Personal data is processed within the framework of the services provided by Exter Polak & Charlouis B.V. (hereinafter referred to as 'EP&C' or 'we').  We also process personal data when you visit our website. The term 'personal data' refers to all information about an identified or identifiable natural person. EP&C qualifies as data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ('GDPR') when processing personal data. Our contact details, including the e-mail address at which we can be contacted for privacy related issues, are set out below:

Postbus 3241
+31 (0)70 414 54 54

What personal data do we process?


 When you apply for a job at EP&C, we will process the following personal data when we consider your application: 

  • Your name and address (surname, first names, initials, title, gender, address, post code, place of residence);
  • Other contact details (telephone number, e-mail address and similar information required for communication);
  • Bank account number and travel expenses data (distance from home to work);
  • Nationality, date and place of birth;
  • Availability, CV and employment history, educational background (copies of certificates), cover letter;
  • References, details of the job applied for, interview records and written communication with the applicant

When you receive our newsletter or an invitation to, for example, a workshop or other EP&C event, we process the following (categories of) personal data:

  • Your e-mail address;
  • Whether or not you received an EP&C newsletter or invitation;
  • Whether or not you opened the newsletter or invitation (open ratio) and the activity 'in' the newsletter or invitation (click ratio), which website pages you visited via the links in the newsletter or invitation and the name of the campaign in question (e.g. which newsletter or event);
  • An internal e-mail ID number. On the basis of this ID number we can find out which EP&C newsletter or invitation you opened;
  • If you opened the newsletter or invitation:
    • The time at which the newsletter or invitation was opened;
    • The e-mail client you use (the computer program you use to receive and send e-mails, e.g. Outlook, Apple Mail or Gmail).

 For what purposes do we process your personal data?


 Your personal data will be processed for the following purposes:

  • Recruitment and selection;
  • To assess your suitability for a current or future vacancy at EP&C;
  • To settle the expenses incurred by you;
  • For internal control and business security;
  • To improve the job application process;
  • To deal with any questions, comments and complaints;
  • To make analyses and draw up reports on questions, remarks and complaints;
  • To comply with legal obligations and court orders.

On the basis of what principles do we process your personal data?

We process your personal data on the basis of one or more of the following legal principles:

  1. When this is necessary for the performance of an agreement to which you are a party or to perform pre-contractual acts at your request;
  2. When this is necessary in order to comply with a legal obligation;
  3. When this is necessary to protect our legitimate interests or the interests of a third party;
  4. With your consent.

If we process your personal data on the basis of your consent, we will ask you for this separately. You may withdraw your consent at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.

To whom do we disclose your personal data? 

We do not disclose your personal data to third parties ('recipients' within the meaning of the privacy legislation), unless this is necessary for the proper execution of the purposes described in this Privacy Statement, if this is required by law or if you have given your consent to this. The third parties to whom the personal data is made available are obliged to treat your personal data confidentially. If these parties are regarded as 'processors' within the meaning of the privacy legislation, we will ensure that a processing agreement is concluded with these parties that meets the requirements described in the GDPR.

We may share applicant's personal data with:

  • EP&C employees;
  • Suppliers (e.g. software suppliers);
  • Other parties, such as regulators and other agencies where required by law or with your consent.

How long do we keep your personal data?

EP&C will not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes set out in this Privacy Statement. More specifically, we use the following retention periods:

We retain certain personal data in order to comply with statutory retention obligations, such as the retention of certain accounting data for 7 years (from the end of the year in which the data in question have lost their current importance for (fiscal) business operations) in connection with the tax retention obligation incumbent upon us pursuant to Article 52 of the State Taxes Act (AWR). 

The personal data that you provide to EP&C for your application will be kept for up to four weeks after the end of the application procedure. With your consent, we will keep your personal data on file for one year after the end of the application procedure. This gives us the opportunity to contact you for any future vacancies at EP&C. When you join EP&C, your personal data will become part of your personnel file.

Please refer to our Cookie Statement for the retention periods of the information obtained via cookies on our website.

The specific retention periods referred to above may be extended if statutory retention obligations apply or become applicable. We may also retain personal data for longer if this is necessary for the settlement of incidents and/or legal disputes.


EP&C has taken appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against loss, destruction, damage, modification or disclosure. Our employees are bound to secrecy and are bound by instructions aimed at the adequate protection of your personal data. If you have any questions about the security of your personal data, or if you have any suspicions or indications of improper use, please get in touch with us via the contact details above. 

Your privacy rights 

You have the following rights with regard to the processing of your personal data by EP&C:

  • the right to ask whether we process personal data about you and, if so, to have access to your personal data;
  • the right to have your personal data rectified if it is incorrect or incomplete;
  • the right to have your personal data deleted ('right to be forgotten');
  • the right to object to the processing of your personal data or to limit the processing of your personal data;
  • the right to withdraw consent to the processing of your personal data, if the processing is based on your consent;
  • the right to obtain or hand over your personal data to a third party designated by you in a structured, common and machine-readable format ('right to data portability');

To exercise your rights, please contact us at or by post using the above-mentioned contact details.

In order to prevent us from providing information to the wrong person, we may ask you for additional information to verify your identity. We will, in principle, inform you no later than one month after receipt of your request if we are able to comply with your request. This period may be extended by two months in specific cases, e.g. in the case of a complex request. We will inform you about such an extension at the latest within one month after receipt of your request. Under the privacy legislation, we may refuse your request under certain circumstances. If this is the case, we will explain why. If you object to the processing of your personal data for direct marketing purposes, we will always respect your request. More information about your privacy rights can be found on the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).


If you have a complaint about the processing of your personal data by EP&C, we will try to arrive at a solution together with you. If this does not lead to the desired result, you have the right to submit a complaint to the competent regulator. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).  If you live or work in another country of the European Economic Area, you can submit a complaint to the regulator in that country.


This Privacy Statement was last updated on 19 February 2020. We reserve the right to amend this Privacy Statement and will always post the most recent version of this Privacy Statement on our website.  In the event of substantial changes that could have a significant impact on one or more of the parties concerned, we will endeavour to inform these parties immediately.