Privacy statement

Brainpower Group recruits developers in Serbia and places them in the teams of companies in the Netherlands and Europe. Brainpower Group is a trade name of ESBL B.V., registered with the Dutch Chamber of Commerce under number 81886837. ESBL B.V. is responsible for the personal data we process (the controller under the GDPR).

You can reach us at hello@brainpowergroup.eu or +31 20 210 1978. Our postal address is Keizersgracht 62, 1015 CS Amsterdam, the Netherlands.

With the form on the contact page you send us a question or a job description. You enter your name, email address and message, and if you like a job title, your company and your phone number. The website sends this to us as an email through Brevo (Sendinblue SAS, France). We do not store the message on the web server.

A copy of the message goes to an internal channel on Discord (Discord Inc., United States), so we still have it if the email does not arrive.

To stop spam, the server counts how many messages come from the same IP address. It does this in memory only; the IP address is not stored in a database.

We use this data to answer your question and, if you want, to prepare working together.

The chat runs on Crisp (Crisp IM SAS, France), which stores the data in Europe. The chat script loads a few seconds after the page has loaded, or straight away when you click a chat button or send a question from a question box. Crisp then sets a cookie that remembers your chat session (six months by default) and processes your IP address.

What you type in the chat reaches us in Crisp. After your first message Crisp asks for your email address. If you enter it, we can reply even after you have closed the chat. We only tell Crisp that you are chatting from this website, in which language, and from which button or page.

You book appointments through Sprintful. When you click the button to book an appointment, a Sprintful window opens. There you choose a time and enter your details, such as your name and email address. That data goes to Sprintful and into our calendar.

The Sprintful script loads a few seconds after the page, so the button works straight away. Sprintful sees your IP address when it loads. In the booking window Sprintful uses its own cookies and services from other companies. According to Sprintful's privacy policy, its servers are in the United States.

The contact page shows a Google Maps map. When you view that page, the map loads from Google (Google Ireland Ltd.). Google then sees your IP address and may set cookies. Google's privacy policy applies to this.

The website runs on a server of Hetzner Online GmbH in Germany. The server records which IP address requested which page, when, and with which browser. We use these logs only to secure the website and to find faults, and keep them for at most 30 days.

We do not measure visitor statistics and use no advertising cookies or tracking pixels. The fonts are served from our own server; your browser fetches nothing from Google Fonts.

The website itself sets at most one cookie: NEXT_LOCALE. It remembers the language you choose and is deleted when you close your browser. The cookies of Crisp, Sprintful and Google Maps are described above under those services.

When you email or call us as a client or candidate, we use your data to handle your request, for recruitment and for contracts. Our email runs on Microsoft 365 (Microsoft Ireland Operations Ltd.).

For candidates we keep the CV, contact details, notes from interviews and the results of technical tests. We share this data only with a client, and only for the role in question.

For clients we keep the contact details of the people we work with, and proposals, contracts and invoices.

We do not sell personal data. These parties receive data through the website or from us:

• Brevo (Sendinblue SAS, France), for email from the contact form
• Discord Inc. (United States), for a copy of messages from the contact form
• Crisp IM SAS (France), for the chat
• Sprintful (servers in the United States), for appointments
• Google Ireland Ltd. (Ireland), for the map on the contact page
• Hetzner Online GmbH (Germany), for hosting the website
• Microsoft Ireland Operations Ltd. (Ireland), for our email

Discord and Sprintful store data in the United States. For data leaving the EU, Discord's privacy policy names the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses.

We share candidate data only with the client the role is for.

We process personal data on these legal bases from article 6 of the GDPR:

• Consent, for example when you as a candidate agree that we keep your data for 1 year. You can withdraw consent at any time.
• A contract: preparing and carrying out an assignment, or scheduling an appointment you book yourself.
• Legitimate interest: answering questions from the form and the chat, recruiting candidates and securing the website.
• A legal obligation: Dutch tax law requires us to keep our records for 7 years.

• Messages through the form, email and chat: up to 2 years after the last contact.
• Candidate data: up to 4 weeks after the application process ends, or up to 1 year if you consent to that.
• Records such as proposals, contracts and invoices: 7 years (Dutch tax retention obligation).
• Server logs: at most 30 days.

The website uses an encrypted connection (https). Messages from the contact form go straight to us as email and are not kept on the web server. Only people who need the data for their work have access to it. If you think something is wrong with your data, email hello@brainpowergroup.eu.

You have the right to access your data, to have it corrected and to have it deleted. You can also ask us to restrict processing, object to processing, receive your data to take to another party, and withdraw your consent. Email hello@brainpowergroup.eu for any of this. We reply within one month.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in the country where you live.