Applicant Privacy Notice

1. Introduction

1.1 MILEWAY B.V., a limited liability company (besloten vennootschap met beperkte aansprakelijkheid), incorporated under the laws of the Netherlands, with its registered office at Parnassusweg 723, (1077 DG) Amsterdam, the Netherlands, registered with the Dutch trade register under number 71555730 and its associated companies ("Company", "Mileway", "we", "us" and "our") hold and process data on all current and former employees, workers, individual contractors, contingent workers, applicants, interview candidates, interns, consultants and directors, and third parties whose information you provide to us in connection with the employment or other work relationship (e.g. next of kin, emergency contact information and/or dependents) ("staff" or "you" or "your").

1.2 The Company will be the controller of your personal data. In addition, where processing of personal data is undertaken by affiliates of the Company for their own independent purposes, these affiliate companies may also be controllers of your personal data. This Applicant Privacy Notice is provided on behalf of the Company and each such affiliate company. You may contact us at privacy@mileway.com

1.3 We take your data protection rights and our legal obligations seriously. Your personal data will be processed in a secure and confidential manner and only as set out below or otherwise notified to you in writing.

1.4 This Privacy Notice describes the categories of personal data we collect, how your personal data is processed, for what purposes we process your data and how your privacy is safeguarded in the course of your application. It is intended to comply with our obligations to provide you with information about our processing of your personal data under applicable privacy laws.

1.5 If you have any questions about this Applicant Privacy Notice or would like to be provided with a copy of the information it contains in a different format please contact us at privacy@mileway.com

2. What data do we process?

2.1 Personal data means any information describing or relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

2.2 We collect various types of personal data about you for the purposes described in this Applicant Privacy Notice including:

  • Personal details: your name, gender, nationality, civil / marital status, date of birth, age, personal contact details (e.g. address, telephone or mobile number, e mail), immigration and eligibility to work information, languages spoken, next of kin / dependent / emergency contact information, details of any disability and any reasonable adjustments required as a result;
  • Recruitment and selection data: skills and experience, qualifications, references, CV and application, interview and assessment data, vetting and verification information (e.g. results of credit reference check), right to work verification, information related to the outcome of your application, details of any offer made to you;
  • Regulatory data: records of your registration with any applicable regulatory authority, your regulated status and any regulatory certificates and references; and
  • Any other personal data which you choose to disclose to us during the course of your application, whether verbally or in written form (for example in emails).

2.3 Apart from personal data relating to you, you may also provide the Company with personal data of third parties, notably any referees or next of kin contact information, for the purposes described in this Applicant Privacy Notice. Before you provide such third party personal data to the Company, you must first inform these third parties of any such personal data which you intend to provide to the Company and of the processing to be carried out by the Company, as detailed in this Applicant Privacy Notice.

3. Special categories of personal data and personal data relating to criminal convictions and offences

3.1 To the extent authorised or permitted by applicable laws, the Company may collect and process a limited amount of personal data falling into special categories, sometimes called "sensitive personal data". This term means information relating to:

  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • physical or mental health (including details of accommodations or adjustments);
  • trade union membership;
  • sex life or sexual orientation;
  • biometric and genetic data although we do not collect or expect to hold this type of data; and
  • personal data relating to criminal convictions and offences.

4. How does the company collect personal data?

4.1 The Company mainly obtains your personal data directly from you. You may provide this information directly to the hiring manager or relevant recruiter or enter it into our systems (for example, through your self service access to our online recruitment system, your participation in the recruitment process, emails and instant messages you send or through verbal information which is recorded electronically or manually). In addition, further information about you may be generated by the relevant recruiter, hiring manager or other employees involved in the recruitment process.

4.2 We also obtain some information from third parties: for example, references from a previous employer, information from tax authorities, or where we employ a third party to carry out a background check (where permitted by applicable law).

4.3 In some circumstances, data is collected indirectly from monitoring by, for example, building and location access control and monitoring systems when you come to our premises for an interview, CCTV, telephone logs and recordings and email logs), if and to the extent permitted by applicable laws. In these circumstances, the data may be collected by the Company or a third party provider of the relevant service. This type of data is generally not accessed on a routine basis but access is possible.

4.4 Some data may be obtained from publicly accessible sources.

4.5 In the event that particular information is required by contract or statute this will be indicated at the time of collection. We will also let you know where there are consequences of you not providing the information requested. Failure to provide some information will mean that we cannot carry on with the recruitment process. For example, if you do not provide us with your name or background, we will not be able to consider you for employment. In some cases it may mean that we are unable engage further with you as the Company will not have the personal data we believe to be necessary to reach a recruitment decision.

5. What are the purposes for which data is processed and what is our legal basis for carrying out the processing?

5.1 Your personal data are collected and processed for various business purposes, in accordance with applicable laws. This Privacy Notice sets out the purposes for which we may use your personal data for. Personal data may occasionally be used for purposes not obvious to you where the circumstances warrant such use. We may, where we think it is necessary, provide you with additional information during the recruitment process to ensure that you understand how your personal data may be used.

5.2 The legal basis on which we process your personal data

  • Whenever the Company processes your personal data, we do so on the basis of a legal basis or justification for that processing. Processing of sensitive data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following basis:
    • The processing is necessary for compliance with a legal obligation to which the Company is subject; or
    • The processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract;
    • The processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. We may on occasion process your personal data for the purpose of legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our clients).
    • In exceptional circumstances we may carry out the processing on the basis of your consent. Where we rely on consent we will make this clear at the time.
  • We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case.

5.3 The purposes we use personal data for and the legal basis that applies

We have identified a number of purposes for collecting and processing your personal data. These are set out below together with the legal basis we rely on in each case:

Recruitment and selection

Considering your suitability to work for us in the role you have applied for, comparing you to other candidates and making recruitment decisions

The lawful basis we rely on
Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to make reasonable adjustments or accommodations where appropriate in the event that you choose to disclose that you have a disability.

Some of this processing is necessary for takings steps at your request to enter into a contract with you.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in fully assessing applicants to ensure that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position. The Company aims to recruit the best person for each vacancy through fair, systematic, effective recruitment and selection procedures. This will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Pre-employment verification and screening

Appropriate pre-employment screening including, where relevant and appropriate, identity check, right to work verification, reference check, credit check, financial sanction check, criminal record checks (if and to the extent permitted by applicable laws), relevant employment history, relevant regulatory status and relevant professional and educational qualifications.

The lawful basis we rely on
Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including establishment of the right to work in the country in which you are employed.

Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business, its employees or clients and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business from fraud, dishonesty or incompetence.

Offers of employment and on-boarding

Making job offers, providing contracts of employment or engagement and preparing to commence your employment or engagement where you accept an offer from us

The lawful basis we rely on
Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you.

Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us.

The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring the effective engagement of candidates on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. This will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Future job opportunities

To contact you if you are not successful in your initial application should another potentially suitable vacancy arise during the six months following completion of the recruitment process for the role you originally applied for

The lawful basis we rely on
This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Recruitment feedback and complaints

To deal with any query, challenge or request for feedback received in relation to our recruitment decisions

The lawful basis we rely on
This processing is necessary for the compliance with legal obligations to which the Company is subject including ensuring that the Company is able to demonstrate its compliance with data protection laws and anti-discrimination laws

Beyond legal compliance processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation.

References

Complying with reference requests where the Company is named by the individual as a referee

The lawful basis we rely on
This processing is necessary for the purpose of the legitimate interests pursued by the Company and potential new employers. It is in the legitimate interests of a new employer to receive confirmation of basic employment details from the Company for the purposes of confirming a former employee's employment history including dates of employment, role and, if appropriate, reason for leaving.

More detailed information would only be provided if you consented to the Company providing such information. Such consent would be entirely voluntary and would be sought at the time before additional information were provided.

Operating Company Policies & Procedures and Network Protection

Operating email, IT, internet, social media, HR related and other company policies and procedures. To the extent permitted by applicable laws, the Company carries out monitoring of the Company's IT systems to protect and maintain the integrity of the Company's IT systems and infrastructure; to ensure compliance with the Company's IT policies and to locate information through searches where needed for a legitimate business purpose

The lawful basis we rely on
This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in managing its workforce and operating its business and protecting its business and all stakeholders from various risks. This includes putting in place appropriate policies and procedures for employees, measuring compliance, detecting breaches and taking action if they are not complied. It also includes appropriate protection of the IT network, systems and business devices to maintain the integrity and security of data and business information and facilitating records management. Effective policy and procedure compliance and IT management including breach detection are important to maintain business standards, ensure business continuity and to protect the Company's reputation. This is important to support the Company's long-term business goals and outcomes.

Ensuring equality of opportunity

Monitoring programmes to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti-discrimination laws

The lawful basis we rely on
This processing is necessary for the compliance with legal obligations to which the Company is subject including anti-discrimination laws.

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

Beyond the above processing is also necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in ensuring equality of opportunity or treatment between people of different age, sex, racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation. Ensuring equality and diversity ensures attraction and retention of high calibre employees, protects the Company's reputation, avoids unlawful discrimination and supports the Company in achieving its long-term business goals and outcomes.

Complaints, claims and litigation

To enforce our legal rights and obligations, and for any purposes in connection with any complaint or legal claim made by, against or otherwise involving you

The lawful basis we rely on
This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation and to protect the Company from other damage or loss. This is important to protect the business of the Company and ensure its continued success and growth. This supports the Company's immediate and long-term business goals and outcomes.

5.4 Additional legal basis we rely on where we process special categories of personal data and personal data relating to criminal convictions and offences

The special categories of personal data that are processed by the Company are set out above. Where we process special categories of data it will be justified by a condition set out at 5.2 above and also by one of the following additional conditions:

Some special categories of personal data (your racial or ethnic origin, religion, philosophical or political belief, sexual orientation or disability status) may be used for the collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation or to keep the Company’s commitment to equal opportunity under review

The lawful basis we rely on
This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular compliance with anti-discrimination legislation.

Where not legally required this processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained.


Special category personal data of any type may be used in the event of a complaint, claim or litigation or potential claim or litigation by, against or involving you.

The lawful basis we rely on
This processing is necessary to establish, exercise or defend legal claims.


Health and medical information may be processed for compliance with employment, health and safety or social security laws. For example, to comply with our legal obligations to make reasonable adjustments where you have notified us of a disability.

The lawful basis we rely on
This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.

Where not legally required this processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;


Some special category personal data may be processed to assess your working capacity and ability to perform the role.

The lawful basis we rely on
The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws


Criminal convictions and offences data may be processed where the Company carries out a criminal record check on recruitment (where authorised by applicable laws); or if an allegation of a criminal offence or conviction arises during your relationship with the Company (where required or authorised by applicable law).

The lawful basis we rely on
This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.

Where not legally required this processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject


Some special categories of personal data (your racial or ethnic origin, religion, philosophical or political belief, sexual orientation or disability status) may be used for the collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation or to keep the Company’s commitment to equal opportunity under review

The lawful basis we rely on
This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular compliance with anti-discrimination legislation.

Where not legally required this processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained.


Special category personal data of any type may be used in the event of a complaint, claim or litigation or potential claim or litigation by, against or involving you.

The lawful basis we rely on
This processing is necessary to establish, exercise or defend legal claims.


Health and medical information may be processed for compliance with employment, health and safety or social security laws. For example, to comply with our legal obligations to make reasonable adjustments where you have notified us of a disability.

The lawful basis we rely on
This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.

Where not legally required this processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;


Some special category personal data may be processed to assess your working capacity and ability to perform the role.

The lawful basis we rely on
The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws

6. Automated decision making and profiling

6.1 We do not currently rely on automated decision making.

7. Retention of personal data

7.1 The Company endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.

7.2 We generally retain personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the length of the relevant recruitment exercise plus the length of any applicable statutory limitation period following this, although some data may need to be kept for longer. We may keep some specific types of data for different periods of time, as required by applicable law. Some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.

8. Disclosures of personal data

8.1 Within the Company, your personal data can be accessed by or may be disclosed internally on a need to know basis to:

  • Human Resources, including managers and team members;
  • management responsible for managing or making decisions in connection with your application (including, without limitation, staff from Compliance, Legal and Information Security);
  • system administrators; and
  • where necessary for the performance of specific tasks or system maintenance by staff in the Company teams such as the Finance and IT Department and the HR information systems support team.

8.2 Your personal data is also accessed by third parties whom we work together with for providing us with services, such as hosting, supporting and maintaining the framework of our HR information systems, including our recruitment systems.

8.3 Examples of third parties with whom your personal data will be shared include tax authorities, regulatory authorities, the Company's insurers, bankers, IT administrators, lawyers, auditors, investors, consultants and other professional advisors and administrators of the Company's benefits programs. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.

8.4 In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

9. Security of data

9.1 The Company is committed to protecting the security of the personal data you share with us. The Company uses a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.

10. International transfer of personal data

10.1 Personal data will be transferred to third parties (e.g. service providers or regulators as set out above), who may have systems or suppliers located outside the European Union. As a result, your personal data may be transferred to countries outside of the country in which you work or outside of the European Union to countries whose data protection laws may be less stringent than ours.

10.2 The Company will ensure that appropriate or suitable safeguards are in place to protect your personal information and that transfer of your personal information is in compliance with applicable data protection laws.

10.3 Where required by applicable data protection laws, the Company has ensured that service providers (including our associated companies) sign standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant Company exporter.

10.4 You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these contact privacy@mileway.com

11. Your rights as a data subject

11.1 You have specific rights over your personal data, as explained below. These may in some circumstances include:

  • Data subject access request: You may request information concerning what personal data we process on you and request a copy of that personal data;
  • Rectification of inaccurate personal data: You may request rectification of any inaccurate personal data. We take reasonable steps to keep your personal data accurate and current but you can also ask us to change any information we hold about you to keep it accurate, complete and current. However, please remember that it is your responsibility to tell us about any updates to this information;
  • Erasure of personal data: In certain circumstances, you have the right to ask us to erase the personal data we hold about you, for example, if you withdraw your consent to our processing of your personal data, your personal data is no longer necessary for the purposes it was collected for, or your personal data has been processed unlawfully. Where there are legitimate reasons for us to retain some of your personal data after you have requested its erasure, appropriate organisational and technical controls will remain in place. Such reasons include for compliance with a legal obligation to which we are subject, for reasons of public health or for statistical and historical research purposes, or for the establishment, exercise or defence of legal claims;
  • Restricting processing of personal data: You can request that we restrict our processing of your personal data where you contest the accuracy of the information we hold (restricted until it has been verified), it was processed unlawfully but you do not wish us to erase it just restrict our processing or we no longer need the personal data but you need us to retain it for the establishment, exercise or defence of a legal claim. Where a restriction is in place we can continue to store your information but only otherwise process it with your consent or for the establishment, exercise or defence of legal claims, for the protection of another individuals rights or for important public interest reasons. We will inform you prior to the lifting of any restriction;
  • Right of portability: In certain circumstances, where technically feasible, you have the right to receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit such personal data to another controller, if the processing is based on consent and is carried out by automated means;
  • Object to the processing of your personal data: Where our processing of your personal data is performed on the basis of ‘Legitimate Interests’ or ‘Public Interest’, you can request we stop such processing. We can continue to process your information if that processing is necessary for the establishment, exercise or defence of legal claims and if we demonstrate compelling legitimate grounds which over-ride your interests, rights or freedoms. Where we process your personal data for direct marketing purposes, you can request we stop such processing and we will cease any processing related to direct marketing;
  • Right not to be subject to automated decision-making: Other than where processing is based on the lawful basis of contractual performance or legal obligation or you have otherwise explicitly consented, you have the right to ask that we obtain human intervention in such automated decision, to express your point of view and to contest such automated decision; and
  • Right to withdraw consent: Where we process your personal data because you have given us your consent, withdraw your consent at any time.

11.2 You can exercise your rights by contacting us at privacy@mileway.com

11.3 We may need to take steps to confirm your identity before processing your request(s). Please note that if you cannot give us satisfactory proof of your identity, we have the right to refuse your request. We will respond to your request within one calendar month. We also have the right to reject requests that are manifestly unfounded or excessive.

12. Additional privacy notices

12.1 We may undertake certain processing of personal data which are subject to additional Privacy Notices and we shall bring these to your attention where relevant.

12.2 To the extent that you become an employee of the Company, the Company’s Employee Fair Processing Notice will apply to the processing of your personal data.

13. Notice of changes

13.1 The Company may change or update this Privacy Notice at any time.

13.2 Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Privacy Notice so that you know which information we process and how we use this information.

13.3 This Privacy Notice was last updated and reviewed on 8 May 2020.