Privacy Statement Stichting War Child

The Privacy Statement below applies to employees, interns, self-employed contractors and volunteers.

1. Introduction

This is War Child's Privacy Statement for employee and volunteer data as well as of independent / self-employed contractors (ZZP) and interns. This Privacy Statement provides information on the processing of personal data of the mentioned persons by Stichting War Child, based at Helmholtzstraat 61G, (1098 LE), Amsterdam (“War Child”).

This Privacy Statement may be changed over time. You are advised to regularly review the Privacy Statement for possible changes. The privacy statement is published on the site of HR &OD at SharePoint and on the recruitment page of the War Child website. This Privacy Statement was last changed on 23 May 2018. You can store or print this Privacy Statement by using the buttons at the top of this page.

2. When does this privacy statement apply?

This Privacy Statement is applicable to the processing by War Child of all personal data of its employees, job applicants, volunteers, interns, temporary workers working under direct supervision of War Child (e.g. independent contractors and trainees), former employees, (former) managing directors of War Child, and (former) members of the supervisory board or similar body of War Child (employees).

In collecting, processing and retaining data we only do so when necessary for your position. In this document we’ve stated the widest range for all the positions as mentioned above.

3. Who is responsible for your personal data?

War Child is the controller for the processing of your personal data. This Privacy Statement indicates what employee personal data are processed by War Child and for what purpose, and to which persons or entities the data will or may be provided.

4. For which purposes do we process your personal data?

4.1           FOR RECRUITMENT PURPOSES

(a)            What does this purpose entail?

If you contact one of our recruiters, apply for a vacancy, register at the War Child recruitment database or apply as a volunteer or in other capacity, we include the personal data you provide us in our recruitment database. We use the data in this database to communicate with you. For example, we may inform you about new vacancies or invite you for recruitment activities. Also, we will process your personal data to manage our recruitment database. This purpose also entails other and general questions you ask to the HR-department in relation to your recruitment process.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Information you provide is necessary to process your application, to inform you about your application and have related communication with you.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, recruitment information (such as your resume, employment history, education history etc.) and correspondence with War Child with regard to job applications (including references).

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 4 weeks after the end date of the relevant recruitment procedure. After this period, your personal data will be deleted from our systems, unless you give your consent to save for another year based on our explicit invitation and your reply.

4.2           TO INFORM YOU AND COMMUNICATE WITH YOU WITH REGARD TO YOUR VOLUNTEER WORK, INTERNSHIP, CONTRACT OF EMPLOYMENT

(a)            What does this purpose entail?

If you are a War Child employee, consultant, intern or volunteer, we store your personal data in the HR database. We then use the data in this database to communicate with you. For example, when War Child informs you of changes in the terms of your employment or of War Child's activities.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. With the information you provide we will be able to communicate with you.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details (such as your email address).

(d)            How long do we retain your personal data for this purpose?

Your personal data will be retained for 6 months after the end of your contract with War Child for this purpose.

4.3           TO ENTER INTO AN EMPLOYMENT CONTRACT, AN INTERNSHIP AGREEMENT, VOLUNTEER CONTRACT OR  CONTRACT FOR SERVICES WITH YOU.

(a)            What does this purpose entail?

If we offer you an intern, volunteer or employment position at War Child, we will process your personal data to prepare and process an intern, volunteer or employment agreement with us. We use your personal data for the conclusion, execution and termination of your intern, volunteer or employment agreement. We will then also store your personal data in our HR database.

If you are an independent contractor, we will process your personal data in the same way to enter into an agreement for services with you.

(b)            On what legal basis do we process personal data for this purpose?

Contract. With the information you provide, we are able to draw up a contract, after agreement register you in systems related to the contract and execute the agreement we have entered into. 

(c)            Which personal data do we process for this purpose?

For this purpose, we process your name, address, postal code, place of living, gender, mobile telephone    number, private telephone number, fixed private telephone number, private email, work email, Citizen service (BSN) number, date of birth, birthplace, Country of birth, marital status, nationality, CV, warn contact in case of emergency, medical data, date of signing CoC, VOG statement, CIGNA number, ATA, Type of employment, Start Date service, End Date service, Contract period, Type of employee, Function, Date in function, Department, Supervisor-Manager, Salary, Salary group, Salary step, Fees, FTE Percentage, Number of hours / week, ID card or passport details, chamber of commerce and VAT details, recruitment information (such as employment history, education history details), work permit details, availability, terms of employment, tax details, payment details, insurance details and location and organizations.

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 7 years. After this period, your personal data will be deleted from our systems.

4.4           TO OFFER YOU SUITABLE OPPORTUNITIES FOR YOUR DEVELOPMENT.

(a)            What does this purpose entail?

War Child uses the information stored in its HR database to offer you suitable opportunities for development. This way, we are able to offer you the right training, education, coaching or other forms of careers guidance or personal development to suit your needs. We also use your personal data for general career and talent development.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Information involved enables us to make development plans with you.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, recruitment information (such as employment history, education history details), job and position data, location and organizations, data generated during the performance of the employment contract, and correspondence with War Child with regard to job applications (including references, absence and leave information).

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 1 years after the end of your contract. After this period, your personal data will be deleted from our systems.

4.5           FOR HUMAN RESOURCES, PERSONNEL MANAGEMENT ANDADMINISTRATION.

(a)            What does this purpose entail?

We process your personal data for human resources and personnel management and to manage your personnel file. This includes processing your personal data for your performance reviews, outplacements, leave and other absences, pension details, travel and expenses and our communications with you. War Child may also have to process your personal data following laws and regulations. This is, for example, the case for identification, fraud prevention, internal controls and company security. If you are an expat, we will also process your personal details for any tax related issues. If public institutional donors require, we provide information to them like labour contracts and salary slips.

Further, we process your personal data for payroll administration. War Child does not only maintain an administration of your salary payments, but also of your hours and overtime, bonuses and other compensation or benefits.

(b)            On what legal basis do we process personal data for this purpose?

Both legitimate interest and contract. Information is needed to be able to pay out your salary, have correspondence on contract (-alterations) and have relevant data for staff planning, staff evaluations and registration of your absence.

(c)            Which personal data do we process for this purpose?

For this, we process your contact details, date of birth, gender, civil status, nationality, photographs, videos, citizen service number, ID card or passport details, declaration of employment status, chamber of commerce and VAT details, recruitment information (such as employment history, education history details), job and position data, work permit details, availability, terms of employment, tax details, payment details, hours worked, personnel file details, insurance details, location and organizations, beneficiaries and dependants, account/profile data (corporate ICT-systems), data generated during the performance of the employment contract and correspondence with War Child with regard to job applications, including references, absence and leave information.

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 7 years. After this term, your personal data will be deleted from our systems.

4.6           TO PROTECT YOUR VITAL INTERESTS.

(a)            What does this purpose entail?

When it is necessary to process your personal data to protect your vital interests, we will do so. This could, for example, be the case when you have a medical condition that your colleagues or superiors need to be aware of.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate and vital interest. In case you travel to Project Countries and to be prepared for possible health emergencies in those project countries with little health provisions, data on health will be of vital interest.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, emergency contact details, relevant personnel file details, insurance details, location and organizations and the relevant health data that you provided to War Child. When working and visiting project countries we ask for your blood type,  medication, allergy and other relevant medical info (e.g. medical devices, contact lenses, glasses, pacemaker).

(d)             How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for the period of engagement (employment or otherwise). After this period, your personal data will be deleted from our systems.

4.7           TO ALLOW YOU TO PERFORM YOUR TASKS IN THE REGULAR COURSE OF BUSINESS.

(a)            What does this purpose entail?

When you work at War Child (as an employee, intern, volunteer or in another capacity), you use our systems and networks in the regular course of business. You may enter personal data in your user profile, send emails and can be referred to in many organisational documents and records that are produced by you and your colleagues in the course of carrying out your duties.  We process your personal data included in such mails or documents or in the meta data attached to such documents. For example, when you send an email, we process the content of your mail, including your contact details, your profile information (e.g. your photograph), the contents of your message, any attachments you add to your message etc.   

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. This information enables you to participate in the organisation in your job performance. We may sometimes need to process your data (mail and documents) to pursue our legitimate business interests, for example to prevent fraud, for administrative purposes, for reporting potential crimes and to meet donor and audit requirements.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, date of birth, gender, job and position data, account/profile data (corporate ICT-systems), content and traffic data (such as your internet communications, sent and received email messages, documents you have stored on your personal OneDrive, and in some cases we reserve the right to access your mailbox and mail archive).

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for the period of your engagement (employment or otherwise). After this period, your personal data will be deleted from our systems. In addition, contact details and profile data will be retained for 2 years. Personal documents will be deleted after 90 days. Your mailbox and archive will be deleted after 90 days, but in specific cases might be retained for up to 3 years or longer if necessary to meet donor and audit requirements, in case of non-compliance cases or when legal proceedings are ongoing that relate to your work for War Child).

4.8           FOR THE EXECUTION OF BUSINESS PROCESSES AND INTERNAL MANAGEMENT.

(a)            What does this entail?

When you work at War Child (as an employee, intern, volunteer or in another capacity), we will process your personal data in the performance and organisation of our business. This includes general management, scheduling work, recording worked time, electing members of the War Child participation body, the administration of the staff association and managing War Child and employee assets.

War Child processes your personal data for its internal management. For example, we provide central processing facilities in order to work more efficiently. We conduct audits and investigations, implement business controls and manage and use employee directories. Also, we process your personal data for archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Your information is needed to execute business processes and enable internal management.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, date of birth, gender, job and position, availability, hours worked, insurance details, location and organizations, beneficiaries and dependants and data generated during the performance of the employment contract.

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 7 years. After this period, your personal data will be deleted from our systems.

4.9           FOR ORGANIZATIONAL ANALYSIS AND DEVELOPMENT AND MANAGEMENT REPORTING.

(a)            What does this purpose entail?

At War Child, we process your personal data to be able to prepare and perform management reporting and analysis. For example, we conduct employee surveys to learn more about your views and opinions in preparation of our management reporting. We also process your personal data in the context of mergers, acquisitions and divestitures and in order to manage such transactions.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Your information enables organizational analysis and development and management reporting.

(c)            Which personal data do we process for this purpose?

For this, we process your contact details, date of birth, gender, job and position, terms of employment, insurance details, location and organizations, beneficiaries and dependants and relevant data generated during the performance of the employment contract.

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for 7 years. After this period, your personal data will be deleted from our systems.

4.10         TO PROTECT HEALTH, SAFETY AND SECURITY AND TO ENSURE INTEGRITY.

(a)            What does this purpose entail?

At War Child, we highly value health, safety, security and integrity. In order to safeguard our employees and project participants, we process your personal data. We screen and monitor our employees both before and while they are employed at War Child and authenticate your employee status and access rights. We also process your personal data to ensure occupational health and safety and to protect War Child and employee assets.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Your information it to protect health, safety and security and to ensure integrity.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, job and position, location and organizations and account/profile data (corporate ICT-systems). Health and safety data are processed for your vital interest (see other paragraph). The use of War Child Cars is kept in logbooks. 

(d)            How long do we retain your personal data for this purpose?

For this purpose, your personal data will be retained for the period of employment. After this period, your personal data will be deleted from our systems.

4.11         TO MONITOR AND INVESTIGATE COMPLIANCE WITHIN WAR CHILD.

(a)            What does the purpose entail?

War Child monitors employee accounts to check compliance with War Child's policies and regulations, such as the Code of Conduct and the IT Policy. You can find War Child's policies and regulations on SharePoint at the HR&OD page. War Child also monitors your use of its networks, systems and information to observe compliance with its policies. We do so irrespective of whether you use War Child IT devices or your own devices to access or use War Child's information, network or systems.

War Child will only monitor an individual employee if it has received signs of irregular use and in such cases will inform the employee concerned. If an employee is suspected of behaviour or actions that are not compliant with War Child's policies and regulations, War Child could instigate an internal investigation and generate and process additional personal data. We could, for example, instigate such an investigation in the case of a prohibited transfer of any of War Child's trade secrets, confidential information, intellectual property or knowhow, fraud or if we suspect an employee to be the origin of any virus, spam or intrusion in our systems or network.

(b)            On what legal basis do we process personal data for this purpose?

Legitimate interest. Your information enables monitoring and investigation regarding compliance with polices and regulations.

(c)            Which personal data do we process for this purpose?

For this purpose, we process account/profile data (corporate ICT-systems), such as the time and date of your logins, the type of information and files shared, the search queries that are made and the type of device you use, the mobile number of your device, IP addresses, MAC addresses, documents accessed and duration of access, mobile network information, your mobile operating system and which mobile browser you use, your time zone settings and device details.

If a War Child employee is suspected of behaviour or actions that are not compliant with War Child's policies and regulations we will use more specific content and traffic data for internal investigations. We use this personal data to make legal decisions and to conduct legal proceedings. Such data includes: your internet communications (including social media), sent and received email messages, printed documents, storage devices (USB sticks, portable hard drives) and data on back-ups.

(d)            How long do we retain your personal data for this purpose?

We retain your personal data for 7 years, except if you are the subject of an internal or external investigation or legal proceedings. We will then retain the relevant personal data until the investigation or proceedings have been concluded.

4.12         TO COMPLY WITH THE LAW.

(a)            What does this purpose entail?

In some cases, War Child processes your personal data to comply with laws and regulations. This could be the case for human resources related obligations, as indicated in paragraph 4.5. We may, for example, also need to process your personal data in light of subsidies or tax regulations. Following laws and regulations, we may need to disclose your personal data to government institutions or supervisory authorities.

(b)            On what legal basis do we process personal data for this purpose?

Legal (law). If you do not provide the information needed for the employer to comply with legal requirement, the labour contract cannot be carried out fully, possibly even leading to dissolving the contract agreement and other consequences regulated in specific laws.

(c)            Which personal data do we process for this purpose?

For this purpose, we process your contact details, date of birth, gender, civil status, nationality, citizen service number, ID card or passport details, declaration of employment status, chamber of commerce and VAT details, job and position, work permit details, terms of employment, tax details, payment details and location and organizations.

(d)            How long do we retain your personal data for this purpose?

We retain your personal data for this purpose for this purpose for 7 years.

5. Who has access to your personal data?

5.1           Access to your personal data within War Child

All War Child staff members have access to your War Child profile and the data you have made publicly available there. After the end of employment, the manager will be granted access to the email box and documents of the former staff member.

Non-public data can be accessed by relevant War Child departments such as IT, Finance, HR and Legal or the Integrity Officer, or Volunteer Management but only to the extent necessary to fulfil their respective tasks. In this processing, your personal data may be transferred to a country that does not provide an adequate level of protection of personal data. War Child will take measures to ensure that your personal data are adequately protected.

5.2           Access to your personal data by third parties

The following third parties have access to your personal data where relevant for the provisioning of their products or services to War Child:

  • Banks
  • Insurance broker / companies
  • Assessment  agencies
  • Travel agencies
  • IT suppliers
  • Financial, tax or legal advisors
  • Salary administration and processor
  • Pension provider
  • Accountants
  • Health service company (arbodienst)
  • Training institutes 

If your personal data are transferred to a recipient in a country that does not provide an adequate level of protection of personal data. War Child will take measures to ensure that your personal data are adequately protected, such as entering into EU Standard Contractual Clauses with these third parties.

In other cases, your personal data will not be supplied to third parties, except when required by law.

5.3           The use of your personal data by data processors

When a third party processes your personal data solely following War Child's instructions, it acts as a data processor. We enter into an agreement with such a data processor concerning the processing of personal data. In this agreement we include, at a minimum, the following obligations to safeguard that your personal data are solely provided to the data processor to provide services to us.

6. How are your personal data secured?

We take appropriate steps to maintain the security of personal data collected. This includes technical, physical and organisational protection measures, the necessary procedures and policies and creating awareness among employees and volunteers about the need to protect personal data.

All interactions and transactions which take place on our websites are secure. Our website has a certified Secure Socket Layers (SSL) certificate. This is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. Your financial transactions are managed by payment services provider that uses secure technology systems.

When you make a transaction or are in any other form engaged with War Child, your data is securely passed to our databases which also use industry standard secure protection systems.

Data breaches

War Child takes technical and organisational measures to prevent, signal, report and handle data security breaches. In the case of a personal data breach, War Child shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to Dutch Data Protection Authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

7. Questions or requests for access, correction and removal?

You can request access, correction, restriction, portability or removal of the data that War Child processes about you at any time by sending a request to: 

Stichting War Child
Attn. Customer Service, Charlotte van den Tol
Helmholtzstraat 61-G
1098 LE Amsterdam
+31 (0) 20 422 7777
yourrights@warchild.nl

NOTE! Before your request is granted, we may ask you to verify your identity.  

For further information about applicable data protection law and to find out about your rights, you can also visit the website of the Autoriteit Persoonsgegevens (the Dutch personal data regulator).

7.1           Access

You have the right to request access to the information War Child has on you. You can ask for access by contacting us. We will provide you with a copy of the data we process about you. The information will be send to you electronically.

7.2           Rectification

You have the right to rectify your personal data that War Child has on you. If you believe that the information War Child has on you is incorrect, please feel free to contact us so we can update it.

7.3           Right to be forgotten

You have the right to get War Child to erase your personal data. If you want War Child to erase the information we have on you, please contact us.

7.4           Right to object

If you object to War Child using your personal data, please contact us.

7.5           Withdraw permission

If you want to withdraw your previously given permission to process your personal data, please contact us. This will not affect the lawfulness of processing based on consent before your withdraw.

7.6           Complaints

If you may not agree with our decision about a request concerning inspection, correction, deletion, objection, or other complaint regarding your personal data, you can lodge a complaint with the Dutch Data Protection Authority at: https://www.autoriteitpersoonsgegevens.nl.