Privacy statement | Zantboer & Partners

I. General

I.1. Moore DRV

This privacy notice has been prepared by the public partnership Moore DRV (hereinafter: “Moore DRV”). Moore DRV’s contact details are:

Address: Joulehof 10, 4622 RG Bergen op Zoom
Phone: 0164-241850
E-mail: info@moore-drv.nl
Chamber of Commerce: 24492873

I.2. Controller

Moore DRV determines the purposes and means for which, and on the basis of which, personal data is used within its business activities. Moore DRV therefore qualifies as a data controller within the meaning of the General Data Protection Regulation (GDPR).

I.3. Data Protection Officer

Moore DRV has appointed a Data Protection Officer who is involved in all matters relating to the protection of personal data within Moore DRV. The contact details of the Data Protection Officer are:

Name: mevr. A.M.H.G. van Delft
Phone: 06-31986056
E-mail: compliance@moore-drv.nl

I.4. Duty to inform

Moore DRV – as the data controller – has the obligation to inform the persons whose personal data it processes about how and why they are processed. Moore DRV fulfils this information obligation through this privacy notice.

I.5. Changes

This privacy notice was adopted October 27^th 2025. Moore DRV may amend this statement in the future. If Moore DRV amends this statement, the amended privacy statement will be published on Moore DRV’s website (www.moore-drv.nl), indicating the effective date of the amendments. If there are changes that may significantly affect one or more stakeholders, Moore DRV will do its best to also inform those stakeholders immediately.

II. Purposes and means

This section is structured as follows: for each category of data subjects, Moore DRV fulfils its duty to disclose. In addition to the information per category of data subjects, Moore DRV also informs you about purposes that are the same for all categories of data subjects.

II.1. You are a client (being a natural person in a sole proprietorship, VOF, CV or partnership) of ours

If you are a client (being a natural person in a sole proprietorship, VOF, CV or partnership) of Moore DRV, personal data of yours may be processed by us for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	negotiating and entering into (potential) agreements for the supply or purchase of our services by the client	contract performance
2	screening the client prior to the provision of our services - and during the provision of services - under the WWFT and complying with the resulting obligations	statutory duty
3	reporting an unusual transaction to the FIU	statutory duty
4	executing the agreement between) between Moore DRV and the client and communicating about the execution, progress and results (including handling and/or submitting complaints in this context)	contract performance
5	sending, processing, viewing and collecting invoices	contract performance
6	managing the business relationship with the client	legitimate interest
7	sending our newsletters and determining, based on aggregated data, whether and how Moore DRV's newsletters are read	legitimate interest
8	conducting client satisfaction surveys	legitimate interest

Insofar as the basis for processing personal data for a purpose is based on the existence of a legitimate interest (balancing the interest of the processing controller vs. the interest of the data subject), the legitimate interest of Moore DRV or third party (per purpose) is formulated below:

Purpose	Legitimate interest	From whom?
A.6	Enabling Moore DRV to manage client relationship	Moore DRV
A.7	Enabling Moore DRV to inform clients about relevant Moore DRV services and/or products by means of a newsletter and to gain insight into the conversion of those newsletters on the basis of aggregated data	Moore DRV
A.8	Enabling Moore DRV to determine the level of client satisfaction with Moore DRV's services and products	Moore DRV

Notes

In the event Moore DRV provides its services to a natural person in a sole proprietorship, VOF, CV or partnership, Moore DRV shall consider all data it processes in the context of the provision of services to the sole proprietorship, VOF, CV or partnership and the documents created on the basis of the services as personal data relating to the client being a natural person.

In case Moore DRV performs its services for a legal entity, Moore DRV does not consider data it processes in the context of providing services to that legal entity as personal data relating to the client.

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data by purpose if you are a client of ours.

Purpose	(Categories) of personal data
A.1	client contact details: • initials* • first name* • surname* • email address* • phone number* • company name* • title • titles company details: • pre-contractual communication • communication about concluding the agreement • pre-contractual documents / offers • Chamber of Commerce registration number • Commercial Register excerpt • contract documentation** • financial data • creditworthiness data
A.2	client data: • company name screening data: • first name client/PEP() • surname client/PEP() • date of birth client/PEP() • place of birth client/PEP() • address client/PEP() • copy of passport client/PEP (without BSN)() • first name representative() • surname representative() • date of birth representative() • place of birth representative() • address representative() • ID card number() • validity period ID()
A.3	data to be reported to the FIU, among others: • identity client/UBO/party on whose behalf transaction is executed • type of ID and number client/UBO/party on behalf of which transaction is executed • nature, time and place of transaction • cash: volume, origin and destination • reason transaction is unusual**
A.4	client contact details: • the contact details listed under A.1* company details: • contract details • financial data() • data structure() • payroll() • personnel administration() • contract documentation() • administration and accounting (e.g. sales, purchases, turnover)() agreed-upon products: • (draft) annual accounts and reports • approval statements • pay slips • (subsidy) applications • opinions • reports other details: • data relating to the execution, progress and results of the agreement • payment details ** • communication regarding implementation, progress and results of the agreement • communication with third parties (including tax authorities)
A.5	client contact details: • the contact details listed under A.1* company details: • contract details • VAT number • billing data • payment details** • payment reminders / summonses • objections to invoices • communication regarding invoicing
A.6	client contact details: • the contact details listed under A.1* company details:: • services/products purchased relationship management details: • private address client • position client • working days client • birthday client • anniversaries/promotions client • birth and death notices related to client • interests/hobbies client • company characteristics • gifts to client • communication with client regarding relationship management
A.7	contact details: • email address contact person • logging interests • data relating to conversion of sent newsletters • log data opt-out
A.8	contact details: • the contact details listed under A.1 client satisfaction survey: • recording of content of physical interview • communication/feedback on physical interview

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you purchase services from us as a client (being a natural person in a sole proprietorship, VOF, CV or partnership). Personal data necessary for Moore DRV to provide you with services are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot provide the client with its services and/or products.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in connection with the services provided by Moore DRV to you as a client:

(Categories) of recipients
Internal	External
• Finance & Control department	• Tax authorities
• Compliance & Quality Management depart-ment	• UWV (unemployment agency)
• Adviser(s) involved	• Chamber of Commerce
• Marketing and communications department	• Netherlands Enterprise Agency (Rijksdienst voor Ondernemend Nederland/RVO)
	• Chamber of Commerce
	• External advisers to client
	• Notaries
	• Service providers (SaaS services)
	• Microsoft Dynamics 365 CRM

E. Source of personal data

The personal data that Moore DRV processes from you as a client (being a natural person in a sole proprietorship, VOF, CV or partnership) comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself
• generated by Spotler
• Microsoft Dynamics 365 CRM
• Company.info
• Tax authorities
• UWV (unemployment agency)
• Chamber of Commerce
• Netherlands Enterprise Agency (Rijksdienst voor Ondernemend Nederland/RVO)
• External advisers to client

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Dele-tion of personal data stored in Spotler takes place by irreversibly anonymising it.

Purpose	Retention period
A.1	for a maximum period of two (2) years from the day on which the business relationship between Moore DRV and the client has ended. The exception is for business data. Business data relating to a particular agreement shall be deleted or terminated seven (7) years after the end of the calendar year in which the relevant agreement was concluded, unless the retention of such personal data is longer necessary to substantiate/defend an interest of Moore DRV in legal proceedings.
A.2	for a maximum period of five (5) years, from the day the business relationship between Moore DRV and client ended.
A.3	for a maximum period of five (5) years, from the day the business relationship between Moore DRV and client ended.
A.4	for a maximum period of two (2) years from the day on which the business relationship between Moore DRV and the client has ended. The exception applies to company data, data included in agreed products and grant administration. Business data relating to performance of a particular agreement for a period of seven (7) years from the end of the calendar year in which the relevant agreement was performed, or that agreement was terminated. The data included in agreed products for a period of seven (7) years from the end of the calendar year in which the relevant agreed product was delivered, or the work on the product was permanently discontinued, As an exception to the above, grant administration is subject to a period of ten (10) years from the end of the calendar year in which the relevant grant was refused or obtained. The above retention periods do not apply in the event that the retention of these personal data is necessary for a longer period to substantiate/defend an interest of Moore DRV in legal proceedings.
A.5	for a maximum period of two (2) years from the day on which the business relationship between Moore DRV and the client has ended. The exception is for business data. Business data relating to a particular agreement will be retained for seven (7) years after the end of the calendar year in which the relevant agreement came into being or was terminated, unless the retention of such personal data is longer necessary to substantiate/defend an interest of Moore DRV in legal proceedings.
A.6	for a maximum period of two (2) years from the day on which the business relationship between Moore DRV and the client has ended.
A.7	for a period not exceeding one (1) year from the day the client unsubscribes from the relevant newsletter. The sending of the newsletter will stop immediately upon receipt of you unsubscribing.
A.8	for a maximum period of two (2) years from the day on which the business relationship between Moore DRV and the client has ended.

II.2. You are contact person of a client/supplier of ours

If you are a contact of a client or supplier (natural person, partnership or legal entity) of Moore DRV, personal data of you may be processed by us for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	negotiate with contact person about entering into (possible) agreement between Moore DRV on the one hand and client or supplier on the other hand	legitimate interest
2	communicate with contact person on the execution, progress and results of the agreement (including handling, dealing with and/or submitting complaints) between Moore DRV and the client/supplier	legitimate interest
3	sending, processing, viewing and collecting invoices	legitimate interest
4	managing the business relationship with the contact person	legitimate interest
5	sending our newsletters and determining, based on aggregated data, whether and how Moore DRV's newsletters are read	legitimate interest
6	conducting client satisfaction surveys	legitimate interest

Purpose	Legitimate interest	From whom?
A.1	enable Moore DRV to communicate with the contact person during the (pre)contractual phase and the entering into (any) agreement between Moore DRV and client/supplier	Moore DRV
A.2	enable Moore DRV to communicate with the contact person regarding the execution, progress and results of an agreement between Moore DRV and the client/supplier	Moore DRV
A.3	enable Moore DRV to send invoices for the client to the contact and process, verify and/or collect them, or process and verify supplier invoices.	Moore DRV
A.4	enable Moore DRV to manage contact relationship	Moore DRV
A.5	enable Moore DRV to inform client's contact person about relevant Moore DRV services and/or products by means of a newsletter and to gain insight into the conversion of those newsletters on the basis of aggregated data	Moore DRV
A.6	enable Moore DRV to determine the level of client satisfaction with client about Moore DRV's services and products	Moore DRV

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data by purpose if you are a contact.

Purpose	Categories) of personal data
A.1	contact details: • initials contact* • first name contact* • surname contact * • email address contact* • phone number contact* • company name* • title contact • titles contact
A.2	contact details: • the contact details listed under A.1*
A.3	contact details: • the contact details listed under A.1*
A.4	contact details: • the contact details listed under A.1* relationship management details: • phone number contact • private address contact • position of contact • working days contact person • birthday contact • anniversaries/promotions contact • birth and death notices related to contact • interests/hobbies contact • gifts to contact • communication with contact regarding relationship management
A.5	client contact details: • email address contact person • logging interests • data relating to conversion of sent newsletters • log data opt-out
A.6	client contact details: • the contact details listed under A.1 client satisfaction survey: • recording of content of physical interview • communication/feedback on physical interview

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you function as a contact for client. Personal data necessary for Moore DRV to provide you with services are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot provide you with its services and/or products.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in connection with the services provided by Moore DRV to you as a client:

(Categories) of recipients
Internal	External
• Finance & Control department	• External advisers to client
• Compliance & Quality Management depart-ment
• Advisers involved

E. Source of personal data

The personal data that Moore DRV processes from you as a client are from, or may be from:

Source of personal data
• yourself
• generated by Moore DRV itself
• generated by Spotler
• External advisers to client

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by irreversibly anonymising it.

Purpose	Retention period
A.1	for a maximum period of two (2) years, from the day on which the contact is no longer employed by, or is no longer the contact for, the client/supplier
A.2	for a maximum period of two (2) years, from the day on which the contact is no longer employed by, or is no longer the contact for, the client/supplier
A3	for a maximum period of two (2) years, from the day on which the contact is no longer employed by, or is no longer the contact for, the client/supplier
A.4	for a maximum period of two (2) years, from the day on which the contact is no longer employed by, or is no longer the contact for, the client/supplier
A.5	for a period not exceeding one (1) year from the day the contact unsubscribes from the relevant newsletter. The sending of the newsletter will stop immediately upon receipt of you unsubscribing.
A.6	for a maximum period of two (2) years, from the day on which the contact is no longer employed by, or is no longer the contact for, the client/supplier

II.3. You are (pseudo-)UBO, PEP or client representative

If you are a UBO/PEP or client representative of Moore DRV, personal data about you may be processed by us for the purposes and by the means set out below under the WWFT:

A. Purposes and bases

	Purpose	Basis
1	screening the (persons behind the) client prior to the provision of our services - and during the provision of services - based on the WWFT and complying with the resulting obligations.	legal obligation
2	reporting an unusual transaction to the FIU	legal obligation

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data by purpose if you are UBO/PEP or client representative.

Purpose	Legal entity
A.1	client data: • company name screening data: • first name (pseudo-)UBO() • surname (pseudo-)UBO() • date of birth (pseudo-)UBO() • place of birth (pseudo-)UBO() • address (pseudo-)UBO() • percentage interest (pseudo-)UBO() • percentage of voting/controlling (pseudo-)UBO() • copy of passport (pseudo-)UBO (without BSN)() • first name PEP() • surname PEP() • date of birth PEP() • birthplace PEP() • position of PEP() • position of family member PEP() • copy of passport PEP (without BSN)() • first name representative() • surname representative() • date of birth representative() • place of birth representative() • address representative() • ID card number() • validity period ID()
A.2	data to be reported to the FIU, among others: • identity client/UBO/party on whose behalf transaction is executed • type of ID and number client/UBO/party on behalf of which transaction is executed • nature, time and place of transaction • cash: volume, origin and destination • reason transaction is unusual **

Purpose

Legal entity

A.1

client data:
• company name

screening data:
• first name (pseudo-)UBO*(*)
• surname (pseudo-)UBO*(*)
• date of birth (pseudo-)UBO*(*)
• place of birth (pseudo-)UBO*(*)
• address (pseudo-)UBO*(*)
• percentage interest (pseudo-)UBO*(*)
• percentage of voting/controlling (pseudo-)UBO*(*)
• copy of passport (pseudo-)UBO (without BSN)*(*)

• first name PEP*(*)
• surname PEP*(*)
• date of birth PEP*(*)
• birthplace PEP*(*)
• position of PEP*(*)
• position of family member PEP*(*)
• copy of passport PEP (without BSN)*(*)

• first name representative*(*)
• surname representative*(*)
• date of birth representative*(*)
• place of birth representative*(*)
• address representative*(*)
• ID card number*(*)
• validity period ID*(*)

A.2

data to be reported to the FIU, among others:
• identity client/UBO/party on whose behalf transaction is executed**
• type of ID and number client/UBO/party on behalf of which transaction is executed**
• nature, time and place of transaction**
• cash: volume, origin and destination **
• reason transaction is unusual **

C. Obligation to provide personal data

The disclosure of certain personal data is mandatory/necessary if you are a UBO/PEP or client representative. Personal data necessary for Moore DRV to provide you with services are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot provide the client with its services and/or products.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you as a UBO/PEP or client representative:

(Categories) of recipients
Internal	External
• Finance & Control department	• FIU
• Compliance & Quality Management department	• Other gatekeepers providing services to client
• Advisers involved

E. Source of personal data

The personal data that Moore DRV processes from you as a client are from, or may be from:

Source of personal data
• yourself
• generated by Moore DRV itself (from public and external sources)
• client
• other gatekeepers (including accountants, lawyers and notaries) providing services to client

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV.

Purpose	Retention period
A.1	for a maximum period of five (5) years, from the day the business relationship with client ended.
A.2	for a maximum period of five (5) years, from the day the business relationship with client ended.

II.4. You are a supplier (being a natural person/partnership) of ser-vices/products to us

If you are a supplier (being a natural person or a partnership) of Moore DRV, your personal data may be processed by us for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	negotiating and entering into (potential) supply or purchase of your services by us.	contract performance
2	executing the agreement between) between Moore DRV and the client and communicating about the execution, progress and results (including handling and/or submitting complaints in this context)	contract performance
3	receiving, processing, viewing and paying invoices	contract performance
4	managing the business relationship with supplier	legitimate interest

Purpose	Legitimate interest	From whom?
A.4	enable Moore DRV to manage supplier relationship	Moore DRV

Notes

In the event Moore DRV procures its services and/or products from a natural person/partnership (VOF, CV, partnership), Moore DRV shall designate all data it processes in the context of procuring those services and/or products from the natural person/partnership as personal data.

In the event Moore DRV procures services and/or products from a legal entity, Moore DRV shall not consider any data it processes in the context of procuring those services and/or products from that legal entity as personal data relating to that supplier

B. (Categories) of personal data

Moore DRV may process from you as a supplier the following (categories of) personal data for each purpose.

Purpose	Legal entity
A.1	Supplier contact details: • initials* • first name* • surname* • email address* • phone number* • company name* • title • titles company details: • pre-contractual communication • communication on entering into the agreement* • pre-contractual documents / offers • Chamber of Commerce registration number • Commercial Register excerpt • contract documentation** • financial data • creditworthiness data
A.2	supplier contact details: • the contact details listed under A.1* company details: • contract details* • financial data • data relating to performance, progress and results of the agreement* • payment details** • communication regarding implementation, progress and results of the agreement
A.3	Supplier contact details: • the contact details listed under A.1* company details: • contract details • VAT number • billing data • payment details** • payment reminders / summonses • objections to invoices • communication regarding invoicing
A.4	Supplier contact details: • the contact details listed under A.1* company details:: • services/products purchased relationship management details: • private address supplier • position supplier • working days supplier • anniversary of supplier • anniversaries/promotions supplier • birth and death notices related to supplier • interests/hobbies supplier • company characteristics • gifts to supplier • communication with supplier regarding relationship management

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you purchase services from us as a client. Personal data necessary for Moore DRV to provide you with services are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot provide you with its services and/or products.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in connection with the services and/or products purchased by Moore DRV from you as a supplier:

(Categories) of recipients
Internal	External
• Purchasing department	• Tax authorities
	• Microsoft Dynamics 365 CRM

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself
• generated by Spotler

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by irreversibly anonymising it.

Purpose	Retention periods
A.1	for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended.
A.2	for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended. The exception is for business data. The business data relating to a particular agreement will be retained five (5) years after the end of the calendar year in which the relevant agreement came into being or was terminated, unless the retention of such personal data is longer necessary to substantiate/defend an interest of Moore DRV in legal proceedings.
A.3	for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended. The exception is for business data. Business data relating to a particular agreement will be retained for seven (7) years after the end of the calendar year in which the relevant agreement came into being or was terminated, unless the retention of such personal data is longer necessary to substantiate/defend an interest of Moore DRV in legal proceedings.
A.4	for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended.
A.5	for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended.

II.5. You fill in the contact form on our website

If you complete the contact form on our website, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	responding to, and handling, the contact request you have made through our website regarding the possible provision of any of Moore DRV's services	execution of contract
2	responding to, and handling, the contact request you have made through our website in relation to a subject other than the possible provision of any of Moore DRV's services	legitimate interest

Purpose	Legitimate interest	From whom?
A.2	enable Moore DRV to respond to the contact request made by you and to provide you with an answer to your question and/or comment	Moore DRV

B. (Categories) of personal data

Moore DRV may process from you as a data subject the following (categories of) personal data for each purpose.

Purpose	(Categories) of personal data
A.1	• company name* • name* • phone number • email address* • concerning which services?** • your question/remark/completed data on form • newsletter? yes/no • our response to your question/comment
A.2	• company name* • name* • phone number • email address* • concerning which services?* * • your question/remark/completed data on form • newsletter? yes/no

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you submit a contact request via our website. Personal data necessary for Moore DRV to process your contact request are indicated under B with an *. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot process your contact request.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you as part of your contact form:

(Categories) of recipients
Internal	External
• HRM department	• Spotler
• relationship manager(s)	• Microsoft Dynamics 365 CRM
• involved consultant(s)

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself
• Company.info
• Kamer van Koophandel

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by irreversibly anonymising it.

Purpose	Retention period
A.1	for a period of one (1) year from the day there was last contact between us and you based on the contact request.
A.2	for a period of one (1) year from the day there was last contact between us and you based on the contact request.

II.6. You contact us via WhatsApp or Facebook Messenger

If you contact us via WhatsApp or Facebook Messenger, your personal data will be processed by Moore DRV for the purposes and through the means set out below:

A. Purposes and bases

	Purpose	Basis
1	responding to, and handling, the question you ask us via WhatsApp or Facebook Messenger in relation to a service we already provide to you	execution of contract
2	responding to, and handling, the question you ask us via WhatsApp or Facebook Messenger in relation to a subject other than a service already provided to you	legitimate interest

Purpose	Legitimate interest	From whom?
A.2	enable Moore DRV to respond to contact made by you via WhatsApp or Messenger and provide you with an answer to your question and/or comment	Moore DRV

Note on purpose A.1 and A.2

Moore DRV allows you to connect via messenger apps WhatsApp and Facebook Messenger. Moore DRV notes that by using the messenger services of WhatsApp and Facebook Messenger, respectively, the latter process personal data about you. This data may be used by WhatsApp and Facebook Messenger to create or enrich a profile of you and, based on this, undertake direct marketing activities towards you. WhatsApp and Facebook Messenger are themselves responsible for those processing operations. Moore DRV only uses WhatsApp and Facebook Messenger to communicate with you and therefore not to undertake direct marketing activities towards you ourselves.

Messages sent through WhatsApp are end-to-end encrypted. WhatsApp therefore does not know the content of our communications. WhatsApp does process your metadata when using WhatsApp. Moore DRV advises you to take note of WhatsApp’s privacy notice so that you are aware for what purposes and on what bases they process personal data from you, and which personal data.

Messages sent via Facebook Messenger are not encrypted by default. However, encryption can be enabled. In addition to your meta data, Facebook Messenger also processes data relating to search history, location and financial data when using Facebook Messenger, among other things. Moore DRV advises you to take note of Facebook Messenger’s privacy statement so that you are aware for what purposes and on what bases they process personal data from you, and which personal data.

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data for each purpose from you as a data subject.

Purpose	(Categories) of personal data
A.1	• WhatsApp or Facebook Messenger account name • phone number (if via WhatsApp) • IP address (if via Messenger) • your question/comment/provided data in app/chat message • our response to your question/comment
A.2	• WhatsApp or Facebook Messenger account name • phone number (if via WhatsApp) • IP address (if via Messenger) • your question/comment/provided data in app/chat message • our response to your question/comment

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you contact us via Whatsapp or Facebook Messenger. Personal data necessary for Moore DRV to respond to your contact request are indicated with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot process your contact request.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of your contact request via WhatsApp or Facebook Messenger:

(Categories) of recipients
Internal	External
• IT department	• Ask Roger/Roger365.io
• marketing and communications department	• Microsoft (Teams and CRM)
• relationship managers	• WhatsApp
• involved consultant(s)	• Facebook Messenger
	• CM.com

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself
• WhatsApp (communication data)
• Facebook Messenger (communication data)
• Microsoft (communication data)
• Company.info
• Kamer van Koophandel

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV:

Purpose	Retention period
A.1	for a maximum period of one (1) year, from the day there was last contact between us and you based on the contact request and no further contact has taken place between us during these twelve (12) months.

II.7. You subscribe to our digital newsletter

If you register via our website to receive our digital newsletter, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	process your registration (opt-in) and subsequently send you our digital newsletter	permission
2	send you white papers and/or brochures at your request as a reward for subscribing to the newsletter	permission
3	determine whether and how Moore DRV's newsletters are read based on aggregated data	legitimate interest
4	unsubscribe you from our digital newsletter	permission

Purpose	Legitimate interest	From whom?
A.3	allow Moore DRV to gain insight into the conversion of our newsletters based on aggregated data	Moore DRV

Note on consent (A.1 and A.2)

Given the nature and content of the newsletter, Moore DRV assumes that if you subscribe to the newsletter you are over 16 years of age. Should this not be the case, Moore DRV assumes that your parents/legal representatives have given permission for you to subscribe to the newsletter. In case of reasonable doubt, we will be able to ask you to demonstrate such consent.

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data about you as a newsletter recipient.

Purpose	(Categories) of personal data
A.1	• email address* • log data login (opt-in)
A.2	• email address* • company name* • name* • phone number
A.3	• data relating to conversion of sent newsletters
A.4	• email address* • logout details

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you want to receive the newsletter. Personal data necessary for Moore DRV to send you the newsletter are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. If you do not wish to provide these mandatory/necessary details to Moore DRV, Moore DRV cannot process your newsletter subscription.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of sending the newsletter to you:

(Categories) of recipients
Internal	External
• Marketing & Communications department	• Spotler

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by anonymising it.

Purpose	Retention periods
A.1	for a period not exceeding one (1) year, from the day you unsubscribe from the newsletter. The sending of the newsletter will stop immediately upon receipt of you unsubscribing.
A.2	for a period not exceeding one (1) year, from the day you unsubscribe from the newsletter. The sending of the newsletter will stop immediately upon receipt of you unsubscribing.
A.3	for the period during which the aggregated data are relevant and useful to Moore DRV to determine (partly) on that basis the frequency and content of its newsletters
A.4	for a period not exceeding one (1) year, from the day you unsubscribe from the newsletter. The sending of the newsletter will stop immediately upon receipt of you unsubscribing.

II.8. You sign up for a webinar

If you register to participate in one of our webinars via our website, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	processing and confirming your registration for a webinar	legitimate interest
2	sending the link for the purpose of the webinar	contract performance
3	posting the presentation/content as discussed during the webinar	permission

Purpose	Legitimate interest	From whom?
A.1	enable Moore DRV to record who and how many people sign up for a webinar	Moore DRV

Note on purpose A.1

Given the nature and content of the webinars, Moore DRV assumes that if you register for a webinar you are over 16 years of age. Should this not be the case, Moore DRV assumes that your parents/legal representatives have given permission for you to register for our webinar. In case of reasonable doubt, we will be able to ask you to demonstrate such consent.

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data from you as a webinar participant.

Purpose	(Categories) of personal data
A.1	• company name* • first name* • surname* • email address* • which webinar* • communication regarding registration
A.2	• first name • surname • email address • webinar correspondence
A.3	• first name • surname • email address • log data post-presentation/content (opt-in) • post-performance/content correspondence

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you wish to participate in a webinar. Personal data necessary for Moore DRV to send you the newsletter are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory/necessary details to Moore DRV, Moore DRV cannot process your request to participate in a webinar.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of participating in a webinar:

(Categories) of recipients
Internal	External
• Marketing & Communications department	• Spotler
• relationship managers	• Microsoft Dynamics 365 CRM
• involved consultants

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by anonymising it.

Purpose	Retention periods
A.1	for a period not exceeding two (2) years, from the day the relevant webinar took place. The exception is the case where the webinar participant is a (contact of) a client, in which case the personal data will be retained for a maximum period of two (2) years, calculated, from the day the contact is no longer employed by, or is no longer a contact for, the client, respectively, calculated from the moment the client is no longer a client of Moore DRV.
A.2	for a period not exceeding two (2) years, from the day the relevant webinar took place. The exception is the case where the webinar participant is a (contact of) a client, in which case the personal data will be retained for a maximum period of two (2) years, calculated, from the day the contact is no longer employed by, or is no longer a contact for, the client, respectively, calculated from the moment the client is no longer a client of Moore DRV.
A.3	for a period not exceeding two (2) years, from the day the relevant webinar took place. The exception is the case where the webinar participant is a (contact of) a client, in which case the personal data will be retained for a maximum period of two (2) years, calculated, from the day the contact is no longer employed by, or is no longer a contact for, the client, respectively, calculated from the moment the client is no longer a client of Moore DRV.

II.9. You register for - and attend - an event

If you register to participate in one of our events, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
1	invite you to participate in a Moore DRV event	permission legitimate interest
2	recording your registration for the event and confirming the registration to you	permission
3	including you in the event's attendee list providing you with a list of event attendees prior to the event	permission
4	providing you with a list of event attendees prior to the event	permission
5	providing the event attendee with a name badge for use during the event	permission
6	reporting/recording the event for internal and external reporting and/or marketing purposes	legitimate interest
7	reporting/recording the event for marketing purposes	permission

Purpose	Legitimate interest	From whom?
A.1	enable Moore DRV to invite you by post to participate in a Moore DRV event	Moore DRV
A.6	enable Moore DRV to cover/record the event for internal and external reporting	Moore DRV

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data from you if you register for an event and/or attend an event.

Purpose	(Categories) of personal data
A.1	• first name contact* • surname contact* • email address contact* • address contact* • company* • communication regarding event registration
A.2	• first name visitor* • surname visitor* • email address visitor* • mobile phone number visitor* • company* • on participant list: yes/no* • receive list of participants: yes/no* • nameplate: yes/no* • recognisable in photo/video: yes/no* • registration correspondence
A.3	• first name visitor* • surname visitor* • company*
A.4	• first name visitor* • surname visitor* • email address visitor* • company* • (communicatie m.b.t.) deelnemerslijst
A.5	• first name visitor* • surname visitor* • nameplate
A.6	• photos/video in which visitor is recognisable • recognisable voice of visitor
A.7	• photos/video in which visitor is recognisable • recognisable voice of visitor

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you wish to attend one of our events. Personal data necessary for Moore DRV to send you the newsletter are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you refuse to provide Moore DRV with these mandatory/necessary details, Moore DRV cannot process your request for registration and/or participation in an event.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of event participation:

(Categories) of recipients
Internal	External
• Marketing & Communications department	• Spotler
• relationship manager(s)	• Microsoft Dynamics 365 CRM
• involved consultant(s)
• staff involved in event

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself

F. Retention periods

Purpose	Retention periods
A.1	for a period not exceeding two (2) years, from the day on which the event in question took place
A.2	for a period not exceeding two (2) years, from the day on which the event in question took place
A.3	for a period not exceeding two (2) years, from the day on which the event in question took place
A.4	for a period not exceeding two (2) years, from the day on which the event in question took place
A.5	for a period of not more than three (3) months , from the day on which the event in question took place
A.6	for the period that a photograph/video/recording in which you are recognisable is relevant and usable for internal or external reporting by Moore DRV
A.7	for the period that a photograph/video/recording in which you are recognisable is relevant and usable for internal or external reporting by Moore DRV

II.10. You request a demonstration via our website

If you request a demonstration (online or physical) via our website, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
		application on behalf of legal entity	application on behalf of natural person/partnership
1	being able to process your request for a demonstration	legitimate interest	execution of contract
2	communicating regarding date, time and manner of demonstration and giving it	legitimate interest	execution of contract

Purpose	Legitimate interest	From whom?
A.1	being able to process your request for a demonstration	Moore DRV
A.2	make it possible for us to communicate with you on the date, time and manner of the demonstration and to provide this demonstration	Moore DRV

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data from you as a demonstration applicant.

Purpose	(Categories) of personal data
A.1	• company name* • name* • email address* • phone number* • newsletter: yes/no
A.2	• name* • email address* • phone number* in case of natural person/partnership: • type of demonstration • date and time of demonstration • place and address (in case of a physical demonstration)* • link (in case of an online demonstration) • communication regarding demonstration

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you want us to provide you with a demonstration. Personal data necessary for Moore DRV to provide you with a demon-stration are marked with an * under B. Personal data that Moore DRV is legally obliged to pro-cess are indicated under B by a **. Should you not wish to provide these mandatory/necessary details to Moore DRV, Moore DRV may be unable to process your request for a demonstration.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of sending the newsletter to you:

(Categories) of recipients
Internal	External
• Marketing & Communications department	• Spotler
• relationship manager(s)	• Microsoft Dynamics 365 CRM
• involved consultant(s)

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by anonymising it.

Purpose	Retention period
A.1	for a period not exceeding two (2) years from the day the demonstration in question was requested. The exception is the case where the applicant for the demonstration is a (contact of) a client, in which case the personal data will be kept for a maximum period of two (2) years from the day the client is no longer a client of Moore DRV.
A.2	for a period not exceeding two (2) years from the day the demonstration in question was requested. The exception is the case where the applicant for the demonstration is a (contact of) a client, in which case the personal data will be kept for a maximum period of two (2) years from the day the client is no longer a client of Moore DRV.

II.11. You request a price indication for payroll service via our website

If you request a price indication for payroll service via our website, your personal data will be processed by Moore DRV for the purposes and by the means set out below:

A. Purposes and bases

	Purpose	Basis
		legal entity	natural person/partnership
1	being able to process and prepare your request for a price indication	legitimate interest	contract performance
2	being able to send you the price indication	legitimate interest	contract performance

Purpose	Legitimate interest	From whom?
A.1	being able to handle your request for a price indication for payroll service and being able to set it up	Moore DRV
A.2	make it possible for us to provide you with the requested price indication for payroll service	Moore DRV

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data from you as a price indication applicant.

Purpose	(Categories) of personal data
A.1	• company name* • name* • email address* • phone number** • number of employees * • payroll: outsource/do it yourself online* • newsletter subscription: yes/no
A.2	• name* • email address* • price indication for payroll service (in case of natural person/personal company) • correspondence regarding price indication

C. Obligation to provide personal data

The provision of certain personal data is mandatory/necessary if you want to receive a price indication. Personal data necessary for Moore DRV to send you a price indication are marked with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. If you do not wish to provide these mandatory details to Moore DRV, Moore DRV may not be able to process your request for a price indication for payroll services.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in the context of sending the price indication to you:

(Categories) of recipients
Internal	External
• Marketing & Communications department	• Spotler
• relationship manager(s)	• Microsoft Dynamics 365 CRM
• involved consultant(s)

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself
• generated by Moore DRV itself
• company.info
• Kamer van Koophandel

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV. Deletion of personal data stored in Spotler takes place by anonymising it.

Purpose	Retention period
A.1	for a maximum period of two (2) years from the day the relevant price indication was sent The exception is the case where the applicant for the price indication is a (contact of) a client, in which case the personal data will be retained for a maximum period of two (2) years from the day on which the client is no longer a client of Moore DRV n Moore DRV
A.2	for a maximum period of two (2) years from the day the relevant price indication was sent The exception is the case where the applicant for the price indication is a (contact of) a client, in which case the personal data will be retained for a maximum period of two (2) years from the day on which the client is no longer a client of Moore DRV n Moore DRV

II.12. You use our WiFi guest network
If you are at one of our offices and log into our guest WiFi network using a password, your personal data will be processed by Moore DRV for the purposes and by the means set out below:
A. Purposes and bases
Purpose Basis
A.1 offering visitors access to the internet using WiFi via the guest network legitimate interest

B. (Categories) of personal data
Moore DRV may process the following (categories of) personal data from you by purpose:
Purpose (Categories) of personal data
A.1 • IP-address*
• MAC address*
• device data*
• logging data*
• location
• date and/or time(s)

C. Obligation to provide personal data
The provision of certain personal data is mandatory/necessary if you want to be able to use our WiFi network for guests. Personal data necessary for Moore DRV to grant you access to our WiFi network for guests is indicated with an * under B. Personal data that Moore DRV is legally obliged to process are indicated under B by a **. Should you not wish to provide these mandatory details to Moore DRV, Moore DRV cannot process your contact request.

D. (Categories) of recipients
The following (categories of) recipients may receive personal data from you in connection with your use of our guest WiFi network:
(Categories) of recipients
Internal External
• IT department • Invision-ICT (IT service provider)
• Paree (WiFi management service provider)

E. Source of personal data
The personal data that Moore DRV processes from you as a data subject comes from, or may come from:
Source of personal data
• yourself
• generated by Invision-ICT and Paree

F. Retention periods
Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV:
Purpose Retention period
A.1 for a period not exceeding four (4) hours counted from the time from the start of the use of the WiFi network for guests of Moore DRV

II.13. Your data are in the records of a client of ours

If you are a natural person and (former) employee, job applicant, trainee, contractor, client, supplier or any other relation of our client, your personal data will be in the records of client. In the context of our services to our client, your personal data may be processed by Moore DRV for the purposes and through the means set out below:

A. Purposes and bases

	Purpose	Basis
A.1	executing the agreement between Moore DRV and the client and communicating about the execution, progress and results (including handling and/or submitting complaints in this context)	legitimate interest

Purpose	Legitimate interest	From whom?
A.1	being able to carry out the assignment assigned to Moore DRV by the client on behalf of the client	Moore DRV / client

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data from you by purpose:

Purpose	(Categories) of personal data
A.1	all your personal data contained in client's records which Moore DRV processes in the context of the service it performs for the client

C. Obligation to provide personal data

Processing for these general purposes does not involve the compulsory provision of certain data by the data subject to Moore DRV.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you in connection with your use of our guest WiFi network:

(Categories) of recipients
Internal	External
• Advisers involved	• Client
	• Tax authorities
	• UWV (unemployment agency)
	• Netherlands Enterprise Agency (Rijksdienst voor Ondernemend Nederland/RVO)
	• External advisers to client
	• Notaries
	• Service providers (SaaS services)

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• client
• generated by Moore DRV itself
• external advisers to client
• tax authorities
• UWV (unemployment agency)

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV:

Purpose

Retention period

A.1

for a maximum period of two (2) years, from the day on which the business relationship between Moore DRV and the client has ended.

The exception applies in case your personal data are part of the company data, are included in agreed products and/or subsidy records of our client.

If your personal data forms part of client's business data that Moore DRV processes in relation to the performance of a particular agreement with client: for a period of seven (7) years, calculated from the end of the calendar year in which the relevant agreement with client was performed, or that agreement was terminated.

Personal data contained in agreed products (with client): for a period of seven (7) years, from the end of the calendar year in which the relevant agreed product has been delivered, or the work on the product has been permanently discontinued,

As an exception to the above, personal data in the subsidy records will be deleted after a period of ten (10) years, counted from the end of the calendar year in which the relevant subsidy was refused or obtained.

The above retention periods do not apply in the event that the retention of these personal data is necessary for a longer period to substantiate/defend an interest of Moore DRV in legal proceedings.

II.14. You visit our website
If you visit and surf our website, we process personal data about you. In this context, we hereby refer you to our cookie policy.

11.15. For all concerned

A. Purposes and bases

	Purpose	Basis
1.	going through an application process, whereby your suitability for a position that is vacant (or may become vacant) is assessed by us and communicated, which may specifically, but not exclusively, include assessment of your suitability by means of, inter alia: a) screening by checking stated references; b) screening by looking at your LinkedIn profile; c) conducting an assessment;	legitimate interest legitimate interest legitimate interest permission
2.	check whether you belong to the target group of the Jobs Agreement and Quota Act	legitimate interest
3.	keeping your details in our talent pool for a possible future vacancy	permission
4.	producing aggregate data relating to the age of applicants and the channel through which applicants came into contact with Moore DRV	legitimate interest

Purpose	Legitimate interest	From whom?
A.1	enable us to carry out an application process in an informed, thorough and legal manner that enables us to make the right choice with regard to your application	Moore DRV
A.1.a	make it possible for us to be confident that our future employees have integrity and reliability by checking the information you provide with referees	Moore DRV
A.1.b	make it possible for us to be confident that our future employees have integrity and trustworthiness by tracing data provided by you on your LinkedIn profile	Moore DRV
A.2	enable us to check whether you fall under the target group of the Jobs Agreement and Quota Act	Moore DRV
A.4	enable us to use aggregated data on age and the channels through which applicants came into contact with Moore DRV to determine how our application and marketing campaigns are fulfilled	Moore DRV

B. (Categories) of personal data

Moore DRV may process the following (categories of) personal data for each purpose from you as a data subject.

Purpose	(Categories) of personal data
A.1	first name * surname * address residence * postal code phone number date of birth (only for unsolicited applications) email address * cover letter CV * application video (optional) data relating to vacancy preferences with regard to subject areas (in case of open application) availability	correspondence with you internal communication/notes following job applications (interviews) trainings work history hobbies passport photo data/findings assessment how you got in touch with us * newsletter: yes/no *
A.1.a	name and address of referees data reference check
A.1.b	data based on LinkedIn profile
A.2	belonging to target group Jobs and Quota Act: yes/no
A.3	all data as listed under A.1
A.4	age channel through which you came into contact with Moore DRV

C. Obligation to provide personal data

Processing for these general purposes does not involve the compulsory provision of certain data by the data subject to Moore DRV.

D. (Categories) of recipients

The following (categories of) recipients may receive personal data from you for the supporting purposes:

(Categories) of recipients
Internal	External
• HRM department	• Emply
• Board of Directors Moore DRV	• Assessment office
• Vacancy holders (only after application is marked as interesting)	• Referees
• Our employees who have introduced applicants	• Microsoft Dynamics 365 CRM

E. Source of personal data

The personal data that Moore DRV processes from you as a data subject comes from, or may come from:

Source of personal data
• yourself	• introducing employee of Moore DRV
• generated by Moore DRV itself	• assessment office
• referee
• your LinkedIn profile

F. Retention periods

Moore DRV will retain your personal data for the periods indicated below. After expiry of these retention periods, the personal data in question will be deleted/destroyed by Moore DRV:

Purpose	Retention period
A.1	for a maximum period of four (4) weeks from the day your application procedure ends
A.1.a	for a maximum period of four (4) weeks from the day your application procedure ends
A.1.b	for a maximum period of four (4) weeks from the day your application procedure ends
A.2	for a maximum period of four (4) weeks from the day your application procedure ends
A.3	for a period of no more than one (1) year from the day on which you consented to the inclusion of your data in our talent pool, unless, before the end of this retention period and at our request, you again consent to the retention of your data (possibly updated) in our talent pool for a further period of one (1) year
A.4	for the period that the aggregated data are relevant and usable by Moore DRV to determine (in part) the content of its application and marketing campaigns based on them

III. Transfer outside the EEA

Moore DRV may transfer your personal data to an organisation in a country outside the European Economic Area (EEA) and that country may have a lower level of protection in relation to personal data than the protection based on the GDPR and other regulations within the EEA. For example, a provider of online services (such as WhatsApp, WeTransfer, Google and Dropbox) that Moore DRV uses may be located outside the EEA (e.g. in the United States of America), and the use of those services involves a transfer of personal data to the provider.

If such a situation arises, and personal data is transferred to a country outside the EEA that provides less legal protection for personal data, Moore DRV will ensure that appropriate safeguards are in place to ensure that the transfer takes place in accordance with the privacy laws applicable here. For example, Moore DRV will – if at any time there were no adequacy decision in force for the United States – provide personal data to recipients in the United States on the basis of model contracts (SCC). In that model contract, Moore DRV will agree the appropriate safeguards with the recipient based on a model approved for that purpose by the European Commission or a national regulator. Alternatively, Moore DRV may use approved codes of conduct or certifications for that transmission.

Separately, Moore DRV may transfer personal data to an organisation in a country outside the European Economic Area (EEA), which country has a lower level of protection with regard to personal data than the protection based on the GDPR and other regulations within the EEA, if there is a statutory exception as mentioned in Article 49 GDPR (e.g. based on your explicit consent or necessary to perform an agreement that is of interest to you).

IV. Processing operations based on your consent

If Moore DRV processes your personal data on the basis that you have given express consent to Moore DRV for such processing, you have the right to withdraw such consent at any time. Should you withdraw your consent, Moore DRV will no longer process your personal data for the purpose for which you had consented. The withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.

V. Automated decision-making

Moore DRV does not use fully automated decision-making processes in the context of any decision-making with respect to you.

VI. Your rights as a data subject

As a data subject, with regard to the processing of your personal data by Moore DRV , you have the right to request (at) Moore DRV at any time:

allow you to inspect the personal data Moore DRV processes about you (right to inspection);
have your personal data rectified if it is incorrect (right to correction);
have your personal data erased (deletion right/right to oblivion);
have the processing of your personal data restricted (right to restrict processing);
object to the processing of (some of) your personal data (right to object);
to have your personal data disclosed to Moore DRV, or to have your personal data disclosed to another controller (right to data portability).

The above rights follow from the GDPR. These rights do not always apply. The exercise of some rights will require specific circumstances for them to be invoked. Moore DRV refers to Articles 15 to 18, 20 and 21 GDPR for these specific circumstances.

If you would like to exercise your rights, please send an email to Moore DRV (compliance@moore-drv.nl) describing which right you are exercising and what personal data the request relates to.

Moore DRV may askyou to identify yourself if you exercise the rights listed here. This is because we need to be sure that Moore DRV provides (or otherwise processes) the personal data at the request of the data subject who requests it. Only if it is not reasonably possible otherwise will we ask you to identify yourself by means of your proof of identity.

Should Moore DRV not honour a data subject’s request to exercise any of the above rights, Moore DRV shall substantiate in writing why it does not, or cannot, do so.

VII. Complaints

In the unlikely event that you have a complaint about the way Moore DRV handles your per-sonal data, Moore DRV would like to try to resolve it with you first. You can contact our Data Protection Officer in this case. The Data Protection Officer will then get back to you promptly in writing.

However, you are also free – in case of a complaint regarding the way Moore DRV processes your personal data – to file a complaint directly with the Personal Data Authority.

	Purpose	Basis
A.1	offering visitors access to the internet using WiFi via the guest network	legitimate interest