This is a translation for your convenience. In case of any difference in meaning, the Dutch version of this statement prevails.
Short version: your data is yours, we sell nothing on and we set no tracking cookies. If you have a profile, we keep your CV and your details for as long as you want, and you can delete everything yourself. The full story is below.
Who is the data controller?
MaRan Information Technology BV, publisher of EchteVacatures.nl. For questions about your data, use the contact form.
If you create a profile
In a profile we keep what you fill in yourself: your name, email address, phone number, place of residence, your description, your work experience, your education, your skills and your CV files. That is the point of a profile: fill it in once and then apply without retyping everything.
Legal basis: performance of the service you take from us. You decide what you fill in, you can change or discard anything at any time, and you can delete your account with everything in it in one go from your profile.
Who can see your profile. By default, nobody. An employer sees your profile and your CV only if you applied to their vacancy. If you want employers to be able to find you, you switch that on yourself in your profile, and you can switch it off just as easily. We never switch it on for you.
CV files sit on our server outside the public folders and can only be retrieved after a check on who you are. There is no CV database that we offer to third parties, and we do not sell or rent your data to anyone.
If you create a CV here, we also store your languages, driving licence, courses and interests for it, and a photo if you add one. You take the photo with your webcam or choose it yourself; you crop it in the browser before it is sent to us. It only appears on the CV you create yourself, not in the profile employers see. You can delete it at any time. If you delete your account, it goes to the archive with everything else (see the retention periods).
If you apply
Your name, your motivation and your CV go to the employer of the vacancy. Your email address and phone number do not: the employer responds via us and only receives them when you click 'Share my details'. If they are on your CV, the employer will see them there; a CV you save to your profile with our generator therefore leaves them out. We keep the application and the messages about it with your profile, so you can see where you applied and the employer can find it in their dashboard.
Applying without an account is possible too. In that case we keep the application and the CV you sent only to deliver them to the employer and to be able to check whether that worked.
One exception to forwarding. Employers pay with points for a response. If their balance is empty at the moment you apply, we do keep your application but do not forward it yet; that happens as soon as the employer tops up. We notify them that a response is waiting. So your application is and stays sent, but it may take longer before the employer sees it. If it sits too long, we take the vacancy offline.
Legal basis: performance of the service you requested. From the moment of forwarding, the employer is itself responsible for your application data, with its own retention period. We cannot retrieve a sent application from the employer.
Logging in, password and two-step verification
You log in with your email address and a password. We do not keep the password itself: we keep an encrypted imprint of it (PBKDF2 with a separate salt per password), from which the password cannot be calculated back. So even a stolen database yields no working passwords.
If you forget your password, we send a one-time link to your email address. Of that link we keep only a hash; it is valid for 30 minutes and works once.
If you switch on two-step verification yourself, we keep the secret your app uses to generate codes, and hashes of your recovery codes. If you switch it off again, we delete both. Two-step verification is off by default.
If you link your LinkedIn account, we keep the account identifier LinkedIn gives us and the name that goes with it. Your LinkedIn password never reaches us.
If you set up a job alert
We keep your email address and your search criteria, plus an unsubscribe token. You can unsubscribe with the link at the bottom of every alert email, without logging in. After unsubscribing the record is kept inactive so we do not write to you again by accident.
If you register as an employer
We keep the organisation details (name, chamber of commerce number, industry code, website, place, description) and the contact details of the person registering. The chamber of commerce number and industry code are public company data and are shown with your vacancies, so candidates can check them themselves. We do not publish the contact person's details.
In case of a rejection we keep the registration and the screening report, so we can recognise the same organisation on a next attempt.
Of payments we keep the order, the amount and the status. We do not see account numbers or card details: those stay with the payment provider.
If you report a vacancy
The reason, your explanation and your IP address are kept. Your email address is optional and we use it only to send you a reply. A report is never passed on to the employer reported.
Log files and IP addresses
For applications, reports and login attempts we store the IP address, purely against abuse. On a server error a technical report is emailed to our own error address; it may contain the IP address and the URL of the request. We leave cookie headers out of that report.
Cookies
We place no tracking cookies and use no advertising networks. There are two technical cookies: an anti-forgery cookie on forms, and a login cookie when you log in. The latter is needed to stay logged in and disappears when you log out. Necessary cookies require no consent, so you see no cookie banner here.
Third parties
- Brevo (Sendinblue, EU) sends our email. They see the receiving address and the content of the mail, including an attached CV.
- Stripe processes employers' payments. We see no account numbers or card details: the employer enters those at Stripe and they do not reach us. Stripe is a US company with an Irish entity for Europe; transfer outside the EU may therefore take place, for which Stripe relies on the European Commission's standard contractual clauses.
- Cloudflare Turnstile checks, when you create an account and when an employer signs up, whether there is a human behind the form. The widget loads in your browser from Cloudflare and sees, among other things, your IP address and details about your browser; it does not set tracking cookies. We only send the result and your IP address to Cloudflare for the check. Cloudflare is an American company; for transfers outside the EU it relies on the EU-US Data Privacy Framework and the standard contractual clauses.
- Google Fonts supplies the typeface of this site.
Data only ends up outside the EEA at Stripe and Cloudflare, as described above. We do not sell data and do not share it with anyone else.
Retention periods
- Profile and CV files: for as long as you keep your account. If you delete your account, we keep a copy of your data and files for one more year in a locked archive. We do this only to be able to defend ourselves in the event of a complaint or dispute (legitimate interest); nobody uses the archive for anything else, and after that year it is deleted automatically.
- Applications with an account: as long as you keep your account, so you can look back at them.
- Applications without an account: 12 months.
- Views of a vacancy: as a hash, a few days at most. Only to be able to deduplicate; we keep no IP address and after a day the hash can no longer be traced back.
- Links for a forgotten password: valid for 30 minutes; we clear the records after a week.
- What you do while logged in (logging in, searches, vacancies viewed, applications and changes to your profile or account, with the IP address): 90 days, in a log that only we can see. We keep it to detect misuse and to answer questions about your account (legitimate interest). Employers do not see it. For visitors who are not logged in, we keep nothing per person.
- Job alerts: until you unsubscribe, then kept inactive.
- Employer data: as long as the organisation is on the site.
- Invoices and payment data: seven years, because of the tax retention obligation.
- Reports: 24 months.
Your rights
You can view, change and delete your profile, your work experience, your education and your CVs yourself: it is all in your profile, without having to ask us anything. For access, correction or deletion of other data, use the contact form. We respond within four weeks. If you are not satisfied, you can lodge a complaint with the Dutch Data Protection Authority.
Two things that do not disappear when you delete your account. A sent application already sits with the employer; for deletion there you have to go to that employer yourself, and we can tell you which address it was sent to. And a CV you sent with an application stays available to that one employer: they already received it, and it would be odd if they lost the attachment to an ongoing application.