This notice is a draft. It describes what our systems actually do, but it has not yet been reviewed or approved by a lawyer or a data protection officer. If you need a binding answer about your data before then, contact us and we will give you one in writing.
Who we are
DDG People is the recruitment label of Dirkse De Graaf b.v., part of DDG Europe, at Baarnsche Dijk 4-B, 3741 LR Baarn, Netherlands. When you send us your details through this site, we decide why and how they are used, which makes us the controller for that data.
We place sales and marketing professionals across Europe, and we work in the UK, the Netherlands, Belgium and Portugal. The confirmation of which DDG entity is the controller in each of those countries is one of the points still with our advisers.
What we collect when you join our talent network
If you fill in the form at /join, you give us the following, and nothing else on that form is optional to us in the sense that we ask for more later without telling you:
- Your name, email address, and your phone number if you choose to give it.
- The country and city you are based in.
- Your LinkedIn profile address, if you choose to give it.
- The kind of role you are looking for, and how soon you are available.
- The languages you speak and the skills you have, chosen from our lists, plus anything you add in your own words.
- Your CV, as a file.
What we collect when you ask us for people
If you brief us at /request, we collect your company name and contact email address, the role you are hiring for and the skills it needs, and the practical shape of the work: duration, budget, targets, working format, location and languages. That is business contact information about you in your professional capacity, not information about your private life.
What our colleagues add later
Once your details are with us, our consultants may add their own assessment to your record: notes from a conversation, a seniority band, the industries you have worked in, an internal rating, and where you are in our process. These are our opinions rather than facts you gave us, and your right of access covers them too.
Why we are allowed to hold it
For candidates, we rely on your consent, and we ask for it in two separate pieces so that agreeing to one does not commit you to the other. The first is permission to keep your details in our database at all; without it we do not create a record, and the tick box is never filled in for you. The second, which is genuinely optional, is permission to show your profile to prospective employers. If you do not give the second one, your details stay with us and go no further.
We record which version of this notice you agreed to, so that changing this page later cannot quietly reinterpret a consent you gave against an older one.
For client briefings we rely on our legitimate interest in responding to an enquiry a business has sent us, and on taking steps to enter into a contract with you. Which basis applies to which processing is among the points our advisers are confirming.
Who else sees it
Your CV and your profile are seen by DDG staff who are signed in to our system through our company's Microsoft account, and by nobody else by default.
We share your profile with a prospective employer only if you gave us the second permission described above. We do not sell your data, we do not use it to train anything, and we do not hand it to anyone for advertising.
Our systems run on Microsoft Azure, and our staff sign in through Microsoft Entra ID, so Microsoft processes data on our behalf as our supplier. The detail of where that data sits and which safeguards cover any transfer outside the EEA is being confirmed and will be stated here plainly once it is.
Where your CV is kept
The file itself is stored in private storage that is not reachable from the public internet and is not linked from any page. The details you typed are kept separately, in our database. A member of staff who is signed in and authorised can ask our system for the file, and that request is logged.
We work out what kind of file your CV is by reading the file itself rather than trusting its name, so renaming something to .pdf will not get it past us.
How long we keep it
If you are in our network and we have not heard from you or acted on your record for 24 months, we delete it. Any contact, any update and any step in our process starts that clock again.
If we have decided not to take your application further, we keep your record for 6 months and then delete it.
A client briefing is kept for 24 months.
Deletion happens in two stages. Your record first disappears from every search and screen and your CV file is destroyed at that moment. The record itself is then permanently erased 30 days later. That gap exists so that a mistake can be caught and undone before anything is unrecoverable, and it is the only reason a record outlives its CV.
These periods are our documented defaults and are still with our data protection adviser for sign-off. If they change, this page changes with them.
What we log
We keep an audit record of what our staff do with candidate records, so that access to personal data can be accounted for. That log deliberately holds none of your personal details and survives the deletion of your record, so erasing you does not erase the evidence that we handled you properly.
What we do not do
This site sets no tracking or advertising cookies, runs no analytics, and loads no third-party scripts. Reading these pages, sending us your CV or briefing us puts no cookie on your device at all. Our cookie policy explains the few cookies our own staff receive when they sign in.
We do not currently send email from this system. When we contact you, a person does it.
No decision about you is made automatically. Our system can order candidates by how well they match a brief, but a consultant decides what happens next.
Your rights
Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, and ask us to send it to someone else in a portable form. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not make anything we did beforehand unlawful.
Ask us by email and we will act on it. We will not charge you and we will not ask you why.
If you are not happy with how we have handled your data you can complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
How to reach us
Email us at people@ddg-europe.com or call +31 (0) 355 411 482. Our postal address is Baarnsche Dijk 4-B, 3741 LR Baarn, Netherlands.
Our cookie policy covers what is and is not stored on your device.