Global Privacy Notice
This version was published on 6 June 2025.
In this privacy notice we explain how we use personal data (“data”).
We always strive to make our privacy notice clear and comprehensive. If you have any questions after reading this notice, you can contact:
Next Step Hire.
The Data Protection Officer of nsh can be reached by email at nextstephire.eu or by post at The Data Protection Officer, Koningstraat 93, 7315 HV Apeldoorn
+31 85 060 4667
Mon – Fri: 8:00 – 17:00
Sat: 9:00 – 12:00
Sun: Closed
You can contact nsh’s EU data protection representative by emailing info@nextstephire.eu or by post at Data Protection Representative, Koningstraat 93, 7315 HV Apeldoorn
info@nextstephire.eu
For data subject access requests, you can contact us using any of the methods above. This helps us handle your request quickly.
Who are we?
nsh brings skilled people together to build the future through its global network of specialist recruitment brands.
nsh offers products and services through its brands in the following countries:
Bulgaria, Hungary, Netherlands, Germany, Luxembourg.
Who is the controller?
Next Step Hire.
How do we use personal data?
You may interact with us for a variety of reasons. Each reason may require different processing of your personal data.
To help you find the right information, we have structured this notice based on the type of contact you have with us.
We do not sell personal data that we collect and process about you.
Candidate – Vacancy at Next Step Hire
If you apply for a job at nsh or with one of nsh’s clients (this may include an assignment at the client performed through your own service company, as a sole trader, as an employee of a management company, or for a permanent position), we process your personal data to determine whether your skills and experience are suitable for the specific role. This includes interviews and skills assessments. We may carry out background checks to verify your eligibility to work at a specific location or to verify your credentials and qualifications. We process your personal data on the basis of taking steps prior to entering into a contract or due to legal requirements. We may also conduct a formal background check with your express and freely given consent if we have no other legal basis.
We typically collect your name, address, date of birth, nationality, citizen service number, another government-issued identification number, driving licence details, email address, telephone number, ethnicity (where legally required or with your express and freely given consent where permitted under local law), qualifications and work experience.
Please note that some of our clients are legally required to conduct formal background checks, including criminal record checks that go beyond the checks carried out by nsh. In such cases the client is the controller and nsh is the processor. If a client requires a background check, we will notify you at that time and inform you about the client’s data protection notice.
We may also process your personal data to comply with laws and regulations that apply to us. This includes screening against economic and trade sanctions lists issued by countries and intergovernmental organisations such as the UN.
We may contact the individuals you have listed as referees on your CV or provided later during the application process. You must ensure that individuals you list have agreed that we may contact them to discuss your references and qualifications.
We may also take notes during an interview to support the selection stage of the recruitment process. These notes may include personal details that you shared during the interview.
If your application is successful, we will retain the information collected during the recruitment process and add it to your placement file. We will continue to process your personal data as an nsh employee in accordance with our Employee Data Privacy Notice [link available to employees only].
If your application is not successful, we may retain personal data collected during the recruitment process to demonstrate compliance with legal requirements such as non-discrimination laws. We keep the data for as long as necessary to meet those legal requirements.
We may also retain your personal data to inform you about other relevant roles that match your skills and qualifications.
When seeking suitable opportunities for you, we may share your profile in an anonymised manner with clients and organisations that we believe may be interested in your profile. When approaching clients or other organisations, we usually include multiple anonymised profiles. The information we send is sufficient for the recipient to understand your general skills. We do this on the basis of legitimate interests. If a client is interested in your profile, we will contact you to discuss the opportunity. If you decide you are interested in further conversations, we will ask for your consent to send your full CV, including your name and contact details.
We will retain your personal data only to find a suitable opportunity for you until you ask us to delete your personal data (see above regarding your rights) and we are legally required to honour your request.
If we have had no meaningful contact with you in the past two years, we will remove your personal data from our active database. Your personal data will then be stored in an archive for up to three years before being deleted.
We may retain your personal data for longer if required by applicable local law.
Employees within nsh and companies that have hired you
Please refer to the detailed information available on the nsh website.
Employees working with nsh clients
If you are hired as an employee to work exclusively on assignments with nsh clients, we will process your personal data in the same way as described above under “Candidate – Vacancy”. We will also share your skills and expertise with our clients. You may be asked to be interviewed directly by the client. In that case, any personal data you share with the client will be processed directly by the client under the client’s data protection policies and notice.
Where permitted by local law and in agreement with the client, we may ask you to provide geolocation data. The data may be collected by nsh and shared with the client, or collected directly by the client to ensure contract compliance and for safety and security reasons. Geolocation data may be collected using devices we provide such as laptops or mobile phones. Where we have provided a vehicle, we may also collect geolocation data using that vehicle’s geolocation functionality.
Processing geolocation data is required under the contract or by law. In some circumstances it may be optional and data will only be collected with your express and freely given consent. You can withdraw this consent at any time.
During your employment we collect further information about your working hours through timesheets, any issues raised by the client about your conduct, or other matters relevant to your employment.
Self-employed professionals
When you are successfully matched to an nsh client to perform an assignment as a self-employed professional, we will collect and process personal data relating to the hours worked and any issues raised by the client in relation to the assignment. We do this to enable performance of the contract and to comply with relevant laws.
Where permitted by local law and in agreement with the client, we may ask you to provide geolocation data. The data is shared with the client and collected to ensure contract compliance and for safety and security reasons. Geolocation data may be collected using devices we provide such as laptops or mobile phones. Where we have provided a vehicle, we may also collect geolocation data using that vehicle’s geolocation functionality. This will be required under the contract or by law. In some circumstances it may be optional and data will only be collected with your express and freely given consent. You can withdraw this consent at any time.
Note: If your services are provided through a legal entity such as a management company or your own service company, we have a legal agreement with that company to enable delivery of services to the end client. Part of that agreement concerns the lawful processing and transfer of your personal data from that company to us and, where needed, sharing with the end client. Any processing of your personal data by your service company or the management company that employs you is the responsibility of that company. You should refer to that company’s data protection notice and policies.
Social media including job boards
If you engage with us via social media or other online forums, we process your personal data to contact you and respond to any questions you raise through direct messaging features or other features provided by the social media platform to connect with us about vacancies and related services.
We also actively search for talent using social media. We may contact you via social media if we find your profile interesting to match you with one of our clients, if we have a relevant opportunity, to see if you are interested in future opportunities, or if we believe we can provide services that benefit your organisation.
We may collect your name, email address, phone number and profile URL.
We process your personal data on the basis of legitimate interest and only to the extent permitted by other applicable laws such as local marketing laws.
We may also offer in local markets the option to join our own members-only social media area. If you decide to join such a members area, we process your personal data to enable interaction between you as a member, other members and us, to gain insight into your activities and to tailor content, and to moderate conversations. We process your personal data on the basis of legitimate interest.
Please note that if you join a members-only area on a social network, you generally need to create or have a personal account with that social network independent of our members area. The social media platform dictates the terms and conditions of such an account and determines the purposes and means of processing your personal data, acting as an independent controller. We have no control over this. Please refer to the privacy notice of the relevant social media platform.
Where we process your personal data on the basis of legitimate interest, we will keep your personal data until you ask us to delete it (see above regarding your rights) and we are legally required to honour your request. If we have had no meaningful contact with you in the past two years, we will remove your personal data from our active database. Your personal data will then be stored in an archive for up to three years before being deleted.
We may retain your personal data for longer if required by applicable local law.
Reference – Candidate
If you have been named as a referee by one of our candidates, we will contact you to verify the candidate’s qualifications, experience and character. We ask candidates to name only referees who have agreed that we may contact them. We process your personal data on the basis of legitimate interests.
Through the candidate we typically collect your name, email address, phone number and professional details such as title, current employer and role.
We keep your personal data for the duration of the recruitment process and, if the candidate is successful, for the duration of employment. We may need to retain your personal data for longer to comply with contractual obligations to which the candidate is a party, or to comply with applicable local law.
Receiving your personal data from a third party
We may receive your information from a third party that provides such information as part of paid or unpaid services. We process your personal data on the basis of legitimate interests to research marketing insights and to determine whether there are business opportunities to work with you and or your organisation. We will contact you as soon as possible and always within 30 days to let you know that we have obtained your personal data and where it came from. Where permitted under local law, we will also market our services to you. If we cannot reach you within 30 days, your personal data will be deleted.
Unless you object to further processing of your personal data after we have made contact, we will retain your personal data until you ask us to delete it (see above regarding your rights) and we are legally required to honour your request. If we have had no meaningful contact with you in the past two years, we will remove your personal data from our active database. Your personal data will then be stored in an archive for up to three years before being deleted.
We may retain your personal data for longer if required by applicable local law.
Clients
We will process limited personal data relating to our relationship with your organisation to enable us to deliver our services under the agreed contract, including invoicing. Personal data we collect includes your name, business email address, business phone number and billing address. We may use your personal data for regular communications, to invite you to events, or to discuss other service or product opportunities.
We keep your personal data for the duration of the contract or as required by specific contractual clauses such as audit clauses that may remain in effect after termination. We may also be required to retain your personal data for longer to comply with applicable local law.
Suppliers
If you supply goods or services to nsh and you are the designated contact person, we process your personal data to ensure performance of the contract whether written or verbal. Personal data we collect includes your name, business email address and business phone number. We may use your personal data for regular communications, to invite you to events, to discuss other service or product opportunities, or to respond to invoices.
We keep your personal data for the duration of the contract or as required by specific contractual clauses such as audit clauses that may remain in effect after termination. We may also be required to retain your personal data for longer to comply with applicable local law.
Affiliates Programme
We may offer you the opportunity to work with us in securing new opportunities with our clients, including developing proposals, attending client meetings and giving presentations. We process your personal data to enter into a contract with you, to perform such a contract, to communicate with you about our arrangement and opportunities, to invite you to events and to discuss other products and services.
Personal data we collect includes your name, email address and phone number.
We keep your personal data for the duration of the contract or as required by specific contractual clauses such as audit clauses that may remain in effect after termination. We may also be required to retain your personal data for longer to comply with applicable local law.
Website visitor
We may collect your personal data when you visit our website and request more information about our company, for example by completing a form. This data includes your name, email address and phone number. We will process your personal data to ensure we can respond to your request and may retain your personal data for additional communications about our products and services.
We will process your personal data on the basis of legitimate interests unless local law does not allow this. If not permitted, we will ask for your consent. You can always opt out of further communications by objecting to further processing or by withdrawing your consent. You can do this by unsubscribing from our written communications via a link in the message, or if we call you, you can let us know during the call.
We may also use cookies or other tracking technology that places a text file on your device such as your laptop or smartphone. This helps us track your interactions with our website. You can read more about this in the Cookies section later in this notice.
If we process your personal data based on consent, we will retain your personal data until you withdraw your consent.
If we process your personal data based on legitimate interests, we will retain your personal data until you ask us to delete it (see above regarding your rights) and we are legally required to honour your request. If we have had no meaningful contact with you in the past two years, we will remove your personal data from our active database. Your personal data will then be stored in an archive for up to three years before being deleted.
We may retain your personal data for longer if required by applicable local law.
General business enquiry
If you contact us by email, phone, SMS, post, at seminars, web conferences or otherwise to obtain more information about us or if you have a specific question, we process the personal data you provide to respond to your request. We may retain your personal data for further correspondence with you. We collect your name, email address and phone number. We may also collect your business address and or home address. We process your personal data on the basis of legitimate interests or in some cases on the basis of consent.
If we process your personal data based on consent, we retain your personal data until you withdraw your consent.
If we process your personal data based on legitimate interests, we retain your personal data until you ask us to delete it (see above regarding your rights) and we are legally required to honour your request. If we have had no meaningful contact with you in the past two years, we will remove your personal data from our active database. Your personal data will then be stored in an archive for up to three years before being deleted.
We may retain your personal data for longer if required by applicable local law.
Transfer of personal data
As a global company we operate centralised systems where we host most of our data including our customer and candidate data, marketing data, financial data and HR data.
The systems are hosted in a cloud solution located in the United Kingdom. The transfer of your personal data from the country where you live to our cloud solution in the UK is protected by our internal data transfer agreement based on the European Commission’s Standard Contractual Clauses with local adaptations to comply with relevant and applicable data protection law regarding the transfer of personal data.
We may also transfer your personal data to our clients or third-party suppliers to deliver our services to you and our clients. Such transfers are governed by our contract with the client or third-party supplier to ensure your personal data is protected to standards equivalent to those of the country where you reside.
When we transfer personal data with an EU or UK residence to countries that do not meet the EU or UK standards as set by the EU Commission or the UK authority, we will include appropriate language in our contracts to ensure EU and or UK standards are still met. We typically do this by applying contractual language approved by the EU Commission and or the UK authority.
If you do not reside in the EU or the UK, we provide equivalent protection of personal data to the rights in your country of residence by applying the same or similar contractual provisions as those in the EU or UK, or specific provisions as required by local law.
Examples of transfers to other parties
Example 1 – Sending your CV and contact details to a client for an interview.
Please note that when the client uses the CV and contact details to prepare and conduct the interview, the client will use your personal data in a way the client deems necessary for the interview. They act independently of nsh as a controller. If you have questions about the processing of your personal data, you can ask the client for their privacy notice and or policy.
Example 2 – Sharing and reconciling your personal data with a job board or a social media provider.
Where you have consented on a job board or a social media platform to the sharing of your personal data, we receive your personal data from that job board or platform. While storing your personal data we may ask the job board or social media platform to validate its accuracy so that we always keep the most up-to-date personal data in our records. Personal data we will receive includes name, current employer, role, profile URL, email and phone number.
Your rights
We will meet all our legal obligations to you.
Where you have a legal right to do so, upon your request we will:
- provide you with a copy of your personal data that we hold. Please note that to protect other people we may need to remove or obscure parts of the information we provide to you
- update your personal data
- delete your personal data. Please note that we may not always be able to delete some or all of your personal data. We will inform you if this is the case and explain why
- restrict or suspend processing of your personal data
- have a human review and explanation of the outcome of automated decisions made about you.
If you live in a country where the above rights are not legally available to you, we will still consider your request and may grant it at our discretion.
We may ask you to provide additional and sufficient evidence to verify your identity before we can process your request.
We will respond within one month unless we are legally required to respond sooner.
If you would like to make a request, click here or email info@nextstephire.eu
You can also contact us in writing using any of the addresses at the top of this notice.