Privacy policy
1. Introduction

This privacy statement describes how the publisher of the website www.pinely.com, NXT Capital B.V. (hereinafter "NXT Capital" or "we") handles your personal data. Please note that NXT Capital is a partner of Pinely group, and therefore Pinely branding, domain and e-mail addresses might be used on the website and in the communication. Processing of your data is however done by NXT Capital, unless it is otherwise indicated in this privacy statement.
Our goal is to comply with privacy laws, and to inform you as required under those privacy laws.
Personal data is data which can be used to identify you.
Below you will find information on the following topics:
- In which cases we process personal data (section 2).
- What kind of personal data we process (section 3).
- For what purpose and for how long we process personal data (section 4).
- Information about the legal basis for the processing of personal data (section 5).
- Information about how we protect your personal data (section 6).
- Information about transfer of personal data outside the European Economic Area (section 7).
- Information about the use of cookies (section 8).
- What your rights are (section 9).
- How to contact us with questions, requests and complaints about the use of your personal data (section 10).
If you have provided personal data to us, we kindly ask you to help us keep your personal data up to date by informing us of any changes, especially your contact details.

2. In which cases do we process your personal data?

We process your personal data in the following cases:
- If you contact us by mail, phone or email, or request information through the website.
- If NXT Capital contacts you by mail, phone or email.
- If you upload data, such as through your resume, CV, and/or cover letter.
- If a government, regulator, authority or court gives us a legally valid order or demand to provide personal data, which we are legally obliged to comply with.

3. Which categories of personal data do we process?

NXT Capital may process the following data from you:
- If you use a general contact form, or contact us directly, NXT Capital processes name, first name, email address and possibly your phone number if you provide it yourself.
- You may also provide your phone number and/or address in other, specific, direct one-to-one contact in which case we might store and process that as well, if necessary within the context of the contact we have.
- If you express interest in a position with us and upload or send us data, such as your resume, CV, and/or motivation letter. Please be aware that much of the information in a resume, CV, and motivation letter is personal data under the applicable privacy regulations.
- The following information is therefore considered personal data by us, and we will handle it with care accordingly: Name (incl. first name, last name), date of birth, place of birth, home address, residency, passport photo, bank details (Note: does not have to be provided through the CV/resume), employment history, education details, personal motivation and any other personal characteristics that come up in a resume, CV, and/or motivation letter.
- When you visit the website, data about your visit in aggregated, anonymized form is represented into reports from the software we use to measure user statistics. We use these to analyze the use of the website. We also register your consent with or refusal to accept cookies. This data is not traceable to you as an individual visitor for us as a user of the software.

4. For what purposes and for how long do we process your personal data?

NXT Capital processes your personal data only to the extent and for as long as necessary:
- When you contact us through a general contact form on our website and in other one-on-one contact: Your data will be used and retained to the extent, and for as long as, necessary for the purpose of the contact, and for a maximum of 3 calendar months after that purpose can reasonably be deemed to have been fulfilled.
- Direct contact can have different purposes, such as a job application, a possible commercial cooperation, or informative purposes.
- Data that you upload when expressing interest in a job opening, such as a resume, CV, and/or cover letter are used to study and assess whether your data and profile match the job openings we have, and whether it makes sense to start an application process.
- In respect of an application for a job, your personal data, and data on the course of a procedure, may also be used indirectly in evaluations of our recruitment and HR policies, subject to the maximum retention periods listed below.
- Once an application procedure is initiated, we will retain your data for up to 4 weeks after the procedure is completed.
- Notwithstanding the above, when uploading your data via our website you may check the box indicating your explicit consent to the retention of the data for up to 1 year. In this case, if subsequent vacancies occur, we will assess whether it makes sense to contact you to investigate whether we can initiate a new application process.
- If you email your resume, CV, and/or motivation letter to us, we will also ask you for explicit consent to the retention of the data for up to 3 years. Thus, if subsequent vacancies occur, we will assess whether it makes sense to contact you to investigate whether we can initiate a new application process.
- If an employment relationship is entered into, the processing of personal data which you provided during the application procedure will be governed by the terms and conditions applicable to the employment relationship.

5. Lawful grounds for processing

Personal data may only be processed under the privacy regulations if there is a lawful ground for doing so.
NXT Capital generally processes data on the following grounds:

6. Protective measures

Privacy law requires us to apply appropriate technical and organizational measures that protect your personal data from loss, destruction or damage. For example, by encrypting data and restricting access.
The technical and organizational measures we apply are in accordance with the latest applicable insights. This ensures a level of security appropriate to the existing risks.
In practical terms, this means that your personal data will only be stored on our own servers, and when sent within our organization, the security measures customary within the current business environment will be applied.

7. Transfer to other countries inside the EU, and outside the European Economic Area

NXT Capital is an international enterprise with Offices (hereinafter the term “Offices” include NXT Capital’s branches, representative offices, affiliates, business partners, considering also prospective ones) and operations in other countries. Within the EU our Cyprus Offices might process your personal data as part of the recruitment and onboarding process, or as part of your employment if you are employed by our local Offices there.
For these purposes we also may use a business partner which is not a direct affiliate of NXT Capital. In such case appropriate contractual arrangements are in place to safeguard an equal level of protection as applies within our own organization.
NXT Capital also has operations and business partners outside the European Economic Area (EEA). At the moment this is mainly Singapore, but in the future other countries could be included.
If you upload or otherwise provide us with your personal data, it is used to provide you with an appropriate response. In doing so, your personal data might be stored, read, processed and used by our employees and employees in our foreign Offices outside the EEA, but only insofar as necessary. For instance: The responsible manager is travelling and using our facilities outside the EEA.
When uploading personal data, such as resume, CV, and/or cover letter, you are therefore given the opportunity to explicitly consent to the transfer of your data to (employees of) NXT Capital and its affiliates / third party business partners, that are involved in the recruitment and onboarding process, in such foreign locations by ticking a check box.
A uniform level of protection applies within NXT Capital and its affiliates and third party business partners: NXT Capital and its affiliates and third party business partners apply the same strict technical and organizational measures to data transferred outside the EEA as NXT Capital does to data within the EEA. We therefore consider the risks to your privacy, from transfers to foreign locations, to be limited.
However, you should be aware that the countries concerned may not offer the same level of protection of personal data as EEA countries.
If you have any questions about international transfers of personal data, please contact us at privacy@pinely.com.

8. Cookies

When you visit our website, you can choose which cookies you accept:
· "Necessary cookies only" option: You then agree to the use of the functional cookies necessary for the website to function properly. This option cannot be turned off (this is allowed under the privacy law).
· The "Allow all cookies" option: You then agree to the placement of statistical analysis cookies and the cookies registering your consent or refusal of cookies.
Most web browsers also have automatic settings to control the acceptance/non-acceptance of cookies. The settings vary by web browser, and for more information on this it is best to visit the support page of your web browser.
Most cookies have an expiration date. If an expiration date is set, the cookie is automatically deleted when the expiration date expires. You can also choose to delete cookies manually, before the expiration date has passed. This usually works most easily through the browser's settings menu (rather than manually on your computer's hard drive). The settings vary from one web browser to another, and it is best to visit the support page for your web browser for instructions and more information.

9. Your rights under the privacy regulations

Under the General Data Protection Regulation, you have the following rights towards NXT Capital:
- Right of inspection: your have the right to inspect the personal data we process about you.
- Right to rectification: your have the right to correct or supplement the personal data we process about you if it is incorrect or incomplete.
- Right to withdraw your consent: you can easily withdraw your consent at any time.
- Right to object: you can object to the processing of your personal data.
- Right of deletion: you can request us to delete your personal data.
- Right to restrict processing: in some cases, you can request that we restrict (temporarily or otherwise) the processing of your personal data, which means that we process less of it.
If you wish to exercise any of these rights, we will in principle comply with your request within one month. However, this period may be extended by two months for reasons related to the specific privacy rights or the complexity of the request. If we extend this deadline, we will notify your within the first month.
If you wish to exercise any of your rights, you may do so by contacting us using the contact information provided at the bottom of this privacy statement.
If you have any other questions or wish to make a complaint regarding the use of your personal data, please contact us using the contact details in the next section. We address all questions and complaints internally and will as soon as possible also follow up with you. If you feel that we are not responding properly, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) to file a complaint.

10. Contact

Do you have a question, request or complaint about NXT Capital's use of your data?
In such a case, please feel free to contact us by sending an e-mail to privacy@pinely.com.
Together we will then see what we can do to answer your question, request or complaint in the best possible way and in accordance with the applicable privacy regulations.

20 January 2023