations;
• The consent given by you (unambiguously and specifically);
• The promotion of the legitimate interests of Sphere IT or a third party (Art. 6(1)(f) AVG).

The aforementioned legitimate interests may lie in the following:

• Direct marketing purposes;
• Quality and training purposes;
• Improving the quality of our product and service;
• Scientific research.

Under the General Data Protection Regulation, you have several rights. We would like to list these rights for you herewith:

1. Right of inspection
   You have the right to access the data recorded about you at Sphere IT.
2. Right of correction and annulment
   You have the right to have your data amended. You also have the right to have your data destroyed, unless it is reasonable to assume that further retention may be of substantial interest to someone other than you, as well as if a legal requirement precludes destruction.
3. Right of objection
   A right to object means that you can object to certain processing of your personal data because of your specific situation. You have the right to object to all processing not based on your consent, failure to comply with legal obligations for Sphere IT or for the protection of vital interests of yourself or others.
4. Right to limitation
   You also have the right to restrict the processing of your data under certain circumstances. In short, this means that Sphere IT "temporarily" freezes the processing of your data. You can invoke this right in four situations:
   • pending the assessment of a correction request;
   • if data should actually be deleted where you do not want deletion;
   • if Sphere IT no longer needs the data, while you need the data for the preparation of legal proceedings;
   • pending consideration of an objection.
5. Data portability
   You have the right to receive (back) data provided by you to Sphere IT in a common file format. This right only applies to the personal data we process pursuant to your consent or an agreement concluded with you. Moreover, the right only applies to the data we already process in digital form (i.e. not to "paper" processing). You are free to subsequently transfer the data to another party.
6. Withdrawal of consent
   For the data described above, we process your data on the basis of your consent. You have the right to withdraw a consent once given at any time. We will then discontinue processing as soon as possible. Withdrawal of consent does not have retroactive effect. All processing that has already taken place therefore remains lawful.