NXT Capital B.V. ("NXT", "we", "us") is a company incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce under number 75312026, with its registered office at Hildegard von Bingenstraat 14, 1081 LH Amsterdam, the Netherlands.
NXT recruits under the Pinely brand and is the controller of the personal data described in this Recruitment Privacy Notice.
This Recruitment Privacy Notice explains how we collect and process personal data in connection with our recruitment activities and the rights available to you under the General Data Protection Regulation (EU) 2016/679 ("GDPR").
We use Workable as our applicant tracking system to support and administer our recruitment process. Workable processes personal data on our behalf as a processor and is required to process that data in accordance with our documented instructions and applicable data protection law.
If you apply through a third-party job site or recruitment platform, we may receive personal data about you from that platform and, where applicable, provide information to it about the progress of your application. The relevant platform may also process personal data for its own purposes as an independent controller. Its own privacy notice will apply to that processing.

Your personal information
Depending on the recruitment process, we may process the following categories of personal data:

• identity and contact information, such as your name, email address, telephone number and address;
• information contained in your CV, resume or cover letter, including your education, qualifications, skills, certifications and employment history;
• information you provide in response to application form questions;
• correspondence with you concerning your application;
• information about the progress and status of your application;
• interview notes, assessments and other recruitment-related evaluation information;
• information generated during the recruitment process, such as application status and recruitment decisions;
• and where applicable, video or audio information where a recruitment process expressly involves a recorded video interview.

Please do not provide personal data that is not relevant to your application unless we specifically ask you to do so.

Personal data we obtain from other sources
We may obtain professional information about potential candidates from third parties or publicly available professional sources. This may include professional profile information, employment history, qualifications, skills and contact information available through professional networking platforms or other professional sources.
We may also receive personal data about you from recruitment agencies, professional referrers or other individuals who recommend you for a particular role or for opportunities with NXT more generally.
Where we obtain personal data about you from another source and you have not already received this Recruitment Privacy Notice, we will provide you with the information required by applicable data protection law within the applicable timeframe.

Why we process your personal data
We may process your personal data in order to:

• administer and assess your application for a role;
• communicate with you about your application and the recruitment process;
• manage and document our recruitment and selection process;
• arrange and conduct interviews and assessments;
• identify and contact potential candidates for our vacancies;
• verify information provided as part of the recruitment process where appropriate;
• comply with applicable legal requirements;
• establish, exercise or defend legal claims; and
• where you have consented, consider and contact you in relation to suitable future vacancies.

Lawful bases for processing
For our ordinary recruitment activities, we rely primarily on our legitimate interests under Article 6(1)(f) GDPR in recruiting suitable personnel and operating an effective and fair recruitment process.
Where we ask for your consent to retain your application information so that we can contact you about future vacancies, we rely on your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before your consent was withdrawn.
We may also process personal data where this is necessary to comply with a legal obligation to which NXT is subject.
Where necessary, we may retain and process relevant personal data for the establishment, exercise or defence of legal claims.

Automated processing and decision-making
We use Workable to administer our recruitment process. Certain functions may involve automated processing, for example extracting information from a CV and structuring that information within a candidate profile.
Unless we specifically inform you otherwise in relation to a particular recruitment process, NXT does not make decisions that produce legal or similarly significant effects concerning candidates based solely on automated processing. Recruitment decisions are subject to human assessment.
If we use automated decision-making to which Article 22 GDPR applies, we will provide you with the information required by the GDPR, including meaningful information about the logic involved, the significance and envisaged consequences of the processing and the safeguards available to you.

Who we share your personal data with
Where necessary for the purposes described in this Recruitment Privacy Notice, we may share your personal data with:

• NXT personnel involved in recruitment and hiring decisions;
• Workable and other service providers that process personal data on our behalf in connection with recruitment;
• recruitment agencies and other recruitment service providers, where relevant;
• professional advisers, such as legal advisers, where necessary;
• job boards or online recruitment platforms through which you apply, where information is exchanged with those platforms in connection with your application; and
• public authorities, courts, regulators or other third parties where disclosure is required by law or is necessary for the establishment, exercise or defence of legal claims.

We require service providers acting as processors on our behalf to process personal data only in accordance with our instructions and applicable data protection requirements.
Where a third-party recruitment platform processes personal data for its own purposes as an independent controller, its own privacy notice will apply to that processing.

International transfers
Some of our service providers may process personal data in, or permit access to personal data from, countries outside the European Economic Area ("EEA").
Where personal data is transferred to a country or recipient covered by an adequacy decision of the European Commission, we rely on that adequacy decision.
Where no adequacy decision applies, we use an appropriate safeguard under the GDPR, such as the European Commission's Standard Contractual Clauses, together with any supplementary safeguards required in the circumstances.
You may contact us using the details below if you would like further information about international transfers or the safeguards that apply.

Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to recruitment data is restricted to individuals who require access for legitimate recruitment or related business purposes and who are subject to appropriate confidentiality obligations.

How long we keep your personal data?
If your application is unsuccessful, we will ordinarily delete your recruitment data no later than four weeks after the recruitment procedure has ended.
We may ask for your consent to retain your application information so that we can contact you about suitable future opportunities. If you consent, we will retain your recruitment data for this purpose for up to one year. You may withdraw your consent at any time.
We may retain particular information for longer where this is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims. In those circumstances, we will retain only the information necessary for that purpose and only for as long as necessary.
If your application is successful, personal data that is relevant to your employment may become part of your personnel records and will then be processed and retained in accordance with the privacy information and retention requirements applicable to employees.

Do you have to provide your personal data?
You are not generally under a statutory obligation to provide personal data to us as part of a job application. However, we need certain information in order to assess and administer your application. Where information is required for this purpose, failure to provide it may mean that we are unable to consider or progress your application.
Where applicable, optional application fields will be identified as such.

Your data protection rights
Depending on the circumstances and subject to the conditions set out in the GDPR, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of the processing of your personal data;
• object to processing based on our legitimate interests;
• receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and, where applicable, have that data transmitted to another controller;
• withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• and not be subject to a decision based solely on automated processing where Article 22 GDPR applies.

You will not normally have to pay a fee to exercise these rights.
If you wish to exercise a data protection right, please provide sufficient information for us to identify you and understand your request. Where we have reasonable doubts concerning your identity, we may request additional information that is necessary to verify your identity.

How to complain
If you have concerns about how we process your personal data, we encourage you to contact us so that we can try to resolve your concerns.
You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection supervisory authority. Depending on the circumstances, you may also have the right to lodge a complaint with another competent supervisory authority under Article 77 GDPR.

Contact
If you have any questions about this Recruitment Privacy Notice, our processing of your personal data or if you wish to exercise a data protection right, please contact us at: privacy@pinely.com

Changes to this Recruitment Privacy Notice
We may update this Recruitment Privacy Notice from time to time to reflect changes in our recruitment practices, service providers or applicable legal requirements.
The current version will be made available through our recruitment process.


Last updated: August 2026