Privacy Policy for Job Applicants - Vlisco Netherlands B.V.

Last update: 23-03-2026

1 Introduction

1.1 This Privacy Policy (‘Policy’) is used by Vlisco Netherlands B.V., a private limited company incorporated under Dutch law, entered in the trade register of the Chamber of Commerce under registration number 50751492, with its registered office in Helmond and its principal place of business at Binnen Parallelweg 27, 5701 PH Helmond (referred to below as: ‘Vlisco’ or ‘we’). Vlisco can be reached at privacyofficer@vlisco.nl.

1.2 This Policy intends to explain why and how Vlisco processes data that identifies or could identify individuals (‘Personal Data’) when dealing with job applicants.

1.3 The way we use your personal data is explained in Annex 1 to this Privacy Policy.

1.4 Unless stated otherwise, Vlisco is the ‘Controller’ within the meaning of the General Data Protection Regulation (‘GDPR’) for the processing of Personal Data referred to in this Policy. Vlisco may amend this Policy at any time. If this Policy is amended, it will be made available to you through publication on the website http://careers.vlisco.com (‘Website’). If you have any questions after reading this Policy, contact Vlisco using the above contact details.

1.5 This Policy consists of the following components:

1. Introduction
2. What Personal Data do we process?
3. For what purposes do we process Personal Data?
4. Who can receive Personal Data?
5. For how long do we retain your personal data?
6. How do we secure your Personal Data?
7. What are your rights?
8. What else is important to know?

2 What Personal Data do we process?

2.1 As part of your application for a job at or interest in Vlisco, we may process personal data. Vlisco is the Controller under the GDPR. This means that with respect to the Personal Data referred to in this Policy, we are responsible for determining the purpose and means of processing.

Personal data that are processed automatically

2.2 If you apply for a job via the Website or otherwise express interest in Vlisco as an employer, we may automatically collect Personal Data about you and/or the device you are using. We do not intend to identify you, but since it is possible to identify you directly or indirectly based on this information, this Policy informs you transparently. Automatically collected Personal Data can include:

2.2.1 your IP address

2.2.2 your mobile device ID

2.2.3 information about your settings, such as aspect ratio, screen resolution, language settings, browser information (user agent) and/or operating system

2.2.4 the pages you visited on our website, but also pages before you visited our website (source)

2.2.5 your location and time zone

2.3 We process these data by using cookies and similar technologies. More information about the types of cookies we use — including analytical and marketing cookies — and about any third parties that may receive data through these cookies, can be found in our Cookiebeleid which provides full transparency on their purposes, use and retention.”

Personal data that you provide

2.4 The Personal Data that Vlisco processes as part of your job application or interest in Vlisco as an employer may include:

• your first and last name
• your contact details
• your address details
• your email address and/or telephone number
• your CV and education/training details
• your photograph
• your motivation letter
• your LinkedIn profile and URL
• your communication with Vlisco as part of your job application or interest in Vlisco as an employer

2.5 In the course of your contact with Vlisco, you may provide additional Personal Data, for example the results of tests or assessments. These data may also include information required to prepare or conclude an employment contract following a successful application, such as:

a. financial information;

b. your citizen service number (BSN);

c. information regarding your dependants.

The processing of these Personal Data is governed by Vlisco’s internal privacy policy. You will receive a copy of this policy before, or at the moment you are asked to provide such information.

2.6 If you choose to voluntarily provide us with Personal Data other than the above, we recommend that you keep this provision to an absolute minimum and do not provide us with sensitive or special personal data, such as data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and any processing of genetic data, biometric data for the purpose of uniquely identifying an individual, or data concerning health, or data concerning a natural person’s sexual life or sexual orientation.

2.7 Providing the requested Personal Data under 2.4.1. - 2.4.5 is mandatory, in principle, and a necessary condition for concluding an employment contract with Vlisco. If these data are not provided, Vlisco may not be able to comply with its obligations under the contract that has been or is to be concluded. The provision of the requested Personal Data as from 2.4 and 2.5 is not mandatory in principle, and not a necessary condition for concluding a contract with Vlisco.

Sources

2.8 In principle, Vlisco collects Personal Data from you. This is not so in the following cases where you have actively shared your personal data, in which cases Vlisco may assume you have granted your permission:

• If Vlisco has engaged a temporary employment agency, headhunting or similar service to recruit new employees.
• If we have contacted you via your LinkedIn profile or any other online profile.
• If a Vlisco employee has recommended us to you.

3 For what purposes do we process Personal Data?

3.1 The privacy legislation, including the General Data Protection Regulation (“GDPR”), allows the processing of personal data if such processing is based on one of the legal grounds set out in the GDPR. When we process your personal data, we do so on the basis of legitimate interest, on the basis of your consent, or pursuant to a legal obligation.

Your personal data are processed on the basis of Vlisco’s legitimate interest in the following cases:

1. Finding suitable candidates for Vlisco and maintaining contact with potential candidates via the “connect” button.
2. Managing existing (potential) job applicants.
3. Optimising and/or personalising content.
4. Optimising our business operations, such as standardising processes.
5. In the context of privacy or security audits.
6. to communicate with you: when you contact us, we process your contact details, such as your name, email address and any other Personal Data you provide to us.
7. To personalise our Website and recruitment processes.
8. To improve our Website and recruitment processes.
9. To comply with a statutory obligation: we may be required by law or by a court order to process and/or transfer certain Personal Data.
10. To enable Vlisco to inform you about suitable vacancies with your consent.

3.2 Vlisco has several lawful bases for processing your Personal Data. The applicable bases are set out below:

3.2.1 The processing is necessary for performing a contract to which you are a party or, at your request, to adopt measures prior to concluding a contract.

3.2.2 To enable Vlisco to comply with its statutory obligations.

3.2.3 Vlisco’s legitimate interest in conducting its business, including but not limited to the performance of the contract to which your company, your employer or your client is a party, unless your interests or your fundamental rights and freedoms that require the protection of Personal Data outweigh those interests.

3.2.4 The processing is necessary to promote Vlisco’s legitimate interests.

3.2.5 If necessary, Vlisco will ask for your additional consent for processing your Personal Data.

4 Who can receive Personal Data?

4.1 Vlisco discloses Personal Data to third parties, known as ‘recipients’, if this is necessary for achieving the purposes set out in this Policy. The categories of recipients of the Personal Data are:

• Our suppliers, including but not limited to assessment partners and recruitment agencies.
• The party that hosts our data and IT suppliers.
• Other companies affiliated with Vlisco, or as required for compliance, internal reporting, audit and/or security purposes, or for performing a contract with you.
• External consultants, insofar as they are involved in the job application process, such as assessment agencies.
• Our analytical service providers for the purpose of assessing the effectiveness of our Website.
• Government agencies, if we are required to provide your Personal Data to a supervisory authority (such as the Dutch Data Protection Authority) or other government agencies.
• If Personal Data must be transferred to third parties because Vlisco is being bought or merged, part of its assets is being sold, or in the event of a corporate reorganisation.

4.2 Where Vlisco transfers your data to recipients that process these data only on behalf of Vlisco and not for their own purposes, it has made proper written arrangements with these recipients (‘processors’ within the meaning of the GDPR) regarding the processing of your data.

4.3 In principle, Vlisco does not transfer Personal Data to countries outside the European Economic Area or international organisations, except in the cases mentioned below.

4.4 Vlisco transfers Personal Data to other companies within the same group, including these companies’ shareholders. These companies may be located outside the European Economic Area. Vlisco and these companies have adopted appropriate safeguards to guarantee the proper handling of your Personal Data.

5 For how long do we retain your personal data?

5.1 We retain your Personal Data only for as long as necessary to achieve the purposes described in this Policy. Personal Data processed in the context of an application process will be kept for a maximum of one year after the procedure has ended. If Vlisco wishes to retain your Personal Data for a longer period, we will request your written permission, and it is entirely up to you to decide whether to grant or refuse such permission. We retain your Personal Data for as long as necessary to achieve the above purposes. With your consent, we will keep your data processed for an application process for up to one year after the end of this process.

5.2 Vlisco may retain your Personal Data as required or necessary to comply with applicable laws or to comply with statutory, reporting or auditing requirements. Where possible, we either pseudo-anonymise your Personal Data or retain it only in aggregate form.

6 How do we secure your Personal Data?

6.1 Vlisco attaches great importance to protecting personal data and has adopted appropriate technical and organisational measures for this purpose. These measures meet the requirements set by the GDPR. The following measures have been implemented to secure your Personal Data:

• The transfer of Personal Data via the Website is encrypted.
• The servers on which your Personal Data are stored are equipped with passwords and other appropriate security measures, including Single Sign On for hiring managers.
• Access to servers is restricted to a limited number of people, consisting of the hiring manager, the Vlisco employees working on the hiring process and the HR department.
• The servers are up-to-date.

7 What are your rights?

7.1 The GDPR grants Data Subjects a number of rights in relation to their Personal Data, depending on the specific circumstances and subject to the conditions set out in the GDPR. These rights include::

• The right to request Vlisco to give access to the Personal Data processed about you;
• The right to request Vlisco to rectify inaccurate or incomplete Personal Data;
• The right to request Vlisco to erase Personal Data (“right to be forgotten”), insofar as the GDPR provides such grounds;
• The right to request Vlisco to restrict the processing of your Personal Data, insofar as the GDPR provides such grounds;
• The right to object to the processing of your Personal Data, including the right to object at any time to processing carried out on the basis of Vlisco’s legitimate interests;
• The right to object at any time to the processing of your Personal Data for direct marketing purposes; if you exercise this right, Vlisco will cease all processing for such purposes;
• The right to data portability, meaning the right to receive the Personal Data you have provided to Vlisco in a structured, commonly used and machine‑readable format, and to transmit those data to another controller, where technically feasible;
• Where processing is based on your consent: the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless permitted under the GDPR and subject to appropriate safeguards;
• The right to lodge a complaint with a supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7.2 To ensure that these rights are exercised by the rightful person, Vlisco may request you to provide additional information necessary to verify your identity. Such information will be used solely for this purpose.
7.3 Vlisco will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by up to two additional months where necessary due to the complexity or number of the requests. In such cases, Vlisco will inform you of the extension and the reasons for it within one month of receiving your request.

8 What else is important to know?

8.1 This Policy is effective for the entire duration of the processing operations referred to in this Policy, or until it is terminated by Vlisco.

8.2 Only Dutch law applies to this Policy and all agreements and legal relationships between you and Vlisco. Any disputes relating to or arising from this Policy and the use of the Website will be submitted exclusively to the competent court in the judicial district of Oost-Brabant, hearing location ‘s-Hertogenbosch, the Netherlands, unless another court is competent based on a mandatory statutory provision.

8.3 For questions regarding this Policy or Vlisco’s processing of Personal Data, and for requests regarding your Personal Data, contact Vlisco using the information provided in Article 1.1 of this Policy.

9 Privacy Officer

Vlisco has appointed a Data Protection Officer (“DPO”) in accordance with Article 37 of the General Data Protection Regulation (“GDPR”). The DPO monitors Vlisco’s compliance with data protection legislation, advises on our obligations under the GDPR, and acts as the primary contact point for supervisory authorities.

You may contact the DPO with any questions regarding the processing of your Personal Data, or if you wish to exercise any of your rights under this Policy. The DPO can be reached at:

Name: Harold Verhoeven
Email: privacyofficer@vlisco.nl

The Privacy Officer will handle your request confidentially and independently. If necessary, and in line with the GDPR, the Privacy Officer may request additional information to verify your identity.

------------------------------------------------------------------------------------

ANNEX 1

How are personal data processed in the recruitment process?

Personal data are processed at various stages of the recruitment process. Below you will find more information about these processing activities. The purpose of all processing is to identify suitable candidates for Vlisco.

Recruiting suitable candidates

During the recruitment process, Vlisco searches for suitable candidates through direct search, Vlisco Connect and events.

Direct search

Candidates are approached through various platforms, such as LinkedIn. With the candidate’s consent, profiles and contact details are stored. The data are deleted one year after the candidate has given consent, unless the candidate provides new consent to retain the data for another year.

Vlisco Connect

Candidates who appear suitable for Vlisco but who are not immediately eligible for an open vacancy may register via Vlisco Connect. Vlisco requests their consent to store their data for this purpose, which includes contact details, CV and motivation letter. Contact is maintained, for example by telephone or through mailings containing interesting articles, vacancies or invitations to events. The data are deleted one year after consent has been given, unless renewed consent is provided.

Events

Candidates may register via a tablet after attending an event. The candidate’s data are deleted four weeks after the event has taken place, unless the candidate consents to their data being stored for one year. After this year, the data are deleted unless the candidate provides consent again for an additional year.

Application

The application process may consist of several components, including the application itself, an online assessment, interviews and the contract offer. Candidates can apply through vacancies on the website.
When applying, a candidate provides contact details, a CV and a motivation letter.

Vlisco may review the candidate’s social media profiles as part of the application process, such as LinkedIn or Facebook profiles. This is done only when necessary and relevant to determine whether someone is suitable for a position at Vlisco. The data received during the application process are shared only with the employees involved in the recruitment of the candidate.

Online assessment

An online assessment may form part of the recruitment process. The candidate completes the assessment via the online environment of an external assessment agency. After completion, the Recruitment department receives the assessment results and forwards them to the candidate. Consent is requested from the candidate before sharing the assessment results.

Interviews

After the online assessment, interviews with the candidate take place. The interviewers receive the candidate’s personal data (contact details, CV, motivation letter, and, where available, the assessment results). The candidate receives feedback on the outcome of the interviews by telephone. This feedback is also recorded.

Contract offer

After the interviews, Vlisco may make an offer to the candidate. At this stage, Vlisco requests a copy of the candidate’s identification document to add to the personnel file. Vlisco is legally required to retain a copy of this document.

Rejected candidates are notified of their rejection. The personal data of rejected candidates are retained for a maximum of one year.

Where are your personal data stored and how do we secure them?

We store your data in the recruitment system Team Tailor.

Vlisco applies appropriate technical and organisational measures to protect personal data stored in Team Tailor against unauthorised access, loss, misuse or alteration. Access to candidate data is granted only to employees directly involved in the recruitment process and only to the extent necessary for their role.