Privacy Statement AFAS-HRM

Personal data are pieces of information that can enable another person to identify you. The information could be direct but also indirect. For example, someone with your postal code could identify you if that information were combined with other data.

AFAS is the employee records system within Hanze. The data we process within that system are processed for the following purposes:

• to keep personnel files up to date in accordance with Hanze's Selection List
• to pay employees’ salaries
• to file returns with the Tax and Customs Administration
• to offer courses for the development of our employees
• to offer and provide facilities for employees

We will record your data if you are employed at Hanze and/or if you apply for a job at Hanze. We will process those data in AFAS using the employee records system. We process some data during the job application period and will process other data during the course of your career.

Data when your job starts and during the job application:

• CV
• letters of application and forms
• official certificate of good conduct (VOG)
• employment start date
• pay scale
• job changes and assignment or reassignment
• proof of ID
• assessment of diplomas
• recorded arrangements and agreements
• CASO registration forms
• correspondence concerning a job application

 General details of the employee:

• full name
• address
• town/city
• date of birth
• telephone number
• private email address
• work email address
• citizen service number (BSN)
• bank account number
• payslips
• contact details
• marital status
• development plans
• position
• leave
• agreements on training
• letters concerning anniversaries
• participation in facilities, including, for instance, the bicycle scheme and cafeteria model

 Data relating to absence:

• type of absence with the choice of three options: illness, pregnancy or unfitness for work owing to a third-party's action
• absence rate
• hours in percentage terms

 Special data:

• trade union dues
• nationality
• sexual orientation (based on marital status and post-birth leave request as the female partner)

Data concerning an employee’s child for parental leave:

• name of child
• date of birth of child
• initials of child
• gender of child
• previously taken parental leave

We will process your data when you join Hanze. We process those data because we require them on the basis of an agreement. For example, we need them to be able to pay your salary or to enable you to carry out your duties under a contract of employment or a contract for the provision of services. Without that information, we cannot comply with the obligations arising under that agreement. This is the reason why, for the purposes of processing data based on the performance of an agreement, we will rely on the following basis: the agreement.

The law may require us to process certain personal data. Such requirements may arise under the Wages and Salaries Tax Act (Wet op de loonbelasting), for instance. In AFAS, data are processed on the basis of a legal obligation, such as the documentation of your identity. We rely on the legal obligation basis for processing operations based on a legal obligation.

Not all data that we process are processed on the basis of a legal obligation or an agreement. We process certain data on an optional basis, such as your marital status. With optional processing, you are not obliged to provide those data, but you can choose to do so. This means that we will rely on the basis of consent when processing is optional.

Please be advised that you are entitled to withdraw your consent at any time. If you withdraw your consent, we will stop processing the data for which you have withdrawn your consent in so far as there is no legal retention period.

We respect your privacy and will not retain your personal data for any longer than necessary. There may be occasions when the law requires us to retain certain data for a certain period of time. Those obligations are included in Hanze's Selection List. Those legal retention periods apply to some data that are processed in AFAS. Details of how long data are retained are provided below.

Immediately upon the termination of your employment

• the CASO registration forms
• letters of application and forms
• CV
• references
• official certificate of good conduct
• correspondence concerning a job application
• agreements on training
• letters concerning anniversaries
• computer system/email log files and internet monitoringTwo years after termination of employment
• assessment of the employee's diplomas

Two years after completion

• participation in facilities, including, for instance, the bicycle scheme and cafeteria mode
• employee development plans

 Five years

• the forms completed upon commencement of employment

 Seven years after termination of employment

• documents concerning dismissal or retirement
• pay scale
• job changes
• assignment or reassignment
• recorded arrangements and agreements
• proof of ID
• employee’s leave and parental leave

Selection procedure and retention periods

If you are rejected during the selection period, with your consent, we may retain the job application documents for up to a year. This is so that we can contact you should there be any other openings for which you might be suitable. If you do not give your consent, we will delete your data four weeks after the job applications have been dealt with.

We will not disclose your personal data unless required to do so by a legal obligation, such as, for example, the obligations under the Wages and Salaries Tax Act, or if we have engaged a supplier to perform a particular service for us. In the latter case, we will always conclude a processing agreement to protect your data. We will also share data internally for teaching purposes.

Internally, access is given to:    

The Hanze Integration Platform (HIP) is a kind of intermediate system that retrieves data from AFAS and then forwards them to other applications. Examples of such applications include: Topdesk, Blackboard and Webroombooking. They are the applications required for the business operations of Hanze UAS and for the performance of your duties.

Externally, access is given to:

• The supplier: Hanze does not own AFAS. AFAS is a system supplied by AFAS software. AFAS software is established in Leusden, the Netherlands and has a processing agreement with Hanze UAS to protect your personal data. That processing agreement contains agreements on the processing of your personal data, including an agreement whereby your data will remain within the European Economic Area (EEA) and will be adequately protected.
• Employee Insurance Agency (UWV): the UWV will receive your data in the event of sick leave if this is strictly necessary for the performance of its tasks.
• ABP Pension Fund: the ABP Pension Fund is the pension fund used by Hanze UAS, and it acquires data to operate the pension scheme.
• Loyalis: for insurance focused on sickness absence.
• Bank: Hanze uses bank details such as the bank account number you have entered in AFAS to pay your salary.
• Tax and Customs Administration: we will share your salary and income details with the Tax and Customs Administration based on tax legislation concerning the payment of tax.

Automated decision-making means that decisions are made by computer programs or systems without any human intervention. There is no automated decision-making in AFAS.

We take the protection of your personal data seriously and have taken appropriate measures to prevent misuse, loss, unauthorised access, inappropriate disclosure and unauthorised changes. This way, your data will be accessible only by persons authorised to have access by virtue of their positions or duties. The information security and privacy policy is based on the Royal Netherlands Institute of Chartered Accountants (NBA) Maturity Model of the Dutch professional association for IT auditors (NOREA) and the ISO27001/2:2017 standard. If you believe that your data are not being adequately protected or there are indications of misuse, please contact:

[email protected]

You are entitled to inspect, correct or delete your personal data. You are also entitled to withdraw your consent for the processing of data or to lodge an objection to the processing of your personal data by Hanze.

You have the right of data portability, and the right to have your data removed from our employee records system in the customary way and then have it processed elsewhere, for example, with your new employer.

You can submit a request for the inspection, correction, deletion or transfer of your personal data, a request to withdraw your consent or an objection to the processing of your personal data to [email protected]. We will respond to your request as soon as possible but within four weeks at the latest.

Hanze would also like to point out that you have the possibility to submit a complaint to the national supervisory authority, the Dutch Data Protection Authority.