Privacy statement employees and hired workers

GDPR

Snijder B.V.

Privacy statement employees and hired workers The General Data Protection Regulation (referred hereinafter as: the ‘GDPR’) has been applicable to the processing of personal data since 25 May 2018.

What is the GDPR? The rules to be complied with by anyone who processes personal data are set out in the European GDPR. In addition to protecting this data well, everybody has to grant permission explicitly for the use of his/her data for a specific purpose.

What does this mean for the employer?

As your employer we, Snijder B.V. and Snijder Project Support B.V. (referred to hereinafter as: ‘Snijder’), process your personal data as the party responsible for processing.

Snijder respects your privacy and ensures that your personal data is processed in conformity with legislation and regulations. In this statement, we inform you about the various subjects with respect to the processing of your personal data.

Contact details Name: Snijder B.V. and affiliated companies Visiting address: Kernweg 41, 1627 LH Hoorn, the Netherlands Postal address: Postbus 527, 1620 AM Hoorn, the Netherlands General telephone number: +31 (0)229 210617 General email address: snijder@snijder.nl Website: www.snijder.nl

1/3

If you have any questions, please contact: Details Data Protection Officer Data Protection Officer: Stephan Koppes Email address: s.koppes@snijder.nl Details privacy contact (this is not the Data Protection Officer) Contact: Iet Jongbloed Email address: i.jongbloed@snijder.nl Personal data processed Snijder processes various personal data for the benefit of executing the contract of employment and all administrative activities concerning employment. These activities are included in the processing register.

Purposes of processing Snijder primarily collects your personal data to be able to execute – in a wide sense – the contract of employment. Processing especially takes place in personnel administration, absence registration, ICT systems, salary records, and financial administration.

Snijder processes your personal data for the following purposes: • Performing a proper personnel administration, payroll administration, and internal management; • Contacting you and maintaining contact with you (by post, telephone and email);

• Using INSITE, the personal environment of Profit from Afas; • Complying as an employer with the obligations pursuant to the employment relationship, such as salary payment, providing pay slips and annual statements, realising participation in a pension scheme and/or taking out the insurances required; • Complying as an employer with statutory obligations, such as obligations concerning absence and reintegration, tax payment, paying the proper salary, participation in a compulsory pension fund of the industry or pension insurance or being able to apply for or obtain any benefits; • Giving you access to Snijder sites, buildings and rooms; • Informing you about developments at Snijder; • For the international travellers, taking care of visa formalities, booking flights, arranging for access to the clients’ work sites; sending passport details and/ or data for this; applying for A1 statements; • Organising training/education; recording diplomas and certificates; • Making appointments for testing/ examinations and preparing the report; • Submitting name, address and salary details to insurance companies.

EARTH MOVING EQUIPMENT ANY PLACE, ANY TIME

GDPR

Snijder processes the personal data obtained for the above-mentioned purposes exclusively. If Snijder intends to use your personal data for other purposes, Snijder will contact you to offer you the opportunity to object to further processing. This will take place before or during any processing, and the information about the said other purpose will be shared with you.

Legal grounds processing Each processing with respect to the afore-mentioned purposes has at least one legal ground. More information about these legal grounds is provided below.

Execution contract (of employment) In many cases, Snijder processes your personal data to execute your contract of employment and perform all administrative activities concerning your employment.

Compliance with statutory obligation In many cases, Snijder processes your personal data to be able to comply with a statutory obligation imposed on Snijder.

Right to be forgotten The right to be forgotten is set out in the GDPR. This is the right you have to have your data deleted from the files. Employees have to comply with the provision that certain data is not allowed to be deleted or cannot be deleted. This is stipulated by law.

Permission In principle, Snijder as an employer will not (only) base the processing of your personal data on your permission. Your free, explicit and unequivocal permission is required for processing data on the basis of your permission. As the relationship between Snijder and you is a relationship of authority, it is assumed that in most cases you cannot give your approval in full freedom. There are some exceptions to this principle. If Snijder gives extra guarantees to ensure you can give or refuse your permission in freedom without running the risk of suffering any adverse consequences as a result, the permission can still be considered permission rendered freely. In

2/3

Snijder B.V.

that case, Snijder can base the data processing on your permission.

Consequences of not providing personal data Snijder will inform you in advance about cases in which you are held to provide personal data that will then be processed by Snijder pursuant to: • a legal or contractual obligation and/or; • because this is a condition that is necessary for being able to enter into an agreement.

Retention term As to your personnel file, the specific obligation applies that Snijder retains this file until two years after the termination of your contract of employment, on the advice of the Personal Data Authority (Autoriteit Persoonsgegevens). As the occasion arises, this retention term can be shorter or longer if the respective data is no longer relevant or is relevant longer.

Data from the salary records that is relevant from a tax perspective is retained by Snijder in conformity with the statutory retention term until seven years after termination of your employment.

Wage tax statements and a copy of your proof of identity are retained

by Snijder in conformity with the Dutch Income Tax Act (Wet op de Loonbelasting) 1964 until five years after termination of your employment.

No legal terms or terms established internally in advance apply to retaining your other personal data. Snijder uses the principle that your personal data cannot be retained any longer than strictly necessary for the purposes for which your personal data is collected. When your personal data is no longer relevant for the purposes mentioned, it will be deleted by Snijder.

Recipients of personal data Snijder shares your personal data with other parties. This pertains for instance to the following recipients (if applicable):

• Client(s); • Visa bureau; • Travel agency; • Training centre; • Inspection bodies; • Insurers; • Pension insurer or the pension fund; • The Dutch Tax and Customs Administration (Belastingdienst); • The body implementing employee insurance schemes (Uitvoeringsinstituut Werknemersverzekeringen, UWV); • The Dutch National Insurance Institute (sociale verzekeringsbank); • The Health & Safety Service (arbodienst).

If one of the parties above has the role of ‘processor’, Snijder will check if it has a Processor Agreement with this party and/or will enter into a Processor Agreement with this party to safeguard the protection of your data.

Transfer of personal data to a third country outside the European Union If personal data is not processed outside the EU: Your personal data is not processed in countries outside the European Union.

If personal data is processed outside the EU: • Your data can be submitted to clients in the countries where we work. The purposes for this include booking flights, issuing admission badges for the project, organising training, etc.

• Your personal data is transferred securely.

Your rights Pursuant to the GDPR, you are entitled to various rights concerning your personal data: • The right to inspection and obtaining a copy; • The right to rectification; • The right to data sharing; • The right to restriction of data processing; • The right to object to data processing; • The right to transferability of data;

EARTH MOVING EQUIPMENT ANY PLACE, ANY TIME

GDPR

• The right to be excluded from being subjected to automated decision-making.

If you want to exercise your rights, you can submit a request, using the contact details stated in this letter.

It should be noted that the abovementioned rights are not absolute.

This means that Snijder does not in all cases need to comply with a request for exercising one of the afore-mentioned rights.

Within one month after Snijder received a request from you for exercising one of the afore-mentioned rights, Snijder will inform you. When doing so, Snijder will indicate if and how your request will be complied with, and, if it is not complied with, why not. If this is necessary in the context of the request, Snijder can prolong the response term of one month. In that case, Snijder will inform you within one month within which term a reaction will be

3/3

Snijder B.V.

provided. In principle, your exercising of your right(s) is free of charge.

Right to withdraw the permission granted If a person involved has granted permission for processing personal data, he/she can withdraw this permission at all times.

Comments Although privacy is essential, there is always a risk of errors. If errors are made, we can learn from them.

If you think that something is not correct with respect to privacy, please send an email to privacy@snijder.nl The question or comment will be handled, and the reply will be fed back. With this question or comment we can improve privacy at Snijder.

your personal data. You can file a complaint with the supervisory body. In the Netherlands, the Personal Data Authority (Autoriteit Persoonsgegevens) is the supervisory body with respect to the processing of personal data. The contact details of the Personal Data Authority are provided on the website www.autoriteitpersoonsgegevens.nl.

Amendments The privacy statement as described in this letter was drawn up in October 2018 and can be amended.

You will be informed about these amendments in time via Insite.

Please, use the contact details above if you have any questions with reference to this letter.

Filing complaints You may have a complaint about the way in which Snijder processes

EARTH MOVING EQUIPMENT ANY PLACE, ANY TIME