privacy regulations equals
1. who we are
we support w b.v., trading as equals, keizersgracht 316, 1016 ez amsterdam, chamber of commerce no. 77800311, is the controller for the personal data described in these regulations. our data protection officer is ricardo van loenen, who can be reached at ricardo@equals.nl. questions and requests about your data can be sent to ricardo@equals.nl.
2. which processing activities these regulations cover
these regulations apply to all processing of personal data by equals, in particular:
- registration, intake and selection for our programmes, such as dutch programs, equals in tech, brabant leert, equals entrepreneurship, the member club and future programmes;
- the delivery of our education and guidance: student administration, attendance, progress, tests and exams;
- guidance towards work and introductions to employers;
- reporting to clients and funders and to blik op werk;
- our website, newsletter and events;
- the personnel and payroll administration of employees, teachers and volunteers.
we record personal data at two moments only. first, when you register: through a form on our website, at an event or via a client you register for a programme, the talent pool, the member club or the newsletter, and you give consent for us to keep your data. second, when you take part in an equals education programme, such as all programmes within dutch programs, equals in tech, brabant leert and equals entrepreneurship, new programmes we offer in the future, or in the member club; we then process the data needed to deliver the programme and to account for it. outside these moments we collect no personal data, except the website data described in article 10.
3. which data we process
| category | data |
|---|---|
| identity and contact | name, date of birth, address, e-mail address, telephone number, nationality, copy of identity document where a client or duo requires it |
| background | education, work experience, cv, linkedin profile, language level, motivation |
| situation | benefit situation and client (municipality, rmt, uwv, employer), civic integration status (wi2013, wi2021 or not subject to civic integration), learning route and learner profile |
| education | intake test, entry level, group, course schedule, attendance and absence with reason, lesson hours, progress and check-ins, homework and presentations, exam registration and results, certificate |
| guidance | notes of conversations with the student counsellor and the career coach, job applications, introductions to employers, placement and follow-up measurement |
| agreements and finance | course contract or participant agreement, invoices to clients, invoicing details for self-paying students |
| images | photos and video of lessons and events, only with consent |
| website | ip address, cookies and usage data (see article 10) |
at registration we process only the categories identity and contact, background and situation, and only what you fill in yourself. the categories education, guidance, agreements and finance, and images are recorded only once you take part in a programme.
we do not process special categories of personal data, such as data about health, religion or ethnic origin, unless you share them with us yourself because they are needed for your guidance (for example a disability for which you need adjustments). we record such data only with your explicit consent and only in your file with the student counsellor.
4. purposes and legal bases
| purpose | legal basis (gdpr article 6) |
|---|---|
| assessing your registration, intake and placement in a group | performance of the contract, or pre-contractual steps at your request |
| delivering the education and guidance: lessons, attendance, progress, exams | performance of the contract |
| guidance towards work and introductions to employers | performance of the contract; for sharing your cv with a specific employer: consent |
| reporting to your client or benefits agency (municipality, rmt, uwv) on participation, attendance and outflow | performance of the contract with that client and legal obligation (participation act, civic integration act) |
| submitting student data and hour statements to duo | legal obligation (civic integration act) |
| submitting anonymised result data to blik op werk and participation in the satisfaction survey (panteia) | legitimate interest (quality assurance of the quality mark); for sharing your contact details with panteia: consent |
| accountability to grant providers (jtf, erdf, municipalities) | legal and contractual obligation |
| invoicing and financial administration | performance of the contract and legal obligation (tax retention requirement) |
| newsletter, invitations to events, community, and keeping your registration for a future group | consent; for participants and members during the programme: legitimate interest |
| photos and video for communication | consent |
| contact about changes to our services | legitimate interest |
| handling of complaints | legitimate interest and implementation of the complaints procedure |
we do not take decisions about participation, placement or follow-up based solely on automated processing. automatic confirmations of registrations and the creation of profiles in our systems have no legal effects; every decision about you is taken by a member of staff.
5. how long we keep data
| data | retention period |
|---|---|
| registrations that do not lead to participation | 5 years after registration, so that we can approach you for a future group. we periodically ask you by e-mail whether you wish to remain in our database; if you unsubscribe, we delete your data immediately |
| student file: intake, course contract, attendance and hour registration, progress, exam results, certificate | 5 years after completion or termination of the programme, because blik op werk, municipalities, duo and grant providers may audit these data within that period |
| guidance notes and data on guidance towards work | 2 years after completion; thereafter deleted or anonymised |
| data for grant accountability (jtf, erdf) | the period prescribed by the grant scheme, usually 10 years after the final payment |
| invoices and financial data | 7 years (tax retention requirement) |
| newsletter and community | until you unsubscribe |
| photos and video | until you withdraw your consent |
| website data and cookies | according to the period per cookie in the cookie banner, at most 2 years |
| personnel files | 2 years after leaving employment; payroll data 7 years |
at the end of the retention period we delete the data or anonymise them so that they can no longer be traced back to you. alumni who remain members of the equals community keep a limited profile (name, contact details, completed programme) for as long as they are members.
6. with whom we share data
we share personal data only where this is necessary for the performance of our agreement with you or with your client, to comply with a legal obligation, or with your consent. we never sell data.
| recipient | which data | why |
|---|---|---|
| municipality, regional mobility team (rmt) or uwv funding your participation | participation, attendance, progress, completion, outflow | reporting to your client |
| duo | enrolment, lesson hours attended, hour statement | civic integration act |
| blik op werk | anonymised numbers and results; on request access to the administration during an audit | keurmerk arbeid and keurmerk inburgeren |
| panteia (blik op werk satisfaction survey) | name and e-mail address | only with your consent, recorded in your course contract |
| employers | cv and profile | only with your consent, per introduction |
| grant providers and their auditors (jtf, erdf, municipalities) | participant data and attendance | grant accountability |
| openup | your e-mail address for creating an account | access to wellbeing support, only if you wish to use it |
| brunel nederland b.v. (part of the same group) | invoicing details | financial administration |
processors. for our systems we engage suppliers that process data on our behalf: moodle (learning environment and student administration), hubspot (crm, website and newsletter), microsoft 365 (e-mail and documents), typeform (forms), eventbrite and luma (events). we have concluded data processing agreements with these processors. data are stored within the european economic area; where a supplier processes data outside the eea, this is done on the basis of the european commission’s standard contractual clauses.
7. who has access
| role | access to |
|---|---|
| management | all data |
| project coordinator | student administration, course schedule, attendance, teacher registration, exams |
| student counsellor and career coach | file and guidance notes of the students they support |
| intake staff | intake data and test results up to placement |
| teachers and language assistants | name, attendance and progress of their own groups; no file |
| financial administration | invoicing details |
| students | only their own data in moodle |
access is set per person and per role in moodle and on the shared drive, and withdrawn when employment or the assignment ends.
8. how we secure data
- personal accounts with strong passwords for all systems; accounts are withdrawn when employment ends.
- role-based access (article 7); teachers and students see only what they need.
- storage in secure systems of certified suppliers; no student data on personal devices or in private e-mail.
- daily back-ups of moodle and the shared drive.
- documents are kept digitally on the secure shared drive; paper documents are scanned and then destroyed.
- employees and teachers know these regulations and are bound to confidentiality under their employment or service agreement (article 11).
- data breaches are reported immediately to the data protection officer, within 72 hours to the dutch data protection authority (autoriteit persoonsgegevens) where required, and to you if the breach poses a risk to you. equals keeps a register of data breaches.
9. your rights
you have the right to:
- access your data and receive a copy;
- have incorrect data corrected;
- have your data deleted, insofar as we are not required by law or contract to keep them (article 5);
- have the processing restricted or object to processing based on legitimate interest;
- receive your data in a common file format or have them transferred to another organisation;
- withdraw consent at any time, without affecting the processing carried out before that moment.
send your request to ricardo@equals.nl. to make sure the request comes from you, we may ask you to identify yourself; never send an unmasked copy of your identity document. we respond within four weeks. if you are not satisfied with our response, you can file a complaint with us under the complaints procedure, or with the dutch data protection authority (autoriteitpersoonsgegevens.nl).
10. website and cookies
our website uses functional, analytical and, with your consent, marketing cookies. on your first visit you choose in the cookie banner which cookies you allow; strictly necessary cookies are always placed. the banner lists the name, purpose, retention period and provider of each cookie. you can change your choice at any time via the cookie settings at the bottom of the website. our website is not aimed at persons under 16.
11. staff and these regulations
all employees, teachers, language assistants, intake staff and volunteers who work with personal data receive these regulations at the start of their work and work in accordance with the rules in these regulations and the organisation plan. in the event of changes, management informs them by e-mail and at the next team meeting. the regulations are available on the shared drive and in moodle.
12. contact and changes
questions about these regulations or about your data: ricardo@equals.nl or by post to equals, attn. the data protection officer, keizersgracht 316, 1016 ez amsterdam. we may amend these regulations; the current version is always available at equals.nl/privacybeleid/. in the event of material changes we inform participants and students by e-mail.
version: september 2026. adopted by: dieuwke van buren, managing director.