Privacy statement for job applicants - Enexis Personeel B.V.

Enexis Personeel B.V. attaches great value to the protection of your personal data. In this privacy statement, you can read how we handle personal data that we receive in the context of job applications, work placements or other forms of recruitment and selection.

This privacy statement applies in addition to the general privacy statement of Enexis. Where reference is made to Enexis in this statement, this is understood to mean Enexis Personeel B.V., where applicable in conjunction with other parts of Enexis Group insofar as they are involved in recruitment and selection activities. 

Enexis is the controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in the context of recruitment and selection.

Controller

Enexis Personeel B.V.
Magistratenlaan 116
5223 MB 's-Hertogenbosch
Chamber of Commerce number: 17239086
Email: privacy@enexis.nl

Data Protection Officer (DPO)

Enexis Group has appointed a Data Protection Officer who monitors compliance with the GDPR. You can contact this officer via fg@enexis.nl

Contents

1. Which personal data do we use and for what purpose?
2. From whom do we receive personal data?
3. To whom do we provide personal data?
4. How long do we retain personal data?
5. How do we protect your personal data?
6. What rights do you have?
7. About this privacy statement
8. Do you have any questions?

To whom does this privacy statement apply?

This privacy statement applies to everyone who provides personal data to Enexis Personeel B.V. within the context of recruitment and selection procedure. These are, among others:

• job applicants and candidates for a position or work placement;
• persons participating in assessments, talent programmes or recruitment activities;
• persons submitting an unsolicited job application.

This statement does not apply to employees of Enexis; a seperate privacy statement for staff applies to them.

1. Which personal data do we use and for what purpose?

1.1 Which personal data do we proces? We only process personal data that are necessary for the recruitment and selection process. Depending on the position, the course of the procedure and the way in which you apply, it may concern the following categories:

1.2 Purpose and legal bases

We only process your personal data for predetermined, legitimate purposes and based on a legal basis from the GDPR. View a complete overview of purposes and legal bases.

Withdrawing consent

If we process your personal data on the basis of your consent (e.g. for inclusion in a talent pool or retaining your file for a longer period), you can withdraw that consent at any time via privacy@enexis.nl. This does not have retroactive effect: processing operations from the past remain lawful.

1.3 Online application, cookies and tracking

If you apply using our (werkenbij) website, we use cookies and similar technologies to make the website function properly, analyse the use of the site, and improve the operation of the site. This may also involve online tracking for statistic purposes.

We do not collect special categories of personal data through these cookies. For the types of cookies, the retention periods and the way in which you can manage your preferences, we refer to the cookie policy published on the relevant website (e.g. on werkenbij.enexis.nl).

2. From whom do we receive personal data?

We receive personal data in the first place directly form you, for example via:

• the online application form or your account on the werkenbij site;
• email or (video) interviews;
• your CV, cover letter and other documents provided by you.

In addiction, we may receive personal data through: recruitment, temporary employment or secondment agencies, if you apply to us through them;

• assessment agencies, if an assessment is part of the selection procedure;
• references, only after you have given consent for this purpose;
• public sources (such as LinkedIn or other professional platforms), insofar as this is relevant for the performance of the position and in line with applicable laws and regulations.

3. To whom do we give personal data?

3.1 Within Enexis Group

Your personal data may be shared within Enexis Group with employees involved in the recruitment and selection procedure, such as:

• recruiters and HR employees;
• immediate supervisors and members of the selection committee;
• other internal parties involved for whom access is necessary (e.g. payroll administration when a salary offer will be made).

We restrict access to your data to those persons for whom access is necessary ('need-to-know').

3.2 External parties (processors and other recipients) 

In some cases, we share personal data with external parties, for example:

• providers of job application and recruitment systems;
• assessment and test agencies;
• ICT service providers that manage systems or infrastructure;
• temporary employment, recruitment and secondment agencies in the context of the procedure;
• other service providers who assist us in recruitment and selection.

We conclude a processing agreement with parties that process personal data on our instructions (processors). We record, among other things, the following in this agreement:

• what data they are allowed to process;
• for what purpose;
• what security measures apply;
• that they are not allowed to use the data for their own purposes;
• when and how they have to delete or return the data.

In addition, we may provide personal data to:

• supervisory authorities, investigation bodies or other competent authorities, insofar as we are required by law to do so.

We do not provide your data to third parties for their own commercial purpose, such as direct marketing, without your explicit consent.

3.3 Transmission outside the European Economic Area (EEA)

We try to process personal data as much as possible within the European Economic Area (EEA). If processing outside the EEA is nevertheless necessary, we will only do this if there are appropriate safeguards, such as:

• an adequacy decision by the European Commission; of
• standard contractual clauses (SCCs), possibly supplemented with additional measures.

In that case we will inform you - where appropriate - separately about the countries involved and the measures we take to protect your data. 

4. How long do we retain personal data?

We will not retain your personal data longer than necessary for the purpose for which they were collected, unless we are required by law to retain data for a longer period. After the end of the relevant period, we will delete your personal data or anonymise them irreversibly.

5. How do we protect your personal data?

5.1 We do not process more personal data than necessary

We do not process more personal data than we need for the performance of our recruitment and selection activities. To ensure that this is properly arranged in practice, we keep a register of processing operations to record the categories of personal data that we register in our systems. We assess at regular intervals whether there is still a valid basis for our processing operations and whether the data are really necessary for the purpose for which we collected them. If this is not the case, we will stop processing them and delete or anonymise the data.

5.2 We arrange for safe repositories

• regular security audits and compliance with the Enexis information security policy;
• secure connections (SSL/TLS);
• logging and access monitoring;
• restricted access for authorised persons;
• encrypted data storage.

We keep personal data of job applicants in a safe place. Our information security policy contains organisational and technical security measures to ensure that we do not lose personal data and that abuse of personal data is prevented as much as possible.

In practice this means, among other things:

• we ensure an appropriate level of security for each application, in line with the information security policy;
• only authorised employees and processors are given access to files with job application data;
• measures such as a clean desk policy and safe destruction of paper and data carriers are in place at Enexis locations.

5.3 We work with authorisations

Only employees who need personal data for their role in the recruitment and selection process are given access to the relevant systems. They may only use the data for the performance of their job. Access rights are granted on the basis of authorisation profiles and are periodically checked and where necessary adjusted or withdrawn.

5.4 We have arrangements in place to ensure confidentialy

Enexis employees have a duty of care when handling personal data. New employees make a statement on confidentiality, or a confidentiality provision is included in their employment contracts. In addition, internal codes of conduct and guidelines for the use of resources such as laptop, telephone and email apply.

We make written arrangements about confidentiality and data protection with external parties that are involved in the selection process as a processor or supplier. Such arrangements are usually contained in a processing agreement.

5.5 We follow a fixed procedure if there is a data breach

Despite all measures, personal data may nevertheless fall into the wrong hands or be temporarily unavailable, a situation which we hope will not occur. In that case, we speak of a (possible) data breach. We have an internal procedure for reporting, registering and dealing with data breaches.

• Employees are obliged to report a suspected data breach immediately to the Security department or through the reporting channels set up for this purpose.
• Third parties may report a (possible) data breach involving Enexis data through the web form on our website or through the dedicated email address.

After a data breach has been reported, we will assess which measures are necessary for mitigating the consequences and preventing repetition. If required by law, we will report the data breach to the Autoriteit Persoonsgegevens (the Dutch data protection authority) and - where necessary - to the data subjects. 

6. What rights do you have?

As a job applicant, the GDPR gives you a number of rights with regard to your personal data. You can exercise these rights by sending an email to privacy@enexis.nl stating your name and - where necessary - additional information to verify your identity.

You have, among other things, the following rights:

• Right of access - you are allowed to know what personal data we process of you, for what purpose, with whom we share these data, and what retention periods apply;
• Right to rectification – if your data are incorrect or incomplete, you can ask us to rectify or supplement them;
• Right to erasure (‘right to be forgotten’) – in specific cases, you can ask us to delete your personal data, for example, if the data are no longer necessary or if you withdraw your consent and as a result, there is no longer a legal basis for processing them;
• Right to restriction of processing – in specific situations, you can ask us for a temporary restriction of processing, for example, during the assessment of an objection or a request for rectification;
• Right to object – you can object to processing operations based on a legitimate interest if you feel that your interests outweigh ours;
• Right to data portability – to the extent legally and technically feasible, you can receive the personal data that you have provided to us yourself in a structured, commonly used and machine-readable format or have them transmitted to another controller;
• Right to withdraw consent – if we process your data on the basis of consent, you can withdraw that consent at any time. This does not have any consequences for processing operations that took place before you withdrew your consent.

6.1 How can you exercise your rights?

You can exercise your rights by sending an email to privacy@enexis.nl. Describe as clearly as possible to what right your request relates and to what processing or data your request pertains. We may ask you for additional information to verify your identity.

As a rule, we will respond within one month of receipt of your request. In the event of complex or multiple requests, we may extend this period – in accordance with the GDPR – by no more than two months. In that case, we will inform you about the extension and the reason for it within one month of receipt of your request.

6.2 Profiling and automated decision-making

When recruiting and selecting for positions with Enexis, we do not take decisions that are solely based on automated processing, including profiling, that may have legal effects concerning you or similarly significantly affect you. There will therefore be no automated decision-making within the meaning of Article 22 of the GDPR.

If this changes in the future (for example, because of the use of AI-supported selection tools), we will communicate this clearly in advance, inform you about this in accordance with the GDPR, and where necessary ask for your consent. In that case, we will consider your right to request human intervention, make your position known, and contest the decision.

6.3 Submitting a complaint to the supervisory authority

Do you disagree with the way we handle your personal data or the handeling of your request? Is so, you can:

• first contact privacy@enexis.nl or the DPO (fg@enexis.nl);
• in addition or subsequently submit a complaint to the Autoriteit Persoonsgegevens, the Dutch data protection authority, via www.autoriteitpersoonsgegevens.nl

7. About this privacy statement

7.1 Legal framework

When processing personal data of job applicants, we comply in any case with:

• the General Data Protection Regulation (GDPR);
• the General Data Protection Regulation (Implementation) Act;
• other relevant laws and regulations in the areas of labour law, equal treatment, integrity and data protection.

Where in this statement reference is made to the general privacy and cookie statements of Enexis (e.g. for website visits), the provisions of those statements apply in addition.

7.2 Amendments

This privacy statement was last updated on: 16 December 2025.

We may update this privacy statement form time to time, for example in the event of changes in laws and regulations, internal processes or systems used.

• The latest version of this privacy statement always prevails.
• In the event of substantial changes, we will inform you through the website werkenbij.enexis.nl or - if applicable - by email.

8. Do you have any questions?

If you have any questions, comments or complaints with regard to this privacy statement or the way we handle your personal data, you can contact:

Enexis Personeel B.V.
attn. Privacy Officer
Magistratenlaan 116
5223 MB 's-Hertogenbosch
Email: privacy@enexis.nl

For confidential questions about privacy or if you feel that your request has not been handled correctly, you can also contact the:

Data Protection Officer (DPO)
Email: fg@enexis.nl