GDPR & data protection

1. GDPR and AVG are the same regulation

GDPR is the General Data Protection Regulation; AVG is its Dutch abbreviation. This page supplements the Privacy notice with our rights-request approach. They are not separate laws requiring two general consents.

2. Data protection principles

Processing must be lawful, fair and transparent. Personal data must be collected for defined purposes, limited to what is needed, kept accurate and not kept longer than necessary. Access and security must reflect risks.

Programmes identify controllers and processors. Processing agreements, transfer assessments and, where required, a data protection impact assessment form part of that evaluation. This page is not a certification or absolute compliance guarantee.

3. Your rights

Depending on the processing, you may request access, correction, erasure, restriction, portability or objection. Applicable consent may be withdrawn. For requests other than erasure, use our contact page; you do not need to send an identity document.

4. The right to be forgotten

Use the form below to request removal of data no longer needed or lacking a lawful basis. If possible, identify the data or earlier request without unnecessary medical or sensitive information.

We do not automatically erase everything on receipt. We assess identity, scope and exceptions such as statutory retention or legal claims. If erasure is partial or refused, we explain the reasons and your options.

5. Proportionate identity verification

An ID copy is not routinely mandatory. Additional necessary information may be requested only where identity is reasonably in doubt. Email verification or another less intrusive method may suffice.

The upload is optional. Only upload a redacted copy if asked; hide identification numbers, photo, signature and unnecessary details. It is private and authorised staff remove it after necessary verification once further retention is unjustified.

6. Handling and deadlines

Requests are stored separately and accessible only to authorised administrators. You receive a reference confirming receipt. Staff must then assess, verify and handle the request.

Normally a substantive response follows within one month. Complex or multiple requests may need two additional months; we inform you of the extension and reasons in the first month. Requests are normally free; only lawful exceptions for manifestly unfounded or excessive requests may apply.

7. Recipients and backups

Where required by GDPR, relevant recipients are notified of correction, erasure or restriction unless impossible or disproportionate. Ask which recipients apply to your data.

Backups and statutory records may limit immediate erasure. Handling must explain what is deleted, what is retained, why and how further use is restricted. A receipt does not confirm that all backups are erased.

8. Complaints and confidential support

You may complain to your competent authority. Links to GDPR and authorities are provided on this page; prior contact with us is not required.

A rights request does not result in personal feedback to HR. EAP support remains external and confidential under professional arrangements and applicable legal obligations.