Crossfire Oncology B.V. – PRIVACY NOTICE
This is the privacy notice (hereinafter: Privacy Notice) of Crossfire Oncology B.V. (Crossfire Oncology, we, us).
This Privacy Notice is intended to inform you about how we process and collect your personal data, for example when you do business with us, when you visit our website, request information, when you apply for a job or communicate with us in relation to a (future) position at Crossfire Oncology. It is important that you read this Privacy Notice carefully so that you are aware of how and why we use your personal data.
In processing your personal data, Crossfire Oncology qualifies as the ‘controller’ within the meaning of the General Data Protection Regulation (GDPR).
If you have any questions about this Privacy Notice or about the processing of your personal data, please contact us at firstname.lastname@example.org.
1. The personal data we collect about you
1.1 The term ‘personal data’ is understood to mean all information that can be traced back to a person who can be identified (directly or indirectly), such as a first name and surname, telephone number, address and e-mail address and date of birth, salary, performance data and bank details. Data that cannot be traced back to a person (anonymous data) is not included.
1.2 We collect and process personal data in order to offer our services or to do business, to negotiate and perform agreements, to improve our services or business, for hiring purposes and to be able to personally communicate with you. Also, you may register yourself for receiving a newsletter or other forms of communication of Crossfire Oncology. We process personal data (as set out below) solely for the following purposes:
• The provision of services;
• The negotiation and performance of agreements;
• Collecting of invoices;
• Compliance with legal and statutory obligations;
• Marketing- and communication activities;
1.3 We process the following (types or categories) of personal data in relation to the general conduct of our business, or that have been provided by a person out of his/her own initiative:
name, employer, business contact data such as address, telephone number, mobile number, business e-mail and e-mail correspondence. The aforementioned personal data are processed when you have provided these data to us, if we have obtained such data in the context of the aforementioned purposes, if these personal data have been provided to us by third parties or have become known via public sources.
1.4 In the course of a job application process with us, we collect, use, store and share various categories of personal data from and about you, including:
• Contact details (your first and last name, address, e-mail address, title and telephone number(s) where we can reach you).
• Your CV and all the information on your CV (such as your work experience, education, date of birth, references, courses you have attended, language level(s), photo and social media profile).
• Your cover letter and all personal data contained therein.
• Content of references or letters of recommendation.
• Any additional data that we obtain about you from recruiters, headhunters, agencies or employment agencies.
• Information from your social media profile(s), such as your LinkedIn profile, but only insofar as this is necessary and relevant in the context of the application process (e.g. because you apply to us via LinkedIn).
• Data we obtain in connection with assessments and/or other tests in the context of your application process.
• Other personal data that you provide voluntarily, for example during the job interviews you conduct with us.
1.5 We do not process special categories of personal data such as health data, criminal data or data about your religion, political affiliation, faith, origin or ethnicity unless you provide us with this data yourself and we are permitted to process it on the basis of the GDPR.
2. How we collect and use your personal data
2.1 Crossfire Oncology collects and uses personal data only for specific purposes, on the following legal grounds as referred to in Article 6 of the GDPR:
• Legal obligation;
• Performance of an agreement;
• Obtained consent;
• Legitimate interest
2.2 The personal data we collect in a job application process is mostly provided by you yourself, by corresponding with us by phone, e-mail or social media (e.g. LinkedIn) about your application. In certain cases, we may also receive data from third parties, namely your references, or recruiters, headhunters, employment agencies or temporary work agencies (when these parties are involved in your application).
2.3 If we want to process personal data and cannot do so based on our legitimate interests, legal obligations or establishment of a (employment) contract, we will always ask for your prior consent to such processing (and only if this is possible and allowed under the GDPR). You can withdraw your consent at any time, either in the same way you consented or by contacting us via email@example.com. Upon withdrawal of your consent, we will stop processing that data. The withdrawal of your consent does not affect the lawfulness of the processing operations that we carried out before the withdrawal.
The situations in which we will process your personal data during a job application process are described in more detail below.
Purpose: To communicate with you within the framework of the application (e.g. to request additional information or to schedule interviews)
- Contact details
- Information about your availability
- Your CV and cover letter
- Information that we obtain from recruiters, headhunters, agencies or temporary work agencies (to the extent that they are involved in your application)
- Legitimate interests of Crossfire Oncology (to be able to ensure an efficient application process and to maintain contact with you and other involved parties).
- Your consent to the processing, in order to be able to contact you in the future for suitable positions.
- We will retain your personal data for up to four weeks after the end of the application process. If you have given your explicit consent, we will retain your personal data for up to one year (and only the personal data relevant to that longer retention) or until you withdraw your consent, whichever comes first.
Purpose: For the selection of the candidates; assessing your skills, qualifications and suitability in relation to the position and/or any future positions that may be suitable for you, obtaining information from referees and carrying out tests or assessments.
- Contact details
- Employment history
- Education received
- CV and all the information on your CV (such as date of birth, references, etc.)
- Motivation letter and personal data contained therein.
- Content of references or letters of recommendation.
- Social media profile(s).
- Any additional data that we obtain about you from recruiters, headhunters, agencies or employment agencies (insofar as these parties are involved in your application).
- Test results and results of assessments (where relevant)
- Other personal data that you provide voluntarily.
- Legitimate interests of Crossfire Oncology (to find a suitable candidate and to conduct an efficient and effective application process).
- Your consent to the processing, in order to approach you for suitable positions in the future.
- We will retain personal data for up to four weeks after the end of the application process. If you have given your express consent, we will retain your personal data for up to one year (and only the personal data relevant to that longer retention) or until you withdraw your consent, whichever comes first.
Purpose: Informing you of career opportunities and vacancies for which you may be considered.
- Contact details
- Details of the (previous) vacancies or positions to which you have applied and the outcome of those procedures.
- Your interests in possible (future) jobs.
- Your consent to the processing, in order to be able to approach you in the future for suitable positions.
- Where you have given your express consent, we will process your personal data for a period of up to one year in order to be able to contact you for any interesting (other) positions, or until you withdraw your consent, whichever comes first.
Purpose: Using your data to make you an offer and enter into an employment contract with you.
- Contact details
- Information from your CV (such as information about previous jobs)
- Information on previously obtained salary, job scales, remuneration and fringe benefits.
- Other personal data you provide voluntarily (e.g. on your salary expectations).
- Necessity of being able to conclude and negotiate the employment contract with you.
- To fulfil our legal obligations (e.g. tax and/or administrative obligations).
- We process personal data for the period until we have concluded an employment contract with you, unless longer retention is necessary to fulfil our legal obligations. After the contract has been concluded, we will process your personal data in accordance with our Employee Privacy Notice, a copy of which you will receive upon commencement of employment.
3. Sharing your data
3.1 We may share your data with external service providers to the extent necessary for the purposes set out above (and to the extent that we are permitted to do so under the GDPR). This includes parties such as our IT service providers and Cloud providers and providers of file sharing systems (Microsoft Outlook and OneDrive). It may, in case of a job application, also include parties such as recruiters, headhunters, intermediaries or employment agencies, references provided by you, training providers and parties involved in administering tests and assessments during your application. In accordance with our legal obligations, we conclude a processing agreement with these external service providers, if necessary.
3.2 We may also share your personal data with other parties if we believe it is necessary and permitted to do so:
• with competent supervisors, authorities, judicial bodies or other parties, when we would be legally obliged to do so, or if this is necessary in the context of legal proceedings or to establish or exercise our legal rights (for example, in the context of the handling or institution of complaints or proceedings); or
• with interested parties in connection with a (proposed) sale, merger, acquisition, consolidation or disposal of assets or our business activities, or in the unlikely event of bankruptcy. In these situations, we will only share personal data with third parties to the extent that this is necessary in the context of the (completion of the) transaction and, where possible, we will only share anonymised or aggregated data.
3.3 We will not sell your personal data to third parties.
4. International transfer
4.1 As set out in section 3 above, we will share your personal data with IT service providers and Cloud providers and providers of file sharing systems (Microsoft Outlook and OneDrive) as necessary to communicate with you. These service providers are located outside the European Economic Area (EEA).
4.2 Crossfire Oncology shall ensure that personal data is only transferred if those parties guarantee that the transfer is made in compliance with the applicable privacy legislation. This includes providing a level of protection for personal data that is substantially equivalent to that ensured in the EEA (for example, through implementation of the standard contractual clauses adopted by the European Commission). You may at any time request a copy of the relevant safeguards in place, using the contact details set out in this Privacy Notice.
5. Data security
5.1 We take the security of your personal data very seriously. We have therefore implemented appropriate technical and organisational security measures to prevent your personal data from being lost, used, accessed by unauthorised persons, modified or disclosed in an unauthorised manner.
5.2 Access to your personal data is only permitted to persons who have a “need to know” and are bound by confidentiality obligations. If we engage a third party, we ensure that this party guarantees the same level of security as we do.
5.3 When we engage a third party to process your personal data in order to provide their service to us, we ensure that this party guarantees the same level of security as we do to protect your personal data.
6. Retention period of your personal data
6.1 We will retain your personal data for the period necessary to fulfil the purposes set out in this Privacy Notice. Crossfire Oncology stores personal data that it processes not longer than necessary for the aforementioned purposes, or as long as is required by law. For archiving purposes we may store all correspondence and files for twenty years. During this period, the personal data cannot be accessed in a regular manner. Details of the relevant retention periods in relation to job applications can be found in section 2 above.
7. Your rights
7.1 In accordance with applicable law, you have various rights concerning the processing of your personal data, which are listed below.
• The right to access your personal data. This gives you the right to receive a copy of the personal data we process from and about you.
• The right to request that your personal data be corrected, updated and/or supplemented.
• The right to request deletion of your personal data. For example, if the data are no longer necessary or are being processed unlawfully.
• The right to object to the processing of your personal data, unless we have a legitimate interest that outweighs your interests.
• The right to limit the processing of your personal data. For example, if the accuracy of your personal data is disputed or the processing is unlawful.
• The right to data portability. Receiving your personal data and/or having them sent to a third party.
7.2 You can exercise your rights as set out above by submitting a request by e-mail to firstname.lastname@example.org. We will endeavour to respond to your request within one month of receipt. However, this one-month period may be extended by two months, for example in the case of extensive or complex requests. In this case, we will notify you within one month of receiving your request and explain why the extension is necessary.
7.3 You also have the right to lodge a complaint with the supervisory authority (the Dutch Data Protection Authority) about the way we process your personal data.
8. Social media
If on the website(s) of Crossfire Oncology buttons and/or links have been included to be able to promote or share certain webpages on social media networks or third party websites, such as LinkedIn or Facebook, Crossfire Oncology does not monitor and is not responsible for the processing of your personal data by such third parties. The use of such media is thus for your own risk. Prior to using the services of a third party, it is recommended to read their privacy statement first.
We may apply cookies on our website, in order to increase the ease of use. A cookie is a small text file that is placed on your device during a visit to the website. Without your explicit consent, we will only use functional cookies that are intended to obtain information about the quality and efficacy of the website and cookies that are necessary for the functioning of the website. So-called “tracking cookies” that monitor the surfing behaviour of users, will only be used with your explicit consent.
10. Changes to this Privacy Notice
We may change this Privacy Notice from time to time, without prior notice. Amendments will be published on our website.
Last updated: August-2023.