AGREEMENT ON PROCESSING OF PERSONAL DATA

1. For the execution of the Agreement, Hotel in Motion B.V., hereinafter: “Client”, provides personal data of those involved to employers who post vacancies on www.hotelprofessionals.nl (hereinafter: “HP.nl”), hereinafter: “Contractor(s) ”, or the Parties exchange personal data with each other. The Contractor then processes these personal data, independently determining the purposes and means of the processing.

2. In the context of the new regulations in the field of privacy and data protection, the General Data Protection Regulation, the Parties wish to make agreements about the (unilateral) provision or exchange of personal data of data subjects.

3. A number of terms from the GDPR are used for these agreements. These have the following meaning: GDPR: General Data Protection Regulation. Implementation Act: the Implementation Act of the General Data Protection Regulation. Data Subject: the person to whom a Personal Data relates. In the context of the present agreements, this concerns applicants who apply on the website of www.hotelprofessionals.nl for a vacancy that a Contractor has posted there (hereinafter: “Applicant(s)”). Data breach: a breach of security of personal data leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, data transmitted, stored or otherwise processed. Agreement: the agreement between the Client and the Contractor on the basis of which the Contractor may post unlimited vacancies on the website www.hotelprofessionals.nl for an annual fee with the aim of bringing together supply and demand on the labor market. Personal data: all information about an identified or identifiable natural person that the Contractor processes in the context of the execution of the Agreement. Processing: an operation or set of operations in the context of the Agreement with regard to Personal Data, or a set of Personal Data, whether or not carried out by automated processes, such as collecting, recording, organizing, structuring, storing, updating or modifying, retrieve, consult, use, provide by transmission, dissemination or otherwise make available, align or combine, restrict, erase or destroy.

4. The parties first establish that the Parties may cooperate with each other for the purpose of the Agreement, but that the Contractor is the 'controller' within the meaning of the GDPR in the performance of the Agreement. The Contractor independently processes the personal data provided for its own purposes to be determined by it. There is no obligation to conclude a processing agreement between the Parties for this processing of personal data by the Contractor.

5. As controller, the Contractor is obliged to ensure the correct implementation of the GDPR, the Implementation Act and all other relevant legislation. In its capacity as controller, the Contractor is, among other things: required to take the organizational and technical security measures necessary to comply with the GDPR. Any costs incurred to resolve a breach of security of the Personal Data concerned will be borne by the Contractor as controller; responsible at all times for all actions of third parties that he engages during the performance of his work. Just as for its own activities, the Contractor is obliged to ensure that these third parties strictly comply with the GDPR. The Contractor is liable and responsible if a third party does not act in accordance with the GDPR. The Contractor is obliged to inform the Dutch Data Protection Authority in a timely manner if a Data Leak is caused by his actions or by a third party engaged by him; Obligated to inform the Data Subject within the meaning of the GDPR where he can go with questions and exercise of rights with regard to the processing by the Contractor.

6. For the purpose of executing the Agreement, the Contractor receives the following personal data from Applicants who apply for a vacancy from the Contractor on HP.nl: Contact details Applicant (first name, last name, address, email address, telephone number) CV Brief motivation for the vacancy for which the applicant is applying

7. If the Applicant applies for a vacancy on the HP.nl website, he will be informed that this information will be passed on directly to the relevant Contractor and will end up in the portal of that Contractor. This data will remain available in the portal for 4 months and will then be automatically deleted, or sooner if the Applicant requests it. The Client considers this 4 months to be reasonable because it is customary for the data of an applicant who does not get the job to be deleted no later than 4 weeks after the end of the application procedure. Since the Client has no insight into (the duration of) the application procedure between the Contractor and the Applicant, the Client considers the aforementioned retention period of 4 months reasonable. The Contractor has its own responsibility with regard to the retention of personal data of Applicants and must in principle adhere to the following guidelines: delete personal data 4 weeks after the end of the application procedure and a maximum of 12 months with the Applicant's consent.

8. The Contractor will not use the Personal Data of the Applicants for other or more far-reaching purposes than is reasonably necessary for the execution of the Agreement, unless (1) the Parties make different written agreements to this effect or (2) the Contractor has independently obtained another basis from the Data Subject. processing personal data. The Contractor may only enrich the personal data received with personal data independently requested from the Data Subject if this is necessary for the implementation of the agreed or legally established purposes.

9. The Contractor will inform the Client without unreasonable delay, but no later than within 24 hours, as soon as it has become aware of the Data Leak. This notification to the Client will be made by e-mail via info@hotelprofessionals.nl. As the controller, the Contractor is responsible for timely reporting a Data Breach to the Dutch Data Protection Authority. Communication with the Data Subject about a Data Breach will always take place in consultation.

10. The Contractor will inform the Client without unreasonable delay, but no later than within 24 hours, of any request and/or complaint from the Dutch Data Protection Authority or a Data Subject with regard to the Personal Data used in the execution of the Agreement. This notification to the Client will be made by e-mail via info@hotelprofessionals.nl.

11. If the Agreement between the Contractor and the Client ends, the Contractor will ensure that all personal data provided by the Client to the Contractor are returned to the Client or destroyed with the Client's consent, unless the Contractor has a legitimate interest in longer processing of those personal data. for example because of an ongoing application procedure, or when a mandatory legal provision prevents destruction.

12. If the Contractor or a third party engaged by the Contractor acts in violation of the GDPR, the Implementation Act and/or relevant legislation and regulations in the field of protection of Personal Data, the Contractor will indemnify the Client against claims from third parties in this regard. .

13. The Contractor will inform the Client within 24 hours of any court order, summons, legal obligation or other obligation to share Personal Data with third parties. This information is provided by e-mail via info@hotelprofessionals.nl. CONFIDENTIALITY

14. The parties undertake not to disclose in any way - including via social media channels - or to use for their own purposes, anything that comes to their attention during the performance of the Agreement and the confidential nature of which is known or can reasonably be suspected. , except to the extent that any statutory provision or court decision requires disclosure.

15. The parties will oblige the persons working under them or third parties engaged by them to comply with this obligation of confidentiality. Parties are obliged to have their staff or third parties engaged by them sign a confidentiality statement.

16. In the event of violation of the previous paragraphs by the other party and/or the persons working for that party and/or third parties engaged by that party, the parties have the right to suspend the Agreement immediately or without judicial intervention and without notice of default. to dissolve or terminate, provided that the violation is so serious that it is deemed to justify such a measure. Any suspension or dissolution or cancellation shall be effected by registered letter.

17. Breach of the confidentiality obligation in this article by the Contractor or third party(ies) gives the Client the right to charge the Contractor an immediately payable fine of 10,000 euros per event and with a maximum of 100,000 euros, without prejudice to the Client's right to compensation if and insofar as the damage exceeds the amount of the fine charged and received from the Contractor.

18. Breach of the obligation of confidentiality by the Client towards The Contractor gives the Contractor the right to charge the Client an immediately payable penalty of 10,000 euros per event and with a maximum of 100,000 euros, without prejudice to the Contractor's right to compensation if and insofar as the damage exceeds the amount charged and of fine received by the Client exceeds.