Privacy Notice For Employees And Contractors

Blue Lynx | Version 2.0 | Effective 8 September 2026

This notice explains how Blue Lynx collects and uses personal data relating to its workforce. It applies to employees, temporary agency workers, Employer of Record team members, secondees, and other professionals employed or engaged by a Blue Lynx entity. Where a provision applies only to employees or only to self-employed contractors, this is stated explicitly.

This notice is provided for transparency. It is not a request for consent to processing that is necessary for an employment or service contract, compliance with law, or the legitimate interests described below.

1. Who is responsible for your personal data?

The controller is the Blue Lynx legal entity identified as your employer or contracting party in your employment contract, assignment documentation, or service agreement. Depending on your arrangement, this may be The Blue Lynx Group B.V., Blue Lynx Employment B.V., or Blue Lynx Projects B.V.

Address: Koninginnegracht 19, 2514 AB The Hague, the Netherlands
Data Protection Officer: gdpr@bluelynx.com
HR contact: hr@bluelynx.com

Other Blue Lynx group entities may process limited personal data where required to provide central HR, finance, compliance, management, or IT support. Their role will depend on the relevant activity and may be that of a processor, joint controller, or separate controller.

2. Personal data we may process

  • Identification and contact data, including name, address, date of birth, nationality, photograph, signature, telephone number, email address, and emergency contact details
  • Government and immigration data, including BSN, identity-document data and copies where legally permitted, work authorisation, residence permits, sponsorship and visa information, and 30% ruling documentation
  • Employment and assignment data, including contracts, job title, assignment, work location, manager, client, start and end dates, working hours, timesheets, attendance, leave, and availability
  • Recruitment and professional data, including CV, work history, education, qualifications, references, interview records, skills, and suitability assessments
  • Payroll, tax, and financial data, including salary, allowances, bonuses, expenses, bank details, payroll-tax information, deductions, attachments, and payment history
  • Benefits and insurance data, including holiday entitlement, pension participation, statutory benefits, accident and liability coverage, and claims information
  • Performance and workplace data, including objectives, appraisals, training, development, conduct, grievances, disciplinary matters, complaints, and termination records
  • Absence, occupational-health, and reintegration data that Blue Lynx is legally permitted to receive and record. Medical diagnoses are handled by the company doctor or occupational-health provider and are not requested or recorded by Blue Lynx unless the law expressly permits this
  • Equality and pay-transparency data, including gender or sex information and the employment, assignment, working-time, job-category, and remuneration information required to monitor, analyse, and report pay differences.
  • IT, communications, access, and security data, including account identifiers, device and system logs, access records, security events, and business communications, where relevant and permitted
  • Information relating to legal claims, investigations, compliance reviews, sanctions screening, or requests from competent authorities

3. Where we obtain personal data

We obtain personal data directly from you and, where relevant, from recruitment sources, referees, the client or hiring organisation, managers, colleagues, public registers, government authorities, pension and insurance providers, occupational-health providers, and suppliers supporting the employment or assignment relationship. Where we receive information from another source, we process only what is relevant for the stated purpose.

4. Why we process personal data and our lawful grounds

Purpose  Examples  Main lawful ground 
Entering into and managing the relationship  Onboarding, contracts, assignments, access, working time, leave, expenses, remuneration, and termination  Taking steps before and performing a contract - Article 6(1)(b) GDPR 
Meeting legal obligations  Payroll tax, social security, pension, minimum employment conditions, immigration sponsorship, workplace safety, sickness and reintegration, record keeping, and official reporting  Legal obligation - Article 6(1)(c) GDPR 
Workforce and business administration  Resource planning, client delivery, internal reporting, finance, audits, quality control, business continuity, and supplier management  Legitimate interests - Article 6(1)(f) GDPR 
Security and protection  Identity and access management, fraud prevention, investigations, information security, and protection of people, systems, and assets  Legal obligation and/or legitimate interests - Articles 6(1)(c) and 6(1)(f) GDPR 
Claims and professional advice  Handling disputes, complaints, insurance claims, legal proceedings, and obtaining professional advice  Legitimate interests and/or legal obligation - Articles 6(1)(f) and 6(1)(c) GDPR 
Optional activities  Use of photographs, testimonials, or participation in voluntary promotional activities where no other ground applies  Consent - Article 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting earlier lawful processing 

Our legitimate interests include operating and improving our services, administering our workforce, meeting client commitments, ensuring security, preventing misuse, maintaining accurate records, and protecting or exercising legal rights. We balance these interests against the rights and freedoms of the individuals concerned.

5. Special categories of personal data

Where processing involves health information or another special category of personal data, Blue Lynx will process it only where an additional condition under Article 9 GDPR and applicable Dutch law is met. This will normally be necessary for employment, social-security, occupational-health, reintegration, insurance, or legal-claims purposes. Access is restricted to authorised persons. Blue Lynx does not require employees to disclose a medical diagnosis when reporting sickness.

6. Who may receive personal data?

We disclose personal data only where necessary and proportionate. Recipients may include:

  • The client, end client, hiring organisation, MSP, or authorised client managers involved in the assignment
  • Other Blue Lynx group entities providing central support
  • Payroll, HR, time-registration, hosting, communications, security, and other IT service providers
  • Clients, end clients, competent monitoring bodies, and public authorities where disclosure is required under applicable equal-pay or pay-transparency legislation or where another valid legal basis applies.
  • Banks, pension providers, insurers, benefit administrators, and claims handlers
  • The company doctor, Arbodienst, case-management provider, or other occupational-health professionals
  • The Belastingdienst, UWV, IND, labour inspectorates, courts, regulators, law-enforcement bodies, and other competent authorities
  • Auditors, accountants, legal advisers, consultants, and other professional advisers
  • A prospective purchaser, investor, or successor where required for a corporate transaction and subject to appropriate safeguards

Clients and public authorities generally determine their own purposes and act as separate controllers. Suppliers processing personal data solely on our instructions are contractually required to protect the data and use it only for authorised purposes.

7. International transfers

Personal data may be accessed or processed outside the European Economic Area where a Blue Lynx group entity, client, or service provider is located there. Where the destination is not recognised by the European Commission as providing an adequate level of protection, we use an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. You may contact gdpr@bluelynx.com for information about the relevant transfer safeguard and how to obtain a copy.

8. Is providing personal data mandatory?

Some information is required to enter into or perform the employment, assignment, or service relationship, or to comply with legal obligations. If required information is not provided, Blue Lynx may be unable to conclude the contract, process payroll or benefits, maintain immigration sponsorship, arrange the assignment, or comply with its legal duties. Information requested for an optional activity will be clearly identified as optional.

9. How long we retain personal data

We retain personal data only for as long as necessary for the relevant purpose, taking account of legal retention duties and limitation periods. The principal periods are:

Record category  Indicative retention period 
Payroll, tax, and core financial administration  Generally 7 years, or longer where a specific legal rule requires it 
General personnel and assignment records  Generally 7 years after the relationship ends, unless a longer period is necessary and justified 
Sickness, absence, and reintegration administration  Only for the period permitted by applicable law and normally no longer than 2 years after the relationship ends, subject to specific statutory duties 
Immigration and recognised-sponsor administration  For the period required under applicable immigration and sponsorship rules 
Equal-pay and pay-transparency compliance  Monitoring and analysing pay differences, responding to employees’ information rights, and preparing or submitting reports required under applicable equal-pay and pay-transparency legislation 
Claims, disputes, investigations, and insurance matters  Until the matter is concluded and the applicable limitation or statutory retention period has expired 
Optional processing based on consent  Until consent is withdrawn or the stated purpose ends, whichever occurs first 

A record may be retained longer where necessary to establish, exercise, or defend legal claims, comply with a preservation request, or meet another legal obligation. It will then be restricted to that purpose.

10. Security and confidentiality

Blue Lynx applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Access is limited according to role and business need. Employees, contractors, and suppliers who handle personal data are subject to confidentiality and security requirements.

11. Automated decision-making

Blue Lynx will inform you separately if it uses solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. The information will explain the logic involved, the significance and expected consequences, and the safeguards available, including any right to obtain human intervention.

12. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may ask Blue Lynx to:

  • Provide access to your personal data and a copy of it
  • Correct inaccurate data or complete incomplete data
  • Delete personal data where there is no lawful reason to retain it
  • Restrict processing in the circumstances provided by law
  • Provide eligible data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller
  • Stop processing based on legitimate interests where your rights and interests prevail
  • Stop direct marketing at any time
  • Withdraw consent at any time where processing is based on consent
  • Request human intervention and contest an eligible solely automated decision

To exercise a right, contact gdpr@bluelynx.com or write to the Data Protection Officer at the address above. We may need to verify your identity. Exercising a right is normally free of charge, and we will respond within the period required by law.

You may also lodge a complaint with the Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl/en or with another competent supervisory authority.

13. Updates to this notice

We may update this notice where our processing activities or legal obligations change. The current version will be published on the Blue Lynx website. Material changes will be communicated through an appropriate channel.

14. Acknowledgement and separate consent

Blue Lynx may ask employees and contractors to sign a separate acknowledgement confirming that they have received, read, and understood this Privacy Notice and have had the opportunity to ask questions about it.

Signing the acknowledgement does not constitute consent to the processing described in this notice and does not affect the individual’s data protection rights.

Where Blue Lynx wishes to process personal data for a genuinely optional activity requiring consent, such as using an individual’s photograph or testimonial for promotional purposes, Blue Lynx will request separate, specific consent. Refusing or withdrawing that consent will not affect the individual’s employment or engagement.