Privacy notice

1. Who is responsible

Synthetic Test Agency B.V. decides why and how personal data is used in this application. Under the GDPR (in Dutch, the AVG), Synthetic Test Agency B.V. is the controller.

The supplier of the application, Synthetic Edge S.R.L., processes this data only on Synthetic Test Agency B.V.'s behalf, under Schedule 4 of the signed agreement between Synthetic Test Agency B.V. and the supplier.

2. What the application keeps, and why

The application keeps the data that Synthetic Test Agency B.V. needs to run its staffing operations: to plan shifts, record hours, invoice Clients, pay people and meet payroll and invoicing obligations.

• Workers: name, contact details, address, date of birth, BSN, IBAN, photo, diploma, security pass, a copy of the identity document, contracts, leave, expenses, hours, payslips and messages.
• Candidates: name, contact details, CV, notes on the application and its phases.
• Client contacts: name, e-mail address, telephone number, the Client and Jobs they work for, and the hours they confirm.
• Office users: name, e-mail address, role, and a record of what they do in the application (the Audit log).

The legal bases are the performance of the agreements Synthetic Test Agency B.V. has with these people, legal obligations such as payroll and invoicing, Synthetic Test Agency B.V.'s legitimate interest in running its operations securely, and, for keeping a candidate's application for a year, the candidate's consent.

3. What Clients see of Workers

A Client contact sees details of a Worker only for a Worker who has a shift at the Client's Job.

They see the photo, name, date of birth, diploma, and security pass number and validity of that Worker, and can download the scan of the diploma and of the security pass.

They see an item only when Synthetic Test Agency B.V.'s staff have marked it as verified; any other item shows as not reviewed.

They never see the identity document, the BSN, the IBAN or the address of a Worker.

Everything a Client contact opens or downloads of these details is recorded in the Audit log.

4. Payslips

Synthetic Test Agency B.V.'s accountant produces the payslips. Synthetic Test Agency B.V.'s staff upload the accountant's PDFs to the application, and each Worker sees and downloads only their own payslips.

5. Who can see the data

In the application, each office user, Worker and Client contact sees only what their role allows; the server checks this on every request.

The developers of the supplier look into the production system, including Synthetic Test Agency B.V.'s data, only with Synthetic Test Agency B.V.'s approval each time, and everything they do there is recorded.

6. Where the data is kept, and who else handles it

The application and its data are hosted on Google Cloud servers in the European Union.

They start on the supplier's Google Cloud account and move to Synthetic Test Agency B.V.'s own Google Cloud account after Synthetic Test Agency B.V.'s final approval.

The Worker map, which only office users with access to it see, loads its background map from PDOK, the public map service of the Dutch Kadaster. The office user's browser then sends PDOK its IP address and which part of the map it shows, but no Worker data and no address.

Open: the e-mail provider that delivers the application's e-mails is not chosen yet. This notice will name it once it is.

Open: Gemini (Google) as a processor. The application is not connected to an AI provider, so no personal data is sent to one. If Gemini is connected later, it becomes a processor and this notice is updated first.

7. How long the data is kept

Synthetic Test Agency B.V. decided these periods, which the application applies automatically once an administrator has approved the schedule in Settings > Retention:

• invoices, payslips and payments: 7 years;
• the copy of the identity document: 5 years after the person leaves;
• candidates who were not hired: deleted after 4 weeks, or after 1 year with their consent;
• former Workers: anonymized after 7 years;
• the Audit log: 7 years.

Synthetic Test Agency B.V. decided that invoices, payslips, payments and Audit log entries are deleted automatically, with their files, once their 7 years have passed. Until the application does this, it lists them for review by Synthetic Test Agency B.V.'s staff and does not delete them.

8. Your rights

You can ask Synthetic Test Agency B.V. for access to the data it holds about you, ask for it to be corrected, and ask for its deletion where the law allows.

To use these rights, contact Synthetic Test Agency B.V.'s AVG contacts through Synthetic Test Agency B.V.'s privacy contact (the address is still to be confirmed).

You can also complain to the Autoriteit Persoonsgegevens.

Draft for Synthetic Test Agency B.V.'s review: Synthetic Test Agency B.V. confirms this contact path, the channel through which people reach Synthetic Test Agency B.V.'s AVG contacts, and whether the published text names them.