+31 (0) 30 602 16 17

Privacy statement - Brainnet Groep

As of 25 May 2018

Our vision on privacy

Brainnet Groep helps organisations to search for, find and select external professionals, arranges the hiring processes and manages and administers Service Contracts. We refer to external professionals as being ‘experts’. We believe in a transparent labour market, and we believe in a transparent privacy policy. We consider the privacy of our experts, people who we contact at suppliers and clients, applicants, employees hired by Brainnet, and other business relations highly important. Within Brainnet, we weigh up all of the interests and consider your right to privacy to be extremely important. This privacy statement explains how we protect your privacy and how we handle your personal data.

Who processes your personal data?

Brainnet Groep, registered at the Chamber of Commerce under number 53836073, and
its affiliated companies, including Brainnet B.V., Infraflex B.V. that operates under the name Myflex, Flexbrain Detachering B.V, Flexbrain Detachering Publieke Sector B.V. and Flexbrain Detachering Bouw & Infra B.V. (referred to together as: ‘Brainnet’), process personal data. Do you want to know which Brainnet company is responsible for processing your data? Please contact us, we will provide you with this information.

What are personal data and when are they processed?

Personal data include all of the data that can be used to identify a person. Are you self-employed (Dutch abbreviation: ZZP)? Then you are legally considered to be a person and personal data will also concern data that, directly or indirectly, say something about you. You have already shared personal data with us when you contacted us. For instance, your name, telephone number and/or e-mail address.

Specific personal details are considered to be sensitive data, for instance data about your health, criminal record, religious or philosophical beliefs, membership of a trade union, sexual orientation or data concerning race or ethnic origin. In principle, we do not process specific personal details. We only process specific personal data if is required for the service we provide and if it we are statutorily obliged to do so, if this is done with your consent or if you ask us to do so.

‘Processing’ personal data is generally understood to mean performing any action on it, for instance, collecting, storing, using, forwarding or deleting personal data.

From whom do we process personal data?

We process personal data from people with whom we have, want to have or have had a direct or indirect relationship. For instance, this means personal data from:

  • experts;
  • people related to the suppliers;
  • people related to the clients;
  • people interested in our services;
  • people who are related to another company or another organisation with which we have, want to have or have had a business relationship.

How do we get your personal data?

We receive your data because you give them to us, for instance, when you enter into an agreement with us or when you use the service we provide. We can also receive your data from third parties. For instance, from suppliers or other parties with which we collaborate. We have agreed with our suppliers that when they forward your personal data they will point out this privacy statement to you.

For what purposes and on what grounds do we process personal data?

Brainnet can only perform its activities effectively if we know you well. Therefore, we ask for and process your personal data. Brainnet classifies its activities into various main services. Below is an explanation of the personnel data we process for each main service, the purpose for which we process it and on which grounds.


We search for suitable experts to carry out temporary activities for our clients. Brainnet comes into contact with these experts in various ways. In the first place by them applying directly to Brainnet. The expert will then be given access to a portal that contains the Service Contracts for the Brainnet clients. In the second place, an expert can be recommended to us via a Brainnet supplier. In both cases, Brainnet will process the expert’s personal data. We process this personal data for our recruitment and selection activities and to be able to establish where the expert can be deployed. These personal data must be processed to be able to contact the expert, to investigate whether the expert can be deployed for a client’s Service Contract, to be able to enter into a Service Contract with (the supplier of) this expert, but also to enter into a Service Contract with a client regarding the employability of the expert. Brainnet has a justified interest in processing the personal data of the expert, because it makes it possible to select the appropriate expert for the Service Contract.

The personal data of the expert that we process for our recruitment service, include name and address details, date and place of birth, e-mail address, telephone number, curriculum vitae (CV), education details (including the highest level diploma) and other details that can be of interest when assessing the suitability of the expert for a certain job, for instance references and attestations. If you wish to access our portal, we will also process your IP address. We ask your permission to record this IP address.

Pre-employment screening

Brainnet regularly performs pre-employment screenings for its clients. Screening is always a customised activity and depends on the requirements set by the client. We only agree to perform a pre-employment screening for our clients after establishing that the client has a justified reason for performing this screening, which is more important than the expert’s (privacy) rights. If this is the case, we process the expert’s personal data to be able to assess the expert’s suitability and integrity with respect to a specific position. The specific nature of the position can mean that (strict) pre-employment screening is required. For certain positions, for instance those in the financial sector, screening is even a statutory requirement.

When performing a pre-employment screening, we always process the name and the address details of the expert we screen. We also process, among other data, the date and place of birth, e-mail address, telephone number, recent curriculum vitae (CV), educational details and other details that could be of interest within the framework of assessing the expert’s suitability.

Dependent on the degree of pre-employment screening, we also process information from (ex-) employers and/or clients, details about the expert’s labour history (e.g. data related to suspension and dismissal), a Verklaring Omtrent het Gedrag (‘VOG’ - certificate of good conduct) or a Verklaring van Geen Bezwaar (‘VGB’ - declaration of no objection) and an overview of the secondary functions performed.

Contract management

When Brainnet enters into a Service Contract with (a supplier of) an expert or a client, the expert’s personal data must be processed. These personal data are required to maintain and meet the Service Contract. We are also legally obliged to establish the identity of an expert when he or she is employed on a Service Contract. Brainnet also has certain obligations arising from the Wet Ketenaansprakelijkheid (Dutch Sequential Liability Act). Based on these statutory obligations, we must also include certain (financial and fiscal) data of an expert in our records.

The expert’s personal data that we process within the framework of contract management include the name and address data, nationality, gender and a BSN (citizen service number) and/or ID number.

Procurement administration/salary processing and invoicing

We process the salary details for external professionals that are in Brainnet’s paid employment. Brainnet suppliers can send us an invoice related to the expert’s activities. We send invoices to our client. The timesheets for these invoices include personal data, namely the expert’s name and the name and contact data of the client’s manager. These personal data must be processed to execute the Service Contract and to be able to pay the invoices relating to that contract.


If a supplier or a client wants to purchase a service from us, Brainnet requires personal data from one or more of the contacts at the organisation. These personal data are needed to enter into, for instance, a Service Contract or hiring contract with this organisation or to contact this organisation about current business. If you are one of our suppliers or clients, of course we want to provide you with a good service. To do so, we also process your personal data. For instance, we use your name and (business) address data to maintain contact with you. We can also use these data to establish, for instance, whether you are allowed to represent your organisation. If this is the case, we also have a justified interest in processing these personal data.


We process personal data from applicants for positions at Brainnet. The personal data that you share with us, including name and address details, date and place of birth, e-mail address, telephone number, curriculum vitae (CV), educational details (including the highest level diploma) and other details that can be of interest within the framework of assessing the suitability for a certain job, for instance references and attestations. We handle these personal data with great care. Brainnet has a justified interest in processing the personal data of its applicants, as that makes it possible to select the appropriate person for the job.

Workers hired by Brainnet

When Brainnet hires workers, it enters into a Service Contract with (a supplier of) an expert. To do so, Brainnet must process the expert’s personal data. The expert’s personal data that we process to enter into the Service Contract include your name and address data, nationality, gender and a BSN (citizen service number) and/or ID number.

Newsletters, magazines and other messages

We regularly send our clients, suppliers, experts and other business relations newsletters containing substantive and professional items and interviews, magazines and/or other messages dealing with the latest developments in the sector. To be able to send our newsletter and our magazine to the relevant people, we use the name and e-mail address of these people. We send a newsletter, magazine or other message to people who have given us permission to do so. You can also unsubscribe to these publications/messages.

How do we deal with your personal data?

Brainnet and its affiliated companies have an SNA certificate (NEN 4400-1) and Brainnet is also ISO 9001/14001 certified. We have taken appropriate technical and organisational measures to protect your personal data and to avoid abuse. We ensure that our systems and the portal that we use have the maximum protection. Our systems are continually updated. We also frequently ask for advice related to the security of our systems from reputable market parties. We do this to protect your personal data as well as possible.

We resolve and record data leaks. If required, we also report them to the inspector and to the parties involved. Within Brainnet, your personal data can only be used by employees who must have access to them to perform their job.

How long do we keep your personal data?

Your personal data are securely kept and no longer than necessary for the purpose for which they have been processed, unless we have received your permission to keep them for a longer period. We operate a storage policy which states how long we can keep data. The personal data that we have processed within the framework of a Service Contract with a client are kept for five (5) years after the termination of the contract, unless we have reason to keep them longer. For fiscal data, we employ the legal storage term of seven (7) years. Data that we have received from you for a selection process for a Service Contract for which you have not been selected are kept for up to six (6) months after the end of the selection procedure.

Data related to applying for internal positions at Brainnet are kept for a maximum of four (4) weeks after the end of the application procedure, unless you have given us permission to keep your data longer, for instance, because a suitable position for you could possibly arise at a later date.

Do we share your personal data with others?

There are strict rules related to sharing personal data with third parties. We do our utmost to adhere to these rules wherever possible. We only share your personal data with third parties if we have the statutory obligation to do so, because we have to implement an agreement with you or because we employ another service provider. For instance, inspectors and the Tax Authority can request data from us based on the legislation. A judge can also request us to provide data. Furthermore, if you, for instance, commit a fraud, we can report you.

Sometimes, based on an agreement, we are obliged to share your data with another party or organisation. For instance, Brainnet shares an expert’s personal data with clients that are interested in employing the expert for a Service Contract. Brainnet also sends monthly key figure reports to its clients.

We also provide your personal data to other parties that we need to work with to provide our service. For instance, Brainnet can share experts’ personal data with an external party that checks the identity details of the experts who are employed on a Service Contract. In addition, to process the salaries of experts who are in paid employment with Brainnet, data are shared with an external party.

Moreover, Brainnet uses various processing organisations. We have entered into contracts with these organisations that ensure that they guarantee that they will handle your personal data with as much care as Brainnet. In addition, these organisations guarantee that they will adhere to the existing privacy legislation.
If you wish, we can also provide your personal data to other clients or companies.

What rules apply when processing personal data?

As of 25 May 2018, Brainnet is bound to the General Data Protection Regulation (Algemene Verordening Gegevensbescherming - AVG) with respect to processing personal data in the Netherlands.

View or amend your personal data?

Do you want to know what personal data we have recorded from you? You can request from us an overview of the personal data we have processed. Do you think that your personal data have been incorrectly or incompletely processed or do you think that they should not have been processed? If so, you can request Brainnet to change, supplement or delete the data. You are also entitled to object to your personal data being processed and you are entitled to data transfer.

In addition, you are entitled to withdraw any previous permission you have given, if this was why your personal data was processed. If you send us such a request, we will as soon as possible, but in any case within four (4) weeks of receiving your request, explain to you the actions we have taken.

Questions or complaints?

For questions or complaints about how Brainnet processes personal data, please contact us by sending an e-mail to avg@brainnet.nl or sending your written request to:

Brainnet Groep
Request to inspect personal data
P.O. Box 549
3430 AM Nieuwegein

Complaints inspector

The Competent Personal Data Authority (Autoriteit Persoonsgegevens) monitors whether Brainnet adheres to the AVG. If you are of the opinion that Brainnet does not adhere to the applicable privacy legislation, you are entitled to file a complaint with the Personal Data Authority.

About this privacy statement

The regulations related to privacy legislation regularly change. Therefore, our privacy policy is never totally complete. We keep our policy up to date. As a result, Brainnet can change this privacy statement from time to time. If these changes are also important for you, we will point this out to you or notify you of the changes in a clear way. The most up-to-date version of our privacy statement can always be found on [www.brainnet.nl/privacy-statement]. This privacy statement was last changed on 24 May 2018.

Click here if you want to know more about our cookie statement

>Privacy statement