Privacy Statement
Last updated: 29 September 2026
1. Introduction
In our business, confidentiality and privacy are essential. Hence, Top of Minds Group B.V. (including each of the Top of Minds entities and branches listed at the bottom of this chapter) (Top of Minds or we) values and respects the privacy of our clients, candidates and business partners and strives to protect the privacy and confidentiality of personal data that is processed by Top of Minds in connection with the services we provide to our users and candidates. Top of Minds will process your personal data carefully and always in accordance with applicable laws and regulations.
This privacy statement describes how we use your personal data in our operations (as a controller). We collect, use, share and process personal data that are necessary for the purposes mentioned in this privacy statement or that are legally permitted.
In this privacy statement we use a number of terms that have a specific meaning under the applicable privacy rules (such as ‘personal data’ or ‘controller’). Chapter 4 of this privacy statement contains an overview of these defined terms.
Top of Minds has appointed a privacy officer as its point of contact for data protection. Do not hesitate to contact our privacy officer if you have questions about the processing of personal data by Top of Minds. If you contact us, you will receive a response within one month at the latest.
Privacy officer: Martijn van Wingen
E-mail: privacy@topofminds.com
Regular mail:
Top of Minds Group B.V.
Attn. Martijn van Wingen
Prins Hendriklaan 41
1075 BA Amsterdam
The Top of Minds entities and branches covered by this privacy statement are:
- Top of Minds Group B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands (Chamber of Commerce no. 64926753)
- Top of Minds B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands (Chamber of Commerce no. 34286423)
- Top of Minds Rotterdam B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands, with offices at Maastoren, Wilhelminakade 99-B, 3072 AP Rotterdam (Chamber of Commerce no. 90131940)
- Top of Minds Germany GmbH, Grüneburgweg 58-62, 60322 Frankfurt am Main, Germany (Handelsregister HRB 127547)
- Top of Minds Madrid SL, Calle Marqués de la Ensenada 2, planta 4, 28001 Madrid, Spain (CIF B09863051)
- Het PA Bureau B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands (Chamber of Commerce no. 83282076)
- Chapter Data B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands (Chamber of Commerce no. 90475682)
- Top of Minds Employer Marketing B.V., Prins Hendriklaan 41, 1075 BA Amsterdam, the Netherlands (Chamber of Commerce no. 85041548)
2. What do we do with your personal data?
What are personal data?
Personal data are all data relating to an identified or identifiable natural person, such as a name, address, e-mail addresses and e-mails, or a copy of a passport, but also financial data or copies of e-mails and contracts, under the condition that such data relates to a natural person.
What personal data do we collect and process about you?
Contact details and CV → including your name, address, gender, date of birth, education, work experience, e-mail address, telephone details, nationality, resume and any other information you have provided (such as when you add your own photo to your resume). Under certain circumstances we also ask you to provide salary details. This may also include your salary expectations, references and information from your public professional profiles (such as LinkedIn).
Potentially interesting vacancies and whether we believe you are a potential match → vacancies that you have responded to or for which we have taken you into consideration when advising our clients.
Conversation notes and correspondence → personal reports about contact moments (via telephone or face to face interviews) and email correspondence with you.
Website usage → the pages on https://topofminds.com/ are published by Top of Minds. When you visit our website, we collect some basic information such as the origin of the link you clicked to reach our website, your internet service provider's domain name, IP address, which pages you accessed on the site and what links you have interacted with on the site. For further information, please see our cookie statement.
Our marketing activity → we will keep a record of your marketing preferences, any marketing we have previously issued to you (including our newsletters) and how you've interacted with marketing content received by us.
Social media platforms usage → we may receive personal data relating to you when you interact with our content provided on social media platforms such as LinkedIn or when we interact with such platforms (including LinkedIn).
We do not intentionally process any special categories of personal data or personal data relating to criminal convictions and offenses.
What is our legal basis for the processing of your personal data?
Top of Minds only processes your personal data for legitimate purposes. Moreover, the use of your personal data will always be justified on the basis of one or more of the legal "processing grounds" included in the GDPR.
The summary below contains a brief explanation of the different legal processing grounds under the GDPR on the basis of which Top of Minds uses your personal data.
Performance of a contract: where Top of Minds needs your personal data to enter into to deliver our services to you by keeping you informed about potentially interesting vacancies and matching you with our clients on an ongoing basis.
Legitimate interests: where Top of Minds uses your personal data to represent a legitimate interest and our reasons for using your personal data outweigh the disadvantage of your right to protection of personal data.
Legal obligations: where we are required to process your personal data according to a legal obligation.
Consent: where you have consented to the use of your personal data (in which case you have received a (digital) consent form relating to such use). You can withdraw your consent at any time by sending a notification to our privacy officer.
For what purposes does Top of Minds collect your personal data and on which processing grounds do we trust for their use?
In this chapter we describe the purposes for which Top of Minds processes the different categories of personal data that we collect. For each processing purpose we have included the applicable processing grounds on the basis of which we justify the use of your personal data as well as the relevant categories of personal data that are processed.
(a) To assess your application for a specific job → At the moment we receive your application for a specific vacancy or your interest in an open discussion about possible career options, we will use your personal data to assess your suitability for this position and other functions. We provide this service to you free of charge.
Processing ground(s): Performance of a contract.
Processed data: Contact details and CV, potentially interesting vacancies, conversation notes and correspondence and social media platforms usage.
(b) In order to be able to offer you potentially interesting functions in the future → As long as you wish to receive our services, your profile (including your personal data) will continue to be processed, and we will keep you constantly informed about possible suitable functions via email, telephone, newsletters, and social media.
Processing ground(s): Performance of a contract.
Processed data: Contact details and CV, potentially interesting vacancies, conversation notes and correspondence and social media platforms usage.
(c) For the benefit of our services to our clients → when you are a contact person at a client or prospective client, or a business partner or supplier, we process your business contact details, our correspondence and notes of our contacts with you in order to prepare, conclude and perform our agreements and to maintain our business relationship.
Processing ground(s): Performance of a contract and legitimate interest (to provide our services and to maintain our business relationships).
Processed data: Contact details, conversation notes and correspondence.
(d) For marketing purposes → we may use your personal data to contact you by e-mail for marketing purposes, including by sending generic or targeted newsletters. You can unsubscribe from this marketing communication at any time. We only bring our own services to your attention and do not provide your contact details to third parties for their marketing purposes. For the cookies we use on our website, see our cookie statement.
Processing ground(s): Consent (where legally required) and legitimate interest (in all other cases: to enable us to market our services).
Processed data: Contact details and CV, website usage and our marketing activity.
(e) Improvement and development of business → we may use your personal data to analyse the use of our website to help guide improvements and to see what content our users are particularly interested in.
Processing ground(s): Legitimate interest (to improve our services and better understand our users).
Processed data: Website usage.
(f) To comply with our legal obligations and to respond to illegal activities and misconduct → Top of Minds may share your personal data in connection with legal proceedings or investigations with third parties, such as government agencies (these third parties process personal data for their own purposes).
Processing ground(s): legal obligations (where the processing is required to comply with a legal obligation) and legitimate interests (in all other cases: to allow us to cooperate with law enforcement agencies and regulators and to allow Top of Minds to protect its staff and business).
Processed data: Contact details and CV, potentially interesting vacancies, conversation notes and correspondence, website usage, our marketing activities and social media platforms usage.
(g) To establish and handle legal claims → We may process your personal data in the context of (potential) disputes and/or litigation including by sharing your personal data with litigating third parties (these third parties process personal data for their own purposes).
Processing ground(s): legitimate interests (to ascertain and/or exercise our legal rights).
Processed data: Contact details and CV, potentially interesting vacancies, conversation notes and correspondence, website usage, our marketing activities and social media platforms usage.
(h) To review and change our corporate structure → We may provide your personal data to potential buyers of, or investors in, any part of Top of Minds' activities in the context of a purchase or investment or to our affiliates in the context of a re-structuring or to optimize our business.
Processing ground(s): legitimate interests (to allow Top of Minds to change its activities).
Processed data: Contact details and CV, potentially interesting vacancies, conversation notes (including assessments related to your suitability for a certain vacancy) and correspondence, website usage, our marketing activities and social media platforms usage.
How long are personal data stored?
Our retention periods for personal data are based on our business needs and legal requirements. We retain personal data as long as necessary for the processing purposes for which the personal data have been collected and all other permitted related purposes. Our retention policy for candidate data is a maximum of 7 years after our last demonstrable contact with you (such as a conversation, an application or correspondence). You can ask us to remove you from our database at any time. Data relating to a completed placement may be retained for as long as we are legally required to keep the related records.
When we no longer need personal data, we will irreversibly anonymize the data or destroy the data in a safe manner.
Where do we get your personal data from?
We collect personal data directly from you or via publicly accessible sources (such as LinkedIn).
Where do we store your personal data?
We store your personal data on IT systems located in the European Union. Some of our processors, including our recruitment software provider and providers of AI tools, may process personal data outside the EEA; see "Do we share your personal data?" for the safeguards we apply. All IT service providers act as processors on behalf of Top of Minds and are contractually bound by obligations of confidentiality.
How does Top of Minds protect my personal data?
Top of Minds and its IT service providers have implemented appropriate technical and organizational measures to secure the processing of personal data. These precautions depend on the sensitivity, format, location, quantity, distribution and storage of personal data, and include measures to protect personal data against unauthorized access. Where applicable, these measures include the encryption of communications over SSL, encryption of information during storage, firewalls, access controls, and similar security protocols. We restrict access to personal data to staff and third parties who need access to such information for legitimate and relevant business purposes.
All our employees, contractors and third parties who have access to your personal data and act on the instructions of Top of Minds are obliged to maintain confidentiality and we use access controls to restrict access to your personal data to persons who need such access for the execution of their responsibilities and tasks.
Top of Minds reviews its security measures and systems regularly together with its IT service provider. Top of Minds takes the security of its IT infrastructure very seriously.
Do we share your personal data?
Top of Minds has engaged several processors to process your personal data on our behalf for the purposes described in this privacy statement, including IT service providers. These processors are contractually bound by obligations of confidentiality.
We may also share your personal data with the following categories of recipients, for the following purposes:
- Our clients: when you are a candidate in a search, we share your profile and, where relevant, assessment results with the client for whom we conduct the search. We do not introduce you to a client without informing you first.
- Other Top of Minds group companies listed in chapter 1, where this is necessary to provide our services across our offices and countries.
- Our processors: providers of our recruitment software, IT and communication services, assessment tools and AI tools, who process personal data on our behalf under a data processing agreement. Information about our processors is available from our privacy officer on request.
- Legal advisers, where necessary, to investigate, exercise or defend legal claims.
- Law enforcement bodies, when required to do so by law, legal process, statute, rule, regulation, or to respond to a subpoena, search warrant, or other legal request, and where necessary to facilitate the prevention or detection of crime or the apprehension or prosecution of offenders.
- Public authorities, regulators and government bodies, where necessary for us to comply with our legal and regulatory obligations, or in connection with an investigation of suspected or actual illegal activity.
- Successors of the business and affiliates, where we sell or transfer an affiliate or book of business, or acquire or merge with another organisation, in whole or in part, Personal data may be shared with relevant third parties as part of our due diligence process and transferred to the acquiring entity (where applicable).
- Internal and external auditors where necessary for the conduct of company audits or to investigate a complaint or security threat.
- Business partners who collaborate or co-operate with Top of Minds on projects or services. You should refer to their privacy notices for more information about their privacy practices.
Where we transfer your personal data to a recipient located outside the EEA, we require that one of the following appropriate safeguards is in place, in accordance with the GDPR: there is a decision by the European Commission that the country to which your personal data is transferred provides an adequate level of data protection; or in the absence of such decision, the contracts that we have in place with these recipients include the European Commission's Standard Contractual Clauses (SCCs). Please contact our privacy officer if you would like to see a copy of the specific safeguards applied to the export of your personal data.
What if you do not provide your personal data?
Providing your personal data is voluntarily. However, should you choose not to provide your personal data, we might not be able to provide our services to you. In this case, we might have to cancel the service you have with us, but we will notify you if this is the case.
Automated processing, artificial intelligence and profiling
Automated decision-making takes place when an electronic system uses personal data to make a decision without any human intervention. Profiling involves the automated processing of personal data to evaluate certain personal aspects, such as analysing your skills and experience to assess your suitability for roles.
Top of Minds uses software that includes artificial intelligence (AI) to support our consultants. We use it for the following purposes:
- Recognising and routing business enquiries: incoming e-mail sent to our business addresses is screened automatically for signs of a new assignment or client request, so that it reaches the right consultant quickly. Only messages flagged as a business enquiry are shown to the team, including the text of the message; other messages are not read by anyone as part of this process. Flagged messages are kept in our internal systems only as long as needed for follow-up, and a message flagged by mistake is removed.
- Preliminary assessment of CVs: when you apply or register with us, we may use AI to check whether there is a currently suitable vacancy and which consultant is best placed to speak with you, so that we can inform you sooner.
- Drafting and analysis: our consultants use AI tools to help draft texts and analyse information, for instance vacancy descriptions and candidate summaries.
In addition, as part of our recruitment services we record assessments about candidates in our systems, such as ratings, tags and the outcome of personality assessments taken during a search. We may use these to identify suitable opportunities for you in future searches.
We carry out this profiling on the basis of our legitimate interest in providing effective recruitment services. AI and profiling assist our consultants but never replace human judgement. A consultant always reviews the outcome before any decision is taken about you, and no decision that produces legal or similarly significant effects will be taken about you using solely automated means. AI is never used to reject a candidate automatically.
The AI tools we use are provided by specialised providers acting as processors on our behalf under a data processing agreement. Some of these providers process personal data in the United States; see "Do we share your personal data?" for the safeguards we apply. Our principal AI provider does not use our data to train its models and retains inputs and outputs for up to 30 days for safety purposes. Output of automated preliminary assessments is kept only as long as needed for the search concerned.
If our use of automated processing changes in a way that may affect you, we will update this privacy statement before such processing takes place. You have the right to object to profiling at any time by contacting our privacy officer using the details provided above.
Changes to this privacy statement
Top of Minds is authorized to amend this privacy statement in the interim. The most recent version of the privacy statement will be available at all times on the Top of Minds website.
3. What are your rights?
Under the GDPR you have certain rights with regard to your personal data. These rights are listed below. Questions about the privacy statement of Top of Minds must first be addressed to our privacy officer.
Please note that certain exceptions apply to the exercise of these rights and so you may not be able to exercise certain rights in all situations:
- (a) Right of access: You have the right be provided access to your personal data held by us.
- (b) Rectification: You can request us to correct inaccuracies in your personal data.
- (c) Erasure: You may request us to delete personal data under certain circumstances. In that case, we will take reasonable steps to inform other processors who process the personal data on our behalf that you have requested the removal of links to, and copies or replicas of your personal data.
- (d) Restriction of processing: You may, under certain circumstances, request us to limit the processing of personal data whilst complaints are being resolved, for example if the accuracy of your personal data is disputed by you.
- (e) Objection: You may object to our processing of your personal data in certain circumstances.
- (f) Portability: You may request us to transmit to a third party the personal data that you have provided to us that we keep in a structured, current and machine-readable form.
- (g) Withdrawal of consent: In the limited circumstances where you may have provided your consent to the processing of your personal data, you have the right to withdraw any consents to processing that you have given us and prevent further processing. Withdrawal of your consent does not impact the legality of our processing up until your withdrawal.
- (h) Refuse marketing: You have the right to ask us not to process your personal data for direct marketing purposes at any time. To exercise this right, you can click the "unsubscribe" option on any marketing communication (including any newsletter) you receive from us. If you choose to unsubscribe from marketing, we may keep a 'suppression list' containing your details so we know you have unsubscribed and to ensure you are not contacted again. Your personal data held on a suppression list will not be used for any other purpose.
- (i) Raise a complaint: You can submit a complaint about the processing of your personal data by Top of Minds to the supervisory authority in your country (in the Netherlands, for example, this is the Dutch Data Protection Authority). The contact details of EEA data protection authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
If you would like to exercise any of these rights, please contact our privacy officer. We will respond to most requests within a one-month period.
4. Some legal conditions
According to applicable privacy legislation (including, but not limited to, the GDPR), the terms below have a defined meaning as set out in the summary below.
EEA
The European Economic Area.
GDPR
The European General Data Protection Regulation (EU) No. 2016/679. The GDPR applies since 25 May 2018 in all EU Member States.
Personal data
Any information about an identified or identifiable natural person ("the data subject"); an identifiable natural person who can be identified directly or indirectly, in particular by means of an identifier such as a name, an identification number, location data, an online identifier or one or more elements characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Profiling
Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, personal preferences, interests, reliability, behaviour, location or movements.
Processing of personal data
An operation or a set of operations relating to personal data or a set of personal data, whether or not carried out via automated processes, such as collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, providing by means of transmission, distribution or otherwise made available, align or combine, protect, delete or destroy data.
Controller
A natural or legal person, a government agency, a service or any other body that, alone or jointly with others, determines the purpose and means of the processing of personal data.
Processor
A natural or legal person, a government agency, a service or another body that processes personal data on behalf of the controller.
Special categories of personal data
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person's sex life or sexual orientation.