Privacy policy

This policy explains what personal data Quilyx B.V. processes, why we process it, where that data sits, and what rights you have. It applies to professionals we talk to about assignments, to the contact people at clients and intermediaries, and to visitors of this website.

This policy is written to be read. If anything here is unclear, or does not match the practice you know from us, please tell us at gdpr@quilyx.com.

Who processes your data

Quilyx B.V. is the controller for the data this policy covers. The company is based at Rijnzathe 12, 3454 PV Utrecht, the Netherlands, and is registered with the Dutch Chamber of Commerce under number 90180275. Quilyx B.V. is SNA-certified against the NEN 4400-1 standard, registered under the Waadi, and prepared for the coming admission requirement under the Wtta.

Questions about your data, and requests to see it, correct it or have it deleted, go to gdpr@quilyx.com. For anything else the address is info@quilyx.com, and you can reach us by telephone on +31 30 401 0422.

The closed environment in which we publish our assignments is called Freelyx and is the assignment portal of Quilyx B.V. This policy covers that portal as well.

What data we process

From professionals. When you register we ask for your name, your email address, a short description of your field or role profile and your CV. Your CV is part of the registration, because it lets us build a full profile and compare assignments against your actual experience. Without a CV we have only your public LinkedIn profile, and that is usually too thin for the purpose. You can also give us your telephone number, the country and the province where you live, the link to your LinkedIn profile and your availability; only your name and your email address are required. We use your telephone number only to reach you quickly, because an assignment often carries a short response window and email alone can let it pass.

Alongside what you send us, we enrich your profile with the data from your LinkedIn profile. That is the source you keep public yourself, and it is exactly the information that helps us compare assignments against your experience. Enriching your profile from that source is part of the processing you consent to when you register.

Once we start discussing a specific assignment with you, further data joins it: the correspondence between you and us, the assignments you are in the frame for, the referees you name, and what you have told us about your availability and your rate.

At registration we do not ask for your citizen service number, your date of birth or your home address, because we do not need them to judge whether an assignment suits you. If an assignment does go ahead, we do need data to draw up the agreement and keep the records. We ask for it at that point and not before.

What goes into your CV is your call, and anything you would rather not share, you leave out. We do not need and do not ask for data about, for example, your health, your background, your religion or your trade union membership, so leave it out even if an older version of your CV still carries it. We keep your CV as part of your profile, under the same retention period as the rest of your data.

Sometimes your name reaches us another way, because a client or an intermediary mentions you in a message, or because we come across your profile on a professional network where you present yourself publicly. Everything in this policy applies in that case too.

From clients and intermediaries. When a client or an intermediary sends us an assignment, we process the business contact details of the people involved, that is name, role, email address and telephone number, together with the correspondence about the assignment. We use that data to discuss and carry out the assignment, and for nothing else.

If a client or an intermediary sends the assignment through the form at aanmelden.freelyx.nl, it first arrives at that form's server, which runs at our Dutch hosting provider in a hosting package of its own. That server forwards the message as an email straight to our business email environment and keeps nothing itself.

From visitors to this website. This website sets no cookies and uses no tracking scripts. What your browser passes to the web server when it requests a page is described under Cookies and tracking scripts, further down this policy.

What we use your data for

We process the data of professionals to judge which assignments suit a profile, to get in touch as soon as we see such an assignment, and to record the agreement when an assignment goes ahead. We also process data because the law requires it, for instance for the accounts and the tax returns that go with a placement.

The basis for keeping and using your profile is your consent. You give it at registration, including for the enrichment of your profile with the data from your LinkedIn profile, and you can withdraw it at any time. When we then discuss a specific assignment with you, we ask for your consent again and record it per assignment. Without that recorded consent we do not put you forward to a client. Once an assignment goes ahead, we also process the data needed to perform the agreement.

When your name reaches us without you having registered with us, we process that data on the basis of our legitimate interest in bringing supply and demand together. We keep it no longer than we need to ask whether you want to hear from us. If you say no, or say nothing, we delete it.

For the contact details of clients and intermediaries the basis is the performance of the agreement and, as long as there is none yet, our legitimate interest in maintaining business contact.

You can withdraw your consent without giving a reason. It has one consequence, and we would rather tell you beforehand than afterwards: we delete your data, and after that we can no longer approach you when an assignment comes up that suits you.

Where your data sits

Your CV and your messages reach us through our business email environment, which is provided by Microsoft. Your data sits there while it is in transit and for as long as the message is kept in the mailbox. We then move it to our own system in the Netherlands, where the further processing and storage take place.

If you sign up through the form at aanmelden.freelyx.nl, your details and your CV first arrive at that form's server, which runs at our Dutch hosting provider in a hosting package of its own. That server forwards your application as an email message straight to the same email environment and keeps nothing itself.

The messages we send ourselves run through that same email environment, for instance when we respond to a request or put your profile to a client with your consent. Microsoft acts as a processor in this, under a data processing agreement we have concluded for the purpose.

On one point your data deliberately stays with Microsoft, and that is in your interest. As soon as we put you forward for an assignment, and certainly once you win it, we keep the CV we sent separately in our business cloud storage at Microsoft, exactly as it read at that moment. If a question comes up later about what it said, we go back to the document that was actually sent rather than to a profile that has since moved on.

Your data therefore sits in two places: in our own system in the Netherlands, where we match assignments and profiles, and in our cloud storage at Microsoft, which holds the CV belonging to a running or completed assignment.

The closed assignment environment runs at a Dutch hosting provider, in a hosting package of its own that stands apart from our other systems.

If any of our suppliers transfers data to a country outside the European Economic Area, that happens only under the safeguards the GDPR prescribes for it, such as the European Commission's standard contractual clauses.

What we deliberately do not write here is that everything stays in the Netherlands. That would sound better than it is. Your message sits at Microsoft for as long as it is kept in the mailbox, and we deliberately keep the CV belonging to a running or completed assignment there as well. What is true: the matching of assignments and profiles happens in the Netherlands, on our own hardware, and the closed assignment environment runs at a Dutch hosting provider.

How we use AI

To match assignments and profiles we use an AI environment of our own, which runs solely on our own hardware in the Netherlands. It reads an incoming assignment, extracts the essentials, and sets them alongside the registered profiles. In doing so it looks at the whole picture, that is your CV, your LinkedIn profile and whatever else you share with us, in relation to one another. It is deliberately not a keyword comparison, because a career does not fit into isolated words.

What that comparison produces does not determine what you get to see. Every assignment we place in the closed assignment environment is visible to everyone who has registered and whose registration we have assessed. Our own system does make a pre-selection, but it determines only who we approach ourselves. You can express interest in any assignment, including one where the system rated the fit as low.

If the system rates the fit as low, we will show you what that rests on if you ask. That way you know which points in your CV are underexposed, you can sharpen them, and you improve your chances on a future assignment.

We do not enter your CV or your data into external AI services, and we do not offer them there to train models. The final assessment and the decision to put someone forward are always made by a professional who knows the work first hand.

Our email environment runs at Microsoft, where messages and attachments are automatically screened for spam, phishing and malicious files. We cannot switch that screening off, and it is there to protect your data.

Our way of working contains no decision that rests solely on automated processing and denies you access to an assignment, because the assignments stay visible and you can always put yourself forward. If you disagree with an outcome, you can raise it with us, put your point of view, and have the assessment done again.

Once we have put your profile to a client or an intermediary with your consent, that party decides for itself which tools it uses from then on. We have no sight of that, and it is responsible for that processing itself.

How long we keep your data

We keep your data until twelve months after the last contact. After that we delete or anonymise it, unless the law obliges us to keep certain data longer, such as the records around a placement, or unless we have agreed something else with you.

The CV we used to put you forward for an assignment is kept for as long as the records around that assignment require. That way, if a client comes back to it later, we can show what was actually sent.

The business contact details of clients and intermediaries are kept for as long as the working relationship runs, and after that for as long as the statutory retention period for the records applies.

If you want to leave our records sooner, you do not have to wait out those twelve months. One message to gdpr@quilyx.com is enough, and we do not expect an explanation with it.

Who we share your data with

We record per assignment what you consent to, so that you can check later what exactly was agreed.

We never put you forward to a client without discussing it with you beforehand and recording your consent.

With that consent we share your data with the client you are put forward to, and with the intermediary that placed the assignment with us. If you have named referees yourself, we may approach them in that context.

A client or intermediary we put you forward to with your consent decides for itself what it does with your data, and is responsible for that itself.

There are also parties that support us and may see data in the process, namely the supplier of our email environment, the hosting provider of the assignment environment, our accountant and our legal advisers. They work on our instructions and are bound by agreements on security and confidentiality, and they may not use the data for their own purposes.

The reverse also occurs: in some assignments we process personal data on behalf of a client or an intermediary. For those situations we use our standard data processing agreement, published on this website.

Beyond that we disclose data only where the law obliges us to, for instance to a supervisory authority or to the Dutch tax administration. Were the business ever transferred, the data would go with it to the party continuing the work, and what this policy says would continue to apply.

Your account in the closed assignment environment

If you are given access to the closed assignment environment, we create an account for you. That account deliberately stands apart from you as a person, because the system generates a username that gives nothing away about you, and the environment itself holds no names and no email addresses. What it does hold stays limited to what is needed to log you in safely and show you the assignments:

• your username,
• your password, stored in an irreversible form from which the original password cannot be derived,
• the key for your authenticator app, stored encrypted, and your recovery codes in the same irreversible form as your password,
• the sessions you currently have open,
• the assignments you have responded to.

The link between that username and you as a person is not held in the environment, but in our own system.

The environment keeps a log of logins and logouts, recording the time, the event and the IP address of your connection, so that we can spot misuse. We keep those log entries for thirty days and use them for nothing else.

What we do to protect your data

We take appropriate technical and organisational measures to protect your data. Sensitive data, such as your password and the key for your authenticator app, is stored encrypted or in a form from which the original cannot be derived. The rest of the data is accessible only to those who need it for the work. We keep a log of that access, and we make regular backups so that data is not lost.

If something goes wrong despite those measures, we follow a set procedure for data breaches. We establish what happened, report it to the Dutch Data Protection Authority where the law requires it, and inform you where the incident presents a high risk to your data.

Your rights

You stay in control of the data we hold about you. You can ask us for the following:

• Access. You may know what data we hold about you, and request it.
• Rectification. We correct data that is wrong or incomplete.
• Erasure. You can ask us to delete your data.
• Restriction. You can have the processing restricted, for instance while a correction is pending.
• Portability. You can receive your data in a common file format.
• Objection. You can object to processing we base on our legitimate interest, for instance where your name reached us another way.
• Withdrawal. You can withdraw your consent, without affecting what was lawfully done up to that point.

These rights apply to the contact people at clients and intermediaries as well.

Send a request to gdpr@quilyx.com. We first establish that it genuinely comes from you, precisely in order to protect your data, and then respond within the statutory period of one month. When we erase your data, we also remove it from the internal records in which we track who has registered with us.

If you feel we are not handling your data carefully, we would rather hear it from you directly, so that we can put it right. You also always have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection supervisory authority.

Cookies and tracking scripts

This website sets no cookies and uses no tracking scripts. This page loads nothing from another party, so no analytics script, no advertising network, and no font fetched from elsewhere. Feel free to check it in your browser's developer tools.

What your browser passes to the web server when it requests a page does end up in that server's ordinary log files. We do not use those to recognise or track visitors.

The closed assignment environment uses one strictly necessary cookie, which keeps you logged in for the duration of your session. Without it you cannot log in. If, when you log in, you choose not to be asked again for a code from your authenticator app on this device for 24 hours, the environment sets a second strictly necessary cookie containing nothing but a random number. That cookie belongs to your account, lasts 24 hours, disappears when you log out, and is used for nothing else. The environment sets no other cookies.

Changes to this policy

We update this policy as soon as something changes in the way we handle data. Where a change genuinely matters to you, we tell you rather than wait for you to notice it yourself. The date at the top of this page shows when the policy was last updated.