This notice applies to the processing of personal data by Randstad Sourceright EMEA BV (RSR) in connection with the delivery of talent pooling services to Booking.com B.V. (BCOM).
summary
- If you wish to be considered for certain roles at BCOM, you will need to register with the talent pool. When you register your data is controlled by RSR, a company based in Amsterdam, the Netherlands.
- The General Data Protection Regulation (GDPR) applies to the processing of your personal data irrespective of where you are located.
- The GDPR gives you certain rights which are set out in this document.
- Registering will make the details you provide visible to recruiters employed by RSR who will use those details to conduct an initial assessment of your suitability for roles with BCOM.
- If you are considered suitable, you will be referred for a skills assessment and a compliance assessment. Successful completion of both is necessary to enter the gig platform at BCOM and to bid for roles at BCOM.
- The compliance assessment referred to above will ensure that you are registered as an independent contractor or freelancer in accordance with the laws where you live. No jobs available via the talent pool are available on an employed basis.
responsible body
Within the meaning of the GDPR, RSR is responsible for the collection, processing and use of your personal data when using the services offered by RSR.
processing of personal data
| category of individual | personal data collected | legal basis for processing | third party disclosures |
|---|---|---|---|
| all users | IP address of the requesting computer, date and time of access, name and URL of the file accessed, the website from which accessed, computer operating system, browser used and other technical data, name of the Internet access provider, language settings, and geographical origin. | legitimate interests | other companies within the Randstad group and third party service providers for the purpose of securing the website from attacks |
| numerical IDs uniquely identifying the user by placing a “cookie” on the user’s computer associated with the core functionality of the website | legitimate interests | [names of third party cookies] | |
| numerical IDs uniquely identifying the user by placing a “cookie” on the user’s computer not associated with the core functionality of the website | consent | see cookie settings for list of vendors | |
| registered users | biographical information relating to the individual including, but not limited to, name, email address, telephone number, address, profile picture / photo (optional), residence status, work permit, education, skills, CV, career, billing address, other contact information (e.g. Google ID, LinkedIn ID), username, password(hashed), email communication with recruiters | performance of a contract / consent | CXC Global for compliance assessment (email address) BCOM for registration on gig platform |
additional third party disclosures
- Aggregated data is shared with affiliated companies of RSR within the Randstad Group for the purposes of analysing website traffic, trends and for internal statistical purposes.
- Personal data may be shared with RSR’s professional advisors who are contracted under terms requiring them to maintain the confidentiality of any personal data shared.
- Personal data may be accessible to processors engaged by RSR for the purposes of providing the services. Such processors are engaged under contractual terms requiring them to maintain the confidentiality of the personal data and RSR remains liable for the conduct of its processors.
third party processors
- Randstad Sourceright GmbH based in Germany and provides the talent management platform used by RSR for talent pooling services. Randstad Sourceright GmbH is a fully owned subsidiary of RSR.
- Affiliated companies of RSR who provide IT, technical and administrative support services under inter-company arrangements.
RSR remains liable for all activities by its contracted processors.
transfers outside the EEA
Data is only passed on to third parties outside the European Union if this is permitted under GDPR and if measures to ensure an appropriate level of protection (e.g. standard contractual clauses) are in place.
data security
We use appropriate technical and organizational security measures to protect your personal data stored by us against manipulation, partial or complete loss and against unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.
data retention
Personal data of visitors to the website who do not register will be anonymised no later than 3 months after their last visit.
Subject to the following, personal data of registered users is retained for the duration of the contract with BCOM. Registered users can manage their own data and delete their personal data at any time. RSR periodically runs sunsetting campaigns which will remove inactive profiles from the database and if a user wishes to remain registered, they should be active on the platform.
individual rights
Right to information about stored personal data
Upon request, RSR will provide information on data processing and its purpose at appropriate intervals.
Right to correct inaccurate data
If data is incorrect, RSR will correct it upon request and after checking, only if the user is not able to make the change in his or her user account himself or herself.
Right of objection against unlawful data processing
If there are doubts, an objection can be filed against data processing. This applies in particular if RSR has no legitimate interest in the processing or if the data is used for direct advertising.
Right to limitation of processing
If an objection has been filed or the accuracy of data is being checked, a restriction of the processing of the data may be requested for the duration of the examination. If data has been processed unlawfully or is no longer required, the data subject may request the restriction of the data instead of deletion.
Right to cancellation
The data shall be deleted if it is no longer needed and subject to data retention requirements and if there is no legal basis for the processing. This applies in particular if no consent of the person or no legitimate interest in the processing exists.
Right to data transferability
RSR will make the data available on request in a machine-readable format or, as far as possible, transfer it to another responsible party.
Right of appeal to a supervisory authority
Persons have the right to file a complaint with the competent local supervisory authority. The responsible supervisory authority for RSR is:
Autoriteit PersoonsgegevensPO Box 93374
2509 AJ DEN HAAG
Visiting address (only by appointment + show valid identification):
Bezuidenhoutseweg 30
2594 AV Den Haag
Phone: (+31) – (0)70 – 888 85 00
Fax: (+31) – (0)70 – 888 85 01
contact
If you have concerns about the processing of your personal data, please contact gigs@booking.com in the first instance. If your query is not resolved, you can contact the RSR Data Protection Office by emailing rsrdpo@randstad.com.