Candidate Data Privacy Policy

Effective Date: June 15, 2026
Data Controller: Sensorfact B.V.
Contact: legal@sensorfact.nl

At Sensorfact B.V., we value your privacy. This policy explains how we collect, use, and protect your personal data during our recruitment process in accordance with the General Data Protection Regulation (GDPR).

1. Information We Collect

We collect professional and identification data directly from you or through third-party platforms such as LinkedIn, Ashby, and Personio.

2. Why We Process Your Data

  • Application Management: To assess your candidacy. Legal basis includes pre-contractual necessity (Art. 6.1.b GDPR), specifically emphasized for candidates in Spain.
  • Talent Pool: To consider you for future roles. This is based strictly on your explicit consent.
  • Reporting: We use anonymized data to track recruitment performance.

3. Data Retention & Anonymization

We do not keep identifiable data longer than necessary. Our specific retention periods are:

  • Inactive Leads (Sourced): Data is held for 90 days for assessment unless active engagement begins.
  • Unsuccessful Applicants: We retain data for 30 days post-rejection, aligning with the Dutch 4-week rule established by the Autoriteit Persoonsgegevens (AP).
  • Talent Pool: With your consent, we retain data for 18 months. We will contact you at month 17 to refresh this consent.
  • Data Blocking (Spain): Per Art. 32 LOPDGDD, upon expiry of these periods, data for Spanish candidates is « blocked »—restricted to legal and regulatory bodies for the duration of statutory limitation periods (e.g., for defense against legal claims) before final anonymization.

4. Who Has Access?

Your data is shared with our internal teams and trusted processors, including Ashby (ATS), Personio (HRIS), and Remote.com (Global Employment)

5. Your Rights

You have the right to access, correct, or delete your data. You may also lodge a complaint with your local regulator:

  • Netherlands: Autoriteit Persoonsgegevens (AP).
  • Spain: Agencia Española de Protección de Datos (AEPD).
  • Belgium: Gegevensbeschermingsautoriteit (GBA).

To exercise these rights, please contact us at legal@sensorfact.nl. You also have the right to lodge a complaint with your local Data Protection Authority.