Effective Date: October 1, 2026

Last Updated: October 1, 2026

1. Introduction

Welcome to aethr. As a freelance professional specializing in talent sourcing and recruitment services, I am committed to protecting your privacy and handling your personal data transparently, securely, and in accordance with the General Data Protection Regulation (GDPR / AVG).

Because my work involves actively identifying and reaching out to professionals for career opportunities or B2B partnerships, I often process personal data that I have not collected directly from you. This Privacy Notice specifically fulfills my obligations under Article 14 of the GDPR, explaining what data I collect, where I find it, why I use it, and what your rights are.

2. Who is the Data Controller?

For the purposes of the GDPR, I operate as the Data Controller:

• Company/Freelancer Name: aethr

• KVK Number (Chamber of Commerce): 42159803

• Address: Amsterdam, Netherlands

• Email Address: alan@aethr.nl

• Website: www.aethr.nl

3. What Personal Data Do I Process?

I only process professional data relevant to recruitment, career opportunities, and B2B client partnerships. The categories of data I collect include:

• Identity Data: First name, last name.

• Professional Data: Current job title, employer, professional history, skills, qualifications, and educational background.

• Contact Data: Professional email address, phone number (if publicly available or provided by you), and links to public professional profiles.

• Communication Data: Records of our emails, LinkedIn messages, or notes from our calls.

I do not purposefully collect or process any "Special Categories" of personal data (e.g., health information, political beliefs, race).

4. Where Do I Get Your Data? (The Sources)

Since I operate as a proactive sourcer and headhunter, your personal data is typically obtained from publicly accessible sources and third-party platforms, including:

• Professional networking platforms (e.g., LinkedIn, GitHub, Behance).

• Corporate websites (e.g., "Meet the Team" pages).

• Public business registries (e.g., the Dutch KVK).

• Professional directories and job boards where you have made your profile visible to recruiters.

5. Why Do I Process Your Data and What is the Legal Basis?

Under the GDPR, I must have a valid legal basis for processing your data. I process your data based on Legitimate Interest (Article 6(1)(f) GDPR).

• For Candidates: My legitimate interest is to identify and contact professionals whose public profiles suggest they may be suitable for and interested in career advancement opportunities.

• For B2B Prospects: My legitimate interest is business development—reaching out to relevant corporate decision-makers to offer recruitment and staffing solutions.

Note: Before relying on this basis, I conducted a Legitimate Interest Assessment (LIA) to ensure that my commercial interests do not override your fundamental privacy rights. Because I only use professional data and offer clear opt-outs, this processing is considered lawful and proportional.

6. Who Do I Share Your Data With?

I do not sell your data. I may share your data with:

• Prospective Employers/Clients: If you are a candidate, I will only share your full profile and contact details with an employer after obtaining your explicit permission to do so.

• Service Providers: Third-party tools I use to run my freelance business securely, such as email hosting (e.g., Google Workspace/Microsoft 365), CRM/ATS software, and cloud storage providers.

7. International Data Transfers

My business is based in the Netherlands. If any of my software providers host data outside the European Economic Area (EEA), I ensure that adequate safeguards are in place (such as the EU Standard Contractual Clauses or ensuring the provider is certified under the EU-US Data Privacy Framework) to protect your data according to EU standards.

8. How Long Do I Keep Your Data?

I apply strict data minimization and retention policies:

• Unengaged Prospects: If I reach out to you and you do not respond, or if we determine there is no mutual interest, your profile data will be deleted from my active pipeline within 6 months of my last contact attempt.

• Opt-Outs/Suppression List: If you ask me not to contact you again, I will delete your profile but keep a minimal record of your name and public profile link on a secure "Suppression List" to ensure I respect your wishes and do not accidentally source you again in the future.

• Engaged Candidates/Clients: If we collaborate, I will retain your data for as long as is necessary to provide my services, or as required by Dutch tax and commercial laws (typically up to 7 years for financial records).

9. Your Data Protection Rights

Under the GDPR, you have significant rights regarding your personal data:

• Right to Object (Crucial for sourcing): Because I process your data based on legitimate interest, you have the right to object at any time. If you tell me to stop contacting you, I will stop immediately.

• Right of Access: You can ask for a copy of the personal data I hold about you.

• Right to Rectification: You can ask me to correct any inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): You can request that I delete your personal data.

• Right to Restrict Processing: You can ask me to pause processing your data under certain circumstances.

How to exercise your rights: Simply send an email to alan@aethr.nl. I will respond to all requests within 30 days, free of charge. Every initial outreach email I send you will also include a direct option to opt out.

10. Right to Lodge a Complaint

If you believe I have processed your data unlawfully or have not respected your rights, I ask that you contact me first so I can resolve the issue. However, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Website: www.autoriteitpersoonsgegevens.nl