Version 31 May 2025
Data Controller Profas Mobility Overheid B.V.
KvK (Chamber of Commerce) 27326769
Contact info@profas.nl
Website https://www.profas.nl
Profas Mobility Overheid B.V. (hereinafter “PROFAS”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of all individuals who interact with us. This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any applicable national implementing legislation.
This Policy applies to:
Please read this Policy carefully. If you have any questions, you may contact us at any time using the details above.
PROFAS acts as the data controller for the personal data described in this Policy. A data controller is the entity that determines the purposes and means of processing personal data.
PROFAS has been active since 1988 in the field of personnel mobility. We provide career coaching, job coaching, outplacement and HR advisory services throughout the Netherlands, operating under the trade name PROFAS.
We are registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 27326769.
When you enter into a mobility employment arrangement or re-integration programme with PROFAS, we may collect and process the following categories of personal data:
We process the following personal data relating to contact persons at client organisations:
When you visit www.profas.nl we may collect:
We collect personal data:
We process personal data only where we have a valid legal basis under Article 6 of the GDPR. The table below sets out our main processing activities.
| Purpose | Legal Basis | Retention Period |
| Administering the mobility employment arrangement | Performance of a contract (Art. 6(1)(b)) | Duration of the arrangement + 7 years |
| Payroll processing and pension administration | Legal obligation (Art. 6(1)(c)); contract (Art. 6(1)(b)) | 7 years (Dutch fiscal law) |
| Career coaching, assessments and job coaching | Performance of a contract (Art. 6(1)(b)) | Duration of arrangement + 2 years |
| Client relationship management and invoicing | Contract / legitimate interest (Art. 6(1)(b)(f)) | 7 years |
| Website contact form enquiries | Legitimate interest / pre-contractual steps (Art. 6(1)(b)(f)) | 2 years |
| Compliance with legal and regulatory obligations | Legal obligation (Art. 6(1)(c)) | As required by law |
| Research projects (candidate participation) | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
Where we rely on legitimate interests as a legal basis, we have carried out a balancing test and concluded that our interests are not overridden by your rights and freedoms. You have the right to object to such processing at any time (see Section 10).
We share only process-related information with the commissioning employer – for example, whether the programme is progressing, whether you are actively engaged and motivated, and what activities have taken place. We never share the substantive content of coaching sessions or personal assessments with the client organisation.
We engage trusted third-party processors who act on our instructions and are bound by data processing agreements in accordance with Article 28 GDPR:
We may disclose personal data to competent authorities (such as the Dutch Tax Authority or UWV) where we are legally required to do so.
PROFAS operates exclusively within the Netherlands. Where any third-party processor transfers data outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, in accordance with Chapter V of the GDPR.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR. All reportable breaches will be notified to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of discovery, as required by Article 33 GDPR.
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Key retention periods are set out in the table in Section 5 above. In summary:
When the applicable retention period expires, data is securely deleted or anonymised.
You have the following rights with respect to your personal data:
Right of access (Art. 15)
You may request confirmation of whether we process your personal data and, if so, a copy of that data together with supplementary information about how it is processed.
Right to rectification (Art. 16)
You may request that we correct inaccurate or incomplete personal data concerning you.
Right to erasure (Art. 17)
You may request deletion of your personal data where, for example, it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent is the legal basis).
Right to restriction (Art. 18)
You may request that we restrict the processing of your data in certain circumstances, for example whilst the accuracy of the data is being contested.
Right to data portability (Art. 20)
Where processing is based on consent or a contract and carried out by automated means, you may request a copy of your data in a structured, commonly used and machine-readable format.
Right to object (Art. 21)
You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
Right to withdraw consent (Art. 7(3))
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Rights related to automated decision-making (Art. 22)
We do not make solely automated decisions that produce significant legal or similarly significant effects on you.
To exercise any of these rights, please contact us using the details in Section 2 or Section 11. We will respond within one month. If your request is complex, we may extend this period by a further two months, in which case we will inform you within the first month.
We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.
If you are dissatisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the Dutch Data Protection Authority:
| Authority | Autoriteit Persoonsgegevens (AP) |
| Website | https://www.autoriteitpersoonsgegevens.nl |
| Telephone | +31 (0)70 888 8500 |
We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority, so please contact us in the first instance.
For all data protection enquiries, requests to exercise your rights, or questions about this Privacy Policy, please contact:
| Name | Dick Mulder |
| Organisation | Profas Mobility Overheid B.V. |
| info@profas.nl |
Our website www.profas.nl may place cookies and similar tracking technologies on your device. A cookie is a small text file stored by your browser. We use cookies for the following purposes:
You can control or delete cookies via your browser settings. Please note that disabling cookies may affect the functionality of the website. For further information about cookies, please visit www.allaboutcookies.org.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or business operations. When we make material changes, we will update the version date at the top of this document and, where appropriate, notify you directly.
We encourage you to review this Policy periodically. The current version is always available on our website at https://www.profas.nl/privacy-policy/.
