Privacy statement for applicants
Last updated: 23 October 2026
This statement explains what Cermus ("we", "us") does with your personal data when you apply for work with us through talent.cermus.com, and what you can ask of us. It applies to every listing on this site. Our general privacy policy covers the rest of our website and our clients.
1. Who is responsible
Cermus IT B.V. Heerderweg 59c, 6224 LG Maastricht, The Netherlands KVK 89607988
For any question about your data, or to use one of the rights in section 9, use our legal inquiry form or reply to any e-mail we sent you about your application. We confirm within two working days and answer within one month (Art. 12(3) GDPR). We have not appointed a Data Protection Officer, because the law does not require one for us.
2. How the selection works
You apply with your CV and a few facts. If we move you forward, you answer a few written questions, do a small paid assignment, and have a video call with us. After that may come a paid trial project. The listing describes each step. We reply within the time the listing states for each step, never more than three working days, and every decision about you is taken by a person (section 8).
3. What we collect
| What | Where it comes from | Required? |
|---|---|---|
| Your name and e-mail address | you, on the form | yes |
| The country you live in | you | yes. We ask because work that touches a client's personal data can only go to people living in the EU or in a country the EU recognises as safe for data. We do not ask for your nationality |
| Your CV, as a PDF | you | yes |
| Links to LinkedIn, GitHub or a portfolio | you | no, but they help us |
| The hours you can work, from when, your overlap with Central European working hours, the rate you are asking, and the languages and frameworks you have shipped in | you | yes, except the languages and frameworks |
| How you found us | you | no |
| Your answers to the written questions | you | yes, at that step |
| The assignment you hand in: a link to your repository, and what we see there | you | yes, at that step |
| Your invoice for the paid assignment or the trial | you | yes, if you send one |
| Our scores and notes on each step, and a log of who moved your application, when, and which e-mails we sent | us | n/a |
| A recording or transcript of the video call | us, only if you agree (section 5) | no |
| What you write to us by e-mail | you | n/a |
| Technical data: your IP address and browser, in our server logs | your browser | n/a |
What we never ask for: your current or past pay, your date of birth, a photo, a copy of your identity document, or your citizen service number (BSN). You do not need to put a photo, your date of birth, your marital status or your nationality in your CV; we do not use them. We do not ask about health, religion, ethnic origin or any other special category of personal data, and we do not want it. If your CV or answers contain any, we do not use it.
4. What we use it for, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Assessing whether you fit the work, and running the selection: e-mails, the written questions, the paid assignment, scheduling the call | Steps you asked us to take before a possible agreement with you (Art. 6(1)(b) GDPR) |
| Looking at the professional profiles you linked, and checking the claims in your CV (section 6) | Our legitimate interest in hiring people who can do the work (Art. 6(1)(f) GDPR) |
| Recording or transcribing the video call, so that we score it on what was said rather than on memory | Your consent (Art. 6(1)(a) GDPR) |
| Keeping your application on file after the selection, to contact you about future work | Your consent (Art. 6(1)(a) GDPR) |
| Paying for the assignment or the trial, and keeping the invoice | The agreement for that work (Art. 6(1)(b) GDPR) and our tax obligations (Art. 6(1)(c) GDPR) |
| Showing that a person took each decision, and handling a complaint or dispute about the selection | Our legitimate interest in being able to account for our decisions (Art. 6(1)(f) GDPR) |
| Protecting the site against abuse, such as automated form submissions | Our legitimate interest in a secure site (Art. 6(1)(f) GDPR) |
If you do not give the required data, we cannot assess your application. Saying no to a recording, or to keeping your application on file, has no effect on your application.
5. The video call, and recording it
The call takes place in Microsoft Teams. We would like to record and transcribe it, so that we can score it fairly afterwards and do not have to rely on memory. We do this only if you agree. We ask at the start of the call, and Teams shows everyone when a recording runs. If you say no, we take notes instead, and nothing else changes.
A recording is used only to assess your application. It is deleted with the rest of your application (section 7).
6. Information we look up ourselves
We look at the profiles and repositories you give us a link to, such as LinkedIn, GitHub or your portfolio. We may also look at other public information that is about your work, such as code you published or talks you gave. We do not look at private social media, and we do not look you up out of curiosity.
Public information is not always correct or current. So if something we found plays a part in our assessment, we tell you what it is and where we found it, and you can respond to it before we decide.
We contact a reference only if you have given us their details and agreed that we contact them.
7. How long we keep it
| What | How long |
|---|---|
| Your application: the form, CV, answers, scores, notes, the log, a call recording or transcript, and our e-mails with you | Deleted 4 weeks after the selection ends for you: after we tell you our decision, or after you withdraw |
| Your application, if you agreed to keep it on file | Up to 1 year after the selection ends. Before that year is up, we ask whether you want us to keep it for another year. We keep it only if you say yes. If you do not answer within 14 days, we delete it. Silence is never a yes |
| Your invoice for the paid assignment or the trial, and the payment | 7 years, because tax law requires it (art. 52 Algemene wet inzake rijksbelastingen). Only the invoice and the payment; the rest of the application follows the rows above |
| Server logs | 14 days |
If a complaint or dispute about the selection is still open when a period ends, we keep what we need for it until it is settled, and then delete it.
If you join our pool of freelancers after the trial, we keep what our working relationship needs under the freelance agreement, and we tell you how when you sign it.
After deletion we keep only an anonymous count (for example, how many people applied to a listing), which says nothing about you.
You can withdraw your application, or your consent to keep it on file, at any time. We then delete your data, apart from an invoice we must keep.
8. No automated decisions
Every decision about your application is taken by a person: whether you move to the next step, whether we keep your application on file, whether we reject it, and whether we offer you work.
We do not use AI or any other software to score, rank, filter or reject applicants. Our system sends e-mails at set moments (an acknowledgement, the next step, a reminder) and adds up the scores that a person gave. It never decides about you. So there is no decision based solely on automated processing within the meaning of Art. 22 GDPR.
If you do not reply to a step for a while, we send you one reminder. If we still hear nothing, a person closes your application, and we tell you so. You can then reply to reopen it, as long as it has not been deleted.
9. Your rights
You have the right to:
- see the data we hold about you, including your scores and our notes;
- correct data that is wrong;
- have your data deleted;
- restrict what we do with it;
- receive the data you gave us in a machine-readable format;
- object to what we do on the basis of our legitimate interest (sections 4 and 6);
- withdraw your consent at any time, without affecting what we did before.
To use a right, use our legal inquiry form or reply to one of our e-mails. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in the country where you live.
10. Who sees your data
Within Cermus, only the people who run the selection see your application. A developer who reviews your written answers or your assignment for us sees them too. Everyone who sees applications works under a confidentiality agreement and lives in the EU.
We do not sell your data and we share it with no one for their own purposes. We use these service providers, each under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Azure) | Hosting this site, our application system and database, and storing your CV | EU |
| Microsoft Ireland Operations Ltd. (Microsoft 365) | E-mail, calendar and the Teams call, including a recording or transcript if you agree | EU |
| Moneybird B.V. | Our accounting, if you send us an invoice | EU (Netherlands) |
Our accountant sees an invoice you send us, and we give the tax authorities what the law requires.
If you share your assignment through GitHub, GitLab or Azure DevOps, that platform's own terms apply between you and it; we only read what you share with us.
11. Transfers outside the EU
The systems we use for applications run in the European Union, and we do not send your data outside the European Economic Area. If you live outside it, our e-mails reach you through your own e-mail provider.
12. Cookies on this site
talent.cermus.com sets no cookies and uses no analytics or advertising tools. Our server logs (section 7) are the only record of your visit.
13. How we apply the NVP Sollicitatiecode
We follow the principles of the NVP Sollicitatiecode, the Dutch code of conduct for recruitment and selection, although it is written for employees and we hire freelancers. In practice:
- Clear process: the listing says how to apply, what each step is, and how soon you hear from us after each step (never more than three working days).
- No pay history: we ask what rate you want, never what you earn or earned.
- Public information: used with restraint and only when it concerns your work; we tell you what we found and where, and you can respond (section 6).
- References: only with your consent.
- Paid work is paid: the assignment and the trial project are paid at the stated fee, whatever the outcome. Neither is unpaid work in disguise.
- AI: we do not use it to assess you (section 8). You may use AI tools in the assignment; the listing says so.
- Rejection: we tell you as soon as we decide, and why, and we offer short feedback if you want it.
- Deletion: 4 weeks after the selection, unless you agree to more; that agreement is asked again every year (section 7).
- Complaints: if you think we did not follow this code, tell us through our legal inquiry form. We answer in writing, with reasons, within one month.
14. Changes
We change this statement when what we do changes. The date at the top shows the latest version. If a change affects an application of yours that we still hold, we tell you by e-mail.
The Cermus team