Privacy statement

RIXT.IT B.V.

How We Handle Your Personal Data

RIXT.IT B.V. · Lange Kleiweg 14, 2288 GK Rijswijk · Chamber of Commerce no. 42032576

GDPR@rixt.it · www.RIXT.IT

Version 1.0 · June 2026

DATA CONTROLLER

1. Who Are We?

RIXT.IT B.V. (hereinafter: RIXT.IT, we, or us), registered at Lange Kleiweg 14, 2288 GK Rijswijk and entered in the Chamber of Commerce under number 42032576, is the data controller responsible for the processing of personal data as described in this privacy statement.

This privacy statement supplements the General Recruitment Terms and Conditions (art. 10) and the General Interim Management Terms and Conditions (art. 13) of RIXT.IT. In the event of any conflict, the more specific provision shall prevail. Questions regarding this privacy statement or the processing of your data? Please contact us at GDPR@rixt.it. For complaints relating to our services, please refer to Feedback@rixt.it (see art. 13 of the General Recruitment Terms and Conditions and art. 15 of the General Interim Management Terms and Conditions).

TARGET GROUPS

2. To Whom Does This Privacy Statement Apply?

This privacy statement applies to the processing of personal data of three groups:

A Candidates — IT professionals who are registered with us, apply for a vacancy, or are approached by us for a permanent position or interim assignment.

B Clients — contact persons at organisations with which RIXT.IT has or maintains a business relationship in the context of recruitment & selection or interim management.

C Website Visitors — individuals who visit our website rixt.it.

For each group, we set out below which data we process, on what legal basis, for what purpose, and for how long we retain it.

CANDIDATES

3. Candidates and IT Professionals

3.1 What Data Do We Process?

We process only data that is necessary for the performance of our services. Depending on the type of service (recruitment & selection or interim), this includes:

For recruitment & selection (permanent positions)

• Name, contact details (email, telephone, address) and LinkedIn profile
• CV, motivation, work experience, education and certifications
• Salary expectations and availability
• Interview notes and our assessment of the profile
• Reference data (only with your consent)

For interim placements (in addition to the above)

• Hourly rate, contract type (self-employed or secondment) and availability
• Chamber of Commerce number and VAT number (for the assignment confirmation)
• Time registration and progress information during the assignment

We do not process special categories of personal data (such as health data, religion, ethnicity or political beliefs) unless required by law.

3.2 On What Legal Basis Do We Process Your Data?

For the regular performance of our services (assessing a profile, presenting a candidate to a client), we rely on our legitimate interests or the performance of a contract as the legal basis. Consent is used as a legal basis only where required by law, for example for reference checks or inclusion in our talent pool.

Important: in the context of a recruitment procedure, the dependency relationship between a candidate and a recruitment agency is such that consent as a legal basis is legally tenuous. We therefore base the processing of application data on legitimate interests, unless otherwise required.

3.3 For What Purposes Do We Use Your Data?

• Assessing your profile and matching it with suitable vacancies or interim assignments.
• Presenting your profile to clients, exclusively with your prior consent.
• Maintaining contact throughout an ongoing process or assignment.
• Conducting a reference check (exclusively with your explicit consent).
• Including you in our active candidate pool for future opportunities (exclusively with your consent).

3.4 How Long Do We Retain Your Data?

Candidates not placed (rejected or procedure not continued):

We delete or anonymise your data no later than 4 weeks after the conclusion of the procedure. This is in accordance with the guidelines of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the NVP Sollicitatiecode (version September 2025).

Candidates in our talent pool (with consent):

With your explicit consent, we retain your data for a maximum of 1 year. Upon expiry, we will request your consent again. You may withdraw your consent at any time by contacting GDPR@rixt.it.

Placed candidates (permanent position via RIXT.IT):

Data related to the placement is retained during the guarantee period as described in article 7 of the General Recruitment Terms and Conditions — the guarantee period equals the agreed probationary period in the Candidate's employment contract — and thereafter for a maximum of 1 year for the purposes of any potential disputes.

Placed interim professionals (assignment via RIXT.IT):

Contractual data and time registration records are retained for 7 years pursuant to statutory tax retention obligations.

3.5 With Whom Do We Share Your Data?

• Clients: only where you have explicitly consented to presentation to a specific client for a specific vacancy or assignment. This is set out in article 10.2 of the General Recruitment Terms and Conditions and article 13.2 of the General Interim Management Terms and Conditions.
• Software suppliers: we use Loxo as our ATS/CRM system and may use other tools (such as Make.com or scheduling software) that process your data as processors on behalf of RIXT.IT. We conclude a data processing agreement with these parties, as required under the GDPR.
• Outside the EEA: some tools we use process data outside the European Economic Area. In such cases, we ensure that appropriate safeguards are in place, such as the Standard Contractual Clauses established by the European Commission. This is consistent with article 10.4 of the General Recruitment Terms and Conditions and article 13.3 of the General Interim Management Terms and Conditions.
• We never sell your data to third parties and do not share it for the commercial purposes of others.

3.6 Use of AI in Our Services

RIXT.IT uses AI-assisted tools for internal administrative processes, such as managing the candidate database and drafting profiles. AI tools are not used to make automated decisions regarding whether or not to present candidates to clients. The assessment, pre-selection and nomination of candidates are at all times carried out by a RIXT.IT consultant. This is set out in article 9 of the General Recruitment Terms and Conditions and article 12 of the General Interim Management Terms and Conditions.

We comply with the transparency requirements of the EU AI Act and the NVP Sollicitatiecode (September 2025) with respect to the use of AI in recruitment and selection. Upon request, you may be informed of the manner in which AI tools are deployed.

CLIENTS

4. Clients and Business Relations

4.1 What Data Do We Process?

With regard to contact persons at clients and other business relations, we process:

• Name, job title and organisation
• Business email address and telephone number
• Correspondence and meeting notes
• Data required for the performance of the agreement (invoice details, Chamber of Commerce number of the organisation)

4.2 Legal Basis and Purpose

The legal basis for processing data relating to clients is the performance of a contract or our legitimate interest in maintaining business relationships. The data controller responsibilities of the respective parties are further described in article 10 of the General Recruitment Terms and Conditions and article 13 of the General Interim Management Terms and Conditions, under which RIXT.IT and the Client are each individually acting as data controllers. We process this data exclusively for:

• The execution of recruitment & selection or interim management engagements.
• Maintaining the business relationship and follow-up of assignments.
• Invoicing and administration.

4.3 Retention Period

We retain data of clients for as long as the business relationship is maintained, and thereafter for a maximum of 7 years pursuant to statutory tax retention obligations. Meeting notes and commercial correspondence that do not fall under the statutory tax retention obligation are deleted or anonymised 2 years after the last contact.

WEBSITE

5. Website Visitors

5.1 Cookies and Website Statistics

RIXT.IT uses functional and analytical cookies on the website rixt.it. Functional cookies are necessary for the operation of the website. Analytical cookies are used exclusively with anonymised or aggregated data, without infringing on your privacy.

We do not use third-party tracking or advertising cookies. Upon your first visit to our website, we will inform you about the use of cookies and, where required, request your consent.

5.2 Contact Form and Inbound Messages

If you contact us via the contact form on our website or by email, we process the data you provide (name, email address, message) solely for the purpose of responding to your enquiry. We retain this data for a maximum of 6 months, unless you become a candidate or client, in which case the data will be subject to the retention periods described in chapters 3 or 4.

YOUR RIGHTS

6. Your Rights Under the GDPR

As a data subject, you have the following rights. You may submit a request via GDPR@rixt.it. We will respond within 1 month.

Right of access — You may request an overview of the personal data we hold about you, including meeting notes.

Right to rectification — You may request the correction of inaccurate or incomplete data.

Right to erasure — You may request the deletion of your data, provided no statutory retention obligation applies.

Right to restriction — You may request that the processing of your data be restricted, for example while a correction request is being assessed.

Right to data portability — You are entitled to a copy of your data in a structured, commonly used format.

Right to object — You may object to processing based on legitimate interests.

Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time.

You have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

SECURITY

7. How Do We Secure Your Data?

RIXT.IT takes appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure or alteration. Specifically, this means:

• Access to candidate and client data is restricted to RIXT.IT employees who require it for their work.
• Our ATS/CRM system (Loxo) and other tools are secured with passwords and, where possible, two-factor authentication.
• We conclude data processing agreements with all parties that process personal data on our behalf.
• In the event of a data breach that poses risks to data subjects, we report it to the Autoriteit Persoonsgegevens within 72 hours and notify the data subjects in accordance with the GDPR.

AMENDMENTS

8. Amendments to This Privacy Statement

RIXT.IT may amend this privacy statement, for example in the event of changes to our services or to applicable legislation. The most current version is always available at www.rixt.it/privacy. We recommend that you consult this page regularly. In the event of material changes that directly affect data subjects, we will notify them by email.