TUGA Recruitment connects candidates from the European Union with employers across Europe. To do that we need to process personal data — some of it sensitive, such as identity documents, your BSN, your bank details and voice recordings. This policy explains, in plain language, what we collect, why, who sees it, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is TUGA Recruitment, registered with the Netherlands Chamber of Commerce (KVK) under number 42059707, with its registered office at Eikenlaan 203b, 6024 AN Budel-Dorplein, the Netherlands.
- Email: info@tugarecruitment.com
We are not required to appoint a Data Protection Officer. For questions about privacy, contact us at info@tugarecruitment.com.
2. What data we collect
If you register as a candidate, depending on how far you complete your profile:
- Account data — name, email address, password (stored encrypted, never readable by us).
- Contact and personal details — phone and WhatsApp number, emergency contact, date of birth, gender, nationality, native language, address, postal code, city and country.
- Professional profile — CV, work experience, education, certifications, references, driving licences, availability, English level, whether you have your own transport or housing, and a profile photo if you add one.
- Documents for placement — only after a client has accepted you, and only when they are needed to prepare your start: a copy of your identity document, your BSN (Dutch citizen service number), your IBAN and, if the job requires it, your driving licence. We do not ask for your BSN or a copy of your identity document during your application. If you are hired, the employer processes the data it needs to meet its legal obligations (identification, payroll and tax administration).
- Voice recording (optional) — if you choose to record the English exercise, the audio file, its duration and the exercise you were given. It is only used by a recruiter to confirm your English level. It is not used to identify you and is not biometric data.
- Activity on the platform — applications, proposals, status history, notifications, recruiter notes and the compatibility scores calculated for you.
- Consent records — when you accepted these documents, which version, your IP address and browser type.
If you use the chat assistant, the messages you write and the language you choose. Please do not share identity numbers, bank details or passwords in the chat.
If you are a client or a contact person at a client, your name, business email, phone number, role and the communications we exchange.
If you only visit the website, our hosting providers process technical data such as your IP address, browser type and the pages requested, in server logs. We do not use analytics or advertising tools — see our Cookie Policy.
We collect this data directly from you, from the CV you upload, and from the recruiters who work with you. We do not buy data from third parties.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract — Art. 6(1)(b) |
| Matching your profile with job offers and presenting you to clients | Performance of a contract / steps at your request — Art. 6(1)(b) |
| Preparing your start, after a client has accepted you: identity document, BSN and IBAN | Legal obligation — Art. 6(1)(c) |
| Assessing your English level from a voice recording | Your consent — Art. 6(1)(a). You can withdraw it at any time by deleting the recording |
| Using AI to read CVs, calculate compatibility and draft proposals (see section 5) | Legitimate interest in running an efficient recruitment service — Art. 6(1)(f), with the safeguards described below |
| Keeping you informed about your applications by email and platform notifications | Performance of a contract — Art. 6(1)(b) |
| Sending you WhatsApp messages (job invitations, status updates, document requests) | Your consent — Art. 6(1)(a). You can withdraw it at any time |
| Answering questions through the chat assistant | Legitimate interest — Art. 6(1)(f) |
| Managing our relationship with clients | Performance of a contract / legitimate interest — Art. 6(1)(b) and (f) |
| Security, preventing fraud and misuse, keeping proof of consent | Legitimate interest and legal obligation — Art. 6(1)(f) and (c) |
Where we rely on legitimate interest, you have the right to object (see section 8). We do not use your data for marketing and we never sell it.
5. How we use artificial intelligence
We use AI tools to help our recruiters work faster. We want you to know exactly where:
- Reading your CV — to pre-fill your profile. Before your CV is sent to the AI provider, we automatically remove your name, email address, phone number, IBAN, identity numbers, postal code, address and links.
- Calculating compatibility — a percentage that estimates how well your profile fits each job offer.
- Clarifying your CV — the AI may suggest up to five questions about gaps or unclear points. A recruiter reviews your answers before anything changes on your profile.
- Drafting proposals — the AI writes a first draft of the proposal sent to a client. A recruiter always reads, edits and approves it.
- Internal notes — suggestions for the recruiter on how your CV could be improved.
- Chat assistant — answers general questions about the platform and the application process.
Your English level is never assessed by AI. Only a recruiter, listening to your recording, can confirm or change it.
6. International transfers
Some of our providers are based in the United States (see section 4), so your data may be transferred outside the European Economic Area. We only do this when the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses.
Before a CV is sent for AI processing, direct identifiers are removed (see section 5), so that the minimum amount of data leaves the EEA.
7. How long we keep your data
| Data | How long |
|---|---|
| Candidate account and profile (including CV) | While your account is active. You can ask us to delete your account and data at any time (see sections 8 and 9) |
| Voice recording for the English assessment | Deleted automatically 12 months after it was made if you are not in an active recruitment process. You can delete it yourself at any time from your profile |
| Identity documents, BSN and IBAN | Only for as long as needed for your placement, and afterwards for the period required by Dutch law |
| Proof of consent (these documents) | For as long as your account exists |
| Client and business contact data | For the duration of the business relationship and afterwards for as long as the law requires us to keep business records |
When a retention period ends, data is deleted or irreversibly anonymised.
8. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have incorrect or incomplete data corrected. You can also edit most of your profile yourself.
- Erasure — have your data deleted, unless we are legally required to keep it.
- Restriction — ask us to temporarily stop using your data, for example while we check its accuracy.
- Data portability — receive the data you gave us in a structured, machine-readable format.
- Object — to processing based on our legitimate interest, including AI-assisted processing.
- Withdraw consent — at any time, for processing based on consent (such as the voice recording), without affecting what was done before.
- Human intervention — not to be subject to a decision based solely on automated processing, and to have a person review it (see section 5).
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the data protection authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first.
9. How to exercise your rights
Send an email to info@tugarecruitment.com from the email address linked to your account, saying which right you want to exercise. If we cannot confirm that the request comes from you, we may ask for additional information — but never a full copy of your identity document for this purpose.
We reply within one month. For complex requests this may be extended by two more months; if so, we will tell you why within the first month. Exercising your rights is free of charge.
10. How we protect your data
All connections to the website and the platform are encrypted (HTTPS). Passwords are stored as one-way hashes. Documents and voice recordings are kept in private storage that is not publicly accessible and can only be opened by authorised recruiters (and, for your identity document and driving licence, by the client that has accepted you, as described in section 4). Access within our team is limited by role, and clients only ever see the limited information described in section 4.
If a data breach occurs that is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay when required by law.
12. Changes to this policy
We may update this policy when our services or the law change. The date of the latest version is shown at the top of this page. If the changes are significant, we will inform registered users and, where required, ask you to accept the new version.