TUGA Recruitment connects candidates from the European Union with employers in the Netherlands. To do that we need to process personal data — some of it sensitive, such as identity documents, your BSN, your bank details and voice recordings. This policy explains, in plain language, what we collect, why, who sees it, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is TUGA Recruitment [A PREENCHER: legal name and legal form exactly as registered with the KVK], registered with the Netherlands Chamber of Commerce (KVK) under number 42059707, based in the Eindhoven area, the Netherlands.
- Email: info@tugarecruitment.com
- WhatsApp (messages only): +31 6 83785959
We have not appointed a Data Protection Officer [A PREENCHER: confirm — a DPO is mandatory if large-scale processing of special categories or criminal data is a core activity]. Questions about privacy can be sent to the email address above.
2. What data we collect
If you register as a candidate, depending on how far you complete your profile:
- Account data — name, email address, password (stored encrypted, never readable by us).
- Contact and personal details — phone and WhatsApp number, emergency contact, date of birth, gender, nationality, native language, address, postal code, city and country.
- Professional profile — CV, work experience, education, certifications, references, driving licences, availability, English level, whether you have your own transport or housing, and a profile photo if you add one.
- Documents for placement — copies of your identity document and driving licence, your BSN (Dutch citizen service number) and your IBAN. These are only requested when they are needed to place you in a job.
- Criminal record declaration — a yes/no answer on whether you have a criminal record. This is data about criminal convictions (Article 10 GDPR) [A PREENCHER: confirm the legal ground under the Dutch GDPR Implementation Act (UAVG) and whether this question is necessary, or replace it with a Certificate of Conduct (VOG) requested only when a client requires one].
- Voice recording (optional) — if you choose to record the English exercise, the audio file, its duration and the exercise you were given. It is only used by a recruiter to confirm your English level. It is not used to identify you and is not biometric data.
- Activity on the platform — applications, proposals, status history, notifications, recruiter notes and the compatibility scores calculated for you.
- Consent records — when you accepted these documents, which version, your IP address and browser type.
If you use the chat assistant, the messages you write and the language you choose. Please do not share identity numbers, bank details or passwords in the chat.
If you are a client or a contact person at a client, your name, business email, phone number, role and the communications we exchange.
If you only visit the website, our hosting providers process technical data such as your IP address, browser type and the pages requested, in server logs. We do not use analytics or advertising tools — see our Cookie Policy.
We collect this data directly from you, from the CV you upload, and from the recruiters who work with you. We do not buy data from third parties.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract — Art. 6(1)(b) |
| Matching your profile with job offers and presenting you to clients | Performance of a contract / steps at your request — Art. 6(1)(b) |
| Preparing your placement: verifying your identity, registering your BSN and IBAN | Legal obligation — Art. 6(1)(c) [A PREENCHER: identify the specific Dutch legal provisions, e.g. identification and payroll tax obligations] |
| Assessing your English level from a voice recording | Your consent — Art. 6(1)(a). You can withdraw it at any time by deleting the recording |
| Criminal record declaration | [A PREENCHER: legal basis under Art. 10 GDPR and the UAVG] |
| Using AI to read CVs, calculate compatibility and draft proposals (see section 5) | Legitimate interest in running an efficient recruitment service — Art. 6(1)(f), with the safeguards described below |
| Keeping you informed about your applications by email and platform notifications | Performance of a contract — Art. 6(1)(b) |
| Sending you WhatsApp messages (job invitations, status updates, document requests) | Your consent — Art. 6(1)(a). You can withdraw it at any time |
| Answering questions through the chat assistant | Legitimate interest — Art. 6(1)(f) |
| Managing our relationship with clients | Performance of a contract / legitimate interest — Art. 6(1)(b) and (f) |
| Security, preventing fraud and misuse, keeping proof of consent | Legitimate interest and legal obligation — Art. 6(1)(f) and (c) |
Where we rely on legitimate interest, you have the right to object (see section 8). We do not use your data for marketing and we never sell it.
5. How we use artificial intelligence
We use AI tools to help our recruiters work faster. We want you to know exactly where:
- Reading your CV — to pre-fill your profile. Before your CV is sent to the AI provider, we automatically remove your name, email address, phone number, IBAN, identity numbers, postal code, address and links.
- Calculating compatibility — a percentage that estimates how well your profile fits each job offer.
- Clarifying your CV — the AI may suggest up to five questions about gaps or unclear points. A recruiter reviews your answers before anything changes on your profile.
- Drafting proposals — the AI writes a first draft of the proposal sent to a client. A recruiter always reads, edits and approves it.
- Internal notes — suggestions for the recruiter on how your CV could be improved.
- Chat assistant — answers general questions about the platform and the application process.
Your English level is never assessed by AI. Only a recruiter, listening to your recording, can confirm or change it.
6. International transfers
Some of our providers are based in the United States (see section 4), so your data may be transferred outside the European Economic Area. We only do this when the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses.
[A PREENCHER: confirm the transfer mechanism for each provider — e.g. whether Abacus.AI and Vercel are certified under the EU-US Data Privacy Framework, or which Standard Contractual Clauses apply.]
Before a CV is sent for AI processing, direct identifiers are removed (see section 5), so that the minimum amount of data leaves the EEA.
7. How long we keep your data
| Data | How long |
|---|---|
| Candidate account and profile (including CV) | While your account is active, and deleted 12 months after your last activity, unless you are in an active recruitment process or placed |
| Voice recording for the English assessment | Deleted automatically 12 months after it was made if you are not in an active recruitment process. You can delete it yourself at any time from your profile |
| Identity documents, BSN and IBAN | Only for as long as needed for your placement, and afterwards for the period required by Dutch law [A PREENCHER: statutory period — e.g. 5 years after the end of employment for identity document copies, 7 years for tax records] |
| Proof of consent (these documents) | For as long as your account exists |
| Chat assistant conversations | [A PREENCHER: retention period] |
| Client and business contact data | For the duration of the business relationship and [A PREENCHER: period afterwards] |
| Server logs | [A PREENCHER: retention period set by the hosting providers] |
When a retention period ends, data is deleted or irreversibly anonymised.
8. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have incorrect or incomplete data corrected. You can also edit most of your profile yourself.
- Erasure — have your data deleted, unless we are legally required to keep it.
- Restriction — ask us to temporarily stop using your data, for example while we check its accuracy.
- Data portability — receive the data you gave us in a structured, machine-readable format.
- Object — to processing based on our legitimate interest, including AI-assisted processing.
- Withdraw consent — at any time, for processing based on consent (such as the voice recording), without affecting what was done before.
- Human intervention — not to be subject to a decision based solely on automated processing, and to have a person review it (see section 5).
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the data protection authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first.
9. How to exercise your rights
Send an email to info@tugarecruitment.com from the email address linked to your account, saying which right you want to exercise. If we cannot confirm that the request comes from you, we may ask for additional information — but never a full copy of your identity document for this purpose.
We reply within one month. For complex requests this may be extended by two more months; if so, we will tell you why within the first month. Exercising your rights is free of charge.
10. How we protect your data
All connections to the website and the platform are encrypted (HTTPS). Passwords are stored as one-way hashes. Documents and voice recordings are kept in private storage that is not publicly accessible and can only be opened by authorised recruiters. Access within our team is limited by role, and clients only ever see the limited information described in section 4.
If a data breach occurs that is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay when required by law.
12. Changes to this policy
We may update this policy when our services or the law change. The date of the latest version is shown at the top of this page. If the changes are significant, we will inform registered users and, where required, ask you to accept the new version.