Privacy notice the Referral Specialist

Last updated: 9 October 2026

At De Referral Specialist, we handle your personal data with care. This privacy notice explains which data we use, why we use it, how long we retain it and what rights you have.

This notice applies to visitors to our website, people who contact us, those who request our publications, contacts at client organisations and other business contacts.

1. Who is responsible for your personal data?

De Referral Specialist is a trading name of De Wervingsspecialist B.V. This company is the controller responsible for the processing of personal data described in this notice.

Our contact details:
De Referral Specialist
Middenweg 85
1098 AG Amsterdam
The Netherlands
Email: michael@dereferralspecialist.nl
Telephone: +31 6 24768758

As part of our projects, we may process data relating to employees, ambassadors, candidates, volunteers and other individuals involved. Our data protection role depends on the work we carry out. Where we process data solely on behalf of a client, we put appropriate data processing arrangements in place. Where we determine the purposes and means of processing ourselves, we are responsible for that processing.

Where necessary, individuals receive additional information about the project concerned, including where their data came from.

De Referral Specialist and de Wervingsspecialist operate through the same company. We do not automatically use data you provide for advice, research or a publication for recruitment services or other marketing purposes. We assess separately whether any other use is permitted and inform you where necessary.

If you have a privacy question or wish to exercise your data protection rights, please contact us at the email address above.

2. What personal data do we use?

The data we use depends on your contact with us. It may include:

Your company name and role.
Address and billing details needed for an assignment.
Information you share with us through a form, by email, over the telephone or during a conversation.
Your preferences for receiving news and publications.
Technical information about your website visit, such as your IP address, browser, device and pages visited, to the extent permitted by our website configuration and your cookie choices.

Please do not include names or personal information about employees, candidates or other individuals in questionnaires or free-text fields unless this is necessary. Where possible, use figures, percentages and general descriptions.

3. Why do we use your data?

We use personal data for the following purposes.

Answering questions and maintaining contact

If you call us, email us or complete a form, we use your contact details and the information in your message to respond and deal with your enquiry.

We rely on our legitimate interest in answering questions and maintaining business relationships. We limit our use to what is necessary and take your privacy interests into account.

Sending publications or information

If you request a benchmark report or another publication, we use your email address to send it to you. We do this to fulfil your request, relying on our legitimate interest in providing information that has been requested.

Requesting a publication does not automatically subscribe you to our newsletter.

Quickscans, questionnaires and research

We use your contact details and answers to review a quickscan you have requested, prepare a tailored analysis and discuss the findings with you.

If you are personally a party to our contract, we process the data necessary to prepare and deliver the requested service. For contacts at organisations, we rely on our legitimate interest in providing the requested analysis.

For other research, we inform participants in advance about the purpose, the data used, the legal basis and the retention period. Participation does not automatically subscribe you to a newsletter.

We do not publish answers or quotations that can be linked to an individual without establishing an appropriate legal basis and discussing this beforehand with the person concerned.

Preparing quotations and carrying out assignments

We use the necessary data to prepare quotations, agree arrangements, provide our services and communicate about assignments.

If you are personally a party to our contract, we process the data necessary to take steps at your request before entering into a contract or to perform that contract.

If you are a contact at an organisation we work with, we use your business contact details on the basis of our legitimate interest in carrying out that business relationship.

Administration and invoicing

We use the necessary data for invoices, payments and our administration. Where this processing is required by law, we rely on our legal obligations.

Newsletters and other marketing communications

If you subscribe, we use your name and email address to send you news, insights, publications or information about our services. We do this on the basis of your consent.

You can unsubscribe at any time using the unsubscribe link in the message or by emailing us. Withdrawing consent does not affect the lawfulness of processing carried out before you unsubscribed.

Operating and securing the website

We use necessary technical data to operate the website, resolve faults and prevent misuse. Where this involves processing personal data, we rely on our legitimate interest in providing a reliable and secure website.

For cookies and similar technologies that require consent, we obtain it in advance. Further information is provided in section 6.

4. Who do we share personal data with?

We share personal data only where necessary for the purposes described above or where we are legally required to do so.

We use Wix for our website. Data you enter through the website may therefore be processed by Wix.

We also use service providers for our business email, client contact management and newsletters. They receive only the personal data needed to carry out their work for us.

Where service providers process personal data on our behalf, we put appropriate arrangements in place covering security, confidentiality and the use of that data.

We may also disclose data to competent authorities where required by law. If data is needed for legal proceedings, we first assess whether sharing it is necessary and whether there is a valid legal basis.

Our website runs on Wix. We use Group-Office for client management and SurveyMonkey for the quickscans linked from our website. These services may process the data you provide through the relevant application.

5. Is data processed outside Europe?

We use Group-Office, provided by Intermesh B.V., for client management. Group-Office offers both self-hosted installations and hosted services. The location where data is processed depends on the configuration used. Please contact us if you would like further information about the processing of your data.

Wix’s data processing agreement contains provisions for protecting this data. For transfers to Wix in Israel, Wix relies on the European Commission’s decision that Israel provides an adequate level of protection. For onward transfers to countries without such a decision, Wix provides approved standard contractual clauses or other legally permitted safeguards. These arrangements are intended to protect personal data outside the European Economic Area (EEA).

If you would like further information about these arrangements or a copy of the applicable safeguards, please contact us at michael@dereferralspecialist.nl.

6. How do we use cookies?

Our website is built with Wix and uses essential cookies. Cookies are small files stored in your browser during your visit.

These cookies help the website operate securely and reliably. For example, they are used to prevent misuse, identify technical faults and display pages correctly.

We do not use marketing cookies or other cookies that require your consent. We therefore do not display a banner asking you to accept or reject cookies.

Some cookies are deleted when you close your browser. Others remain stored for a specified period. Further information about Wix’s essential cookies, their purposes and lifetimes is available in Wix’s cookie overview.

You can delete or block cookies through your browser settings. Blocking essential cookies may prevent some parts of the website from working properly.

7. How long do we retain your data?

We retain personal data for no longer than necessary for the purpose for which we use it. Sometimes we must retain data for longer to comply with a legal obligation.

Contact enquiries

We retain contact details and correspondence relating to an enquiry for up to six months after it has been dealt with. If the enquiry leads to an assignment or an ongoing business relationship, the relevant retention periods below apply.

Publication requests

We retain data used to send a publication for up to three months after dispatch. A separate newsletter subscription is subject to the retention period for newsletter data.

Quotations that do not lead to an assignment

We retain quotations and associated contact details for up to one year after the last substantive contact about the quotation.

Quickscans that do not lead to a further assignment

We retain contact details, answers and the tailored analysis for up to one year after completing the analysis and discussing the findings. If a further assignment follows, we retain only the data needed for that assignment, in accordance with the project arrangements.

Client and project data

During an assignment, we retain the data needed to carry out our work.

We retain detailed project files containing personal data, such as questionnaires, interview notes and information about employees, ambassadors, candidates or volunteers, for up to two years after completion. We apply a shorter period where the purpose or project arrangements require it.

We retain a limited business file containing agreements, necessary contact details and relevant correspondence for up to five years after completion. This is intended to substantiate agreements and potential claims. This period does not automatically apply to all personal data within the project.

For data we process solely on behalf of a client, we follow the agreed instructions on retention, return and deletion.

We may retain research findings for longer where they are genuinely anonymous and can no longer be linked to individuals.

Financial records

We generally retain invoices and other records subject to statutory tax retention requirements for seven years. Where a different statutory period applies, we follow it. This requirement does not automatically apply to complete client and project files.

Newsletters, consent and unsubscribing

We retain newsletter data until you unsubscribe or we discontinue the newsletter.
We retain evidence of your consent for up to five years after withdrawal or the last use of that consent. We limit this to the data needed to demonstrate consent.
We retain a minimal unsubscribe record for as long as necessary to prevent you from being added to the mailing list again. We use this solely to respect your unsubscribe request.

Technical data and cookies

We retain technical data for as long as necessary to operate and secure the website or investigate a specific problem.

Cookies remain stored for their configured lifetimes. Some are deleted when you close your browser. A cookie’s lifetime is not necessarily the same as the retention period for data held on servers.

Exceptions and deletion

A new contact does not automatically restart a retention period.

Where a legal obligation, ongoing dispute or specific legal claim requires it, we may retain necessary data for longer. We limit this to data relevant to that purpose.

When the retention period ends, we delete the data or anonymise it so that it can no longer be linked to you. We also take copies and backups into account so that deleted data is not made available again for routine use.

8. How do we secure your data?

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

We restrict access to people and service providers who need the data to carry out their work. The security measures required depend, among other things, on the type of data and the risks associated with its use.

9. What data protection rights do you have?

Depending on the circumstances, you have the right to:

Access your personal data and receive a copy.
Have inaccurate or incomplete data corrected.
Request deletion of your personal data.
Request restriction of the use of your personal data.
Object to processing based on legitimate interests.
Receive data you have provided to us in a usable digital format, or have it transferred, where the legal conditions are met.
Withdraw your consent at any time.

You may always object to the use of your personal data for direct marketing. We will then stop using it for that purpose.

These rights are not unrestricted in every situation. For example, we may need to retain data to comply with a legal obligation. If we cannot fulfil your request in full, we will explain why.

Send your request to michael@dereferralspecialist.nl. We normally respond within one month of receiving it. If your request is complex or you make several requests, we may need up to two further months. We will inform you within the first month and explain the reason.

To avoid disclosing data to the wrong person, we may ask for additional information to verify your identity. We do not request more information than necessary for this purpose.

10. Can you lodge a complaint?

If you are unhappy with how we handle your personal data, please contact us so that we can investigate your complaint.

You also have the right to lodge a complaint directly with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority. You do not have to contact us first.

Further information is available at autoriteitpersoonsgegevens.nl.

11. Are you required to provide data?

You decide whether to share personal data with us.

However, some data is needed to answer your enquiry, send a publication or carry out an assignment. Our forms indicate which fields are required. Without the necessary data, we may be unable to deal with your request.

You do not have to consent to newsletters or marketing cookies to contact us.

12. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

13. Changes to this privacy notice

The latest version is always available on this page. The date at the top shows when the notice was last updated. If a change has significant implications for how we use your personal data, we will inform you appropriately. Where necessary, we will ask for fresh consent.