We are Xebia, an IT Consultancy company with its registered office at Laapersveld 27, 1213 VB Hilversum (The Netherlands). By visiting our website and sharing your Personal Data, Xebia is responsible – both as controller and/or processor - for the collection and use of your Personal Data.

1 Terms such as "process/processing", "data subject", "processor”, "controller" and "personal data", etc., shall have the same meaning ascribed thereto in Article 4 of the GDPR, irrespective of whether the GDPR applies.

2 With “Affiliates” we mean those persons or entities located in various countries throughout the world which directly, or indirectly, individually or in combination, control, are controlled by, or are under common control with Xebia’s ultimate parent company.

Xebia respects your privacy and recognizes the importance of providing a secure environment for your Personal Data. That is why we aim to provide you with clear and transparent information as to why and how we process your Personal Data. 

When you access and/or visit one of our Websites, we may collect, use, store and transfer various kinds of Personal Data. The data we use depends on the purpose for which we process the data. We will only use your data for the purposes described in Section 3.

1. Basic Personal Data provided by you

When you access or visit one of our Websites, you may provide certain information to us, or receive a request to provide certain information to us, including but not limited to:

• First and last name

• E-mail address

• Telephone number

• Job Title

• Country of residence

  2. Special Categories of Personal Data

As a general principle, we do not process ‘Special Categories of Personal Data’, and do not ask you to provide such information. ‘Special Categories of Personal Data’ includes sensitive data such as race, ethnic origin, political opinions or philosophical beliefs, religion, trade union membership, sexual preferences or orientation, health data or criminal data.

3. Minors

Our website(s) are a general audience site, and we do not intend to market to or collect, nor do we knowingly collect, personal information from children under the age of 16. Unfortunately, we cannot always determine the age of a visitor to our website(s) or the sender of an email.

4. Personal Data we receive or generate from your use of our Websites

When you visit our websites, we may also process device-related data and information about your interactions with our Websites, including:

• Technical data: We collect information about your device and/or device settings for the purposes described in Section 3 of this Privacy Policy and may combine this information across the different devices you use. The information we collect from these devices includes what type of device you use, online identifiers (your IP address), device IDs, website IDs, geolocation data (based on your IP address), and other technical data.

• Cookie data: As described in more detail in our Cookie Statement, we use cookies and similar technology, such as pixels or local storage, and allow third parties to use cookies and similar technology for the purposes listed in Section 3 of this Privacy Policy. The process of placing cookies as well as the scope of the data that may subsequently be processed is described in our Cookie Statement.

• Your usage: We collect information about how you use our Websites. This information includes your preferences, such as your interests in certain categories of consulting services, the actions you take, and the time and duration of these actions. We also collect information about the websites that led you to our Website.

  5. Personal Data we collect from other third parties

In certain cases, we will also obtain your Personal Data from third parties. We do so in full compliance with applicable data protection laws and regulations.

For example: we may also receive information about your approximate geolocation (the country in which you are located) from third parties (e.g. Google). We use this information to comply with our legal obligations regarding the processing of your Personal Data, to customize certain services to your location, and to prevent fraud or misuse.

6. Personalization activities

If you provide consent to do so via the cookie notification, we may use tracking mechanisms to track your Personal Data for profiling purposes. This allows us to display relevant content and tailor our services to your interests. For example, we may expose specific content or local events fitting to your location. You have the right to object to this type of data processing.

7. (Job) Applications

When applying and interviewing for a position at Xebia, you provide a lot of personal data. Also, feedback will be collected throughout your interview process which contains your performance during these interviews. 

Xebia will keep your data regarding your application and interview process for a maximum of 3 (three) years after you finish this process. This term may be extended: we will send you an e-mail to renew your consent. If you don’t provide us with this consent, we will delete your data after 1 (one) month.

For more information see our ‘Recruitment Privacy Policy’. 

Depending on the Website you are using, we may process your Personal Data for the following purposes:

1. Provision and improvement of our services

• to facilitate content sharing on social networks

• to provide technical/customer support and respond to your requests

• to identify and correct any bugs/errors

• to gain insight into the popularity of our service offerings

• to assess the quality of our services

• to understand and improve your online experience

• to aggregate financial reports in order to pay our business partners

B. Personalization of your experience

• to remember your preferred settings

• to pre-populate forms

• to recommend content you might enjoy on the basis of your interests

• to display personalized offerings

• to remember you the next time you visit one of our Websites

C. Marketing and analytics

• to include (targeted and non-targeted) offerings on our Websites

• to measure the effectiveness of our websites

• to send you marketing communications

• To analyze your engagement and, if applicable, stop communications

D. Preventing fraud and illegal activities

• to detect fraudulent activities and illegal conduct on our Websites

• to comply with and enforce our policies and Terms & Conditions

E. Communication

• to provide you with customer support based on your questions, requests, or complaints

• to send you service emails, so that you can activate your account, for instance, or in case you forget your password

F. Compliance with our obligations on the following legal basis

We process your Personal Data, based on the following legal basis:

• Your consent: We process your Personal Data if you have granted consent to process data for a specific purpose. For example, when you first visit our Website, we ask for your consent to process data e.g. in forms or activating a chat conversation. You have the right to withdraw your consent at any time. Please note that this will not affect any processing carried out prior to the withdrawal of your consent.

• Performance of a contract: We process your Personal Data for the purpose of performing a contract to which you are a party. For example, to facilitate the provision of requested services.

• Compliance with legal obligations to which we are subject: We process your Personal Data in order to comply with legal obligations. For example, to respond to your requests related to your rights as a data subject and other obligations, such as informing you of any changes to this Privacy Statement.

• Legitimate interests: We may also process your Personal Data to the extent that such processing is necessary for our legitimate interests or those of third parties in the application of appropriate safeguards to protect your privacy. For example, we may process your Personal Data to improve the services we provide to you, to enhance your user experience, and ensure the proper functioning of our services.

We will not disclose your Personal Data to any party that is not authorized to process such data. To manage our services, we will share your Personal Data internally with members of the relevant departments and technical support staff involved in the process, and in each case only if access to your Personal Data is necessary for the fulfilment of their professional tasks.

In addition, and only when necessary to fulfil the purposes mentioned above, we may disclose your Personal Data to the following recipients or categories of recipients or permit the following third parties to collect your Personal Data in connection with your use of our Websites:

• External service providers: We may share your Personal Data with external service providers who perform services on our behalf, like customer support service, IT services, hosting and content delivery services, web/social analytics services, data management services, data sharing services on social media, video hosting services, and user notification services. When we share your Personal Data with external service providers, we have appropriate agreements in place to ensure that your Personal Data is processed in compliance with applicable data protection laws.

• Social networks and related third-party platforms: If you wish to share certain content on social media, you will be asked to log in with your login credentials for the relevant social media platform. In this case, a link to the website you wish to share will be published on the relevant website/social network platform. In addition, the social media sharing service we use to enable you to share content on social networks may collect certain information, such as your IP address, geolocation data based on your IP address, the URL that leads to the website, the date and time you visited and used our Website, and whether you used the toolbar to share content.

• Law enforcement, government agencies, or judicial authority: We may disclose your Personal Data in response to lawful requests to public authorities, including law enforcement, government agencies, or the judiciary.

• Other third parties: We may also disclose your Personal Data in the event of any intended or initiated reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business or assets (including in any insolvency or similar proceedings).

Below you’ll find an overview of the third parties with whom we may share your Personal Data or who may share your Personal Data with us.

• SalesForce

• Eventbrite

• GoToWebinar

• HotJar

• SurveyMonkey

• Slack

• TypeForm

• Unbounche

• VidYard

• Zapier

• Zoom

• Instagram

• LeadInfo

• Slack

• Microsoft (Outlook calendar)

• CEDEO

1. How we protect your Personal Data

We have implemented appropriate technical and organizational security measures designed to protect your Personal Data against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We update and test our security standards on an ongoing basis. In addition, we take all reasonable measures to ensure that third parties to whom we transfer your Personal Data provide sufficient Personal Data protection.

2. How long will we store your Personal Data

We will not retain your Personal Data longer than necessary to fulfil the purposes for which the data was collected or to fulfil our legal obligations. We will subsequently delete or anonymize your Personal Data. 

In general, your data is stored on servers within the European Union (EU) / the European Economic Area (EEA).

However, your data may also be shared outside the EU / EEA. Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here).

For the transfer of Personal Data from the EEA to countries not considered by the European Commission to provide an adequate level of protection, we have taken appropriate measures, such as standard contractual clauses adopted by the European Commission, to protect your Personal Data. You can obtain an overview of these measures by clicking here.  

1. Your rights

To the extent permitted by applicable data protection laws and regulations, you have the following rights with respect to your Personal Data:

• To access the Personal Data we hold about you, including information such as the source and categories of data, the processing purposes, the recipients (or categories thereof), and the respective retention period.

• To request an update or correction of your Personal Data so that it is always accurate.

• To receive your Personal Data in a structured, commonly used and machine-readable format, including the right to transfer your Personal Data to another data controller.

• To request the deletion of your Personal Data if you believe that retention is no longer necessary for the purposes indicated above.

• To restrict the processing of your Personal Data in certain circumstances, for example, if you have contested the accuracy of your Personal Data, and for a period of time that is sufficient to allow us to verify its accuracy.

• To withdraw your consent at any time if your Personal Data is processed with your consent. Please note that this will not affect the lawfulness of data processing based on consent granted prior to its withdrawal.

• To object on specific grounds relating to your particular situation, in the event and to the extent that we process your Personal Data based on our legitimate interests. In that case, we will no longer process your Personal Data unless we have compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or within the framework of establishing, exercising or defending legal claims. You also have the right to object if we process your Personal Data for marketing purposes (including profiling). In that case, we will stop processing your Personal Data for marketing purposes.

  2. Privacy Office

If you wish to exercise your rights, please send your request to the Privacy Office:

Xebia Group B.V.

Laapersveld 27

1213 VB Hilversum (The Netherlands)

E-mail: privacy@xebia.com

Please specify in your request, insofar as possible, to which Personal Data your request relates and what right you wish to exercise and provide evidence to demonstrate that you are the individual to whom the Personal Data relates. We aim to respond to your request within a period of one month.

3. Queries, comments, or complaints

If you have any questions, comments, or complaints about this Privacy Statement, please feel free to contact us. If you believe we have failed to comply with our obligations under applicable data protection laws and regulations, you have the right to lodge a complaint with the competent supervisory authority. In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) in The Hague is responsible for monitoring compliance with privacy regulations. 

We regularly review and update this Privacy Statement.

This Privacy Statement was last updated on 16 January 2024.