Hoe gaan we om met je gegevens?

This information gives you an overview of how we process your personal data when you visit the website of  Koning Aap, Shoestring and YourWay2GO use our online application system or send us your application by e-mail or post. We inform you about what data we collect from you and how we use it. In addition, we will inform you about your rights under applicable data protection law and tell you who you can contact if you have any questions.

1. Who is responsible for data processing?
The DER Touristik Group to which you apply for a job or submit an unsolicited application is responsible for processing your personal data when using the online application system or when you send us your application by e-mail or post (hereinafter referred to collectively as the application process). For certain processing of your data in connection with the use of the online application system, the companies of  DER Touristik to which you apply for a job - also on your own initiative - are jointly responsible. They have stipulated in agreements which of them fulfills which obligations under data protection law.

2. Whom can you contact if you have questions about data processing?
Questions regarding the processing of your data can be directed to the data protection officer at any time.

You can reach the data protection officer of DER Touristik Group at:
Adventure Specialists B.V.
Entrada 223
1114 AA Amsterdam-Duivendrecht
020-7887700
E-Mail: [email protected]

3. What data do we process from you?
We process your personal data when you contact us in any other way. In detail, this may be the following data:
- Data that you provide to us as part of an application by e-mail or post.
- Data about your applications (title, first name, surname, date of birth, address, e-mail address, telephone number, mobile phone number, previous contacts with a DER Touristik Group company, first name and surname of legal guardian, data on school education, training and studies, data on previous professional career, data on driving license, data on possible impairments, data on area of deployment, cover letter, CV, certificates, portrait photo, insofar as you provide us with the respective information).
- Data we receive when conducting an aptitude or recruitment test for trainees (data on personality and performance).
- Data from career-oriented social networks (e.g. Xing, LinkedIn), insofar as these are generally accessible.

4. Is there an obligation to provide the data?
The provision of your data is not required by law. However, some of the aforementioned data is required in order to be able to set up a candidate profile and submit an application. Insofar as an employment contract is concluded between you and a DER Touristik Group company, the information you enter in your candidate profile will be forwarded to the HR department for the purpose of concluding the employment contract. The communication of other data is voluntary, but may be necessary for the use of certain services. This concerns, for example, data for setting up a job ticker for suitable jobs. We will inform you when entering data if the provision is required for the respective service or function. These data are marked as mandatory fields. In the case of required data, failure to provide it will result in the relevant service or function not being provided. In the case of optional data, failure to provide it may mean that we are unable to provide our services in the same form and to the same extent as usual.

5. For what purposes do we process your data and on what legal basis is this done?

5.1 Implementation of application procedures
You have the option of applying online for an advertised job or submitting a speculative application. The online application system is available to you for this purpose. The transmission of your data and the file attachments sent with it takes place via an encrypted connection. Your data will be received by the Human Resources department and forwarded to the department responsible for the advertised job or to the persons entrusted with handling the application process. The same applies if you send us an application by e-mail or post. All parties involved will treat your application documents with due care and confidentiality. We process the data you send us in connection with an application in order to check your suitability for the job (or, if applicable, other open positions in the DER Touristik Group company to which you are applying for a job or submitting an unsolicited application) and to carry out the application process. The legal basis for the data processing described above is Article 6 (1) letter b of the General Data Protection (decision on the establishment of an employment relationship).

If we conclude an employment contract with you, we will further process your data for purposes of the employment relationship if this is necessary for its implementation or termination. The legal basis for the data processing described above is Article 6 (1) (b) of the General Data Protection Regulation (implementation of the employment relationship).

5.2 Defense of legal claims
We process your data insofar as this is necessary for the defense of asserted legal claims arising from the application process. The legal basis for this is Art. 6 para. 1 letter f GDPR (balancing of interests, based on the interest of the DER Touristik Group company to which you are applying for a job or submitting an unsolicited application, to be able to defend claims in proceedings.

5.3 Candidate Pool
If your application does not match the job profile you are looking for, but seems suitable for other jobs, you can agree to be included in our candidate pool. If you agree to be included in our candidate pool, we will process your data beyond a specific application process as described in 5.4. This enables recruiters to approach you at a later date with new jobs from DER Touristik Group companies that match your personal qualifications and interests. Consideration in such a new application process will only take place with your consent. You can edit, change or delete the information you have provided at any time. The legal basis for the data processing described is Art. 6 (1) (a) of the General Data Protection Regulation (consent).

5.4 Signing of the employment contract by Docusign
If you are accepted, you will receive your employment contract from our HR partner. This can be done using the DocuSign software. For this purpose, your employment contract and the associated documents are uploaded in encrypted form and assigned to your name and e-mail address. You will then receive the documents by e-mail from the DocuSign software. When you open the envelope from your mailbox,w you are identified by your e-mail address and can sign the documents. When all parties have signed, you will receive the completed document including a DocuSign certificate by e-mail.
The legal basis for the described data processing is Art. 6 (1) (b) of the General Data Protection Regulation (contract) and Art. 6 (1) (f) our overriding legitimate interest in an efficient signing process.

6. Who has access to your data and for what reason?
Within the DER Touristik Group company to which you apply for a job or submit a speculative application, only persons who need your data to perform the tasks assigned to them will have access to it. This mainly concerns employees of the human resources department. If you have given your consent to be included in the candidate pool, all companies of DER Touristik Group may access your data in order to contact you if a suitable job is available. In addition, service providers who support us in fulfilling our tasks may have access to your data. These are service providers in the following categories:
- Hosting service providers for the operation of our servers
- Development service providers for programming, development, maintenance and support of software applications, in particular the online application system
- Scanning service providers for the digital capture of paper documents
- IT service provider for supporting and providing our services

- Service providers for carrying out aptitude and recruitment tests
- Service providers for carrying out chat applications
- Personnel service provider to support the selection of applicants
- Service providers for electronic signatures

Service providers used by us must meet special confidentiality requirements. They are only granted access to your data to the extent and for the period of time required to perform their tasks.

7. Are data processed outside the European Union?
We transfer your data to recipients outside the scope of the regulation of the EU-DSGVO and if there is neither an adequacy decision under Article 45(3) nor appropriate safeguards under Article 46, including binding internal data protection rules exist only to the extent that the transfer is necessary:
- for the conclusion or performance of the contract with you or for the performance of pre-contractual measures at your request
- for the performance of a contract concluded in your interest by the controller with another natural or legal person
- for the assertion, exercise or defense of legal claims
- to protect vital interests of the data subject or other persons, if the data subject is physically or legally unable to give his or her consent
- you have given us your consent
These data processing operations are permissible exceptions from Art. 49 EU-DSGVO.
Insofar as a data transfer outside the scope of the regulation of the EU-DSGVO is necessary due to our predominantly legitimate interest or you have given us your consent, this is secured, among other things, with EU standard contractual clauses according to Art. 46 para. 2 lit. c EU-DSGVO. If necessary, the EU standard contractual clauses are supplemented by further contractual assurances. You can obtain information on this via the specified contact.

8. How long will the data be stored?
We store your data for as long as is necessary for the decision on your application. Insofar as an employment relationship does not come about, we may continue to store your data beyond this, insofar as this is necessary for the defense against possible legal claims. As a rule, application documents are deleted 4 weeks after notification of the rejection decision, unless longer storage is required due to legal disputes. If for any reason we think it is necessary to keep your application for a longer period, we need to ask you for permission. After your permission, we are aloud to have your application in our possession for a maximum of one year.

If we conclude an employment contract with you, we transfer your data from the application to our personnel information system. Otherwise, we delete your data after these periods or determine the deletion period according to these criteria:
- After your permission we save your application max 1 year
- Data on an application 4 weeks after completion of the application process
- Voice recordings after 4 weeks

9. What rights do you have?

9.1 Information
You can request information about your personal data processed by us.

9.2 Correction
f your information is not (or no longer) accurate, you can request that your data be corrected. If your data is incomplete, you can request that it be completed.

9.3 Deletion
You have the right to request the deletion of your data. Please note that a claim for deletion depends on the existence of a legitimate reason. In addition, there must be no regulations that oblige us to retain your data.

9.4 Restriction of processing
You have the right to request the restriction of the processing of your data. Please note that a claim to restriction of processing depends on the existence of a legitimate reason.

9.5 Object
You have the right to object, on grounds relating to your particular situation, to the processing of your data which we base on our legitimate interests. In the event of a justified objection, we will no longer process your data.

9.6 Right of appeal
You have the right to lodge a complaint with a data protection supervisory authority if you do not agree with the processing of your data. The responsible supervisory authority can be found at Adventure Specialists B.V.

9.7 Data portability
You have the right to receive personal data that you have provided to us in an electronic format.

9.8 Revocation of your consent
You have the right to revoke your consent to the processing of your data, which you have given to us, at any time. This also applies to the revocation of declarations of consent that you gave to us before the applicability of the General Data Protection Regulation, i.e. before 25.05.2018. The easiest way to revoke consent you have given is to send an email to the contact details above. The revocation of consent does not affect the lawfulness of the processing of your data carried out until the revocation.

Data protection information for business contact

The controller processes your data to contact you. This information therefore applies to personal data provided to the controller in the course of its business or other activities by post, telephone, fax, e-mail or online. With this data protection information, we would like to inform you about the scope and purpose of the processing as well as your rights as a data subject.

Persons who transmit personal data of others to us must ensure that the data subjects agree to this and that this data may be transmitted to us as well as be informed about how personal data may be processed by us and what rights data subjects have.

(Status: August 2022).

1. Purposes and legal basis of the processing of personal data 

1.1 Establishing contact within the scope of a business relationship

For the initiation or implementation of a business relationship, we will process in particular your contact data (name, address, telephone number and e-mail address), communication data (e.g. correspondence by e-mail), if applicable location data (IP address).

The legal basis for this processing of your personal data is Art. 6 para. 1 lit. a GDPR (your consent) and lit. b GDPR (pre-contractual measures, performance of contract) if we receive the data directly from you or we enter into a direct contractual relationship with you.

If you are not an existing or potential business partner yourself, we have usually received your contact details from our business partner who has named you as a contact person. In this case, the processing of your data is based on Art. 6 para. 1 lit. f GDPR (balancing of interests, based on our legitimate interest in contacting existing or potential business partners).

The provision of personal data about you for the purpose of contacting you in the context of a business relationship is on a voluntary basis. Insofar as your contact data is absolutely necessary for the initiation and fulfilment of a contract, you and must disclose your contact data, as otherwise the contract with you cannot be concluded.

1.2 Establishing contact within the framework of our public relations work

We also maintain databases with contact details of political, media and press representatives, among others, in order to be able to contact them on relevant issues, events, etc. as part of our public relations work. 

The processing of your personal data is based on your consent (Article 6 paragraph 1 lit. a GDPR), which you can give us in personal contact (e.g. by handing over your business card or via online form). For your right to withdraw consent, please see point 5.8.

We also collect contact details from public sources and enter them in our databases. The legal basis for the data processing described is Art. 6 para. 1 lit. f GDPR. (Weighing of interests, based on our legitimate interest in contacting political, media and press representatives, among others, as part of our public relations work).

2. Recipients of personal data

As a general rule, your data collected by us will not be disclosed to unauthorised persons. 

However, in some cases we use service providers to process personal data, including for sending emails, chats and video telephony. Your data (contact data, communication data, location data (IP address) is stored in a secure data center and databases. 

All service providers have been carefully selected and are subject to data protection agreements with us. The service providers are only given access to your data to the extent and for the period required to provide the services or to the extent that you have consented to the data processing and use. 

We also use service providers located in third countries outside the European Union to process your data. Countries outside the European Union handle the protection of personal data differently than countries within the European Union. There is currently no decision by the EU Commission that these third countries generally offer an adequate level of protection. We have therefore taken special measures to ensure that your data is processed in the third countries as securely as within the European Union. With service providers in third countries, we conclude the data protection contract (standard contractual clauses) provided by the Commission of the European Union for the processing of personal data in third countries or implement other permissible guarantees or legally permissible exceptions from Art. 49 GDPR. This provides appropriate safeguards for the protection of your data with service providers in the third country. You can request a copy of these guarantees using the contact details above.

3. Storage period; deletion periods

We store the data processed by you for as long as it is required to achieve the purpose and a legal basis exists. When this ceases to apply, your data will generally be deleted within 1 month. In addition, your data will be stored/not deleted for as long as contractual or statutory retention periods exist for them. These amount to a maximum of 7 years in accordance with the Dutch law. 

4 Automated decision-making; profiling

We do not use your personal data for automated decision-making or profiling.

5 Your data subject rights

Insofar as DER processes your personal data, you as the data subject are entitled to the following data subject rights in particular, subject to the requirements of data protection law. 

5.1 Information 

You can request information about your personal data processed by us (Art. 15 GDPR).

5.2 Correction 

If your information is not (or no longer) accurate, you can request that your data be corrected. If your data is incomplete, you can request that it be completed (Art. 16 GDPR).

5.3 Deletion 

You have the right to request the deletion of your data. Please note that a right to erasure depends on the existence of a legitimate purpose. In addition, there must be no regulations that oblige us to retain your data (Art. 17 GDPR).

5.4 Restriction of processing 

You have the right to request the restriction of the processing of your data. Please note that a claim to restriction of processing depends on the existence of a legitimate purpose (Art. 18 GDPR).

5.5 Objection

If data is collected on the basis of Art. 6(1)(f) GDPR (data processing to protect overriding legitimate interests), you have the right to object to the processing of your data on grounds relating to your particular situation. In the event of an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the assertion, exercise or defence of legal claims (Art. 21 GDPR). 

5.6 Right of appeal

You have the right to lodge a complaint with the competent data protection supervisory authority if you do not agree with the processing of your data (Art. 77 GDPR).

A current list of the responsible supervisory authorities can be found at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

5.7 Data portability 

You have the right to receive personal data that you have provided to us in an electronic format (Art. 20 GDPR).

5.8 Revocation of your consent

You have the right to revoke consent (Art. 6(1)(a) GDPR) to the processing of your data which you have given to us at any time. Your personal data will be deleted on the basis of your consent as soon as the purpose has been fulfilled or until revocation and when prior-rating retention periods have expired.

The easiest way to revoke consent you have given is to send an email to the contact details below. The revocation of consent does not affect the lawfulness of the processing of your data carried out until the revocation.

6. Contact details of the data protection officer

Data protection officer

Patrick van Zijl

[email protected] 

7. Responsible company

Adventure Specialists B.V.

Entrada 223
1114 AA Amsterdam-Duivendrecht