PROCESSING OF PERSONAL DATA IN CONNECTION WITH YOUR EMPLOYMENT
1. Data controller
During your employment with us, we receive and process a variety of personal data about you. This makes us the data controller in respect of the personal data we process about you.
Our contact details are available here:
Vrumona B.V.
Kvk 30024744
Vrumonaweg 2, 3981 HT Bunnik
GDPR@royalunibrew.com
During your employment, we process general personal data about you, but we may also process special personal data, your civil registration number or personal data relating to criminal convictions and offences. In this document, you can read more about the data we process about you during your employment.
All data are hosted internally on a database in The Netherlands and registered in our HR system SAP SuccessFactors or held in manual form and on other internal computer systems.
2. Data received on employment
The purpose of collecting personal data about you during the recruitment process was to assess whether you were a qualified candidate for the position in which you were employed. We store these personal data during your employment to be able to document your employment relationship history.
During the recruitment process, we registered the personal data provided in your application, CV and any other attached documents as well as any personal data you provided to us during the interview.
We typically register the following personal data: Name, address, date of birth, gender, telephone number, e-mail address, civil registration number, marital status, education(s), career history and recommendations/references.
We process these personal data in accordance with article 6(1)(f) of the General Data Protection Regulation (GDPR) as the personal data have been submitted or provided to us by you in connection with your employment and as the personal data serve to document your employment relationship history.
3. Data from social media
If we searched any social media such as LinkedIn in connection with your employment, we store data in this respect.
We collect data about future employees from social media in accordance with article 6(1)(f) of the GDPR on the balancing of interests. We collected the data to be able to assess whether your profile matches the company and the specific position, and we store the data to be able to document your employment relationship history.
4. Data from personality tests and/or proficiency tests
If you completed a personality test and/or a proficiency test in connection with your employment, we store the results of these tests. We use personality and/or proficiency tests to assess whether your competencies and qualifications match the company’s profile and the specific position.
We register data from the personality and/or proficiency tests in accordance with article 6(1)(f) of the GDPR on the balancing of interests. We used the tests to be able to assess whether your profile matches the company and the specific position, and we store the data to be able to document your employment relationship history.
5. Criminal record certificate
If you provided a copy of your criminal record certificate in connection with your employment, we will store a copy of the criminal record certificate. We will only obtain your criminal record certificate if it is necessary considering the specific contents of your position e.g., if you are expected to handle large values, or if you to a greater extent handle or have access to Vrumona’s or our customers assets.
We process these data based on your consent. You may withdraw your consent at any time using the above-mentioned contact details. If you withdraw your consent, this will only apply from the time of such withdrawal. Consequently, it will not affect the lawfulness of our processing of the data up to the time of withdrawal.
6. Residence and work permit
Your employment is conditional on you having a valid work and residence permit. In order to confirm this, we request to receive a copy of your passport in connection with your employment.
If, due to your citizenship, you need a work and residence permit to work lawfully in Denmark, we will also obtain a copy of your work and residence permit from you. We do this both when you are employed and when your work and residence permit needs to be extended.
We obtain a copy of your passport and any work and residence permit in accordance with article 6(1)(c) of the GDPR as we have an obligation under section 59(5) of the Aliens Act to ensure that this is in order.
7. Data from previous employer
If we have obtained references from one or more of your previous employers, we have registered the data we received. We process these data in accordance with article 6(1)(b) considering the processing as the execution of pre-contractual measures falling within the general recruitment activity.
8. Data we receive during your employment
During your employment, we receive a variety of data about you. Generally, we process these data to ensure that we meet our obligations towards you under the employment contract, the applicable collective agreement and the legislation we are bound to comply with. You can read more about the purpose of processing the individual categories of data below.
The data are registered in our HR system SAP SuccessFactors
8.1. Master data etc.
In connection with your employment and the ongoing employment relationship, we process a variety of data about you to meet our obligations towards you under the employment contract. We process the following data:
- Master data, including name, date of birth, job title, address, telephone number, e-mail address and account number
- Data about your educational background, including relevant diplomas and supplementary training
- Registration of hours worked
- Appraisal of performance
- Registration of sickness absence, leave periods and holidays taken
- Registration of personal data of your family members, if provided by you for tax reasons
- Fitness for the job as required by health surveillance
We process these personal data in accordance with article 6(1)(b) of the GDPR as we need to process these personal data to perform the employment contract with you.
In connection with payment of salary during the ongoing employment relationship, we process data about you, including your civil registration number, when we disclose data to the Dutch tax authorities (Belastingdienst) for the purpose of tax withholdings. We process these data in accordance with inter alia article 6(1)(c) of the GDPR as this processing is required to comply with our obligations under tax legislation.
We also process your personal data, here-above described, for the following purposes:
- In order to safeguard corporate assets and in accordance with article 6(1)(f) of the GDPR;
- In order to ensure protection of safety at work and in accordance with article 6(1)(f) and article 88 of the GDPR, article 114 of the Privacy Code and article 4 of the Italian Workers’ Statute (Law no. 300/1970);
- Defensive aims in accordance with article 6(1)(f), article 9(1)(f) and 10 of the GDPR as well as article 2-octies(3)(e) of the Privacy Code
8.2. Performance reviews, workplace risk assessment surveys, employee satisfaction surveys and performance reviews etc.
In connection with your employment and the ongoing employment relationship, we collect and process a number of information about you in order to develop our workplace and you as an employee, as well as to ensure well-being and a good working environment, including in connection with conducting performance dialogue, workplace risk assessment surveys, employee satisfaction surveys and assessment of performance.
This applies to the following information:
- Information about well-being, mental and physical work environment, including certain health information
- Information about your development, results and efforts
- Information on continuing education
We process information about you to conduct performance reviews or performance dialogue. We use the balancing of interests rule in Articles 6(1)(f) and 9(2)(b) of the General Data Protection Regulation as a legal basis for the processing of the data, as information ensures that we can continuously develop employees and ensure well-being and a good working environment.
We process data to carry out risk assessments based on Article 6(1)(c) of the General Data Protection Regulation, as we are obliged to do so in order to fulfil our obligations.
When we conduct employee satisfaction surveys, we obtain your consent to the processing of the data in accordance with Article 6(1)(a) of the General Data Protection Regulation or Article 9(1)(a) of the General Data Protection Regulation.
9. Personal data concerning health
In connection with sickness absence during your employment, it may be relevant to obtain medical certificates, including fitness-for-work certificates, perform sickness interviews or obtain material from your municipality of residence in connection with any sickness benefits case. In such situations, we may receive and register personal data about your health.
We will process such health information as the receipt of these data is required to determine the company’s legal position in relation to employment law rules.
10. Data about children and Family Members
In connection with your employment, we will process data about how many children you have and how old they are. We do this to establish whether you are entitled to any children’s care days, and whether you are entitled to children’s first sick days.
Personal data of your family members, if provided by you to us, will be processed solely for the purpose of tax deductions, benefits or other allowances requested by you. Any personal data of other data subjects that you have freely provided will be processed exclusively for the specific purposes indicated by you or to protect your person (e.g., emergencies, in the absence of other family members).
We process such data in accordance with article 6(1)(b) of the GDPR as we need to process these personal data to perform the employment contract with you.
11. Data about your next of kin
We register contact details about the persons you have designated as your next of kin.
We register these data in accordance with article 6(1)(f) of the GDPR on the balancing of interests as our registration of your next of kin ensures that we can get in contact with them in the event of an accident, acute sickness or the like at work.
12. Reprimands, warnings, etc.
If, during your employment, we receive any complaints about you or if you receive any oral or written reprimands or warnings from the company, we will store data about such events.
We register these data in accordance with article 6(1)(f) of the GDPR on the balancing of interests as such personal data document your employment relationship history and may have an impact on the company’s legal position in relation to any future employment law responses.
13. Data about control measures
In connection with the CCTV system installed at the company, we register data about you. If your job function is covered by the company’s CCTV system, we register data about your movements in the surveyed areas.
The purpose of the CCTV system is for instance crime prevention, including vandalism and pilferage, production monitoring, clarification of customer complaints and traffic accidents, etc. In the event of specific suspicions, we will use data from the CCTV systems for control purposes, and data from the CCTV system may thus be used in the event of a personnel matter involving you. We register these data in accordance with article 6(1)(f) of the GDPR.
We erase the recordings from the company’s CCTV system no later than 30 days after the recordings were made, unless storage for a longer period is necessary for the company’s processing of a specific dispute.
Use of IT systems
In connection with the company’s control of the use of IT systems, including internet and e-mails, we register data about you. If your job function is comprised by these rules, we register data about your use of the company’s IT systems, including internet and e-mails to monitor your activities as person authorized to process personal data, which we reserve to conduct in accordance with the “IT security policy”, available on the company intranet or provided in other form. In particular circumstances, we may log in to the e-mail account provided to you for business purposes ([name]@vrumona.nl), as established in the IT security policy.
The purpose of registering your use of the company’s IT systems is for instance ensuring IT security in relation to the company’s systems as described in the IT security policy. In the event of specific suspicions, we may also use data from the IT systems for control purposes, and data from the IT system may thus be used in the event of a personnel matter involving you. We register these data in accordance with article 6(1)(f) of the GDPR.
GPS tracking
In connection with the company’s use of GPS tracking in company cars, we register data about you. If your job function is comprised by these rules, we register data about your movements via GPS tracking.
In the event of specific suspicions, we may also use GPS data for control purposes, and such data may thus be used in the event of a personnel matter involving you.
You can get more information about GPS tracking by contacting your immediate supervisor. We register these data in accordance with article 6(1)(f) of the GDPR.
Alcohol and drug testing
In connection with testing pursuant to our alcohol and drug policy, we register data about you. If your job function is comprised by these rules, we register data about the results of these tests.
The purpose of testing and registration of test results is for instance to ensure compliance with the company’s alcohol and drug policy, including to ensure road safety, safety in the workplace, etc. In addition, the test results may be used in the event of a personnel matter involving you. We register these data in accordance with article 6(1)(f)
Access control
In connection with your employment with the company, you will be provided with an access card for the workplace. The access card gives you access to certain premises, warehouse, printers, etc. to which the card gives access.
The purpose of the company’s access control is for instance to register working hours, including check-in times and breaks, and tracking who has been in an area of the company in the event of fire, theft, vandalism, etc. In the event of specific suspicions, we may also use data from access card logs for control purposes, and data from access card logs may thus be used in the event of a personnel matter involving you. We register these data in accordance with article 6(1)(f) of the GDPR.
14. Use of photos
Your portrait will be used on our intranet, on your ID and in Outlook (e-mail) and SucessFactors (HR-administration system) card to identify you.
We use your portrait in accordance with article 6(1)(f) of the GDPR on the balancing of interests. The purpose of using your portrait on the intranet is to ensure that your colleagues can identify you. The use of your portrait on your ID card is intended to ensure that you may be identified for company security reasons.
As regards employees in certain positions, we also use their portraits on our website to ensure that our customers and collaboration partners can identify them. If relevant to you, we will obtain your consent thereto as our use of portraits on the website is based on your consent in accordance with article 6(1)(a) of the GDPR. You may withdraw your consent at any time. If you withdraw your consent, the portrait will be erased, without such withdrawal having any employment law consequences.
In addition, we use situation photos from company events, on which you may appear, for example on the intranet in the period after an event. We use such photos in accordance with article 6(1)(f) of the GDPR on the balancing of interests as the photos contribute to documenting the company’s history.
Some employees appear in photos used in our marketing material on our social media. If relevant to you, we will obtain your consent thereto as our use of such photos is based on your consent in accordance with article 6(1)(a) of the GDPR. You may withdraw your consent at any time using the above-mentioned contact details. If you withdraw your consent, this will only apply from the time of such withdrawal. Consequently, it will not affect the lawfulness of our processing of the data up to the time of withdrawal.
15. On severance of service
If you leave your position with Vrumona B.V., we will register the reasons for severance of your service.
We register such personal data in accordance with article 6(1)(f) of the GDPR on the balancing of interests as such personal data document your employment relationship history and may have an impact on the company’s legal position in any subsequent employment disputes.
16. Storage and erasure
We will store in your personnel file any data we have registered about you in connection with your employment and during the ongoing employment relationship for up to five years after termination of your employment, unless it is necessary to store the data for a longer period of time. For example, in connection with work-related injuries or for purposes of defending any legal claims.
17. Other recipients who may process your personal data
In connection with your employment relationship, we will disclose or transfer your personal data to the following recipients:
- Public authorities, including municipalities and the Tax Authority, in connection with payment of salary, reimbursement of sickness benefits, etc.
- Insurance authorities in connection with work-related injuries
- Pension company and health insurance provider
18. Transfer of your personal data
With regard to the transfer of your personal data to third countries outside the European Economic Area (EEA) or international organizations, this processing takes place in accordance with the rules or according to one of the methods established pursuant to Articles 44 to 49 of the General Data Protection Regulation, including, standard contractual clauses adopted by the European Commission or other safeguards or conditions deemed sufficient for the current transfer.
19. Your rights
You have a number of rights. If you want to exercise your rights please contact us at GDPR@royalunibrew.com
Right to access data (right of access), article 15
You have the right to obtain access to the personal data we are processing about you as well as a variety of other information.
Right to rectification, article 16
You have the right to have any inaccurate personal data about you rectified.
Right to erasure, article 17
In special circumstances, you have the right to have personal data about you erased before our usual time limit for erasure.
Right to restriction of processing, article 18
In certain circumstances, you have the right to restriction of the processing of your personal data. If you are entitled to restriction of processing, we may in future only process your personal data – with the exception of storage – with your consent, or for purposes of establishing, exercising or defending legal claims or protecting a person or important public interests.
Right to transmit data (data portability), article 20
In certain circumstances, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those data transmitted from one data controller to another without hindrance.
Right to object, article 21
In certain circumstances, you have the right to object to our lawful processing of your personal data.
Version 1.1 – June 2024