1. Parties and object

SP Platform BV (hereinafter "Service Points" or the " Controller")

Emmasingel 33, 5611AZ, Eindhoven

CoC: 86013394

VAT: NL863831990B01

E-mail: info@servicepoints.nl

Phone: +31 6 47340599

‍

Service Points establishes this Privacy Policy. It aims to transparently inform Users about the way personal data are collected and processed on the website found on our website: https://www.servicepoints.nl, (hereinafter the "Site").

The term "User" refers to any user, whether a natural or legal person, who visits or interacts in any way with the Site.

Service Points determines all technical, legal and organizational means and purposes for processing users' personal data.

Service Points undertakes to take all necessary measures to ensure that the processing of personal data takes place in accordance with the law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (hereinafter the " Law") and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the " Regulation").

Service Points is free to choose a natural or legal person to process the Users' personal data at its request and on its behalf (hereinafter the "Subcontractor"). In this case, Service Points undertakes to select a Subcontractor that provides sufficient guarantees regarding the technical and organizational security measures for the processing of personal data, in accordance with the Law and the Regulation.

2. Processing of personal data

The use of the Site by Users may result in the disclosure of personal data. The processing of this data by Service Points, in its capacity as Controller, or by service providers acting in the name and on behalf of Service Points, is done in accordance with the Law and the Regulation.

Personal data is processed by Service Points in the following manner:

• When completing the registration form for other services (https://www.servicepoints.nl//register/overige-services)
• When completing the registration form for partner services (https://www.servicepoints.nl//register/partnerships)
• When filling out an application form

‍

Use of Webflow Forms

Our website uses Webflow Forms to collect contact requests and other form data. Personal data provided through these forms may be stored on Webflow Inc. servers in the United States.

Webflow complies with GDPR requirements by using a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) as approved by the European Commission. This ensures an adequate level of protection for the processing of personal data outside the EU.

By filling out forms through our website, you agree to this processing and storage as described in this privacy policy.

3. Purpose of processing personal data

In accordance with Article 13 of the Regulation, the purposes of processing personal data are communicated to the User. The purposes of Service Points are as follows:

• Contact
• Pre-screening (om lid te worden van Service Points)
• Pre-selection for job applications

4. Personal data that may be processed

The User agrees that, during the visit and use of the Site, Service Points collects and processes the following personal data, in accordance with the terms and principles described in this Privacy Policy:

• First name and last name
• Email address
• Phone
• Nationality
• Date of birth
• Current work situation
• Work experience (CV)
• Availability & motivation
• Personality traits

‍

This data is collected via:

• Completing the registration form for other services
• Completing the Partner Services Registration Form
• Completing an application form

‍

Use of Google OAuth

Service Points offers users the possibility to log in via Google OAuth. This provides a secure and fast way of authentication without users having to create a separate password for our services.

When a user chooses to log in via Google OAuth, we receive the following data from Google:

• Name
• Email address
• Profile photo (if available)
• Google ID (unique identifier)

‍

This data will only be used for the following purposes:

• Authentication and account management – Allow users to securely log in and access their account.
• Personalization of the user experience – Automatically filling in name and email address and showing a profile picture.
• Security and Fraud Prevention – Preventing unauthorized access and protecting accounts from misuse.

‍

Service Pointsdo not have access to user passwords as authentication is done entirely through Google's secure OAuth process.

Users can revoke their consent to Google OAuth at any time via their Google Account settings. If a user deletes their account at Service Points, the associated Google OAuth data will be permanently deleted from our systems.

‍Gebruik van gegevens verkregen via Google Workspace API's

Our application does not use user data obtained through Google Workspace APIs to develop, improve, or train general artificial intelligence (AI) or machine learning (ML) models. Any data accessed through Google Workspace APIs is used solely to provide the core functionality of our application and is handled in accordance with the Google API Services User Data Policy and this Privacy Policy.

‍

5. Consent

By accessing and using the Site, the User declares that he/she gives his/her free, specific, informed and unambiguous consent to the processing of his/her personal data, having read through the contents of this Privacy Policy.

Consent is given by the positive action whereby the User checks the box for the privacy policy. This consent is an essential condition for performing certain actions on the Site or for enabling the User to enter into a contractual relationship with Service Points. Any agreement binding Service Points and a User regarding the services and goods offered on the Site is subject to the User's acceptance of the Privacy Policy.

The User agrees that the Controller, in accordance with the terms and principles contained in this Privacy Policy, collects and processes his/her personal data that he/she enters on the Site or through other services offered by Service Points.

The User has the right to withdraw his consent at any time.The withdrawal of consent does not affect the lawfulness of the previous processing based on the prior consent.

6. Retention period of Users' personal data

In accordance with Article 13(2) of the Regulation and the Act, the Controller shall retain personal data only for as long as is reasonably necessary to achieve the purposes for which they are processed.

In any case, this duration is less than: 2 years after last contact

7. Recipients of data and disclosure to third parties

Personal data may be transferred to employees, associates, subcontractors or suppliers of Service Points who provide appropriate data security guarantees and who cooperate with Service Points in marketing products or providing services. They act under the direct authority of Service Points and are responsible for collecting, processing or outsourcing this data.

In all cases, recipients of the data live up to the contents of this Privacy Policy. Service Points ensures that they process this data only for the intended purposes and in a discreet and secure manner.

In the event that the data is shared with third parties for the purpose of direct marketing or prospecting, the User will be informed before giving his consent to the use of his personal data.

8. Rights of Users.

The User may exercise his rights at any time by sending an e-mail to the following address: info@servicepoints.nl, or a letter by post, together with a copy of his identity card, to the following address: Emmasingel 33, 5611AZ, Eindhoven

a) Right of access

In accordance with Article 15 of the Regulation, Service Points guarantees the User's right to access their personal data. This includes the following personal data and information:

• the categories of personal data involved;

• the recipients or categories of recipients to whom the personal data have been or will be disclosed, as well as recipients located in third countries or international organizations;

• if possible, the proposed storage period for personal data or, if not possible, the criteria on the basis of which this period is determined;

• the existence of automated decision-making, including profiling (as referred to in Article 22(1) and (4) of the Regulation) and relevant information on the underlying logic, as well as the significance and expected consequences of such processing for the data subject.

The Controller may require reasonable reimbursement of administrative costs for additional copies requested by the User.

If the User submits this request electronically (e.g. by e-mail), the data will be provided in electronic form and for general use, unless the User requests otherwise.

The copy of his data will be sent to the User no later than one month after receipt of the request.

‍

b) Right to rectification

Service Points guarantees to the User the right to rectification and deletion of personal data.

In accordance with Article 16 of the Regulation, incorrect, inaccurate or irrelevant data may be corrected or deleted at any time. The User first makes the necessary changes himself from his user account. If these cannot be made independently, the User can submit a request to Service Points.

In accordance with Article 19 of the Regulation, the Controller shall notify each recipient of personal data of any rectification, unless such notification proves impossible or requires disproportionate efforts. The Controller shall provide the data subject with information about these recipients, if requested.

c) Right to erasure

In the cases mentioned in Article 17 of the Regulation, the User has the right to obtain the deletion of his personal data as soon as possible.

Where the Controller has disclosed the personal data and is required to erase them pursuant to the previous paragraph, the Controller shall take reasonable measures to inform recipients of such personal data that the data subject has requested the erasure of such personal data or a copy or reproduction thereof. It shall do so taking into account available technologies and implementation costs.

The two preceding paragraphs do not apply if processing is necessary for:

• the exercise of the right to freedom of expression and information;

• compliance with a legal obligation to process under Union law or the law of the Member State of the Controller;

• a task of public interest or the exercise of public authority entrusted to the Controller;

• the determination, exercise or defense of legal claims.

In accordance with Article 19 of the Regulation, the Controller shall notify each recipient of personal data of the deletion of personal data or the restriction of their processing, unless such notification proves impossible or involves a disproportionate effort. The Controller shall provide the data subject with information about these recipients if he/she so requests.

d) Right to restrict processing

In the cases mentioned in Article 19 of the Regulation, the User has the right to a restriction of the processing of his personal data.

In accordance with Article 19 of theRegulation, the Controller shall notify each recipient of personal data of the restriction of the processing carried out, unless such notification proves impossible or involves a disproportionate effort. The Controller shall provide the data subject with information about these recipients if he/she so requests.

e) Right to data portability

In accordance with Article 20 of the Regulation, Users have the right to receive from Service Points their personal data in a structured, commonly used and machine-readable format. In the cases provided for in the Regulation, Users have the right to transfer these data to another data controller without Service Points preventing them from doing so.

When the User exercises his right to data portability under the previous paragraph, he has the right to have personal data transferred directly from one controller to another, insofar as this is technically possible.

The exercise of the right to data portability does not affect the right to erasure.

This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

The right to data portability does not affect the rights and freedoms of third parties.

f) Right to object and automated individual decision-making

The User has at all times the right to oppose the processing of his/her personal data due to his/her specific situation, as well as the automation by Service Points. In accordance with Article 21 of the Regulation, Service Points will then no longer process personal data. This opposition will not be heard if there are legitimate and compelling reasons for the processing, which take precedence over the interests, rights and freedoms of the User, or for the establishment, exercise or defense of legal rights.

When processing personal data for prospecting purposes, the User has the right to oppose the processing of his/her personal data at any time. This also applies in the case of profiling, insofar as it relates to such prospecting.

When the data subject objects to the processing for prospecting purposes, the personal data will no longer be processed for that purpose.

g) Right of complaint

The User has the right to submit a complaint about the processing of his personal data by Service Points to the Data Protection Authority, competent for the Dutch territory. More information can be found on the website: https://www.autoriteitpersoonsgegevens.nl/

Complaints can be submitted to the following addresses: Data Protection Authority

Hoge Nieuwstraat 8, 2514 EL The Hague

Phone 088 180 52 50

Fax machine. 088 - 888 85 01

E-mail: info@autoriteitpersoonsgegevens.nl

The User may also file a complaint with the court of first instance of his place of residence.

9. Cookies

The Site uses cookies to distinguish between different users. This allows us to provide users with a better browsing experience and improve the Site and its content.

a) General principles

A " cookie " is a file placed temporarily or permanently on the user's hard drive when they visit the site. This is done for future visits. Cookies allow the server to recognize the user's computer.

Cookies may also be installed by third parties with whom Service Points works.

Some cookies used by Service Points are necessary for the proper operation of the Site; others are necessary to improve the User's experience.

The User can modify or disable cookies by setting their browser.

By using the Website, the User expressly agrees to the management of cookies as described in this article.

b) Types of cookies and purposes pursued

The following types of cookies are used on the Service Points website.

Essential cookies: These cookies are necessary for the functioning of the Site. They enable basic functionalities such as navigation, form submission (such as via Webflow Forms), language selection, cookie settings, etc. Without these cookies the Site may not function properly. Use without consent.

Preference cookies: These cookies remember user preferences, such as language settings (e.g. via Linguana). They provide a personalized user experience. Consent required

Performance cookies: These cookies collect information about how visitors use the website, such as which pages are visited most often and if there are any error messages. This data helps us to optimize the website for a better user experience.

Analytical cookies: These cookies collect anonymised information about the use of the Site (e.g. which pages are visited, average session duration).

Service Points uses:

• Google Analytics 4, via Google Tag Manager
• Cookiebot, for registering consent

All IP addresses are anonymized in accordance with GDPR.
Permission required.

Marketing cookies (tracking/advertisement): These cookies are used to track users across websites, with the aim of showing relevant advertisements and measuring conversion behaviour.

Service Points uses:

• Meta Pixel (Facebook) – Ad Conversion and Remarketing
• Cometly– ad and campaign tracking
• Trustpilot– for displaying reviews
• Google Tag Manager– for script management

Advertising cookies: These cookies are used to display advertisements relevant to the interests of the visitors. They can also be used to measure the effectiveness of advertising campaigns and to prevent the same advertisements from being shown too many times.

Other cookies: This category includes cookies that do not fall directly into the above groups. These may be cookies used for specific functions, such as tracking unique visitors or sessions, or cookies used for other technical purposes.

Cookies and scripts are also used that do not directly fall under the above categories, such as:

• Linguana: for multilingual support and automatic language recognition
• Finsweet scrolldisable: for front-end interaction, such as disabling scrolling on mobile

Google supports the explanation of these cookies at the following address: http://www.google.nl/intl/en_uk/policies/privacy/

‍

c) Retention period for cookies

Cookies are kept for the time necessary to achieve the intended purpose. The cookies that can be stored on the User's hard drive and the storage period of these cookies are as follows:

• The Google Analytics cookies (_ga and _ga_*) are used to collect user statistics. These are stored for a maximum of two years.
• The Facebook Pixel cookie (_fbp) is used for advertising and remarketing purposes and has a retention period of up to 3 months.
• The Cookiebot cookie (CookieConsent), which records the User's consent, is stored for 12 months.
• Cometly cookies, which enable ad and conversion tracking, may be stored for up to 24 months, depending on the specific tracking configuration.

d) Management of cookies

If the User does not want the Website to place cookies on his hard drive, he can easily manage or delete them by adjusting his browser settings. Browser programming also allows the User to receive notification as soon as a Website uses cookies and thus decide whether to accept or reject them.

If the User disables certain cookies, he accepts that the Site may not function optimally. Some parts of the Site may not be usable or only partially usable.

If the User wishes to manage and/or delete certain cookies in this manner, they can do so through the following links:

Internet Explorer: http://windows.microsoft.com/en-us/windows-vista/block-or-allow-cookies

Microsoft Edge: http://windows.microsoft.com/en-gb/windows-10/edge-privacy-faq

Chrome: https://support.google.com/accounts/answer/61416?hl=fr

Firefox: https://support.mozilla.org/fr/kb/activer-deactivater-cookies-preferences

Safari: https://support.apple.com/kb/ph21411?locale=fr_CA

If the User refuses to allow the use of Google Analytics cookies, he or she is invited to configure his or her browser on the following website: http://tools.google.com/dlpage/gaoptout

10. Limitation of the Controller's Liability.

The Site may contain links to other third-party sites not linked to Service Points. The content of these sites and compliance with the Act and Regulation are not the responsibility of Service Points.

The holder of parental authority must give his or her express consent to the minor younger than 16 to disclose any personal information or data on the Site. Service Points strongly encourages persons exercising parental authority over minors to promote responsible and safe use of the Internet. The Controller cannot be held liable for the collection and processing of personal information and data of minors under 16 years of age who have not effectively obtained the consent of their legal parents, nor for incorrect data - such as age - entered by minors. Under no circumstances will personal data be processed by the Controller if the User indicates that he/she is under 16 years of age.

Service Points is not responsible for loss, damage or theft of personal data due to the presence of viruses or following computer attacks.

11. Safety and security

The Controller shall take organizational and technical measures to ensure an appropriate level of security for the processing and collection of data. These security measures depend on the implementation costs related to the nature, context and purposes of the processing of personal data.

The Controller uses standard encryption technologies within the IT sector when transmitting or collecting data on the Site.

12. Modification of Privacy Policy.

Service Points reserves the right to modify this Privacy Policy to comply with legal obligations. The User is therefore requested to consult the Privacy Policy regularly to be informed of any changes and modifications. Any such changes will be posted on the Site or sent by email to ensure its counter operability.

13. Applicable law and competent court

This Privacy Policy is governed exclusively by Dutch law. Any dispute will be submitted to the courts of the judicial district of Service Points' registered office.

14. Contact

For any question or complaint regarding this privacy policy, the User can contact the Controller on our website: info@servicepoints.nl.

Last updated date: August 14, 2023

‍